chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.9 to 6.0.10. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](https://github.com/pnpm/action-setup/compare/v6.0.9...0977fd99725f1db4007ccb2928dbb4e90d06cc86) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-09-11 18:23:35 +08:00 · 2026-08-14 08:13:04 +00:00
59 changed files with 964 additions and 2357 deletions
@@ -171,14 +171,6 @@ TINYAUTH_OAUTH_PROVIDERS_name_USERINFOURL=
 TINYAUTH_OAUTH_PROVIDERS_name_INSECURE=false
 # Provider name in UI.
 TINYAUTH_OAUTH_PROVIDERS_name_NAME=
 # Username claim.
 TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_USERNAME=
 # Email claim.
 TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_EMAIL=
 # Name claim.
 TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_NAME=
 # Groups claim.
 TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_GROUPS=
 # oidc config
@@ -204,7 +196,7 @@ TINYAUTH_UI_TITLE="Tinyauth"
 # Message displayed on the forgot password page.
 TINYAUTH_UI_FORGOTPASSWORDMESSAGE="You can change your password by changing the configuration."
 # Path to the background image.
-TINYAUTH_UI_BACKGROUNDIMAGE="/background.webp"
+TINYAUTH_UI_BACKGROUNDIMAGE="/background.jpg"
 # Enable UI warnings.
 TINYAUTH_UI_WARNINGSENABLED=true
@@ -235,8 +227,6 @@ TINYAUTH_LDAP_GROUPCACHETTL=900
 # Enable the OAuth bridge, uses a new way to format OAuth user information.
 TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false
 # Disable the fallback to forward_auth modules when auth_request or ext_authz fail.
 TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false
 # tailscale config
@@ -1,9 +1,9 @@
 name: Run e2e tests
 on:
  workflow_dispatch:
-  # pull_request:
+  pull_request:
-  #   branches:
+    branches:
-  #     - main
+      - main
 jobs:
  test:
@@ -11,17 +11,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # ratchet:actions/checkout@v7
        with:
          persist-credentials: false
      - name: Setup pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # ratchet:pnpm/action-setup@v6
        with:
          package_json_file: ./e2e/package.json
      - name: Set up Docker
-        uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0
+        uses: docker/setup-docker-action@6d7cfa65f60a9dda7b46e5513fa982536f3c9877 # ratchet:docker/setup-docker-action@v5
      - name: Install dependencies
        run: pnpm ci
@@ -35,7 +35,7 @@ jobs:
        run: pnpm test
        working-directory: e2e
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # ratchet:actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
@@ -23,7 +23,7 @@ jobs:
          REPO: ${{ github.event.repository.name }}
      - name: Create release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          prerelease: true
          tag_name: nightly
@@ -174,7 +174,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -233,7 +233,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -292,7 +292,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -351,7 +351,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -406,7 +406,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Docker meta
        id: meta
@@ -445,7 +445,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Docker meta
        id: meta
@@ -476,7 +476,7 @@ jobs:
          merge-multiple: true
      - name: Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          files: binaries/*
          tag_name: nightly
@@ -146,7 +146,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -203,7 +203,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -260,7 +260,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -317,7 +317,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -373,7 +373,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Docker meta
        id: meta
@@ -414,7 +414,7 @@ jobs:
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
      - name: Docker meta
        id: meta
@@ -449,6 +449,6 @@ jobs:
          merge-multiple: true
      - name: Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          files: binaries/*
@@ -38,6 +38,6 @@ jobs:
          retention-days: 5
      - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          sarif_file: results.sarif
@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.8-alpine3.23 AS frontend-builder
+FROM node:26.7-alpine3.23 AS frontend-builder
 WORKDIR /frontend
@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.8-alpine3.23 AS frontend-builder
+FROM node:26.7-alpine3.23 AS frontend-builder
 WORKDIR /frontend
@@ -81,9 +81,11 @@ A huge thank you to [selfh.st](https://selfh.st) for their generous donation to
 - [JetBrains for Open-Source](https://jb.gg/OpenSource)
 - [CodeRabbit AI](https://www.coderabbit.ai)
 - [Dosu](https://dosu.dev/)
 - [InstaPods](https://instapods.com) - [Deploy Tinyauth from 3$/month](https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth)
 ## Acknowledgements
 - **Freepik** for providing the police hat and badge.
 - **Renee French** for the original gopher logo.
- [Siru Zhou](https://unsplash.com/@syrhu) for providing the background image of the app.
+- **Syrhu** for providing the background image of the app.
@@ -4,13 +4,9 @@ export default defineConfig({
  testDir: './specs',
  fullyParallel: true,
  forbidOnly: false,
-  retries: 3,
+  retries: 0,
  workers: 4,
  reporter: 'html',
  timeout: 60_000,
  expect: {
    timeout: 10_000,
  },
  use: {
    trace: 'on-first-retry',
    video: 'on',
@@ -12,49 +12,49 @@
  },
  "packageManager": "pnpm@11.1.2",
  "dependencies": {
-    "@hookform/resolvers": "^5.9.1",
+    "@hookform/resolvers": "^5.7.1",
    "@radix-ui/react-dropdown-menu": "^2.1.24",
    "@radix-ui/react-label": "^2.1.15",
    "@radix-ui/react-select": "^2.3.7",
    "@radix-ui/react-separator": "^1.1.15",
    "@radix-ui/react-slot": "^1.3.3",
    "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query": "^5.102.8",
+    "@tanstack/react-query": "^5.101.4",
-    "axios": "^1.20.0",
+    "axios": "^1.19.0",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
-    "i18next": "^26.4.2",
+    "i18next": "^26.3.6",
    "i18next-browser-languagedetector": "^8.2.1",
    "i18next-resources-to-backend": "^1.2.3",
-    "lucide-react": "^1.40.0",
+    "lucide-react": "^1.31.0",
    "next-themes": "^0.4.6",
    "radix-ui": "^1.6.7",
    "react": "^19.2.8",
    "react-dom": "^19.2.8",
-    "react-hook-form": "^7.87.0",
+    "react-hook-form": "^7.85.0",
-    "react-i18next": "^17.0.13",
+    "react-i18next": "^17.0.11",
    "react-markdown": "^10.1.0",
-    "react-router": "^8.3.1",
+    "react-router": "^8.3.0",
    "sonner": "^2.0.8",
    "tailwind-merge": "^3.5.0",
    "tailwindcss": "^4.3.3",
-    "zod": "^4.5.4"
+    "zod": "^4.3.6"
  },
  "devDependencies": {
    "@eslint/js": "^10.0.1",
-    "@tanstack/eslint-plugin-query": "^5.102.8",
+    "@tanstack/eslint-plugin-query": "^5.101.4",
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.2.0",
    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.7",
+    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.1.1",
+    "@vitejs/plugin-react": "^6.0.5",
-    "eslint": "^10.9.1",
+    "eslint": "^10.8.1",
    "eslint-plugin-react-hooks": "^7.0.1",
-    "eslint-plugin-react-refresh": "^0.5.6",
+    "eslint-plugin-react-refresh": "^0.5.3",
-    "globals": "^17.12.0",
+    "globals": "^17.9.0",
-    "rollup-plugin-visualizer": "^7.1.1",
+    "rollup-plugin-visualizer": "^7.0.1",
    "tw-animate-css": "^1.4.0",
    "typescript": "~6.0.2",
-    "typescript-eslint": "^8.69.0",
+    "typescript-eslint": "^8.66.0",
-    "vite": "^8.2.2"
+    "vite": "^8.2.1"
  }
 }
@@ -1,104 +1,104 @@
 {
-  "loginTitle": "Benvingut de nou, inicieu la sessió amb",
+  "loginTitle": "Welcome back, login with",
-  "loginTitleSimple": "Benvingut de nou, si us plau, inicieu sessió",
+  "loginTitleSimple": "Welcome back, please login",
