fix: use constant time in user lookups

.env.example

@@ -101,6 +101,8 @@ TINYAUTH_AUTH_SESSIONMAXLIFETIME=0
 TINYAUTH_AUTH_LOGINTIMEOUT=300
 # Maximum login retries.
 TINYAUTH_AUTH_LOGINMAXRETRIES=3
+# Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically.
+TINYAUTH_AUTH_LOCKDOWNENABLED=true
 # Comma-separated list of trusted proxy addresses.
 TINYAUTH_AUTH_TRUSTEDPROXIES=
 # ACL policy for allow-by-default or deny-by-default, available options are allow and deny, default is allow.

.github/workflows/e2e.yml

@@ -1,43 +0,0 @@
-name: Run e2e tests
-on:
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  test:
-    timeout-minutes: 30
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # ratchet:pnpm/action-setup@v6
-        with:
-          package_json_file: ./e2e/package.json
-
-      - name: Set up Docker
-        uses: docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877 # ratchet:docker/setup-docker-action@v5
-
-      - name: Install dependencies
-        run: pnpm ci
-        working-directory: e2e
-
-      - name: Install Playwright Browsers
-        run: pnpm exec playwright install --with-deps
-        working-directory: e2e
-
-      - name: Run Playwright tests
-        run: pnpm test
-        working-directory: e2e
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
-        if: ${{ !cancelled() }}
-        with:
-          name: playwright-report
-          path: e2e/playwright-report/
-          retention-days: 5

.github/workflows/nightly.yml

@@ -23,7 +23,7 @@ jobs:
           REPO: ${{ github.event.repository.name }}
 
       - name: Create release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           prerelease: true
           tag_name: nightly
@@ -476,7 +476,7 @@ jobs:
           merge-multiple: true
 
       - name: Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           files: binaries/*
           tag_name: nightly

.github/workflows/release.yml

@@ -449,6 +449,6 @@ jobs:
           merge-multiple: true
 
       - name: Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           files: binaries/*

README.md

@@ -62,19 +62,18 @@ If you like, you can help translate Tinyauth into more languages by visiting the
 
 Tinyauth is licensed under the GNU Affero General Public License v3.0. TL;DR — You may copy, distribute and modify the software as long as you track changes/dates in source files. Any modifications to or software including (via compiler) AGPL-licensed code must also be made available under the AGPL along with build & install instructions. If you run a modified version over a network, you must also make the source available to the users of that service. For more information about the license check the [license](LICENSE) file.
 
+
+## Hosting Partners
+
+If you use one of our partners, you can help support us while getting a great hosting deal.
+
+<div>
+    <a title="InstaPods" target="_blank" href="https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth"><img src="https://instapods.com/deploy-button.svg"></a>
+</div>
+
 ## Sponsors
 
-A big thank-you to the following individuals and companies
-for their support for Tinyauth.
-
-### Companies and Organizations
-
-- [JetBrains for Open-Source](https://jb.gg/OpenSource)
-- [CodeRabbit AI](https://www.coderabbit.ai)
-- [Dosu](https://dosu.dev/)
-- [InstaPods](https://instapods.com) - [Deploy Tinyauth from 3$/month](https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth)
-
-### Individuals
+A big thank you to the following people for providing me with more coffee:
 
 <!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https:&#x2F;&#x2F;github.com&#x2F;erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a>&nbsp;&nbsp;<a href="https://github.com/nicotsx"><img src="https:&#x2F;&#x2F;github.com&#x2F;nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a>&nbsp;&nbsp;<a href="https://github.com/SimpleHomelab"><img src="https:&#x2F;&#x2F;github.com&#x2F;SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a>&nbsp;&nbsp;<a href="https://github.com/jmadden91"><img src="https:&#x2F;&#x2F;github.com&#x2F;jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a>&nbsp;&nbsp;<a href="https://github.com/tribor"><img src="https:&#x2F;&#x2F;github.com&#x2F;tribor.png" width="64px" alt="User avatar: tribor" /></a>&nbsp;&nbsp;<a href="https://github.com/eliasbenb"><img src="https:&#x2F;&#x2F;github.com&#x2F;eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a>&nbsp;&nbsp;<a href="https://github.com/afunworm"><img src="https:&#x2F;&#x2F;github.com&#x2F;afunworm.png" width="64px" alt="User avatar: afunworm" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="64px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/Lancelot-Enguerrand"><img src="https:&#x2F;&#x2F;github.com&#x2F;Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a>&nbsp;&nbsp;<a href="https://github.com/allgoewer"><img src="https:&#x2F;&#x2F;github.com&#x2F;allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a>&nbsp;&nbsp;<a href="https://github.com/NEANC"><img src="https:&#x2F;&#x2F;github.com&#x2F;NEANC.png" width="64px" alt="User avatar: NEANC" /></a>&nbsp;&nbsp;<a href="https://github.com/axjab"><img src="https:&#x2F;&#x2F;github.com&#x2F;axjab.png" width="64px" alt="User avatar: axjab" /></a>&nbsp;&nbsp;<a href="https://github.com/stegratech"><img src="https:&#x2F;&#x2F;github.com&#x2F;stegratech.png" width="64px" alt="User avatar: stegratech" /></a>&nbsp;&nbsp;<a href="https://github.com/apearson"><img src="https:&#x2F;&#x2F;github.com&#x2F;apearson.png" width="64px" alt="User avatar: apearson" /></a>&nbsp;&nbsp;<a href="https://github.com/Micky5991"><img src="https:&#x2F;&#x2F;github.com&#x2F;Micky5991.png" width="64px" alt="User avatar: Micky5991" /></a>&nbsp;&nbsp;<!-- sponsors -->
 
@@ -82,4 +81,9 @@ for their support for Tinyauth.
 
 - **Freepik** for providing the police hat and badge.
 - **Renee French** for the original gopher logo.
+- **Coderabbit AI** for providing free AI code reviews.
 - **Syrhu** for providing the background image of the app.
+
+## Star History
+
+[![Star History Chart](https://api.star-history.com/svg?repos=tinyauthapp/tinyauth&type=Date)](https://www.star-history.com/#tinyauthapp/tinyauth&Date)

e2e/.gitignore

@@ -1,7 +0,0 @@
-# playwright files
-/node_modules/
-/test-results/
-/playwright-report/
-/blob-report/
-/playwright/.cache/
-/playwright/.auth/

e2e/conf/Caddyfile

@@ -1,15 +0,0 @@
-{
-	auto_https off
-}
-
-http://whoami.127.0.0.1.sslip.io {
-	forward_auth tinyauth:3000 {
-		uri /api/auth/caddy
-		copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
-	}
-	reverse_proxy whoami:80
-}
-
-http://tinyauth.127.0.0.1.sslip.io {
-	reverse_proxy tinyauth:3000
-}

e2e/config.e2e.yaml

@@ -1,22 +0,0 @@
-appUrl: http://tinyauth.127.0.0.1.sslip.io
-
-log:
-  level: debug
-
-auth:
-  users:
-    # user1:password,user2:password,user3:password:token
-    - user1:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e
-    - user2:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e
-    - user3:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e:MVR4JQWNXYKNM6HHJEYEFP2O74QIIEJE
-  # disable rate limits for multiple workers to work
-  loginMaxRetries: 0
-
-apps:
-  whoami:
-    config:
-      domain: whoami.127.0.0.1.sslip.io
-    path:
-      allow: /foo
-    users:
-      allow: user1

