Stavros and GitHub
847d8325c7
fix: auth module selection ( #1089 )
2026-08-25 17:07:56 +03:00
Stavros and GitHub
be48d712ee
feat: support for custom claims in oauth ( #1087 )
2026-08-22 19:58:05 +03:00
Stavros and GitHub
0c47e68c09
feat: do not show oidc consent screen every time ( #989 )
2026-08-17 02:44:48 +03:00
tsushanth and GitHub
f9939538b9
Remote-Name header returns capitalized uid instead of LDAP cn — cn attribute never fetched ( #1072 )
2026-08-13 15:37:03 +03:00
6d5563db2c
fix: clean request path before acls ( #1055 )
...
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-30 19:35:31 +03:00
Stavros and GitHub
0e7bdf6cd5
feat: experimental option to run tinyauth in oauth bridge mode ( #1027 )
2026-07-20 00:03:26 +03:00
Stavros
04a06ec5ff
chore: use blue color for totp generate
2026-07-16 17:13:36 +03:00
Stavros and GitHub
dade1e2c8f
refactor: rework rate limit logic ( #1008 )
2026-07-15 15:30:57 +03:00
Stavros and GitHub
6e095fd4f2
refactor: rework the way trusted proxies ip work ( #1007 )
2026-07-15 15:17:55 +03:00
Stavros and GitHub
b62bb2d37a
refactor: generate mdx docs with tabs for each config option ( #996 )
2026-07-13 18:07:47 +03:00
Stavros and GitHub
0bd2821a9b
refactor: use tailscale api for user checking instead of tsnet ( #978 )
2026-07-09 01:56:09 +03:00
Stavros and GitHub
4aa05aeb79
refactor: use some colors in CLI output ( #962 )
2026-07-03 16:40:22 +03:00
Stavros and GitHub
a3c4d6ac83
chore: move tailscale to experimental config ( #964 )
2026-07-02 23:17:03 +03:00
Stavros and GitHub
a6c716c4e2
fix: ensure data paths are set correctly in docker, fixes #958 ( #959 )
2026-07-01 16:12:46 +03:00
Stavros and GitHub
09ec40cb76
feat: show provider in quick actions ( #955 )
2026-06-28 17:58:11 +03:00
Stavros and GitHub
69f4206f65
refactor: remove concurrent listeners and rework cookie logic ( #950 )
2026-06-23 13:35:29 +03:00
Stavros and GitHub
7f18b45e21
feat: support for the prompt parameter in the oidc flow ( #948 )
2026-06-20 00:04:41 +03:00
Stavros and GitHub
53af1b99c0
tests: don't use _test suffix in service and controller tests ( #944 )
2026-06-17 17:03:30 +03:00
Stavros and GitHub
654b5cc436
fix: use better limits in lockdown to limit dos attack window ( #943 )
2026-06-17 13:10:58 +03:00
Stavros and GitHub
f404c2ef16
feat: use dig for di in services and controllers ( #936 )
2026-06-16 13:00:48 +03:00
Ryc O'Chet and GitHub
49105ce5ff
feat: add ldap bind password file ( #929 )
2026-06-11 13:25:22 +03:00
Stavros
940ba6dff7
fix: don't allow tagged devices in tailscale integration
2026-05-31 12:42:00 +03:00
Stavros and GitHub
672db84200
feat: make config file a stable feature ( #897 )
2026-05-27 11:26:09 +03:00
Scott McKendry and GitHub
359000f731
feat(db): add postgresql support ( #892 )
2026-05-26 00:08:59 +03:00
c3461131f5
feat: support provider-specific OAuth whitelists ( #882 )
...
Co-authored-by: Puneet Dixit <236133619+puneetdixit200@users.noreply.github.com >
2026-05-24 20:18:33 +03:00
Scott McKendry and GitHub
7aa25210f5
feat(config): allow global bypass by ip ( #889 )
2026-05-23 19:58:48 +03:00
Stavros and GitHub
1166a15aa7
feat: tailscale integration ( #847 )
2026-05-20 20:10:38 +03:00
Stavros and GitHub
c855f9b8ac
feat: add support for deny by default access controls ( #852 )
2026-05-19 18:07:55 +03:00
Scott McKendry and GitHub
a56c349525
refactor(db): use new store interface ( #831 )
2026-05-18 22:33:09 +03:00
a9eac7edd2
fix(ldap): pass through LDAP mail attribute instead of crafting email ( #834 )
...
* fix(ldap): pass through LDAP mail attribute instead of crafting email
TinyAuth was constructing LDAP user emails as username@CookieDomain
instead of using the mail attribute stored in the directory. This caused
OIDC clients like Grafana to receive a synthetic email rather than the
real one.