-  "loginDivider": "O",
+  "loginDivider": "Or",
-  "loginUsername": "Nom d’usuari",
+  "loginUsername": "Username",
-  "loginPassword": "Contrasenya",
+  "loginPassword": "Password",
-  "loginSubmit": "Iniciar sessió",
+  "loginSubmit": "Login",
-  "loginFailTitle": "No s'ha pogut iniciar sessió",
+  "loginFailTitle": "Failed to log in",
-  "loginFailSubtitle": "Si us plau, comproveu el vostre nom d'usuari i contrasenya",
+  "loginFailSubtitle": "Please check your username and password",
-  "loginFailRateLimit": "Heu fallat en iniciar sessió massa vegades. Si us plau, proveu-ho més tard",
+  "loginFailRateLimit": "You failed to login too many times. Please try again later",
-  "loginSuccessTitle": "Heu iniciat sessió",
+  "loginSuccessTitle": "Logged in",
-  "loginSuccessSubtitle": "Benvingut de nou!",
+  "loginSuccessSubtitle": "Welcome back!",
-  "loginOauthFailTitle": "S'ha produït un error",
+  "loginOauthFailTitle": "An error occurred",
-  "loginOauthFailSubtitle": "Errada en obtenir l'URL OAuth",
+  "loginOauthFailSubtitle": "Failed to get OAuth URL",
-  "loginOauthSuccessTitle": "Redirigint",
+  "loginOauthSuccessTitle": "Redirecting",
-  "loginOauthSuccessSubtitle": "Redirigint al vostre proveïdor OAuth",
+  "loginOauthSuccessSubtitle": "Redirecting to your OAuth provider",
-  "loginOauthAutoRedirectTitle": "Autoredirecció OAuth",
+  "loginOauthAutoRedirectTitle": "OAuth Auto Redirect",
-  "loginOauthAutoRedirectSubtitle": "Sereu automàticament redirigits al vostre proveïdor OAuth per a autenticar-vos.",
+  "loginOauthAutoRedirectSubtitle": "You will be automatically redirected to your OAuth provider to authenticate.",
-  "loginOauthAutoRedirectButton": "Redirigeix ara",
+  "loginOauthAutoRedirectButton": "Redirect now",
-  "continueTitle": "Continuar",
+  "continueTitle": "Continue",
-  "continueRedirectingTitle": "S'està redirigint...",
+  "continueRedirectingTitle": "Redirecting...",
-  "continueRedirectingSubtitle": "Hauríeu de ser redirigits aviat a l'app",
+  "continueRedirectingSubtitle": "You should be redirected to the app soon",
-  "continueRedirectManually": "Redirigiu-me manualment",
+  "continueRedirectManually": "Redirect me manually",
-  "continueInsecureRedirectTitle": "Redirecció no segura",
+  "continueInsecureRedirectTitle": "Insecure redirect",
-  "continueInsecureRedirectSubtitle": "Esteu intentant redirigir des de <code>https</code>a<code>http</code> que no és segur. Esteu segurs de voler continuar?",
+  "continueInsecureRedirectSubtitle": "You are trying to redirect from <code>https</code> to <code>http</code> which is not secure. Are you sure you want to continue?",
-  "continueUntrustedRedirectTitle": "Redirecció no confiable",
+  "continueUntrustedRedirectTitle": "Untrusted redirect",
-  "continueUntrustedRedirectSubtitle": "Esteu intentant redirigir a un domini que no coincideix amb el vostre domini (<code>{{cookieDomain}}</code>). Esteu segurs de voler continuar?",
+  "continueUntrustedRedirectSubtitle": "You are trying to redirect to a domain that does not match your configured domain (<code>{{cookieDomain}}</code>). Are you sure you want to continue?",
-  "logoutFailTitle": "Errada en tancar la sessió",
+  "logoutFailTitle": "Failed to log out",
-  "logoutFailSubtitle": "Si us plau, torneu-ho a provar",
+  "logoutFailSubtitle": "Please try again",
-  "logoutSuccessTitle": "Sessió tancada",
+  "logoutSuccessTitle": "Logged out",
-  "logoutSuccessSubtitle": "S'ha tancat la sessió",
+  "logoutSuccessSubtitle": "You have been logged out",
-  "logoutTitle": "Tanca la sessió",
+  "logoutTitle": "Logout",
-  "logoutUsernameSubtitle": "Heu iniciat sessió com a <code>{{username}}</code>. Cliqueu el botó de sota per a tancar la sessió.",
+  "logoutUsernameSubtitle": "You are currently logged in as <code>{{username}}</code>. Click the button below to logout.",
-  "logoutOauthSubtitle": "Heu iniciat la sessió actualment com a <code>{{username}}</code> fent servir {{provider}} com a proveïdor OAuth. Cliqueu el botó de sota per a tancar la sessió.",
+  "logoutOauthSubtitle": "You are currently logged in as <code>{{username}}</code> using the {{provider}} OAuth provider. Click the button below to logout.",
-  "notFoundTitle": "Pàgina no trobada",
+  "notFoundTitle": "Page not found",
-  "notFoundSubtitle": "La pàgina que cerques no existeix.",
+  "notFoundSubtitle": "The page you are looking for does not exist.",
-  "notFoundButton": "Torna a l'inici",
+  "notFoundButton": "Go home",
-  "totpFailTitle": "Errada en verificar el codi",
+  "totpFailTitle": "Failed to verify code",
-  "totpFailSubtitle": "Si us plau, comprova el codi i torna-ho a provar",
+  "totpFailSubtitle": "Please check your code and try again",
-  "totpSuccessTitle": "Verificat",
+  "totpSuccessTitle": "Verified",
-  "totpSuccessSubtitle": "Redirigint a la teva app",
+  "totpSuccessSubtitle": "Redirecting to your app",
-  "totpTitle": "Introdueixi el codi TOTP",
+  "totpTitle": "Enter your TOTP code",
-  "totpSubtitle": "Si us plau, introdueix el codi de la teva aplicació d'autenticació.",
+  "totpSubtitle": "Please enter the code from your authenticator app.",
-  "unauthorizedTitle": "No autoritzat",
+  "unauthorizedTitle": "Unauthorized",
-  "unauthorizedResourceSubtitle": "L'usuari amb el nom <code>{{username}}</code> no està autoritzat a accedir al recurs <code>{{resource}}</code>.",
+  "unauthorizedResourceSubtitle": "The user with username <code>{{username}}</code> is not authorized to access the resource <code>{{resource}}</code>.",
-  "unauthorizedLoginSubtitle": "L'usuari amb el nom <code>{{username}}</code> no està autoritzat a iniciar la sessió.",
+  "unauthorizedLoginSubtitle": "The user with username <code>{{username}}</code> is not authorized to login.",
-  "unauthorizedGroupsSubtitle": "L'usuari amb el nom <code>{{username}}</code> no està als grups requerits per al recurs <code>{{resource}}</code>.",
+  "unauthorizedGroupsSubtitle": "The user with username <code>{{username}}</code> is not in the groups required by the resource <code>{{resource}}</code>.",
-  "unauthorizedIpSubtitle": "La vostra adreça IP <code>{{ip}}</code> no està autoritzada a accedir al recurs <code>{{resource}}</code>.",
+  "unauthorizedIpSubtitle": "Your IP address <code>{{ip}}</code> is not authorized to access the resource <code>{{resource}}</code>.",
-  "unauthorizedButton": "Tornar-ho a provar",
+  "unauthorizedButton": "Try again",
-  "cancelTitle": "Cancel·lar",
+  "cancelTitle": "Cancel",
-  "forgotPasswordTitle": "Heu oblidat la vostra contrasenya?",
+  "forgotPasswordTitle": "Forgot your password?",
-  "failedToFetchProvidersTitle": "Errada en carregar els proveïdors d'autenticació. Si us plau, verifiqueu la vostra configuració.",
+  "failedToFetchProvidersTitle": "Failed to load authentication providers. Please check your configuration.",
-  "errorTitle": "S'ha produït un error",
+  "errorTitle": "An error occurred",
-  "errorSubtitleInfo": "Ha ocorregut l'error següent mentre es processava la vostra petició:",
+  "errorSubtitleInfo": "The following error occurred while processing your request:",
  "errorSubtitle": "An error occurred while trying to perform this action. Please check the console for more information.",
-  "forgotPasswordMessage": "Podeu reiniciar la vostra contrasenya canviant la variable d'entorn `USERS`.",
+  "forgotPasswordMessage": "You can reset your password by changing the `USERS` environment variable.",
-  "fieldRequired": "Aquest camp és obligatori",
+  "fieldRequired": "This field is required",
-  "invalidInput": "Entrada no vàlida",
+  "invalidInput": "Invalid input",
-  "domainWarningTitle": "Domini invàlid",
+  "domainWarningTitle": "Invalid Domain",
-  "domainWarningSubtitle": "Esteu visitant aquesta instància des d'un domini incorrecte. Si procediu, podríeu trobar-os amb problemes d'autenticació.",