e2e/docker-compose.e2e.yml

@@ -1,24 +0,0 @@
-services:
-  caddy:
-    image: caddy:2.11.4
-    pull_policy: missing
-    ports:
-      - 80:80
-    volumes:
-      - ./conf:/etc/caddy
-
-  whoami:
-    image: traefik/whoami:v1.11.0
-    pull_policy: missing
-
-  tinyauth:
-    build:
-      context: ../
-      dockerfile: Dockerfile
-      args:
-        - VERSION=e2e
-        - BUILD_TAGS=nomsgpack
-        - LDFLAGS=-s -w
-    command: ["--configfile", "/app/config.yaml"]
-    volumes:
-      - ./config.e2e.yaml:/app/config.yaml:ro

e2e/fixtures/auth.fixtures.ts

@@ -1,47 +0,0 @@
-import {expect, Page} from '@playwright/test';
-import { OTP } from 'otplib';
-
-export class LoginFixture {
-    constructor(public readonly page: Page) {}
-
-    async run(username: string, password: string) {
-        await expect(this.page.getByText('Welcome back, please login')).toBeVisible();
-        await this.page.getByLabel('Username').fill(username);
-        await this.page.getByLabel('Password').fill(password);
-        await this.page.getByRole('button', { name: 'Login' }).click();
-    }
-
-    async expectSuccess(username: string) {
-        await expect(this.page.getByText(`You are currently logged in as ${username}.`)).toBeVisible()
-    }
-}
-
-export class LogoutFixture {
-    constructor(public readonly page: Page) {}
-
-    async run() {
-        await expect(this.page.getByText('Click the button below to logout.')).toBeVisible();
-        await this.page.getByRole('button', { name: 'Logout' }).click();
-    }
-
-    async expectSuccess() {
-        await expect(this.page.getByText('Welcome back, please login')).toBeVisible();
-    }
-}
-
-export class TOTPFixture {
-    constructor(public readonly page: Page) {}
-
-    async run(secret: string) {
-        await expect(this.page.getByText('Enter your TOTP code')).toBeVisible();
-        const otp = new OTP();
-        const token = await otp.generate({ secret });
-        await this.page.getByPlaceholder('XXXXXX').fill(token);
-        // we shouldn't need to click continue, it will auto submit
-        // await this.page.getByRole('button', { name: 'Continue' }).click();
-    }
-
-    async expectSuccess(username: string) {
-        await expect(this.page.getByText(`You are currently logged in as ${username}.`)).toBeVisible()
-    }
-}

e2e/package.json

@@ -1,30 +0,0 @@
-{
-  "name": "e2e",
-  "version": "1.0.0",
-  "description": "",
-  "main": "index.js",
-  "scripts": {
-    "down": "docker compose -f docker-compose.e2e.yml down",
-    "up": "docker compose -f docker-compose.e2e.yml up --build --force-recreate --remove-orphans",
-    "test": "playwright test",
-    "report": "playwright show-report"
-  },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "devEngines": {
-    "packageManager": {
-      "name": "pnpm",
-      "version": "^11.1.2",
-      "onFail": "download"
-    }
-  },
-  "type": "module",
-  "devDependencies": {
-    "@playwright/test": "^1.61.1",
-    "@types/node": "^26.1.1"
-  },
-  "dependencies": {
-    "otplib": "^13.4.1"
-  }
-}

e2e/playwright.config.ts

@@ -1,49 +0,0 @@
-import { defineConfig, devices } from '@playwright/test';
-
-export default defineConfig({
-  testDir: './specs',
-  fullyParallel: true,
-  forbidOnly: false,
-  retries: 0,
-  workers: 4,
-  reporter: 'html',
-  use: {
-    trace: 'on-first-retry',
-    video: 'on',
-  },
-  projects: [
-    {
-      name: 'chromium',
-      use: { ...devices['Desktop Chrome'] },
-    },
-    {
-      name: 'firefox',
-      use: { ...devices['Desktop Firefox'] },
-    },
-
-    {
-      name: 'webkit',
-      use: { ...devices['Desktop Safari'] },
-    },
-    {
-      name: 'Mobile Chrome',
-      use: { ...devices['Pixel 5'] },
-    },
-    {
-      name: 'Mobile Safari',
-      use: { ...devices['iPhone 12'] },
-    },
-  ],
-  webServer: {
-    command: 'pnpm run up',
-    url: 'http://tinyauth.127.0.0.1.sslip.io/api/healthz',
-    reuseExistingServer: true,
-    timeout: 5 * 60 * 1000,
-    gracefulShutdown: {
-      signal: 'SIGINT',
-      timeout: 1000,
-    },
-    stderr: 'pipe',
-    stdout: 'pipe',
-  },
-});