Rename GetUserDN to GetUserInfo and extend it to also fetch the mail
attribute in the same LDAP query. Thread the result through UserSearch
and use it in both the login flow and the basic auth middleware, falling
back to the crafted email only when LDAP returns no mail value.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
* chore: add ldap email logic back after main merge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-11 15:40:15 +03:00
Stavros and GitHub
4f7335ed73
refactor: rework app logging, dependency injection and cancellation ( #844 )
...
* feat: add new logger
* refactor: use one struct for context handling and cancellation
* refactor: rework logging and config in controllers
* refactor: rework logging and config in middlewares
* refactor: rework logging and cancellation in services
* refactor: rework cli logging
* fix: improve logging in routines
* feat: use sync groups for better cancellation
* refactor: simplify middleware, controller and service init
* tests: fix controller tests
* tests: use require instead of assert where previous step is required
* tests: fix middleware tests
* tests: fix service tests
* tests: fix context tests
* fix: fix typos
* feat: add option to enable or disable concurrent listeners
* fix: assign public key correctly in oidc server
* tests: fix don't try to test logger with char size
* fix: coderabbit comments
* tests: use filepath join instead of path join
* fix: ensure unix socket shutdown doesn't run twice
* chore: remove temp lint file
2026-05-10 16:10:36 +03:00
6602b52f85
feat: add support for oauth whitelist file ( #817 ) ( #826 )
...
* feat: add support for oauth whitelist file (#817 )
* Merge branch 'main' into feat/oauth-whitelist-file
* fix: fix conflicts
* tests: use testify for testing
---------
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-07 16:35:38 +03:00
ca6a7fa551
feat: add option to run tinyauth on a top-level domain ( #710 )
...
* Add TINYAUTH_AUTH_SUBDOMAINSENABLED option
Setting it to false allows to use Tinyauth on top-level domain only,
but forbids automatic cross-app authentication using Traefik/Nginx.
* fix: inform services and controllers if subdomain cookie domain is enabled
* chore: rabbit feedback
* fix: deny ip addresses for standalone domain
---------
Co-authored-by: Stavros <steveiliop56@gmail.com >
2026-05-07 16:12:24 +03:00
Stavros and GitHub
1382ab41e7
refactor: rework user context handling throughout tinyauth ( #829 )
...
* wip
* fix: fix util imports
* fix: fix bootstrap import issues
* fix: fix cli imports
* fix: context controller
* fix: use new context in user controller
* fix: fix imports and context in proxy controller
* fix: fix oauth and oidc controller imports and context
* feat: finalize context functionality
* refactor: simplify acls checking logic by passing the entire acl struct
* chore: rename get basic auth to encode basic auth for clarity
* fix: fix controller tests
* tests: fix service tests
* tests: fix utils tests
* tests: move to testify for testing in utils
* fix: fix config reference generator
* tests: add tests for context parsing
* tests: add tests for context middleware
* tests: remove error wrapper from context tests
* tests: fix log wrapper tests
* fix: fix verion setting in cd and dockerfiles
* fix: review comments batch 1
* fix: review comments batch 2
* fix: review comments batch 3
* fix: delete totp pending session cookie on totp success
* tests: fix user controller tests
* fix: don't audit login too early
* fix: own comments
2026-05-07 15:41:07 +03:00
Stavros and GitHub
7e17a4ad86
refactor: replace gorm with vanilla sql and sqlc ( #541 )
...
* refactor: replace gorm with vanilla sql and sqlc
* chore: go mod tidy
* refactor: rebase for main
* tests: fix tests
* fix: review comments
2025-12-31 17:59:21 +02:00
Stavros and GitHub
43487d44f7
feat: forward sub from oidc providers ( #543 )
...
* feat: forward sub from oidc providers
* fix: review comments
2025-12-26 19:02:51 +02:00
Stavros and GitHub
5c866bad1a
feat: multiple oauth providers ( #355 )
...
* feat: add flag decoder (candidate)
* refactor: finalize flags decoder
* feat: add env decoder
* feat: add oauth config parsing logic
* feat: implement backend logic for multiple oauth providers
* feat: implement multiple oauth providers in the frontend
* feat: add some default icons
* chore: add credits for parser
* feat: style oauth auto redirect screen
* fix: bot suggestions
* refactor: rework decoders using simpler and more efficient pattern
* refactor: rework oauth name database migration
2025-09-16 13:28:28 +03:00
Stavros and GitHub
03d06cb0a7
feat: add sqlite database for storing sessions ( #326 )
...
* feat: add sqlite database for storing sessions
* refactor: use db instance instead of service in auth service
* fix: coderabbit suggestions
2025-08-29 12:35:11 +03:00
StavrosandGitHub
tsushanthandGitHub
Ryc O'ChetandGitHub
Scott McKendryandGitHub