+  "domainWarningSubtitle": "You are accessing this instance from an incorrect domain. If you proceed, you may encounter issues with authentication.",
-  "domainWarningCurrent": "Actual:",
+  "domainWarningCurrent": "Current:",
-  "domainWarningExpected": "Esperat:",
+  "domainWarningExpected": "Expected:",
-  "ignoreTitle": "Ignorar",
+  "ignoreTitle": "Ignore",
-  "goToCorrectDomainTitle": "Anar al domini correcte",
+  "goToCorrectDomainTitle": "Go to correct domain",
-  "authorizeTitle": "Autoritzar",
+  "authorizeTitle": "Authorize",
-  "authorizeCardTitle": "Continuar a {{app}}?",
+  "authorizeCardTitle": "Continue to {{app}}?",
-  "authorizeSubtitle": "Voldríeu continuar a aquesta app? Si us plau, reviseu amb cura els permisos sol·licitats per a l'app.",
+  "authorizeSubtitle": "Would you like to continue to this app? Please carefully review the permissions requested by the app.",
-  "authorizeSubtitleOAuth": "Voldríeu continuar a aquesta app?",
+  "authorizeSubtitleOAuth": "Would you like to continue to this app?",
-  "authorizeLoadingTitle": "S'està carregant...",
+  "authorizeLoadingTitle": "Loading...",
-  "authorizeLoadingSubtitle": "Si us plau, espereu mentre carreguem la informació del client.",
+  "authorizeLoadingSubtitle": "Please wait while we load the client information.",
-  "authorizeSuccessTitle": "Autoritzat",
+  "authorizeSuccessTitle": "Authorized",
-  "authorizeSuccessSubtitle": "Sereu redirigits a l'app en pocs segons.",
+  "authorizeSuccessSubtitle": "You will be redirected to the app in a few seconds.",
-  "authorizeErrorClientInfo": "Ha ocorregut un error mentre es carregava la informació del client. Si us plau, proveu-ho més tard.",
+  "authorizeErrorClientInfo": "An error occurred while loading the client information. Please try again later.",
-  "authorizeErrorInvalidParams": "La petició manca dels paràmetres requerits o té paràmetres invàlids. Si us plau, comproveu l'URL i torneu-ho a provar.",
+  "authorizeErrorInvalidParams": "The request is missing required parameters or has invalid parameters. Please check the URL and try again.",
  "openidScopeName": "OpenID Connect",
-  "openidScopeDescription": "Permet a l'app l'accés a la vostra informació OpenID Connect.",
+  "openidScopeDescription": "Allows the app to access your OpenID Connect information.",
-  "emailScopeName": "Correu electrònic",
+  "emailScopeName": "Email",
-  "emailScopeDescription": "Permet a l'app l'accés a la vostra adreça de correu electrònic.",
+  "emailScopeDescription": "Allows the app to access your email address.",
-  "profileScopeName": "Perfil",
+  "profileScopeName": "Profile",
-  "profileScopeDescription": "Permet a l'app l'accés a la vostra informació de perfil.",
+  "profileScopeDescription": "Allows the app to access your profile information.",
-  "groupsScopeName": "Grups",
+  "groupsScopeName": "Groups",
-  "groupsScopeDescription": "Permet a l'app l'accés la vostra informació de grup.",
+  "groupsScopeDescription": "Allows the app to access your group information.",
-  "backToLoginButton": "Tornar a l'inici de sessió",
+  "backToLoginButton": "Back to login",
-  "phoneScopeName": "Telèfon",
+  "phoneScopeName": "Phone",
-  "phoneScopeDescription": "Permet a l'app l'accés al vostre número de telèfon.",
+  "phoneScopeDescription": "Allows the app to access your phone number.",
-  "addressScopeName": "Adreça",
+  "addressScopeName": "Address",
-  "addressScopeDescription": "Permet a l'app l'accés a la vostra adreça.",
+  "addressScopeDescription": "Allows the app to access your address.",
-  "loginTailscaleTitle": "Continuar amb Tailscale",
+  "loginTailscaleTitle": "Continue with Tailscale",
-  "loginTailscaleDescription": "Sembla que esteu accedint a Tinyauth des d'un dispositiu Tailscale autoritzat. Voldríeu continuar amb la vostra connexió Tailscale?",
+  "loginTailscaleDescription": "You appear to be accessing Tinyauth from an authorized Tailscale device. Would you like to continue with your Tailscale connection?",
-  "loginTailscaleDeviceName": "Nom del dispositiu:",
+  "loginTailscaleDeviceName": "Device name:",
-  "loginTailscaleOtherMethod": "Iniciar la sessió amb un altre mètode",
+  "loginTailscaleOtherMethod": "Login with another method",
-  "loginTailscaleSuccess": "Autenticat correctament amb Tailscale.",
+  "loginTailscaleSuccess": "Successfully authenticated with Tailscale.",
-  "loginTailscaleFail": "Errada en autentificar amb Tailscale. Si us plau, intenteu-ho una altra vegada o feu servir un altre mètode d'autenticació.",
+  "loginTailscaleFail": "Failed to authenticate with Tailscale. Please try again or use another login method.",
-  "logoutTailscaleSubtitle": "Heu iniciat sessió actualment amb Tailscale en el vostre dispositiu <code>{{deviceName}}</code>. Cliqueu el botó de sota per a tancar la sessió.",
+  "logoutTailscaleSubtitle": "You are currently logged in with Tailscale on your device <code>{{deviceName}}</code>. Click the button below to logout.",
-  "quickActionsLanguage": "Idioma",
+  "quickActionsLanguage": "Language",
-  "quickActionsTheme": "Tema",
+  "quickActionsTheme": "Theme",
-  "quickActionsThemeLight": "Clar",
+  "quickActionsThemeLight": "Light",
-  "quickActionsThemeDark": "Fosc",
+  "quickActionsThemeDark": "Dark",
-  "quickActionsThemeSystem": "Sistema",
+  "quickActionsThemeSystem": "System",
-  "quickActionsLogout": "Sortir de la sessió",
+  "quickActionsLogout": "Logout",
-  "quickActionsTitle": "Accions ràpides",
+  "quickActionsTitle": "Quick Actions",
  "quickActionsProviderLocal": "Local",
  "quickActionsProviderLDAP": "LDAP",
  "quickActionsProviderOAuth": "{{provider}} OAuth"
@@ -1,5 +1,5 @@
 import { useUserContext } from "@/context/user-context";
-import {useMutation} from "@tanstack/react-query";
+import { useMutation } from "@tanstack/react-query";
 import { Navigate, useNavigate } from "react-router";
 import { useLocation } from "react-router";
 import {
@@ -25,8 +25,7 @@ import {
  searchParamsFromObject,
  useScreenParams,
 } from "@/lib/hooks/screen-params";
-import {useEffect, useState} from "react";
+import { useEffect } from "react";
 import { z } from "zod";
 type Scope = {
  id: string;
@@ -35,10 +34,6 @@ type Scope = {
  icon: React.ReactNode;
 };
 const skipConsentResponseSchema = z.object({
  skipConsent: z.boolean(),
 })
 const scopeMapIconProps = {
  className: "stroke-muted-foreground stroke-[1.75] h-4",
 };
@@ -101,8 +96,14 @@ export const AuthorizePage = () => {
    }
    return "";
  })();
-  const [autoAuthorize, setAutoAuthorize] = useState(false);
+
-  const [skipConsentChecked, setSkipConsentChecked] = useState(false);
+  // TODO: maybe a better way to do this
  const shouldAutoAuthorize =
    auth.authenticated &&
    isOidc &&
    screenParams.oidc_ticket !== undefined &&
    screenParams.oidc_scope !== undefined &&
    screenParams.oidc_prompt === "none";
  const { mutate: authorizeMutate, isPending: authorizePending } = useMutation({
    mutationFn: () => {
@@ -125,34 +126,10 @@ export const AuthorizePage = () => {
  });
  useEffect(() => {
-    let active = true;
+    if (shouldAutoAuthorize) {
-    const controller = new AbortController();
+      authorizeMutate();
-
+    }
-    const checkSkipConsent = async () => {
+  }, [shouldAutoAuthorize, authorizeMutate]);
      try {
        const res = await fetch(
          `/api/oidc/skip-consent?oidc_ticket=${encodeURIComponent( screenParams.oidc_ticket ?? "")}`,
          { signal: controller.signal },
        );
        if (!res.ok) return;
        const parsed = skipConsentResponseSchema.safeParse(await res.json());
        if (!active || !parsed.success || !parsed.data.skipConsent) return;
        setAutoAuthorize(true);
        authorizeMutate();
      } catch {
        // Fall back to manual consent on any failure (including abort).