e2e/pnpm-lock.yaml

@@ -1,338 +0,0 @@
----
-lockfileVersion: '9.0'
-
-importers:
-
-  .:
-    configDependencies: {}
-    packageManagerDependencies:
-      '@pnpm/exe':
-        specifier: ^11.1.2
-        version: 11.13.1
-      pnpm:
-        specifier: ^11.1.2
-        version: 11.13.1
-
-packages:
-
-  '@pnpm/exe@11.13.1':
-    resolution: {integrity: sha512-P4euEK6lOFnd5oTHEc5M/HhvyF4XUhTnVsklEcM6rmY0QJxPD6xbT+u1+gskEIBp4nSRorz20IJQtAU1Nerggg==}
-    hasBin: true
-
-  '@pnpm/linux-arm64@11.13.1':
-    resolution: {integrity: sha512-wB8zloqrYrudPyuA5qbuTCnJGe4eETPwqOjoPjoyyyvA4zFI5XfLpxgqOOcaY5UJBoqzckcGpRVDwhSRfsQ/6A==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@pnpm/linux-x64@11.13.1':
-    resolution: {integrity: sha512-A+wnEvzfWEvanXiwww3tnOPmtjPSrrf5tOP6vk8+K0BRFEe/Df0oPytm2nWgGcn5iwPnqtr1Btkof913McnSPA==}
-    cpu: [x64]
-    os: [linux]
-
-  '@pnpm/linuxstatic-arm64@11.13.1':
-    resolution: {integrity: sha512-k4t65VeqRX4COMFe45TF58CVmCpmAsKZShaR1HobmUeleo98mWTctggKolrA2MHcVUeSS+12yB5Urb3uDazhmw==}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@pnpm/linuxstatic-x64@11.13.1':
-    resolution: {integrity: sha512-A65GqPzwCl0bAMk3kRWfbjSRBm5RRaqR2oMxV/9AYZrwO0X9yEfngbLBISCPHjt6/Qe4nH7DFemyhy6yODYwEw==}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@pnpm/macos-arm64@11.13.1':
-    resolution: {integrity: sha512-MJvOtyGOWSfBoqdVEfAH8ljmHs13mt82k/UxN4f+q7koDxJRR2n4Nie6Og6RwbnbaubCz0Fh2bTeL1+MxDSFpA==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@pnpm/win-arm64@11.13.1':
-    resolution: {integrity: sha512-kl/g1cCKOJPe4HntspyrAJW0LRco0UHnVfxHSspezo4Zj4AanJAZ8WzLqfa6/w3lBSKHTEN4x0pb3m4J7B7Vpw==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@pnpm/win-x64@11.13.1':
-    resolution: {integrity: sha512-Bcb14NeBlbHS2Gq1qr8VnCiAz5eC1lYzXOls7zH0bnV0Taaj4/xyfm0HVO4dn9R2TQtVtz1qnBZHHL9PDFumqQ==}
-    cpu: [x64]
-    os: [win32]
-
-  '@reflink/reflink-darwin-arm64@0.1.19':
-    resolution: {integrity: sha512-ruy44Lpepdk1FqDz38vExBY/PVUsjxZA+chd9wozjUH9JjuDT/HEaQYA6wYN9mf041l0yLVar6BCZuWABJvHSA==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@reflink/reflink-darwin-x64@0.1.19':
-    resolution: {integrity: sha512-By85MSWrMZa+c26TcnAy8SDk0sTUkYlNnwknSchkhHpGXOtjNDUOxJE9oByBnGbeuIE1PiQsxDG3Ud+IVV9yuA==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [darwin]
-
-  '@reflink/reflink-linux-arm64-gnu@0.1.19':
-    resolution: {integrity: sha512-7P+er8+rP9iNeN+bfmccM4hTAaLP6PQJPKWSA4iSk2bNvo6KU6RyPgYeHxXmzNKzPVRcypZQTpFgstHam6maVg==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [glibc]
-
-  '@reflink/reflink-linux-arm64-musl@0.1.19':
-    resolution: {integrity: sha512-37iO/Dp6m5DDaC2sf3zPtx/hl9FV3Xze4xoYidrxxS9bgP3S8ALroxRK6xBG/1TtfXKTvolvp+IjrUU6ujIGmA==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [linux]
-    libc: [musl]
-
-  '@reflink/reflink-linux-x64-gnu@0.1.19':
-    resolution: {integrity: sha512-jbI8jvuYCaA3MVUdu8vLoLAFqC+iNMpiSuLbxlAgg7x3K5bsS8nOpTRnkLF7vISJ+rVR8W+7ThXlXlUQ93ulkw==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@reflink/reflink-linux-x64-musl@0.1.19':
-    resolution: {integrity: sha512-e9FBWDe+lv7QKAwtKOt6A2W/fyy/aEEfr0g6j/hWzvQcrzHCsz07BNQYlNOjTfeytrtLU7k449H1PI95jA4OjQ==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [linux]
-    libc: [musl]
-
-  '@reflink/reflink-win32-arm64-msvc@0.1.19':
-    resolution: {integrity: sha512-09PxnVIQcd+UOn4WAW73WU6PXL7DwGS6wPlkMhMg2zlHHG65F3vHepOw06HFCq+N42qkaNAc8AKIabWvtk6cIQ==}
-    engines: {node: '>= 10'}
-    cpu: [arm64]
-    os: [win32]
-
-  '@reflink/reflink-win32-x64-msvc@0.1.19':
-    resolution: {integrity: sha512-E//yT4ni2SyhwP8JRjVGWr3cbnhWDiPLgnQ66qqaanjjnMiu3O/2tjCPQXlcGc/DEYofpDc9fvhv6tALQsMV9w==}
-    engines: {node: '>= 10'}
-    cpu: [x64]
-    os: [win32]
-
-  '@reflink/reflink@0.1.19':
-    resolution: {integrity: sha512-DmCG8GzysnCZ15bres3N5AHCmwBwYgp0As6xjhQ47rAUTUXxJiK+lLUxaGsX3hd/30qUpVElh05PbGuxRPgJwA==}
-    engines: {node: '>= 10'}
-
-  detect-libc@2.1.2:
-    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
-    engines: {node: '>=8'}
-
-  pnpm@11.13.1:
-    resolution: {integrity: sha512-svx2g7imUlQU59E+G6KMqt3elr9m7FQL+ut+cCuB8+C+TR8pXt9/n+A5Z0Co3ORQnFgt33mJH0VD/qMtN2RfJQ==}
-    engines: {node: '>=22.13'}
-    hasBin: true
-
-snapshots:
-
-  '@pnpm/exe@11.13.1':
-    dependencies:
-      '@reflink/reflink': 0.1.19
-      detect-libc: 2.1.2
-    optionalDependencies:
-      '@pnpm/linux-arm64': 11.13.1
-      '@pnpm/linux-x64': 11.13.1
-      '@pnpm/linuxstatic-arm64': 11.13.1
-      '@pnpm/linuxstatic-x64': 11.13.1
-      '@pnpm/macos-arm64': 11.13.1
-      '@pnpm/win-arm64': 11.13.1
-      '@pnpm/win-x64': 11.13.1
-
-  '@pnpm/linux-arm64@11.13.1':
-    optional: true
-
-  '@pnpm/linux-x64@11.13.1':
-    optional: true
-
-  '@pnpm/linuxstatic-arm64@11.13.1':
-    optional: true
-
-  '@pnpm/linuxstatic-x64@11.13.1':
-    optional: true
-
-  '@pnpm/macos-arm64@11.13.1':
-    optional: true
-
-  '@pnpm/win-arm64@11.13.1':
-    optional: true
-
-  '@pnpm/win-x64@11.13.1':
-    optional: true
-
-  '@reflink/reflink-darwin-arm64@0.1.19':
-    optional: true
-
-  '@reflink/reflink-darwin-x64@0.1.19':
-    optional: true
-
-  '@reflink/reflink-linux-arm64-gnu@0.1.19':
-    optional: true
-
-  '@reflink/reflink-linux-arm64-musl@0.1.19':
-    optional: true
-
-  '@reflink/reflink-linux-x64-gnu@0.1.19':
-    optional: true
-
-  '@reflink/reflink-linux-x64-musl@0.1.19':
-    optional: true
-
-  '@reflink/reflink-win32-arm64-msvc@0.1.19':
-    optional: true
-
-  '@reflink/reflink-win32-x64-msvc@0.1.19':
-    optional: true
-
-  '@reflink/reflink@0.1.19':
-    optionalDependencies:
-      '@reflink/reflink-darwin-arm64': 0.1.19
-      '@reflink/reflink-darwin-x64': 0.1.19
-      '@reflink/reflink-linux-arm64-gnu': 0.1.19
-      '@reflink/reflink-linux-arm64-musl': 0.1.19
-      '@reflink/reflink-linux-x64-gnu': 0.1.19
-      '@reflink/reflink-linux-x64-musl': 0.1.19
-      '@reflink/reflink-win32-arm64-msvc': 0.1.19
-      '@reflink/reflink-win32-x64-msvc': 0.1.19
-
-  detect-libc@2.1.2: {}
-
-  pnpm@11.13.1: {}
-
----
-lockfileVersion: '9.0'
-
-settings:
-  autoInstallPeers: true
-  excludeLinksFromLockfile: false
-
-importers:
-
-  .:
-    dependencies:
-      otplib:
-        specifier: ^13.4.1
-        version: 13.4.1
-    devDependencies:
-      '@playwright/test':
-        specifier: ^1.61.1
-        version: 1.61.1
-      '@types/node':
-        specifier: ^26.1.1
-        version: 26.1.1
-
-packages:
-
-  '@noble/hashes@2.2.0':
-    resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
-    engines: {node: '>= 20.19.0'}
-
-  '@otplib/core@13.4.1':
-    resolution: {integrity: sha512-KIXgK1hNtWJEBMTastbe1bpmuais+3f+ATeO8TkMs2rNkfGO1FbQy8+/UWVEu3TR/iTJerU0idkPudaPmLP2BA==}
-
-  '@otplib/hotp@13.4.1':
-    resolution: {integrity: sha512-g9q04SwpG5ZtMnVkUcgcoAlwCH4YLROZN1qhyBwgkBzqYYVSYhpP6gSGaxGHwePLt1c+e6NqDlgIZN+e1/XPuA==}
-
-  '@otplib/plugin-base32-scure@13.4.1':
-    resolution: {integrity: sha512-Fs/r5qisC05SRhT6xWXaypB6PVC0vgWf6zztmi0J5RnQ09OJiPDWCJFH6cDm6ANsrdvB9di7X+Jb7L13BoEbUA==}
-
-  '@otplib/plugin-crypto-noble@13.4.1':
-    resolution: {integrity: sha512-PJfVW8/1hdS6CfxLheKPZSLTwDq4TijZbN4yRjxlv0ODdzmxpM+wGwWr1JXMdy0xJPxLziydQD5gdVqrR4/gAg==}
-
-  '@otplib/totp@13.4.1':
-    resolution: {integrity: sha512-QOkBVPrf6AM4qZaReZPSk9/I8ATVdZpIISJz115MqeVtcrbcr5llPZ0J7804tpnjnp1vCRkI5Qjd47HhgVteBQ==}
-
-  '@otplib/uri@13.4.1':
-    resolution: {integrity: sha512-xaIm7bvICMhoB2rZIR5luiaMdssWR5nY5nXnR1fdezUgZuEO58D6zrGzLp7pQuBmlpmL0HagnscDQFoskp9yiA==}
-
-  '@playwright/test@1.61.1':
-    resolution: {integrity: sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  '@scure/base@2.2.0':
-    resolution: {integrity: sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg==}
-
-  '@types/node@26.1.1':
-    resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
-
-  fsevents@2.3.2:
-    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
-    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
-    os: [darwin]
-
-  otplib@13.4.1:
-    resolution: {integrity: sha512-o5CxfDw6bh7hoDv0NUUIcc0RqzJ9ipfUrzeKheKJ+vs4rXZnDlA9n4a/7R1cDjpmLjKLix4BgNVRmoDkm5rLSQ==}
-
-  playwright-core@1.61.1:
-    resolution: {integrity: sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  playwright@1.61.1:
-    resolution: {integrity: sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==}
-    engines: {node: '>=18'}
-    hasBin: true
-
-  undici-types@8.3.0:
-    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
-
-snapshots:
-
-  '@noble/hashes@2.2.0': {}
-
-  '@otplib/core@13.4.1': {}
-
-  '@otplib/hotp@13.4.1':
-    dependencies:
-      '@otplib/core': 13.4.1
-      '@otplib/uri': 13.4.1
-
-  '@otplib/plugin-base32-scure@13.4.1':
-    dependencies:
-      '@otplib/core': 13.4.1
-      '@scure/base': 2.2.0
-
-  '@otplib/plugin-crypto-noble@13.4.1':
-    dependencies:
-      '@noble/hashes': 2.2.0
-      '@otplib/core': 13.4.1
-
-  '@otplib/totp@13.4.1':
-    dependencies:
-      '@otplib/core': 13.4.1
-      '@otplib/hotp': 13.4.1
-      '@otplib/uri': 13.4.1
-
-  '@otplib/uri@13.4.1':
-    dependencies:
-      '@otplib/core': 13.4.1
-
-  '@playwright/test@1.61.1':
-    dependencies:
-      playwright: 1.61.1
-
-  '@scure/base@2.2.0': {}
-
-  '@types/node@26.1.1':
-    dependencies:
-      undici-types: 8.3.0
-
-  fsevents@2.3.2:
-    optional: true
-
-  otplib@13.4.1:
-    dependencies:
-      '@otplib/core': 13.4.1
-      '@otplib/hotp': 13.4.1
-      '@otplib/plugin-base32-scure': 13.4.1
-      '@otplib/plugin-crypto-noble': 13.4.1
-      '@otplib/totp': 13.4.1
-      '@otplib/uri': 13.4.1
-
-  playwright-core@1.61.1: {}
-
-  playwright@1.61.1:
-    dependencies:
-      playwright-core: 1.61.1
-    optionalDependencies:
-      fsevents: 2.3.2
-
-  undici-types@8.3.0: {}

