The app name fallback matches any domain that starts with the app name,
so an app named myapp served on myapp.example.com also defined the ACLs
of myapp.evil.com. Behind a proxy with a catch-all route, a request can
be authorized against the wrong app that way.
Label providers now receive the domain being authorized. The Kubernetes
provider keeps the hosts of every Ingress, HTTPRoute and GRPCRoute it
watches and withholds the apps of the resources that do not route the
domain, which bounds the name fallback to the hosts a resource actually
serves. Wildcard hostnames keep matching as a suffix, so nested
subdomains stay resolvable by app name.
Container labels carry no routing information, so the Docker provider
cannot narrow its results down and keeps yielding every app.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: add new logger
* refactor: use one struct for context handling and cancellation
* refactor: rework logging and config in controllers
* refactor: rework logging and config in middlewares
* refactor: rework logging and cancellation in services
* refactor: rework cli logging
* fix: improve logging in routines
* feat: use sync groups for better cancellation
* refactor: simplify middleware, controller and service init
* tests: fix controller tests
* tests: use require instead of assert where previous step is required
* tests: fix middleware tests
* tests: fix service tests
* tests: fix context tests
* fix: fix typos
* feat: add option to enable or disable concurrent listeners
* fix: assign public key correctly in oidc server
* tests: fix don't try to test logger with char size
* fix: coderabbit comments
* tests: use filepath join instead of path join
* fix: ensure unix socket shutdown doesn't run twice
* chore: remove temp lint file
* feat(access-control): Add support for Kubernetes Label
* feat(access-control): Defaults to Docker
* feat(access-control): Remove kubeconfig fallback
* feat(watcher): Watcher for kubernetes service
* feat(watcher): Merge with main + remove nightly fix redirect
* fix(go): Go mod + Go sum after sync with main
* fix(config): Ser default value for LabelProvider to Docker
* feat(go): go mod tidy
* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22
* feat(k8s_service): (Watcher) -> Wait 5s before breaking to outer loop again
* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22
* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22
* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22
* feat(k8s_service): Remove
var _ = unstructured.Unstructured{} + comments + msg edits
* feat(bootstrap): Remove dockerService from bootstrap svc
* feat(auth_svc): Remove dockerService from authservice
* feat(test): Add tests for kubernetes_services
* feat(test): Remove docker serivce form proxy/user test
* fix(refactor): Remove update logic from watcher and resync
* fix(refactor): Split watchGVR to make it more readable
* fix(refactor): Remove discovery + drop K 1.22 completely
* fix(refactor): Move interface to acess_controls_service
* feat: Autodetect labelprovider if TINYAUTH_LABELPROVIDER not set
* fix(test): Match testing scheme to the controllers
* fix: service bootstrap import after merge
* fix: service bootstrap import after merge
* Refactor logging to use centralized logger utility
- Removed direct usage of zerolog in multiple files and replaced it with a centralized logging utility in the `utils` package.
- Introduced `Loggers` struct to manage different loggers (Audit, HTTP, App) with configurable levels and outputs.
- Updated all relevant files to utilize the new logging structure, ensuring consistent logging practices across the application.
- Enhanced error handling and logging messages for better traceability and debugging.
* refactor: update logging implementation to use new logger structure
* Refactor logging to use tlog package
- Replaced instances of utils logging with tlog in various controllers, services, and middleware.
- Introduced audit logging for login success, login failure, and logout events.
- Created tlog package with structured logging capabilities using zerolog.
- Added tests for the new tlog logger functionality.
* refactor: update logging configuration in environment files
* fix: adding coderabbit suggestions
* fix: ensure correct audit caller
* fix: include reason in audit login failure logs
* wip
* feat: add paerser as submodule and apply patch for nested maps
* refactor: update release workflows to include submodule and patches
* chore: update contributing instructions
Stavros
ContreandClaude Sonnet 4.6
Pushpinder SinghandGitHub