      } finally {
        if (active) setSkipConsentChecked(true);
      }
    };
    checkSkipConsent();
    return () => {
      active = false;
      controller.abort();
    };
  }, [authorizeMutate,  screenParams.oidc_ticket]);
  if (!isOidc || !screenParams.oidc_ticket || !screenParams.oidc_scope) {
    return (
@@ -213,13 +190,14 @@ export const AuthorizePage = () => {
      <CardFooter className="flex flex-col items-stretch gap-3">
        <Button
          onClick={() => authorizeMutate()}
-          loading={authorizePending || autoAuthorize || !skipConsentChecked}
+          loading={authorizePending}
          disabled={shouldAutoAuthorize}
        >
          {t("authorizeTitle")}
        </Button>
        <Button
          onClick={() => navigate(`/logout${compiledParams}`)}
-          disabled={authorizePending || autoAuthorize}
+          disabled={authorizePending || shouldAutoAuthorize}
          variant="outline"
        >
          {t("cancelTitle")}
@@ -9,7 +9,7 @@ export default defineConfig({
  plugins: [react(), tailwindcss(), visualizer()],
  resolve: {
    alias: {
-      "@": path.resolve(import.meta.dirname, "./src"),
+      "@": path.resolve(__dirname, "./src"),
    },
  },
  build: {
@@ -4,11 +4,11 @@ go 1.26.4
 require (
 	charm.land/huh/v2 v2.0.3
-	charm.land/lipgloss/v2 v2.0.6
+	charm.land/lipgloss/v2 v2.0.5
 	github.com/cenkalti/backoff/v5 v5.0.3
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/gin-gonic/gin v1.12.0
-	github.com/go-jose/go-jose/v4 v4.1.5
+	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golang-migrate/migrate/v4 v4.19.1
@@ -19,18 +19,18 @@ require (
 	github.com/pquerna/otp v1.5.0
 	github.com/rs/zerolog v1.35.1
 	github.com/steveiliop56/ding v0.2.0
-	github.com/stretchr/testify v1.12.1
+	github.com/stretchr/testify v1.11.1
 	github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298
 	github.com/weppos/publicsuffix-go v0.50.3
 	go.uber.org/dig v1.19.0
-	golang.org/x/crypto v0.56.0
+	golang.org/x/crypto v0.54.0
-	golang.org/x/net v0.58.0
+	golang.org/x/net v0.57.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/tools v0.49.0
+	golang.org/x/tools v0.48.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.37.0
+	k8s.io/apimachinery v0.36.3
-	k8s.io/client-go v0.37.0
+	k8s.io/client-go v0.36.3
-	modernc.org/sqlite v1.58.0
+	modernc.org/sqlite v1.56.0
 )
 require (
@@ -51,8 +51,8 @@ require (
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
-	github.com/charmbracelet/x/ansi v0.11.8 // indirect
+	github.com/charmbracelet/x/ansi v0.11.7 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
@@ -70,12 +70,13 @@ require (
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonreference v0.20.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
@@ -89,10 +90,10 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.24 // indirect
+	github.com/mattn/go-runewidth v0.0.23 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
@@ -109,6 +110,7 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -116,6 +118,7 @@ require (
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -129,28 +132,27 @@ require (
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/arch v0.22.0 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
-	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
-	modernc.org/libc v1.75.6 // indirect
+	modernc.org/libc v1.74.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.12.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
@@ -4,8 +4,8 @@ charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
 charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
 charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
 charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
-charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.5 h1:kbNxgeeUOYv5J0YdpxFjfvf3dFvqH8Aci4zB6xqFtrY=
-charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
+charm.land/lipgloss/v2 v2.0.5/go.mod h1:9oqhxt4yxIMe6q5A4kHr44DremZk7J9UNh74GlWa5nc=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -47,10 +47,10 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
-github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
-github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
+github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
 github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4jxsAuEs=
 github.com/charmbracelet/x/conpty v0.1.1/go.mod h1:OmtR77VODEFbiTzGE9G1XiRJAga6011PIm4u5fTNZpk=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 h1:JSt3B+U9iqk37QUU2Rvb6DSBYRLtWqFqfxf8l5hOZUA=
@@ -105,8 +105,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
 github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
@@ -115,8 +115,8 @@ github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
 github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
 github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
 github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -124,34 +124,12 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
-github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
-github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v0.20.4 h1:bKlDxQxQJgwpUSgOENiMPzCTBVuc7vTdXSSgNeAhojU=
-github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/jsonreference v0.20.4/go.mod h1:5pZJyJP2MnYCpoeoMAql78cCHauHj0V9Lhc506VOpw4=
-github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
-github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
 github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
 github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
 github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
 github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
 github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
 github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
 github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
 github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
 github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
 github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
 github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
 github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
 github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
 github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
 github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
 github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
 github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
 github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
 github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
 github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
 github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -210,6 +188,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
@@ -222,14 +202,16 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
-github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mdp/qrterminal/v3 v3.2.1 h1:6+yQjiiOsSuXT5n9/m60E54vdgFsw0zhADHhHLrFet4=
@@ -300,17 +282,16 @@ github.com/steveiliop56/ding v0.2.0/go.mod h1:bE2u2XH7CjhPzbb/0Ems+D8YZlf2Ae+eKh
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298 h1:EYSb5jv8ZL/0/NVFZtY7Ejplk0QG5+3lrdL3mSrjFZQ=
 github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298/go.mod h1:TlUDoCF66hMqFZqoBym9bUdJ0bKAWYMir6hLJeYN5z0=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
@@ -349,20 +330,20 @@ go.uber.org/dig v1.19.0 h1:BACLhebsYdpQ7IROQ1AGPjrXcP5dF80U3gKoFzbaq/4=
 go.uber.org/dig v1.19.0/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
 golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
-golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
@@ -371,12 +352,12 @@ golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
@@ -398,42 +379,42 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.37.0 h1:Z//Vj9N7RA/yS2sDmxyeo7h+RR4zbUrd2vrd3Z0TbB4=
+k8s.io/api v0.36.3 h1:NxB+05W2UGqXWFXcLO0RB5cnqnUPP5v5sVlaOH0Iz4w=
-k8s.io/api v0.37.0/go.mod h1:LKXgcJWMc+f4OLbP5SFR8rulEg07zZhpi/zMULiBImk=
+k8s.io/api v0.36.3/go.mod h1:JzLQKqRHC5+I8RVj/lS3lCg0mg6nWI9Fo/Sk3ElxHzg=
-k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
-k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
-k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
+k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
-k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
+k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
-modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
-modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
+modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
-modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.75.6 h1:yKk8qo+Di4gkmvRboK8ocCqH22FiUCR6jRy2OwtCRus=
+modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
-modernc.org/libc v1.75.6/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
+modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
+modernc.org/sqlite v1.56.0 h1:/D8e2RfFqoy/Zc6PuC76U28zFwmI/sYx1Kjm4yEn9e0=
-modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
+modernc.org/sqlite v1.56.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -444,7 +425,7 @@ sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5E
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3 h1:u08YRbVUi59ri4YD6cg0UqNM4Dimn0sIl+wldcx5PYw=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
@@ -1 +0,0 @@
 DROP TABLE IF EXISTS "oidc_consents";
@@ -1,7 +0,0 @@
 CREATE TABLE IF NOT EXISTS "oidc_consents" (
    "username" TEXT NOT NULL,
    "client_id" TEXT NOT NULL,
    "scope" TEXT NOT NULL,
    "created_at" BIGINT NOT NULL,
    PRIMARY KEY ("username", "client_id")
 );
@@ -1 +0,0 @@
 DROP TABLE IF EXISTS "oidc_consents";
@@ -1,7 +0,0 @@
 CREATE TABLE IF NOT EXISTS "oidc_consents" (
    "username" TEXT NOT NULL,
    "client_id" TEXT NOT NULL,
    "scope" TEXT NOT NULL,
    "created_at" INTEGER NOT NULL,
    PRIMARY KEY ("username", "client_id")
 );
@@ -179,6 +179,8 @@ func (app *BootstrapApp) Setup() error {
 	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
 	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
 	app.runtime.CSRFCookieName = fmt.Sprintf("%s-%s", model.CSRFCookieName, cookieId)
 	app.runtime.RedirectCookieName = fmt.Sprintf("%s-%s", model.RedirectCookieName, cookieId)
 	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
 	// database
@@ -18,8 +18,3 @@ type RedirectQuery struct {
 	RedirectURI string           `url:"redirect_uri"`
 	LoginFor    FrontendLoginFor `url:"login_for"`
 }
 type SimpleResponse struct {
 	Status  int    `json:"status"`
 	Message string `json:"message"`
 }
@@ -294,9 +294,7 @@ func (controller *OAuthController) getCookieDomain() string {
 func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
 	v := validators.NewDomainValidator(validators.DomainValidatorOptions{
-		WithPort:       true,
+		WithPort: true,
 		WithScheme:     true,
 		AllowedSchemes: []string{"https", "http"},
 	})
 	_, err := v.SafeHostname(controller.runtime.AppURL)
@@ -1,8 +1,6 @@
 package controller
 import (
 	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -64,19 +62,15 @@ type ErrorScreen struct {
 	Error string `url:"error"`
 }
 type ClientRequest struct {
 	ClientID string `uri:"id" binding:"required"`
 }
 type ClientCredentials struct {
 	ClientID     string
 	ClientSecret string
 }
 type SkipConsentRequest struct {
 	OIDCTicket string `form:"oidc_ticket" binding:"required"`
 }
 type SkipConsentResponse struct {
 	SkipConsent bool `json:"skipConsent"`
 }
 type AuthorizeScreenParams struct {
 	LoginFor   FrontendLoginFor   `url:"login_for"`
 	OIDCTicket string             `url:"oidc_ticket"`
@@ -111,7 +105,6 @@ func NewOIDCController(i OIDCControllerInput) *OIDCController {
 	oidcGroup := i.RouterGroup.Group("/oidc")
 	oidcGroup.POST("/authorize-complete", controller.authorizeComplete)
 	oidcGroup.GET("/skip-consent", controller.skipConsent)
 	oidcGroup.POST("/token", controller.Token)
 	oidcGroup.GET("/userinfo", controller.Userinfo)
 	oidcGroup.POST("/userinfo", controller.Userinfo)
@@ -267,90 +260,6 @@ func (controller *OIDCController) authorize(c *gin.Context) {
 	c.Redirect(http.StatusFound, redirectUrl)
 }
 func (controller *OIDCController) skipConsent(c *gin.Context) {
 	c.Header("cache-control", "no-store")
 	c.Header("pragma", "no-cache")
 	if controller.oidc == nil {
 		c.JSON(500, SimpleResponse{
 			Status:  500,
 			Message: "OIDC not configured",
 		})
 		return
 	}
 	userContext, err := new(model.UserContext).NewFromGin(c)
 	if err != nil {
 		if !errors.Is(err, model.ErrUserContextNotFound) {
 			controller.log.App.Warn().Err(err).Msg("Failed to get user context")
 		}
 	}
 	if err != nil || !userContext.Authenticated {
 		c.JSON(401, SimpleResponse{
 			Status:  401,
 			Message: "User not logged in",
 		})
 		return
 	}
 	var req SkipConsentRequest
 	err = c.BindQuery(&req)
 	if err != nil {
 		c.JSON(400, SimpleResponse{
 			Status:  400,
 			Message: "Bad request",
 		})
 		return
 	}
 	controller.log.App.Debug().Interface("req", req).Msg("Received skip consent request")
 	authorizeReq, ok := controller.oidc.GetAuthorizeRequestByTicket(req.OIDCTicket)
 	if !ok {
 		c.JSON(200, SkipConsentResponse{
 			SkipConsent: false,
 		})
 		return
 	}
 	controller.log.App.Debug().Str("client", authorizeReq.ClientID).Str("user", userContext.GetUsername()).Msg("User consented to OIDC")
 	if authorizeReq.Prompt == service.OIDCPromptLogin.String() {
 		c.JSON(200, SkipConsentResponse{
 			SkipConsent: false,
 		})
 		return
 	}
 	consent, err := controller.oidc.GetOIDCConsent(c, userContext.GetUsername(), authorizeReq.ClientID)
 	if err != nil || consent == nil {
 		if err != nil {
 			controller.log.App.Warn().Err(err).Msg("Failed to get OIDC consent")
 		}
 		c.JSON(200, SkipConsentResponse{
 			SkipConsent: false,
 		})
 		return
 	}
 	if !scopesGranted(consent.Scope, authorizeReq.Scope) {
 		c.JSON(200, SkipConsentResponse{
 			SkipConsent: false,
 		})
 		return
 	}
 	c.JSON(200, SkipConsentResponse{
 		SkipConsent: true,
 	})
 }
 // The actual **internal** endpoint that actually creates the code and session.