e2e/specs/apps.spec.ts

@@ -1,28 +0,0 @@
-import {expect, test} from '@playwright/test';
-import {LoginFixture} from "../fixtures/auth.fixtures";
-
-test('should be able to login to app with forward-auth', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    await page.goto('http://whoami.127.0.0.1.sslip.io');
-    // redirect to tinyauth
-    await expect(page.getByText('Welcome back, please login')).toBeVisible()
-    await loginFixture.run('user1', 'password')
-    // redirect to app
-    await expect(page.getByText('whoami.127.0.0.1.sslip.io')).toBeVisible()
-});
-
-test('non authorized user should not be able to access app', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    await page.goto('http://whoami.127.0.0.1.sslip.io');
-    // redirect to tinyauth
-    await expect(page.getByText('Welcome back, please login')).toBeVisible()
-    // user2 is not authorized to access app
-    await loginFixture.run('user2', 'password')
-    // redirect to app
-    await expect(page.getByText('The user with username user2 is not authorized to access the resource whoami.')).toBeVisible()
-})
-
-test('allowed path should skip authentication', async ({ page }) => {
-    await page.goto('http://whoami.127.0.0.1.sslip.io/foo');
-    await expect(page.getByText('whoami.127.0.0.1.sslip.io')).toBeVisible()
-})

e2e/specs/auth.spec.ts

@@ -1,48 +0,0 @@
-import { test, expect } from '@playwright/test';
-import {LoginFixture, LogoutFixture, TOTPFixture} from "../fixtures/auth.fixtures";
-
-test('should be able to login', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
-    await loginFixture.run('user1', 'password')
-    await loginFixture.expectSuccess('user1')
-});
-
-test('should fail to login with wrong credentials', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
-    await loginFixture.run('user27267', 'password')
-    const toast = page.locator('[data-sonner-toast]').first();
-    await expect(toast).toBeVisible();
-    await expect(toast).toContainText('Failed to log in');
-});
-
-
-test('should be able to logout', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
-    await loginFixture.run('user1', 'password')
-    await loginFixture.expectSuccess('user1')
-    const logoutFixture = new LogoutFixture(page);
-    await logoutFixture.run()
-})
-
-test('should be able to login with totp', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    const totpFixture = new TOTPFixture(page);
-    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
-    await loginFixture.run('user3', 'password')
-    await totpFixture.run('MVR4JQWNXYKNM6HHJEYEFP2O74QIIEJE')
-    await loginFixture.expectSuccess('user3');
-});
-
-test('should fail to login with wrong totp', async ({ page }) => {
-    const loginFixture = new LoginFixture(page);
-    const totpFixture = new TOTPFixture(page);
-    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
-    await loginFixture.run('user3', 'password')
-    await totpFixture.run('VZVMOMQCBN24DJ5VRFAL5TJAZGBHXMN3')
-    const toast = page.locator('[data-sonner-toast]').first();
-    await expect(toast).toBeVisible();
-    await expect(toast).toContainText('Failed to verify code');
-});

internal/bootstrap/router_bootstrap.go

@@ -30,16 +30,6 @@ func (app *BootstrapApp) setupRouter() error {
 		if err != nil {
 			return fmt.Errorf("failed to set trusted proxies: %w", err)
 		}
-
-		app.runtime.TrustedProxiesConfigured = true
-	} else {
-		err := engine.SetTrustedProxies(nil)
-
-		if err != nil {
-			return fmt.Errorf("failed to set trusted proxies: %w", err)
-		}
-
-		app.log.App.Warn().Msg("Trusted proxies are not configured, IP access controls will NOT work")
 	}
 
 	middlewareProvideFor := []any{

internal/bootstrap/service_bootstrap.go

@@ -85,8 +85,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 			err := app.dig.Provide(service.NewKubernetesService)
 
 			if err != nil {
-				app.log.App.Warn().Err(err).Msg("Failed to provide kubernetes service")
-				return nil, nil
+				return nil, fmt.Errorf("failed to provide kubernetes service: %w", err)
 			}
 
 			err = app.dig.Invoke(func(k *service.KubernetesService) error {
@@ -95,8 +94,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 			})
 
 			if err != nil {
-				app.log.App.Warn().Err(err).Msg("Failed to invoke kubernetes service")
-				return nil, nil
+				return nil, fmt.Errorf("failed to invoke kubernetes service: %w", err)
 			}
 
