refactor: rework auth and session layer

.env.example

@@ -39,6 +39,8 @@ TINYAUTH_SERVER_SOCKETPATH=
 
 # auth config
 
+# Linking mode for users (username, email, both).
+TINYAUTH_AUTH_LINKINGMODE="both"
 # List of allowed IPs or CIDR ranges.
 TINYAUTH_AUTH_IP_ALLOW=
 # List of blocked IPs or CIDR ranges.
@@ -245,10 +247,10 @@ TINYAUTH_LDAP_GROUPCACHETTL=900
 
 # experimental config
 
-# Enable the OAuth bridge, uses a new way to format OAuth user information.
-TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false
 # Disable the fallback to forward_auth modules when auth_request or ext_authz fail.
 TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false
+# Disable the generation of additional OAuth user information, avoids things like myuser_myprovider.
+TINYAUTH_EXPERIMENTAL_NOOAUTHUSERINFOGEN=false
 
 # tailscale config
 

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Go dependencies
         run: go mod download

.github/workflows/nightly.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -119,7 +119,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -94,7 +94,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Contributing to Tinyauth is straightforward. Follow the steps below to set up a
 ## Requirements
 
 - pnpm
-- Golang v1.26.4 or later
+- Golang v1.27.3 or later
 - Git
 - Docker
 - Make

Dockerfile

@@ -22,7 +22,7 @@ COPY ./frontend/vite.config.ts ./
 RUN pnpm run build
 
 # Builder
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.27-alpine3.23 AS builder
 
 ARG VERSION
 ARG COMMIT_HASH

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine3.23
+FROM golang:1.27-alpine3.23
 
 WORKDIR /tinyauth
 

Dockerfile.distroless

@@ -22,7 +22,7 @@ COPY ./frontend/vite.config.ts ./
 RUN pnpm run build
 
 # Builder
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.27-alpine3.23 AS builder
 
 ARG VERSION
 ARG COMMIT_HASH

cmd/tinyauth/create_oidc_client.go

@@ -34,7 +34,7 @@ func createOidcClientCmd() *cli.Command {
 
 			u := uuid.New()
 			clientId := u.String()
-			clientSecret := "ta-" + utils.GenerateString(61)
+			clientSecret := "ta-" + utils.GenerateSecureString(61)
 
 			uclientName := strings.ToUpper(clientName)
 			lclientName := strings.ToLower(clientName)

frontend/src/components/domain-warning/domain-warning.tsx

@@ -20,7 +20,7 @@ export const DomainWarning = (props: Props) => {
   const { t } = useTranslation();
   const { search } = useLocation();
 
-  const searchParams = new URLSearchParams(search);
+  const searchParams = (new URLSearchParams(search)).toString();
 
   return (
     <Card role="alert" aria-live="assertive">
@@ -45,7 +45,7 @@ export const DomainWarning = (props: Props) => {
       <CardFooter className="flex flex-col items-stretch gap-3">
         <Button
           onClick={() =>
-            window.location.assign(`${appUrl}/login?${searchParams.toString()}`)
+            window.location.assign(`${appUrl}/login${searchParams ? `?${searchParams}` : ""}`)
           }
           variant="outline"
         >

go.mod

@@ -1,6 +1,6 @@
 module github.com/tinyauthapp/tinyauth
 
-go 1.26.4
+go 1.27.3
 
 require (
 	charm.land/huh/v2 v2.0.3

sql/postgres/session_schemas.sql → internal/assets/migrations/postgres/000004_identity.down.sql

@@ -1,3 +1,7 @@
+DROP TABLE IF EXISTS "users";
+DROP TABLE IF EXISTS "identities";
+DROP TABLE IF EXISTS "sessions";
+
 CREATE TABLE IF NOT EXISTS "sessions" (
     "uuid"         TEXT    NOT NULL PRIMARY KEY,
     "username"     TEXT    NOT NULL,

internal/assets/migrations/postgres/000004_identity.up.sql

@@ -0,0 +1,41 @@
+/*
+ Drop the old, legacy, terrible sessions table
+
+ Will log out all users, but that's fine.
+ */
+
+DROP TABLE IF EXISTS "sessions";
+
+/*
+ The new structure consists of the following:
+
+ Users: holds the user data like the username, password, etc.
+ Identities: links the user to the identity provider.
+ Sessions: holds the session data like the UUID, CSRF, expiration time, etc.
+ */
+
+CREATE TABLE IF NOT EXISTS "users" (
+    "uuid" TEXT PRIMARY KEY,
+    "username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "name" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "identities" (
+    "uuid" TEXT PRIMARY KEY,
+    "user_uuid" TEXT NOT NULL,
+    "provider_type" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_user_id" TEXT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("user_uuid") REFERENCES "users"("uuid") ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS "sessions" (
+    "uuid" TEXT PRIMARY KEY,
+    "identity_uuid" TEXT NOT NULL,
+    "expires_at" BIGINT NOT NULL,
+    "created_at" BIGINT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("identity_uuid") REFERENCES "identities"("uuid") ON DELETE CASCADE
+);

sql/sqlite/session_schemas.sql → internal/assets/migrations/sqlite/000012_identity.down.sql