 // It is called by the frontend after the user has logged in and given consent.
 func (controller *OIDCController) authorizeComplete(c *gin.Context) {
@@ -414,19 +323,6 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 	// We no longer need the ticket
 	controller.oidc.DeleteAuthorizeRequestTicket(req.Ticket)
 	// Get the client
 	client, ok := controller.oidc.GetClient(authorizeReq.ClientID)
 	if !ok {
 		controller.authorizeError(c, authorizeErrorParams{
 			err:          errors.New("client not found"),
 			reason:       "Client not found",
 			reasonPublic: "The client is not configured",
 			json:         true,
 		})
 		return
 	}
 	// Create the sub to find and delete old sessions
 	sub := controller.oidc.CreateSub(*userContext, authorizeReq.ClientID)
@@ -460,11 +356,6 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 	// Store the consent granted by the user for this client
 	if _, err := controller.oidc.UpsertOIDCConsent(c, userContext.GetUsername(), authorizeReq.Scope, client.ClientID); err != nil {
 		controller.log.App.Warn().Err(err).Msg("Failed to store OIDC consent")
 	}
 	q := cu.Query()
 	q.Set("code", code)
@@ -547,9 +438,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		return
 	}
-	clientSecretHash := sha256.Sum256([]byte(client.ClientSecret))
+	if client.ClientSecret != creds.ClientSecret {
 	providedSecretHash := sha256.Sum256([]byte(creds.ClientSecret))
 	if subtle.ConstantTimeCompare(clientSecretHash[:], providedSecretHash[:]) != 1 {
 		controller.log.App.Warn().Str("clientId", creds.ClientID).Msg("Invalid client secret")
 		c.JSON(400, gin.H{
 			"error": "invalid_client",
@@ -867,20 +756,3 @@ func (controller *OIDCController) resolveNormalParams(c *gin.Context) (*service.
 	return &req, nil
 }
 // scopesGranted reports whether every scope in requested is present in the
 // space-separated granted scope string.
 func scopesGranted(granted, requested string) bool {
 	grantedScopes := strings.Split(granted, " ")
 	for _, scope := range strings.Split(requested, " ") {
 		if scope == "" {
 			continue
 		}
 		if !slices.Contains(grantedScopes, scope) {
 			return false
 		}
 	}
 	return true
 }
@@ -170,34 +170,6 @@ func TestOIDCController(t *testing.T) {
 				assert.Contains(t, location, "oidc_name="+url.QueryEscape("Test Client"))
 			},
 		},
 		{
 			description: "Authorize does not skip the consent screen even when consent was already granted",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "testuser", ClientID: "some-client-id",
 					Scope: "openid profile", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				q := url.Values{}
 				q.Set("scope", "openid profile")
 				q.Set("response_type", "code")
 				q.Set("client_id", "some-client-id")
 				q.Set("redirect_uri", "https://test.example.com/callback")
 				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
 				router.ServeHTTP(recorder, req)
 				// The consent skip check now happens after auth via the
 				// skip-consent endpoint, so authorize should never set
 				// prompt=none on its own.
 				assert.Equal(t, http.StatusFound, recorder.Code)
 				location := recorder.Header().Get("Location")
 				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
 				assert.NotContains(t, location, "oidc_prompt=none")
 			},
 		},
 		{
 			description: "Authorize redirects to error screen when the request object is invalid",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
@@ -236,232 +208,6 @@ func TestOIDCController(t *testing.T) {
 			},
 		},
 		// --- skip-consent ---
 		{
 			description:  "Skip consent returns 500 when OIDC is not configured",
 			oidcDisabled: true,
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusInternalServerError, recorder.Code)
 			},
 		},
 		{
 			description: "Skip consent returns 401 when the user context is missing",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
 			},
 		},
 		{
 			description: "Skip consent returns 401 when the user is not authenticated",
 			middlewares: []gin.HandlerFunc{
 				func(c *gin.Context) {
 					c.Set("context", &model.UserContext{
 						Authenticated: false,
 						Provider:      model.ProviderLocal,
 						Local: &model.LocalContext{
 							BaseContext: model.BaseContext{Username: "testuser"},
 						},
 					})
 				},
 			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=some-ticket", nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
 			},
 		},
 		{
 			description: "Skip consent returns 400 when the ticket is missing",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent", nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusBadRequest, recorder.Code)
 			},
 		},
 		{
 			description: "Skip consent returns false when the ticket is unknown",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket=nonexistent-ticket", nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.False(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns true when the authorize request has prompt none",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "testuser", ClientID: "some-client-id",
 					Scope: "openid profile", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 					Prompt:       "none",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.True(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns false when no consent was granted yet",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.False(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns false when a new scope is requested",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "testuser", ClientID: "some-client-id",
 					Scope: "openid", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.False(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns true when all requested scopes were already granted",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "testuser", ClientID: "some-client-id",
 					Scope: "openid profile", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.True(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns true for a subset of already granted scopes",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "testuser", ClientID: "some-client-id",
 					Scope: "openid profile email", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.True(t, res.SkipConsent)
 			},
 		},
 		{
 			description: "Skip consent returns false when the consent belongs to another user",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
 				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "otheruser", ClientID: "some-client-id",
 					Scope: "openid profile", CreatedAt: time.Now().Unix(),
 				})
 				require.NoError(t, err)
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid profile",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				req := httptest.NewRequest("GET", "/api/oidc/skip-consent?oidc_ticket="+url.QueryEscape(ticket), nil)
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res SkipConsentResponse
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				assert.False(t, res.SkipConsent)
 			},
 		},
 		// --- authorize-complete ---
 		{
 			description:  "Should fail if oidc is disabled",
@@ -581,60 +327,6 @@ func TestOIDCController(t *testing.T) {
 				assert.Contains(t, redirectURI, "state=state-123")
 			},
 		},
 		{
 			description: "Authorize complete deletes the ticket on success",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid",
 					ResponseType: "code",
 					ClientID:     "some-client-id",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				body, err := json.Marshal(AuthorizeCompleteRequest{Ticket: ticket})
 				require.NoError(t, err)
 				req := httptest.NewRequest("POST", "/api/oidc/authorize-complete", strings.NewReader(string(body)))
 				req.Header.Set("Content-Type", "application/json")
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				_, ok := oidcService.GetAuthorizeRequestByTicket(ticket)
 				assert.False(t, ok)
 			},
 		},
 		{
 			description: "Authorize complete deletes the ticket even when the client is unknown",
 			middlewares: []gin.HandlerFunc{authedUser},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				ticket := oidcService.CreateAuthorizeRequestTicket(service.AuthorizeRequest{
 					Scope:        "openid",
 					ResponseType: "code",
 					ClientID:     "unknown-client",
 					RedirectURI:  "https://test.example.com/callback",
 				})
 				body, err := json.Marshal(AuthorizeCompleteRequest{Ticket: ticket})
 				require.NoError(t, err)
 				req := httptest.NewRequest("POST", "/api/oidc/authorize-complete", strings.NewReader(string(body)))
 				req.Header.Set("Content-Type", "application/json")
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusOK, recorder.Code)
 				var res map[string]any
 				require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &res))
 				redirectURI, ok := res["redirect_uri"].(string)
 				require.True(t, ok)
 				assert.Contains(t, redirectURI, oidcService.GetIssuer()+"/error")
 				_, ok = oidcService.GetAuthorizeRequestByTicket(ticket)
 				assert.False(t, ok)
 			},
 		},
 		// --- token ---
 		{
@@ -57,7 +57,6 @@ type ProxyContext struct {