 			// Kubernetes will fail to initialize with an error if it cannot connect to the cluster
@@ -116,8 +114,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 		err := app.dig.Provide(service.NewDockerService)
 
 		if err != nil {
-			app.log.App.Warn().Err(err).Msg("Failed to provide docker service")
-			return nil, nil
+			return nil, fmt.Errorf("failed to provide docker service: %w", err)
 		}
 
 		err = app.dig.Invoke(func(d *service.DockerService) error {
@@ -126,8 +123,7 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 		})
 
 		if err != nil {
-			app.log.App.Warn().Err(err).Msg("Failed to invoke docker service")
-			return nil, nil
+			return nil, fmt.Errorf("failed to invoke docker service: %w", err)
 		}
 
 		if app.services.dockerService == nil {

internal/controller/oidc_controller.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 	"slices"
 	"strconv"
 	"strings"
@@ -344,31 +343,27 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 	// Create the authorization code
 	code := controller.oidc.CreateCode(*authorizeReq, *userContext)
 
-	cu, err := url.Parse(authorizeReq.RedirectURI)
+	queries, err := query.Values(AuthorizeCallback{
+		Code:  code,
+		State: authorizeReq.State,
+	})
 
 	if err != nil {
 		controller.authorizeError(c, authorizeErrorParams{
-			err:          err,
-			reason:       "Failed to parse redirect URI",
-			reasonPublic: "Failed to parse redirect URI",
-			json:         true,
+			err:           err,
+			reason:        "Failed to build query",
+			reasonPublic:  "Failed to build query",
+			callback:      authorizeReq.RedirectURI,
+			callbackError: "server_error",
+			state:         authorizeReq.State,
+			json:          true,
 		})
 		return
 	}
 
-	q := cu.Query()
-
-	q.Set("code", code)
-
-	if authorizeReq.State != "" {
-		q.Set("state", authorizeReq.State)
-	}
-
-	cu.RawQuery = q.Encode()
-
 	c.JSON(200, gin.H{
 		"status":       200,
-		"redirect_uri": cu.String(),
+		"redirect_uri": fmt.Sprintf("%s?%s", authorizeReq.RedirectURI, queries.Encode()),
 	})
 }
 
@@ -644,37 +639,37 @@ func (controller *OIDCController) authorizeError(c *gin.Context, params authoriz
 	controller.log.App.Error().Err(params.err).Str("reason", params.reason).Msg("Authorization error")
 
 	if params.callback != "" {
-		cu, err := url.Parse(params.callback)
+		errorQueries := CallbackError{
+			Error: params.callbackError,
+		}
+
+		if params.reasonPublic != "" {
+			errorQueries.ErrorDescription = params.reasonPublic
+		}
+
+		if params.state != "" {
+			errorQueries.State = params.state
+		}
+
+		queries, err := query.Values(errorQueries)
 
 		if err != nil {
-			controller.log.App.Error().Err(err).Msg("Failed to parse callback URL")
+			controller.log.App.Error().Err(err).Msg("Failed to build callback error query")
 			c.AbortWithStatus(http.StatusInternalServerError)
 			return
 		}
 
-		q := cu.Query()
-
-		q.Set("error", params.callbackError)
-
-		if params.reasonPublic != "" {
-			q.Set("error_description", params.reasonPublic)
-		}
-
-		if params.state != "" {
-			q.Set("state", params.state)
-		}
-
-		cu.RawQuery = q.Encode()
+		redirectUrl := fmt.Sprintf("%s?%s", params.callback, queries.Encode())
 
 		if params.json {
 			c.JSON(200, gin.H{
 				"status":       200,
-				"redirect_uri": cu.String(),
+				"redirect_uri": redirectUrl,
 			})
 			return
 		}
 
-		c.Redirect(http.StatusFound, cu.String())
+		c.Redirect(http.StatusFound, redirectUrl)
 		return
 	}
 

internal/controller/proxy_controller.go

@@ -111,10 +111,9 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 	clientIP := c.ClientIP()
 
 	aclsCtx := &service.ACLContext{
-		ACLs:                     acls,
-		IP:                       net.ParseIP(clientIP),
-		Path:                     proxyCtx.Path,
-		TrustedProxiesConfigured: controller.runtime.TrustedProxiesConfigured,
+		ACLs: acls,
+		IP:   net.ParseIP(clientIP),
+		Path: proxyCtx.Path,
 	}
 
 	if controller.policyEngine.Evaluate(service.RuleIPBypassed, aclsCtx) {

internal/controller/proxy_controller_test.go

@@ -708,7 +708,7 @@ func TestProxyController(t *testing.T) {
 		Log: log,
 	})
 
-	authService, err := service.NewAuthService(service.AuthServiceInput{
+	authService := service.NewAuthService(service.AuthServiceInput{
 		Log:          log,
 		Config:       &cfg,
 		Runtime:      &runtime,
@@ -721,8 +721,6 @@ func TestProxyController(t *testing.T) {
 		PolicyEngine: policyEngine,
 	})
 
-	require.NoError(t, err)
-
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
 			router := gin.Default()

internal/controller/user_controller.go

@@ -72,32 +72,11 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 
 	controller.log.App.Debug().Str("username", req.Username).Msg("Login attempt")
 
-	search, err := controller.auth.SearchUser(req.Username)
-
-	if err != nil {
-		if errors.Is(err, service.ErrUserNotFound) {
-			controller.auth.DummyPasswordCheck(req.Password)
-			controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
-			controller.log.AuditLoginFailure(req.Username, "unknown", c.ClientIP(), "user not found")
-			c.JSON(401, gin.H{
-				"status":  401,
-				"message": "Unauthorized",
-			})
-			return
-		}
-		controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Error searching for user during login attempt")
-		c.JSON(500, gin.H{
-			"status":  500,
-			"message": "Internal Server Error",
-		})
-		return
-	}
-
 	isLocked, remaining := controller.auth.IsAccountLocked(req.Username)
 
 	if isLocked {
 		controller.log.App.Warn().Str("username", req.Username).Msg("Account is locked due to too many failed login attempts")
-		controller.log.AuditLoginFailure(req.Username, search.Type.String(), c.ClientIP(), "account locked")
+		controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "account locked")
 		c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
 		c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
 		c.JSON(429, gin.H{
@@ -107,10 +86,44 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}
 
+	search, err := controller.auth.SearchUser(req.Username)
+
+	if err != nil {
+		controller.constantTime(func() constantTimeRes {
+			if errors.Is(err, service.ErrUserNotFound) {
+				controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
+				controller.auth.RecordLoginAttempt(req.Username, false)
+				controller.log.AuditLoginFailure(req.Username, "unknown", c.ClientIP(), "user not found")
+				return constantTimeRes{
+					Code: 401,
+					Res: gin.H{
+						"status":  401,
+						"message": "Unauthorized",
+					},
+				}
+			}
+			controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Error searching for user during login attempt")
+			return constantTimeRes{
+				Code: 500,
+				Res: gin.H{
+					"status":  500,
+					"message": "Internal Server Error",
+				},
+			}
+		}, func(res constantTimeRes) {
+			c.JSON(res.Code, res.Res)
+		}, time.Millisecond*45)
+		return
+	}
+
 	if err := controller.auth.CheckUserPassword(*search, req.Password); err != nil {
 		controller.log.App.Warn().Str("username", req.Username).Msg("Invalid password during login attempt")
 		controller.auth.RecordLoginAttempt(req.Username, false)
-		controller.log.AuditLoginFailure(req.Username, search.Type.String(), c.ClientIP(), "invalid password")
+		if search.Type == model.UserLocal {
+			controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "invalid password")
+		} else {
+			controller.log.AuditLoginFailure(req.Username, "ldap", c.ClientIP(), "invalid password")
+		}
 		c.JSON(401, gin.H{
 			"status":  401,
 			"message": "Unauthorized",
@@ -211,7 +224,11 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 
 	controller.log.App.Info().Str("username", req.Username).Msg("Login successful")
 