@@ -1,3 +1,7 @@
+DROP TABLE IF EXISTS "users";
+DROP TABLE IF EXISTS "identities";
+DROP TABLE IF EXISTS "sessions";
+
 CREATE TABLE IF NOT EXISTS "sessions" (
     "uuid" TEXT NOT NULL PRIMARY KEY UNIQUE,
     "username" TEXT NOT NULL,

internal/assets/migrations/sqlite/000012_identity.up.sql

@@ -0,0 +1,41 @@
+/*
+ Drop the old, legacy, terrible sessions table
+
+ Will log out all users, but that's fine.
+ */
+
+DROP TABLE IF EXISTS "sessions";
+
+/*
+ The new structure consists of the following:
+
+ Users: holds the user data like the username, password, etc.
+ Identities: links the user to the identity provider.
+ Sessions: holds the session data like the UUID, CSRF, expiration time, etc.
+ */
+
+CREATE TABLE IF NOT EXISTS "users" (
+    "uuid" TEXT PRIMARY KEY,
+    "username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "name" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "identities" (
+    "uuid" TEXT PRIMARY KEY,
+    "user_uuid" TEXT NOT NULL,
+    "provider_type" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_user_id" TEXT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("user_uuid") REFERENCES "users"("uuid") ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS "sessions" (
+    "uuid" TEXT PRIMARY KEY,
+    "identity_uuid" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL,
+    "created_at" INTEGER NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("identity_uuid") REFERENCES "identities"("uuid") ON DELETE CASCADE
+);

internal/bootstrap/app_bootstrap.go

@@ -38,12 +38,14 @@ type Services struct {
 	accessControlService *service.AccessControlsService
 	authService          *service.AuthService
 	dockerService        *service.DockerService
+	identityService      *service.IdentityService
 	kubernetesService    *service.KubernetesService
 	ldapService          *service.LdapService
 	oauthBrokerService   *service.OAuthBrokerService
 	oidcService          *service.OIDCService
 	tailscaleService     *service.TailscaleService
 	policyEngine         *service.PolicyEngine
+	sessionsService      *service.SessionsService
 }
 
 type BootstrapApp struct {
@@ -178,7 +180,7 @@ func (app *BootstrapApp) Setup() error {
 	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
 
 	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
-	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
+	app.runtime.OAuthFlowCookieName = fmt.Sprintf("%s-%s", model.OAuthFlowCookieName, cookieId)
 
 	// database
 	store, err := app.SetupStore()
@@ -253,17 +255,22 @@ func (app *BootstrapApp) Setup() error {
 
 	if app.services.authService.LocalAuthConfigured() {
 		configuredProviders = append(configuredProviders, model.Provider{
-			Name:  "Local",
-			ID:    "local",
-			OAuth: false,
+			Name: "Local",
+			ID:   "local",
 		})
 	}
 
 	if app.services.authService.LDAPAuthConfigured() {
 		configuredProviders = append(configuredProviders, model.Provider{
-			Name:  "LDAP",
-			ID:    "ldap",
-			OAuth: false,
+			Name: "LDAP",
+			ID:   "ldap",
+		})
+	}
+
+	if app.services.authService.TailscaleAuthConfigured() {
+		configuredProviders = append(configuredProviders, model.Provider{
+			Name: "Tailscale",
+			ID:   "tailscale",
 		})
 	}
 

internal/bootstrap/db_bootstrap.go

@@ -15,15 +15,14 @@ import (
 
 	"github.com/tinyauthapp/tinyauth/internal/assets"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
-	"github.com/tinyauthapp/tinyauth/internal/repository/memory"
 	"github.com/tinyauthapp/tinyauth/internal/repository/postgres"
 	"github.com/tinyauthapp/tinyauth/internal/repository/sqlite"
 )
 
 func (app *BootstrapApp) SetupStore() (repository.Store, error) {
 	switch app.config.Database.Driver {
 	case "memory":
-		return memory.New(), nil
+		return app.setupSQLite(":memory:")
 	case "sqlite", "":
 		return app.setupSQLite(app.config.Database.Path)
 	case "postgres":

internal/bootstrap/service_bootstrap.go

@@ -31,6 +31,8 @@ func (app *BootstrapApp) setupServices() error {
 		service.NewOAuthBrokerService,
 		service.NewAuthService,
 		service.NewOIDCService,
+		service.NewSessionsService,
+		service.NewIdentityService,
 	}
 
 	for _, provider := range serviceProvideFor {
@@ -50,6 +52,8 @@ func (app *BootstrapApp) setupServices() error {
 		OAuthBrokerService   *service.OAuthBrokerService
 		OIDCService          *service.OIDCService
 		TailscaleService     *service.TailscaleService
+		SessionsService      *service.SessionsService
+		IdentityService      *service.IdentityService
 	}
 
 	err = app.dig.Invoke(func(i svcInput) error {
@@ -59,6 +63,8 @@ func (app *BootstrapApp) setupServices() error {
 		app.services.oauthBrokerService = i.OAuthBrokerService
 		app.services.oidcService = i.OIDCService
 		app.services.tailscaleService = i.TailscaleService
+		app.services.sessionsService = i.SessionsService
+		app.services.identityService = i.IdentityService
 		return nil
 	})