 type ProxyController struct {
 	log          *logger.Logger
 	runtime      *model.RuntimeConfig
 	config       *model.Config
 	acls         *service.AccessControlsService
 	auth         *service.AuthService
 	policyEngine *service.PolicyEngine
@@ -68,7 +67,6 @@ type ProxyControllerInput struct {
 	Log           *logger.Logger
 	RuntimeConfig *model.RuntimeConfig
 	Config        *model.Config
 	RouterGroup   *gin.RouterGroup `name:"apiRouterGroup"`
 	ACLsService   *service.AccessControlsService
 	AuthService   *service.AuthService
@@ -79,7 +77,6 @@ func NewProxyController(i ProxyControllerInput) *ProxyController {
 	controller := &ProxyController{
 		log:          i.Log,
 		runtime:      i.RuntimeConfig,
 		config:       i.Config,
 		acls:         i.ACLsService,
 		auth:         i.AuthService,
 		policyEngine: i.PolicyEngine,
@@ -468,10 +465,6 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont
 	// We get the path from the query string
 	path := c.Query("path")
 	if strings.TrimSpace(path) == "" {
 		return ProxyContext{}, errors.New("path not found")
 	}
 	// For envoy we need to support every method
 	method := c.Request.Method
@@ -484,22 +477,14 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont
 	}, nil
 }
-func (controller *ProxyController) determineAuthModules(proxy ProxyType, fallbacks bool) []AuthModuleType {
+func (controller *ProxyController) determineAuthModules(proxy ProxyType) []AuthModuleType {
 	switch proxy {
 	case Traefik, Caddy:
 		return []AuthModuleType{ForwardAuth}
 	case Envoy:
-		authModules := []AuthModuleType{ExtAuthz}
+		return []AuthModuleType{ExtAuthz, ForwardAuth}
 		if fallbacks {
 			authModules = append(authModules, ForwardAuth)
 		}
 		return authModules
 	case Nginx:
-		authModules := []AuthModuleType{AuthRequest}
+		return []AuthModuleType{AuthRequest, ForwardAuth}
 		if fallbacks {
 			authModules = append(authModules, ForwardAuth)
 		}
 		return authModules
 	default:
 		return []AuthModuleType{}
 	}
@@ -529,39 +514,6 @@ func (controller *ProxyController) getContextFromAuthModule(c *gin.Context, modu
 	return ProxyContext{}, fmt.Errorf("unsupported auth module: %v", module)
 }
 func (controller *ProxyController) authModuleIdentifiersPresent(c *gin.Context, module AuthModuleType) bool {
 	switch module {
 	case ForwardAuth:
 		_, host := controller.getHeader(c, "x-forwarded-host")
 		_, uri := controller.getHeader(c, "x-forwarded-uri")
 		return host || uri
 	case AuthRequest:
 		_, ok := controller.getHeader(c, "x-original-url")
 		return ok
 	case ExtAuthz:
 		return strings.TrimSpace(c.Query("path")) != ""
 	default:
 		return false
 	}
 }
 func (controller *ProxyController) ensureNoMultipleAuthModules(c *gin.Context, authModules []AuthModuleType) error {
 	present := 0
 	for _, module := range authModules {
 		if controller.authModuleIdentifiersPresent(c, module) {
 			present++
 		}
 	}
 	if present > 1 {
 		controller.log.App.Warn().Msg("Request carries headers for multiple auth modules, possible spoofing attempt, denying")
 		return fmt.Errorf("conflicting auth module headers")
 	}
 	return nil
 }
 func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext, error) {
 	var req Proxy
@@ -578,34 +530,26 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 	controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy)
-	authModules := controller.determineAuthModules(proxy, !controller.config.Experimental.DisableAuthModuleFallback)
+	authModules := controller.determineAuthModules(proxy)
 	if len(authModules) == 0 {
 		return ProxyContext{}, fmt.Errorf("no auth modules supported for proxy: %v", req.Proxy)
 	}
-	err = controller.ensureNoMultipleAuthModules(c, controller.determineAuthModules(proxy, true))
+	var ctx ProxyContext
 	if err != nil {
 		return ProxyContext{}, err
 	}
 	var ctx *ProxyContext
 	for _, module := range authModules {
 		controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module)
-		authModuleCtx, err := controller.getContextFromAuthModule(c, module)
+		ctx, err = controller.getContextFromAuthModule(c, module)
-		if err != nil {
+		if err == nil {
-			controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err)
+			controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module)
-			continue
+			break
 		}
-		controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module)
+		controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err)
 		ctx = &authModuleCtx
 		break
 	}
-	if ctx == nil {
+	if err != nil {
-		return ProxyContext{}, fmt.Errorf("failed to get context from any auth module")
+		return ProxyContext{}, err
 	}
 	// Parse the raw path to populate the cleaned path used for ACLs
@@ -633,5 +577,5 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 	ctx.IsBrowser = isBrowser
 	ctx.ProxyType = proxy
-	return *ctx, nil
+	return ctx, nil
 }
@@ -213,7 +213,7 @@ func TestProxyController(t *testing.T) {
 			description: "Ensure forward auth fallback for envoy",
 			middlewares: []gin.HandlerFunc{},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil)
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
 				req.Host = ""
 				req.Header.Set("x-forwarded-host", "test.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
@@ -261,7 +261,7 @@ func TestProxyController(t *testing.T) {
 			description: "Ensure extauthz with envoy non browser returns json",
 			middlewares: []gin.HandlerFunc{},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil)
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
 				req.Header.Set("x-forwarded-host", "test.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
 				req.Header.Set("x-forwarded-uri", "/hello")
@@ -877,32 +877,6 @@ func TestProxyController(t *testing.T) {
 				assert.Equal(t, "bar", recorder.Header().Get("x-foo"))
 			},
 		},
 		{
 			description: "Forward auth and auth request headers should fail for nginx",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("GET", "/api/auth/nginx", nil)
 				req.Header.Set("x-forwarded-host", "foo.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
 				req.Header.Set("x-forwarded-uri", "/foo?bar=foo")
 				req.Header.Set("x-original-url", "https://foo.example.com/foo?bar=foo")
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusBadRequest, recorder.Code)
 			},
 		},
 		{
 			description: "Forward auth and ext authz headers should fail for envoy",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
 				req.Host = "foo.example.com"
 				req.Header.Set("x-forwarded-host", "foo.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
 				req.Header.Set("x-forwarded-uri", "/foo?bar=foo")
 				router.ServeHTTP(recorder, req)
 				assert.Equal(t, http.StatusBadRequest, recorder.Code)
 			},
 		},
 	}
 	store := memory.New()
@@ -918,7 +892,6 @@ func TestProxyController(t *testing.T) {
 	aclsService := service.NewAccessControlsService(service.AccessControlServiceInput{
 		Log:           log,
 		Config:        &cfg,
 		Runtime:       &runtime,
 		LabelProvider: nil,
 	})
@@ -979,7 +952,6 @@ func TestProxyController(t *testing.T) {
 			NewProxyController(ProxyControllerInput{
 				Log:           log,
 				RuntimeConfig: &runtime,
 				Config:        &cfg,
 				RouterGroup:   group,
 				ACLsService:   aclsService,
 				AuthService:   authService,
@@ -53,7 +53,7 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
 		UI: UIConfig{
 			Title:                 "Tinyauth",
 			ForgotPasswordMessage: "You can change your password by changing the configuration.",
-			BackgroundImage:       "/background.webp",
+			BackgroundImage:       "/background.jpg",
 			WarningsEnabled:       true,
 		},
 		LDAP: LDAPConfig{
@@ -239,8 +239,7 @@ type LogStreamConfig struct {
 }
 type ExperimentalConfig struct {
-	OAuthBridgeEnabled        bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
+	OAuthBridgeEnabled bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
 	DisableAuthModuleFallback bool `description:"Disable the fallback to forward_auth modules when auth_request or ext_authz fail." yaml:"disableAuthModuleFallback,omitempty"`
 }
 type TailscaleConfig struct {
@@ -254,26 +253,18 @@ type TailscaleConfig struct {
 // OAuth/OIDC config
 type OAuthServiceConfig struct {
-	ClientID         string                `description:"OAuth client ID." yaml:"clientId,omitempty"`
+	ClientID         string   `description:"OAuth client ID." yaml:"clientId,omitempty"`
-	ClientSecret     string                `description:"OAuth client secret." yaml:"clientSecret,omitempty"`
+	ClientSecret     string   `description:"OAuth client secret." yaml:"clientSecret,omitempty"`
-	ClientSecretFile string                `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile,omitempty"`
+	ClientSecretFile string   `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile,omitempty"`
-	Whitelist        []string              `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist,omitempty"`
+	Whitelist        []string `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist,omitempty"`
-	WhitelistFile    string                `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile,omitempty"`