-	controller.log.AuditLoginSuccess(req.Username, search.Type.String(), c.ClientIP())
+	if search.Type == model.UserLocal {
+		controller.log.AuditLoginSuccess(req.Username, "local", c.ClientIP())
+	} else {
+		controller.log.AuditLoginSuccess(req.Username, "ldap", c.ClientIP())
+	}
 
 	controller.auth.RecordLoginAttempt(req.Username, true)
 
@@ -458,3 +475,18 @@ func (controller *UserController) tailscaleHandler(c *gin.Context) {
 		"message": "Login successful",
 	})
 }
+
+type constantTimeRes struct {
+	Code int
+	Res  any
+}
+
+func (controller *UserController) constantTime(f func() constantTimeRes, rf func(res constantTimeRes), targetTime time.Duration) {
+	tStart := time.Now()
+	res := f()
+	tEnd := time.Now()
+	if tEnd.Sub(tStart) < targetTime {
+		time.Sleep(targetTime - tEnd.Sub(tStart))
+	}
+	rf(res)
+}

internal/controller/user_controller_test.go

@@ -542,8 +542,7 @@ func TestUserController(t *testing.T) {
 		Runtime: &runtime,
 		Ctx:     ctx,
 	})
-
-	authService, err := service.NewAuthService(service.AuthServiceInput{
+	authService := service.NewAuthService(service.AuthServiceInput{
 		Log:          log,
 		Config:       &cfg,
 		Runtime:      &runtime,
@@ -556,8 +555,6 @@ func TestUserController(t *testing.T) {
 		PolicyEngine: policyEngine,
 	})
 
-	require.NoError(t, err)
-
 	beforeEach := func() {
 		// Clear failed login attempts before each test
 		authService.ClearLoginAttempts()

internal/middleware/context_middleware.go

@@ -2,7 +2,6 @@ package middleware
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -245,9 +244,6 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.
 	search, err := m.auth.SearchUser(username)
 
 	if err != nil {
-		if errors.Is(err, service.ErrUserNotFound) {
-			m.auth.DummyPasswordCheck(password)
-		}
 		return nil, nil, fmt.Errorf("error searching for user: %w", err)
 	}
 

internal/middleware/context_middleware_test.go

@@ -264,8 +264,7 @@ func TestContextMiddleware(t *testing.T) {
 		Runtime: &runtime,
 		Ctx:     ctx,
 	})
-
-	authService, err := service.NewAuthService(service.AuthServiceInput{
+	authService := service.NewAuthService(service.AuthServiceInput{
 		Log:          log,
 		Config:       &cfg,
 		Runtime:      &runtime,
@@ -278,8 +277,6 @@ func TestContextMiddleware(t *testing.T) {
 		PolicyEngine: policyEngine,
 	})
 
-	require.NoError(t, err)
-
 	contextMiddleware := NewContextMiddleware(ContextMiddlewareInput{
 		Log:              log,
 		RuntimeConfig:    &runtime,

internal/model/config.go

@@ -49,6 +49,7 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
 			ACLs: ACLsConfig{
 				Policy: "allow",
 			},
+			LockdownEnabled: true,
 		},
 		UI: UIConfig{
 			Title:                 "Tinyauth",
@@ -150,6 +151,7 @@ type AuthConfig struct {
 	SessionMaxLifetime int                       `description:"Maximum session lifetime in seconds." yaml:"sessionMaxLifetime,omitempty"`
 	LoginTimeout       int                       `description:"Login timeout in seconds." yaml:"loginTimeout,omitempty"`
 	LoginMaxRetries    int                       `description:"Maximum login retries." yaml:"loginMaxRetries,omitempty"`
+	LockdownEnabled    bool                      `description:"Enable lockdown mode after maximum login retries. Lockdown mode limit is calculated automatically." yaml:"lockdownEnabled,omitempty"`
 	TrustedProxies     []string                  `description:"Comma-separated list of trusted proxy addresses." yaml:"trustedProxies,omitempty"`
 	ACLs               ACLsConfig                `description:"ACLs configuration." yaml:"acls,omitempty"`
 }

internal/model/runtime.go

@@ -1,18 +1,17 @@
 package model
 
 type RuntimeConfig struct {
-	AppURL                   string
-	UUID                     string
-	CookieDomain             string
-	SessionCookieName        string
-	CSRFCookieName           string
-	RedirectCookieName       string
-	OAuthSessionCookieName   string
-	LocalUsers               []LocalUser
-	OAuthProviders           map[string]OAuthServiceConfig
-	OAuthWhitelist           []string
-	ConfiguredProviders      []Provider
-	TrustedProxiesConfigured bool
+	AppURL                 string
+	UUID                   string
+	CookieDomain           string
+	SessionCookieName      string
+	CSRFCookieName         string
+	RedirectCookieName     string
+	OAuthSessionCookieName string
+	LocalUsers             []LocalUser
+	OAuthProviders         map[string]OAuthServiceConfig
+	OAuthWhitelist         []string
+	ConfiguredProviders    []Provider
 }
 
 type Provider struct {

internal/model/users.go

@@ -7,16 +7,6 @@ const (
 	UserLDAP
 )
 
-func (t UserSearchType) String() string {
-	switch t {
-	case UserLocal:
-		return "local"
-	case UserLDAP:
-		return "ldap"
-	}
-	return "unknown"
-}
-
 type LDAPUser struct {
 	DN     string
 	Groups []string

internal/service/access_controls_rules.go

@@ -1,7 +1,6 @@
 package service
 
 import (
-	"errors"
 	"regexp"
 	"strings"
 
@@ -44,10 +43,6 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 		rule.Log.App.Debug().Msg("User is an OAuth user, checking OAuth whitelist")
 		match, err := utils.CheckFilter(ctx.ACLs.OAuth.Whitelist, ctx.UserContext.OAuth.Email)
 		if err != nil {
-			if errors.Is(err, utils.ErrFilterEmpty) {
-				rule.Log.App.Debug().Msg("OAuth whitelist is empty, abstaining")
-				return EffectAbstain
-			}
 			rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.OAuth.Email).Msg("Invalid entry in OAuth whitelist")
 			return EffectDeny
 		}
@@ -77,7 +72,7 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 	match, err := utils.CheckFilter(ctx.ACLs.Users.Allow, ctx.UserContext.GetUsername())
 
 	if err != nil {
-		if errors.Is(err, utils.ErrFilterEmpty) {
+		if err == utils.ErrFilterEmpty {
 			return EffectAbstain
 		}
 		rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")
@@ -220,10 +215,6 @@ type IPAllowedRule struct {
 }
 
 func (rule *IPAllowedRule) Evaluate(ctx *ACLContext) Effect {
-	if !ctx.TrustedProxiesConfigured {
-		return EffectAllow // We can't block the proxy
-	}
-
 	// merge global and per-app block/allow lists
 	blockedIps := append([]string{}, rule.Config.Auth.IP.Block...)
 	allowedIPs := append([]string{}, rule.Config.Auth.IP.Allow...)
@@ -272,10 +263,6 @@ type IPBypassedRule struct {
 }
 
 func (rule *IPBypassedRule) Evaluate(ctx *ACLContext) Effect {
-	if !ctx.TrustedProxiesConfigured {
-		return EffectDeny
-	}
-
 	// merge global and per-app bypass lists
 	bypassList := append([]string{}, rule.Config.Auth.IP.Bypass...)
 	if ctx.ACLs != nil {