+	WhitelistFile    string   `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile,omitempty"`
-	Scopes           []string              `description:"OAuth scopes." yaml:"scopes,omitempty"`
+	Scopes           []string `description:"OAuth scopes." yaml:"scopes,omitempty"`
-	RedirectURL      string                `description:"OAuth redirect URL." yaml:"redirectUrl,omitempty"`
+	RedirectURL      string   `description:"OAuth redirect URL." yaml:"redirectUrl,omitempty"`
-	AuthURL          string                `description:"OAuth authorization URL." yaml:"authUrl,omitempty"`
+	AuthURL          string   `description:"OAuth authorization URL." yaml:"authUrl,omitempty"`
-	TokenURL         string                `description:"OAuth token URL." yaml:"tokenUrl,omitempty"`
+	TokenURL         string   `description:"OAuth token URL." yaml:"tokenUrl,omitempty"`
-	UserinfoURL      string                `description:"OAuth userinfo URL." yaml:"userinfoUrl,omitempty"`
+	UserinfoURL      string   `description:"OAuth userinfo URL." yaml:"userinfoUrl,omitempty"`
-	Insecure         bool                  `description:"Allow insecure OAuth connections." yaml:"insecure,omitempty"`
+	Insecure         bool     `description:"Allow insecure OAuth connections." yaml:"insecure,omitempty"`
-	Name             string                `description:"Provider name in UI." yaml:"name,omitempty"`
+	Name             string   `description:"Provider name in UI." yaml:"name,omitempty"`
 	Claims           OAuthServiceClaimsMap `description:"Map of claims to extract from the userinfo response." yaml:"claims,omitempty"`
 }
 type OAuthServiceClaimsMap struct {
 	Username string `description:"Username claim." yaml:"username,omitempty"`
 	Email    string `description:"Email claim." yaml:"email,omitempty"`
 	Name     string `description:"Name claim." yaml:"name,omitempty"`
 	Groups   string `description:"Groups claim." yaml:"groups,omitempty"`
 }
 type OIDCClientConfig struct {
@@ -20,6 +20,8 @@ var OverrideProviders = map[string]string{
 var ReservedProviderNames = []string{"local", "ldap", "tailscale"}
 const SessionCookieName = "tinyauth-session"
 const CSRFCookieName = "tinyauth-csrf"
 const RedirectCookieName = "tinyauth-redirect"
 const OAuthSessionCookieName = "tinyauth-oauth"
 const GracefulShutdownTimeout = 5 // seconds
@@ -5,6 +5,8 @@ type RuntimeConfig struct {
 	UUID                     string
 	CookieDomain             string
 	SessionCookieName        string
 	CSRFCookieName           string
 	RedirectCookieName       string
 	OAuthSessionCookieName   string
 	LocalUsers               []LocalUser
 	OAuthProviders           map[string]OAuthServiceConfig
@@ -277,80 +277,6 @@ func TestMemoryStore(t *testing.T) {
 				assert.NoError(t, err)
 			},
 		},
 		{
 			description: "Upsert creates a consent for each user+client pair",
 			run: func(t *testing.T, s repository.Store) {
 				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-a", Scope: "openid profile", CreatedAt: 1,
 				})
 				require.NoError(t, err)
 				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-b", Scope: "openid email", CreatedAt: 2,
 				})
 				require.NoError(t, err)
 				consents, err := s.ListOIDCConsents(ctx)
 				require.NoError(t, err)
 				assert.Len(t, consents, 2)
 				gotA, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
 				require.NoError(t, err)
 				assert.Equal(t, "openid profile", gotA.Scope)
 				gotB, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-b"})
 				require.NoError(t, err)
 				assert.Equal(t, "openid email", gotB.Scope)
 			},
 		},
 		{
 			description: "Upsert overwrites the same consent row",
 			run: func(t *testing.T, s repository.Store) {
 				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
 				})
 				require.NoError(t, err)
 				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-a", Scope: "openid email", CreatedAt: 2,
 				})
 				require.NoError(t, err)
 				consents, err := s.ListOIDCConsents(ctx)
 				require.NoError(t, err)
 				assert.Len(t, consents, 1)
 				got, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
 				require.NoError(t, err)
 				assert.Equal(t, "openid email", got.Scope)
 			},
 		},
 		{
 			description: "Get consent by username and client not found",
 			run: func(t *testing.T, s repository.Store) {
 				_, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
 				assert.ErrorIs(t, err, repository.ErrNotFound)
 			},
 		},
 		{
 			description: "Delete consent by client id",
 			run: func(t *testing.T, s repository.Store) {
 				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
 				})
 				require.NoError(t, err)
 				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
 					Username: "alice", ClientID: "client-b", Scope: "openid", CreatedAt: 2,
 				})
 				require.NoError(t, err)
 				require.NoError(t, s.DeleteOIDCConsentByClientID(ctx, "client-a"))
 				consents, err := s.ListOIDCConsents(ctx)
 				require.NoError(t, err)
 				assert.Len(t, consents, 1)
 				assert.Equal(t, "client-b", consents[0].ClientID)
 			},
 		},
 	}
 	for _, test := range tests {
@@ -94,46 +94,3 @@ func (s *Store) DeleteExpiredOIDCSessions(_ context.Context, arg repository.Dele
 	}
 	return nil
 }
 func consentKey(username, clientID string) string {
 	return username + "\x00" + clientID
 }
 func (s *Store) UpsertOIDCConsent(_ context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	oc := repository.OidcConsent(arg)
 	s.oidcConsents[consentKey(arg.Username, arg.ClientID)] = oc
 	return oc, nil
 }
 func (s *Store) GetOIDCConsentByUsernameAndClientID(_ context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	oc, ok := s.oidcConsents[consentKey(arg.Username, arg.ClientID)]
 	if !ok {
 		return repository.OidcConsent{}, repository.ErrNotFound
 	}
 	return oc, nil
 }
 func (s *Store) DeleteOIDCConsentByClientID(_ context.Context, clientID string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	for key, oc := range s.oidcConsents {
 		if oc.ClientID == clientID {
 			delete(s.oidcConsents, key)
 		}
 	}
 	return nil
 }
 func (s *Store) ListOIDCConsents(_ context.Context) ([]repository.OidcConsent, error) {
 	s.mu.RLock()
 	defer s.mu.RUnlock()
 	out := make([]repository.OidcConsent, 0, len(s.oidcConsents))
 	for _, oc := range s.oidcConsents {
 		out = append(out, oc)
 	}
 	return out, nil
 }
@@ -12,7 +12,6 @@ type Store struct {
 	mu           sync.RWMutex
 	sessions     map[string]repository.Session
 	oidcSessions map[string]repository.OidcSession
 	oidcConsents map[string]repository.OidcConsent
 }
 // New returns a new empty in-memory Store.
@@ -20,6 +19,5 @@ func New() repository.Store {
 	return &Store{
 		sessions:     make(map[string]repository.Session),
 		oidcSessions: make(map[string]repository.OidcSession),
 		oidcConsents: make(map[string]repository.OidcConsent),
 	}
 }
@@ -84,22 +84,3 @@ type DeleteExpiredOIDCSessionsParams struct {
 	TokenExpiresAt        int64
 	RefreshTokenExpiresAt int64
 }
 type OidcConsent struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 type UpsertOIDCConsentParams struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 type GetOIDCConsentByUsernameAndClientIDParams struct {
 	Username string
 	ClientID string
 }
@@ -4,13 +4,6 @@
 package postgres
 type OidcConsent struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 type OidcSession struct {
 	Sub                   string
 	AccessTokenHash       string
@@ -80,16 +80,6 @@ func (q *Queries) DeleteExpiredOIDCSessions(ctx context.Context, arg DeleteExpir
 	return err
 }
 const deleteOIDCConsentByClientID = `-- name: DeleteOIDCConsentByClientID :exec
 DELETE FROM "oidc_consents"
 WHERE "client_id" = $1
 `
 func (q *Queries) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
 	_, err := q.db.ExecContext(ctx, deleteOIDCConsentByClientID, clientID)
 	return err
 }
 const deleteOIDCSessionBySub = `-- name: DeleteOIDCSessionBySub :exec
 DELETE FROM "oidc_sessions"
 WHERE "sub" = $1
@@ -100,28 +90,6 @@ func (q *Queries) DeleteOIDCSessionBySub(ctx context.Context, sub string) error
 	return err
 }
 const getOIDCConsentByUsernameAndClientID = `-- name: GetOIDCConsentByUsernameAndClientID :one
 SELECT username, client_id, scope, created_at FROM "oidc_consents"
 WHERE "username" = $1 AND "client_id" = $2
 `
 type GetOIDCConsentByUsernameAndClientIDParams struct {
 	Username string
 	ClientID string
 }
 func (q *Queries) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error) {
 	row := q.db.QueryRowContext(ctx, getOIDCConsentByUsernameAndClientID, arg.Username, arg.ClientID)
 	var i OidcConsent
 	err := row.Scan(
 		&i.Username,
 		&i.ClientID,
 		&i.Scope,
 		&i.CreatedAt,
 	)
 	return i, err
 }
 const getOIDCSessionByAccessTokenHash = `-- name: GetOIDCSessionByAccessTokenHash :one
 SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce, userinfo_json FROM "oidc_sessions"
 WHERE "access_token_hash" = $1
@@ -188,38 +156,6 @@ func (q *Queries) GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSess
 	return i, err
 }
 const listOIDCConsents = `-- name: ListOIDCConsents :many