internal/service/access_controls_rules_test.go

@@ -44,21 +44,6 @@ func TestUserAllowedRule(t *testing.T) {
 			},
 			expected: EffectAbstain,
 		},
-		{
-			name: "abstains when filter is empty",
-			ctx: &ACLContext{
-				ACLs: &model.App{
-					OAuth: model.AppOAuth{Whitelist: ""},
-				},
-				UserContext: &model.UserContext{
-					Provider: model.ProviderOAuth,
-					OAuth: &model.OAuthContext{
-						BaseContext: model.BaseContext{Username: "alice"},
-					},
-				},
-			},
-			expected: EffectAbstain,
-		},
 		{
 			name: "allows OAuth user when email matches whitelist",
 			ctx: &ACLContext{
@@ -626,20 +611,11 @@ func TestIPAllowedRule(t *testing.T) {
 		ctx      *ACLContext
 		expected Effect
 	}{
-		{
-			name: "when trusted proxies are not configured, IP is allowed",
-			ctx: &ACLContext{
-				ACLs: &model.App{},
-				IP:   net.ParseIP("10.0.0.1"),
-			},
-			expected: EffectAllow,
-		},
 		{
 			name: "allows when ACLs are nil and no global lists configured",
 			ctx: &ACLContext{
-				ACLs:                     nil,
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				ACLs: nil,
+				IP:   net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectAllow,
 		},
@@ -649,8 +625,7 @@ func TestIPAllowedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Block: []string{"10.0.0.1"}},
 				},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -662,9 +637,8 @@ func TestIPAllowedRule(t *testing.T) {
 				},
 			},
 			ctx: &ACLContext{
-				ACLs:                     &model.App{},
-				IP:                       net.ParseIP("10.0.0.5"),
-				TrustedProxiesConfigured: true,
+				ACLs: &model.App{},
+				IP:   net.ParseIP("10.0.0.5"),
 			},
 			expected: EffectDeny,
 		},
@@ -674,8 +648,7 @@ func TestIPAllowedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
 				},
-				IP:                       net.ParseIP("192.168.1.10"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("192.168.1.10"),
 			},
 			expected: EffectAllow,
 		},
@@ -687,9 +660,8 @@ func TestIPAllowedRule(t *testing.T) {
 				},
 			},
 			ctx: &ACLContext{
-				ACLs:                     &model.App{},
-				IP:                       net.ParseIP("192.168.1.10"),
-				TrustedProxiesConfigured: true,
+				ACLs: &model.App{},
+				IP:   net.ParseIP("192.168.1.10"),
 			},
 			expected: EffectAllow,
 		},
@@ -699,17 +671,15 @@ func TestIPAllowedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Allow: []string{"192.168.1.0/24"}},
 				},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectDeny,
 		},
 		{
 			name: "allows when no block or allow lists are configured",
 			ctx: &ACLContext{
-				ACLs:                     &model.App{},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				ACLs: &model.App{},
+				IP:   net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectAllow,
 		},
@@ -722,8 +692,7 @@ func TestIPAllowedRule(t *testing.T) {
 						Allow: []string{"10.0.0.1"},
 					},
 				},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -736,8 +705,7 @@ func TestIPAllowedRule(t *testing.T) {
 						Allow: []string{"10.0.0.1"},
 					},
 				},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectAllow,
 		},
@@ -767,23 +735,12 @@ func TestIPBypassedRule(t *testing.T) {
 		ctx      *ACLContext
 		expected Effect
 	}{
-		{
-			name: "when trusted proxies are not configured, IP is not bypassed",
-			rule: defaultIPBR,
-			ctx: &ACLContext{
-				ACLs:                     &model.App{},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: false,
-			},
-			expected: EffectDeny,
-		},
 		{
 			name: "deny when ACLs are nil and no global bypass",
 			rule: defaultIPBR,
 			ctx: &ACLContext{
-				ACLs:                     nil,
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				ACLs: nil,
+				IP:   net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -791,9 +748,8 @@ func TestIPBypassedRule(t *testing.T) {
 			name: "allows when ACLs are nil but IP matches global bypass",
 			rule: globBypassIPBR,
 			ctx: &ACLContext{
-				ACLs:                     nil,
-				IP:                       net.ParseIP("10.0.0.5"),
-				TrustedProxiesConfigured: true,
+				ACLs: nil,
+				IP:   net.ParseIP("10.0.0.5"),
 			},
 			expected: EffectAllow,
 		},
@@ -801,9 +757,8 @@ func TestIPBypassedRule(t *testing.T) {
 			name: "denies when ACLs are nil and IP does not match global bypass",
 			rule: globBypassIPBR,
 			ctx: &ACLContext{
-				ACLs:                     nil,
-				IP:                       net.ParseIP("192.168.1.1"),
-				TrustedProxiesConfigured: true,
+				ACLs: nil,
+				IP:   net.ParseIP("192.168.1.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -814,8 +769,7 @@ func TestIPBypassedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
-				IP:                       net.ParseIP("10.0.0.5"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.5"),
 			},
 			expected: EffectAllow,
 		},
@@ -826,8 +780,7 @@ func TestIPBypassedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Bypass: []string{"172.16.0.0/24"}},
 				},
-				IP:                       net.ParseIP("10.0.0.5"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.5"),
 			},
 			expected: EffectAllow,
 		},
@@ -838,8 +791,7 @@ func TestIPBypassedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
-				IP:                       net.ParseIP("10.0.0.5"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.5"),
 			},
 			expected: EffectAllow,
 		},
@@ -850,8 +802,7 @@ func TestIPBypassedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Bypass: []string{"10.0.0.0/24"}},
 				},
-				IP:                       net.ParseIP("192.168.1.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("192.168.1.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -859,9 +810,8 @@ func TestIPBypassedRule(t *testing.T) {
 			name: "denies when bypass list is empty",
 			rule: defaultIPBR,
 			ctx: &ACLContext{
-				ACLs:                     &model.App{},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				ACLs: &model.App{},
+				IP:   net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectDeny,
 		},
@@ -872,8 +822,7 @@ func TestIPBypassedRule(t *testing.T) {
 				ACLs: &model.App{
 					IP: model.AppIP{Bypass: []string{"not-an-ip", "10.0.0.1"}},
 				},
-				IP:                       net.ParseIP("10.0.0.1"),
-				TrustedProxiesConfigured: true,
+				IP: net.ParseIP("10.0.0.1"),
 			},
 			expected: EffectAllow,
 		},

internal/service/auth_service.go

@@ -8,6 +8,7 @@ import (
 	"math/big"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/steveiliop56/ding"
@@ -68,13 +69,21 @@ type AuthService struct {
 	tailscale    *TailscaleService
 	policyEngine *PolicyEngine
 
-	dummyHash string
+	lockdown struct {
+		active     bool
+		until      time.Time
+		ctx        context.Context
+		cancelFunc context.CancelFunc
+		mu         sync.RWMutex
+	}
 
 	caches struct {
 		login *CacheStore[LoginAttempt]
 		oauth *CacheStore[OAuthPendingSession]
 		ldap  *CacheStore[[]string]
 	}
+
+	maxLoginLimits int
 }
 
 type AuthServiceInput struct {
@@ -92,7 +101,7 @@ type AuthServiceInput struct {
 	PolicyEngine *PolicyEngine
 }
 
-func NewAuthService(i AuthServiceInput) (*AuthService, error) {
+func NewAuthService(i AuthServiceInput) *AuthService {
 	service := &AuthService{
 		log:          i.Log,
 		runtime:      i.Runtime,
@@ -105,18 +114,18 @@ func NewAuthService(i AuthServiceInput) (*AuthService, error) {
 		policyEngine: i.PolicyEngine,
 	}
 
-	// dummy hash
-	dummyHash, err := bcrypt.GenerateFromPassword([]byte(utils.GenerateString(8)), bcrypt.DefaultCost)
+	// get the max login limits based on the number of users and the configured max retries
+	service.maxLoginLimits = service.calculateLockdownLimit()
 
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate dummy hash: %w", err)
+	loginCacheSize := 0
+
+	if !service.config.Auth.LockdownEnabled {
+		loginCacheSize = service.maxLoginLimits
 	}
 
-	service.dummyHash = string(dummyHash)
-
 	// caches setup
 	oauthCache := NewCacheStore[OAuthPendingSession](256)
-	loginCache := NewCacheStore[LoginAttempt](service.calculateLockdownLimit())
+	loginCache := NewCacheStore[LoginAttempt](loginCacheSize)
 	ldapCache := NewCacheStore[[]string](1024)
 
 	service.caches.oauth = oauthCache
@@ -139,28 +148,7 @@ func NewAuthService(i AuthServiceInput) (*AuthService, error) {
 		}
 	}, ding.RingMinor)
 
-	i.Ding.Go(func(ctx context.Context) {
-		ticker := time.NewTicker(15 * time.Minute)
-		defer ticker.Stop()
-
-		for {
-			select {
-			case <-ticker.C:
-				service.log.App.Debug().Msg("Updating login cache limits")
-				service.caches.login.SetMaxSize(service.calculateLockdownLimit())
-				service.log.App.Debug().Msg("Login cache limits updated")
-			case <-ctx.Done():
-				return
-			}
-		}
-
-	}, ding.RingMinor)
-
-	return service, nil
-}
-
-func (auth *AuthService) DummyPasswordCheck(password string) {
-	bcrypt.CompareHashAndPassword([]byte(auth.dummyHash), []byte(password))
+	return service
 }
 
 func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error) {
@@ -257,6 +245,10 @@ func (auth *AuthService) GetLDAPUser(userDN string) (*model.LDAPUser, error) {
 }
 
 func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
+	if locked, remaining := auth.IsInLockdown(); locked {
+		return true, remaining
+	}
+
 	if auth.config.Auth.LoginMaxRetries <= 0 || auth.config.Auth.LoginTimeout <= 0 {
 		return false, 0
 	}
@@ -279,6 +271,14 @@ func (auth *AuthService) RecordLoginAttempt(identifier string, success bool) {
 		return
 	}
 
+	if !success && auth.config.Auth.LockdownEnabled && auth.caches.login.Size() >= auth.maxLoginLimits {
+		if locked, _ := auth.IsInLockdown(); locked {
+			return
+		}
+		go auth.lockdownMode()
+		return
+	}
+
 	auth.caches.login.WithLock(func(actions CacheStoreActions[LoginAttempt]) {
 		entry, ok := actions.Get(identifier)
 
@@ -344,7 +344,7 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
 		return nil, fmt.Errorf("tailscale service not configured, cannot create session for tailscale user")
 	}
 
-	u, err := uuid.NewRandom()
+	uuid, err := uuid.NewRandom()
 
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate session uuid: %w", err)
@@ -361,7 +361,7 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
 	expiresAt := time.Now().Add(time.Duration(expiry) * time.Second)
 
 	session := repository.CreateSessionParams{
-		UUID:        u.String(),
+		UUID:        uuid.String(),
 		Username:    data.Username,
 		Email:       data.Email,
 		Name:        data.Name,
@@ -616,7 +616,62 @@ func (auth *AuthService) GetOAuthPendingSession(sessionId string) (*OAuthPending
 	return &session, nil
 }
 
-// ClearLoginAttempts is a testing function, not useful for anything else
+func (auth *AuthService) lockdownMode() {
+	auth.lockdown.mu.Lock()
+
+	if auth.lockdown.active {
+		auth.lockdown.mu.Unlock()
+		return
+	}
+
+	ctx, cancel := context.WithCancel(auth.ctx)
+
+	auth.log.App.Warn().Msg("Too many failed login attempts, entering lockdown mode")
+
+	auth.lockdown.active = true
+	auth.lockdown.ctx = ctx
+	auth.lockdown.cancelFunc = cancel
+
+	d := time.Duration(auth.config.Auth.LoginTimeout) * time.Second
+	auth.lockdown.until = time.Now().Add(d)
+	timer := time.NewTimer(d)
+
+	auth.lockdown.mu.Unlock()
+
+	defer cancel()
+	defer timer.Stop()
+
+	select {
+	case <-timer.C:
+		// Timer expired, end lockdown
+	case <-ctx.Done():
+		// Context cancelled, end lockdown
+	}
+
+	auth.lockdown.mu.Lock()
+
+	auth.log.App.Info().Msg("Exiting lockdown mode")
+
+	auth.caches.login.Clear()
+	auth.lockdown.active = false
+	auth.lockdown.until = time.Time{}
+	auth.lockdown.ctx = nil
+	auth.lockdown.cancelFunc = nil
+
+	auth.lockdown.mu.Unlock()
+}
+
+func (auth *AuthService) IsInLockdown() (bool, int) {
+	auth.lockdown.mu.RLock()
+	defer auth.lockdown.mu.RUnlock()
+	if auth.lockdown.active {
+		remaining := int(time.Until(auth.lockdown.until).Seconds())
+		return true, remaining
+	}
+	return false, 0
+}
+
+// mostly a testing function, not useful for anything else
 func (auth *AuthService) ClearLoginAttempts() {
 	auth.caches.login.Clear()
 }

internal/service/cache_store.go

@@ -195,19 +195,3 @@ func (cs *CacheStore[T]) Clear() {
 	cs.cache = make(map[string]cacheEntry[T])
 	cs.order = make([]string, 0)
 }
-
-func (cs *CacheStore[T]) SetMaxSize(maxSize int) {
-	cs.mu.Lock()
-	defer cs.mu.Unlock()
-	cs.maxSize = maxSize
-	for len(cs.cache) > maxSize {
-		if !cs.evictOne() {
-			break
-		}
-	}
-}
-func (cs *CacheStore[T]) GetMaxSize() int {
-	cs.mu.Lock()
-	defer cs.mu.Unlock()
-	return cs.maxSize
-}

internal/service/cache_store_test.go

@@ -316,21 +316,6 @@ func TestCacheStoreSizeAndClear(t *testing.T) {
 	assert.False(t, ok)
 }
 
-func TestCacheStoreWithMaxSize(t *testing.T) {
-	cs := NewCacheStore[string](0)
-	assert.Equal(t, 0, cs.Size())
-
-	for i := 0; i < 100; i++ {
-		cs.Set(strconv.Itoa(i), strconv.Itoa(i), 0)
-	}
-
-	assert.Equal(t, 100, cs.Size())
-
-	cs.SetMaxSize(10)
-
-	assert.Equal(t, 10, cs.Size())
-}
-
 func TestCacheStoreWithLock(t *testing.T) {
 	cs := NewCacheStore[int](0)
 	cs.Set("counter", 1, 0)

internal/service/policy_engine.go

@@ -29,11 +29,10 @@ type Rule interface {
 }
 
 type ACLContext struct {
-	ACLs                     *model.App
-	UserContext              *model.UserContext
-	IP                       net.IP
-	Path                     string
-	TrustedProxiesConfigured bool
+	ACLs        *model.App
+	UserContext *model.UserContext
+	IP          net.IP
+	Path        string
 }
 
 type PolicyEngine struct {

internal/test/test.go

@@ -163,10 +163,9 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
 				},
 			},
 		},
-		CookieDomain:             "example.com",
-		AppURL:                   "https://tinyauth.example.com",
-		SessionCookieName:        "tinyauth-session",
-		TrustedProxiesConfigured: true,
+		CookieDomain:      "example.com",
+		AppURL:            "https://tinyauth.example.com",
+		SessionCookieName: "tinyauth-session",
 	}
 
 	return config, runtime