 SELECT username, client_id, scope, created_at FROM "oidc_consents"
 `
 func (q *Queries) ListOIDCConsents(ctx context.Context) ([]OidcConsent, error) {
 	rows, err := q.db.QueryContext(ctx, listOIDCConsents)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	var items []OidcConsent
 	for rows.Next() {
 		var i OidcConsent
 		if err := rows.Scan(
 			&i.Username,
 			&i.ClientID,
 			&i.Scope,
 			&i.CreatedAt,
 		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)
 	}
 	if err := rows.Close(); err != nil {
 		return nil, err
 	}
 	if err := rows.Err(); err != nil {
 		return nil, err
 	}
 	return items, nil
 }
 const updateOIDCSession = `-- name: UpdateOIDCSession :one
 UPDATE "oidc_sessions" SET
    "access_token_hash" = $1,
@@ -272,43 +208,3 @@ func (q *Queries) UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionPa
 	)
 	return i, err
 }
 const upsertOIDCConsent = `-- name: UpsertOIDCConsent :one
 INSERT INTO "oidc_consents" (
    "username",
    "client_id",
    "scope",
    "created_at"
 ) VALUES (
    $1, $2, $3, $4
 )
 ON CONFLICT ("username", "client_id")
 DO UPDATE SET
    "scope" = excluded.scope,
    "created_at" = excluded.created_at
 RETURNING username, client_id, scope, created_at
 `
 type UpsertOIDCConsentParams struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 func (q *Queries) UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error) {
 	row := q.db.QueryRowContext(ctx, upsertOIDCConsent,
 		arg.Username,
 		arg.ClientID,
 		arg.Scope,
 		arg.CreatedAt,
 	)
 	var i OidcConsent
 	err := row.Scan(
 		&i.Username,
 		&i.ClientID,
 		&i.Scope,
 		&i.CreatedAt,
 	)
 	return i, err
 }
@@ -56,10 +56,6 @@ func (s *Store) DeleteExpiredSessions(ctx context.Context, expiry int64) error {
 	return mapErr(s.q.DeleteExpiredSessions(ctx, expiry))
 }
 func (s *Store) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
 	return mapErr(s.q.DeleteOIDCConsentByClientID(ctx, clientID))
 }
 func (s *Store) DeleteOIDCSessionBySub(ctx context.Context, sub string) error {
 	return mapErr(s.q.DeleteOIDCSessionBySub(ctx, sub))
 }
@@ -68,14 +64,6 @@ func (s *Store) DeleteSession(ctx context.Context, uuid string) error {
 	return mapErr(s.q.DeleteSession(ctx, uuid))
 }
 func (s *Store) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
 	r, err := s.q.GetOIDCConsentByUsernameAndClientID(ctx, GetOIDCConsentByUsernameAndClientIDParams(arg))
 	if err != nil {
 		return repository.OidcConsent{}, mapErr(err)
 	}
 	return repository.OidcConsent(r), nil
 }
 func (s *Store) GetOIDCSessionByAccessTokenHash(ctx context.Context, accessTokenHash string) (repository.OidcSession, error) {
 	r, err := s.q.GetOIDCSessionByAccessTokenHash(ctx, accessTokenHash)
 	if err != nil {
@@ -108,18 +96,6 @@ func (s *Store) GetSession(ctx context.Context, uuid string) (repository.Session
 	return repository.Session(r), nil
 }
 func (s *Store) ListOIDCConsents(ctx context.Context) ([]repository.OidcConsent, error) {
 	rows, err := s.q.ListOIDCConsents(ctx)
 	if err != nil {
 		return nil, mapErr(err)
 	}
 	out := make([]repository.OidcConsent, len(rows))
 	for i, row := range rows {
 		out[i] = repository.OidcConsent(row)
 	}
 	return out, nil
 }
 func (s *Store) UpdateOIDCSession(ctx context.Context, arg repository.UpdateOIDCSessionParams) (repository.OidcSession, error) {
 	r, err := s.q.UpdateOIDCSession(ctx, UpdateOIDCSessionParams(arg))
 	if err != nil {
@@ -135,11 +111,3 @@ func (s *Store) UpdateSession(ctx context.Context, arg repository.UpdateSessionP
 	}
 	return repository.Session(r), nil
 }
 func (s *Store) UpsertOIDCConsent(ctx context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
 	r, err := s.q.UpsertOIDCConsent(ctx, UpsertOIDCConsentParams(arg))
 	if err != nil {
 		return repository.OidcConsent{}, mapErr(err)
 	}
 	return repository.OidcConsent(r), nil
 }
@@ -4,13 +4,6 @@
 package sqlite
 type OidcConsent struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 type OidcSession struct {
 	Sub                   string
 	AccessTokenHash       string
@@ -80,16 +80,6 @@ func (q *Queries) DeleteExpiredOIDCSessions(ctx context.Context, arg DeleteExpir
 	return err
 }
 const deleteOIDCConsentByClientID = `-- name: DeleteOIDCConsentByClientID :exec
 DELETE FROM "oidc_consents"
 WHERE "client_id" = ?
 `
 func (q *Queries) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
 	_, err := q.db.ExecContext(ctx, deleteOIDCConsentByClientID, clientID)
 	return err
 }
 const deleteOIDCSessionBySub = `-- name: DeleteOIDCSessionBySub :exec
 DELETE FROM "oidc_sessions"
 WHERE "sub" = ?
@@ -100,28 +90,6 @@ func (q *Queries) DeleteOIDCSessionBySub(ctx context.Context, sub string) error
 	return err
 }
 const getOIDCConsentByUsernameAndClientID = `-- name: GetOIDCConsentByUsernameAndClientID :one
 SELECT username, client_id, scope, created_at FROM "oidc_consents"
 WHERE "username" = ? AND "client_id" = ?
 `
 type GetOIDCConsentByUsernameAndClientIDParams struct {
 	Username string
 	ClientID string
 }
 func (q *Queries) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error) {
 	row := q.db.QueryRowContext(ctx, getOIDCConsentByUsernameAndClientID, arg.Username, arg.ClientID)
 	var i OidcConsent
 	err := row.Scan(
 		&i.Username,
 		&i.ClientID,
 		&i.Scope,
 		&i.CreatedAt,
 	)
 	return i, err
 }
 const getOIDCSessionByAccessTokenHash = `-- name: GetOIDCSessionByAccessTokenHash :one
 SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce, userinfo_json FROM "oidc_sessions"
 WHERE "access_token_hash" = ?
@@ -188,38 +156,6 @@ func (q *Queries) GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSess
 	return i, err
 }
 const listOIDCConsents = `-- name: ListOIDCConsents :many
 SELECT username, client_id, scope, created_at FROM "oidc_consents"
 `
 func (q *Queries) ListOIDCConsents(ctx context.Context) ([]OidcConsent, error) {
 	rows, err := q.db.QueryContext(ctx, listOIDCConsents)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
 	var items []OidcConsent
 	for rows.Next() {
 		var i OidcConsent
 		if err := rows.Scan(
 			&i.Username,
 			&i.ClientID,
 			&i.Scope,
 			&i.CreatedAt,
 		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)
 	}
 	if err := rows.Close(); err != nil {
 		return nil, err
 	}
 	if err := rows.Err(); err != nil {
 		return nil, err
 	}
 	return items, nil
 }
 const updateOIDCSession = `-- name: UpdateOIDCSession :one
 UPDATE "oidc_sessions" SET
    "access_token_hash" = ?,
@@ -272,43 +208,3 @@ func (q *Queries) UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionPa
 	)
 	return i, err
 }
 const upsertOIDCConsent = `-- name: UpsertOIDCConsent :one
 INSERT INTO "oidc_consents" (
    "username",
    "client_id",
    "scope",
    "created_at"
 ) VALUES (
    ?, ?, ?, ?
 )
 ON CONFLICT ("username", "client_id")
 DO UPDATE SET
    "scope" = excluded.scope,
    "created_at" = excluded.created_at
 RETURNING username, client_id, scope, created_at
 `
 type UpsertOIDCConsentParams struct {
 	Username  string
 	ClientID  string
 	Scope     string
 	CreatedAt int64
 }
 func (q *Queries) UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error) {
 	row := q.db.QueryRowContext(ctx, upsertOIDCConsent,
 		arg.Username,
 		arg.ClientID,
 		arg.Scope,
 		arg.CreatedAt,
 	)
 	var i OidcConsent
 	err := row.Scan(
 		&i.Username,
 		&i.ClientID,
 		&i.Scope,
 		&i.CreatedAt,
 	)
 	return i, err
 }
@@ -56,10 +56,6 @@ func (s *Store) DeleteExpiredSessions(ctx context.Context, expiry int64) error {
 	return mapErr(s.q.DeleteExpiredSessions(ctx, expiry))
 }
 func (s *Store) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
 	return mapErr(s.q.DeleteOIDCConsentByClientID(ctx, clientID))
 }
 func (s *Store) DeleteOIDCSessionBySub(ctx context.Context, sub string) error {
 	return mapErr(s.q.DeleteOIDCSessionBySub(ctx, sub))
 }
@@ -68,14 +64,6 @@ func (s *Store) DeleteSession(ctx context.Context, uuid string) error {
 	return mapErr(s.q.DeleteSession(ctx, uuid))
 }
 func (s *Store) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
 	r, err := s.q.GetOIDCConsentByUsernameAndClientID(ctx, GetOIDCConsentByUsernameAndClientIDParams(arg))
 	if err != nil {
 		return repository.OidcConsent{}, mapErr(err)
 	}
 	return repository.OidcConsent(r), nil
 }
 func (s *Store) GetOIDCSessionByAccessTokenHash(ctx context.Context, accessTokenHash string) (repository.OidcSession, error) {
 	r, err := s.q.GetOIDCSessionByAccessTokenHash(ctx, accessTokenHash)
 	if err != nil {
@@ -108,18 +96,6 @@ func (s *Store) GetSession(ctx context.Context, uuid string) (repository.Session
 	return repository.Session(r), nil
 }
 func (s *Store) ListOIDCConsents(ctx context.Context) ([]repository.OidcConsent, error) {
 	rows, err := s.q.ListOIDCConsents(ctx)
 	if err != nil {
 		return nil, mapErr(err)
 	}
 	out := make([]repository.OidcConsent, len(rows))
 	for i, row := range rows {
 		out[i] = repository.OidcConsent(row)
 	}
 	return out, nil
 }
 func (s *Store) UpdateOIDCSession(ctx context.Context, arg repository.UpdateOIDCSessionParams) (repository.OidcSession, error) {
 	r, err := s.q.UpdateOIDCSession(ctx, UpdateOIDCSessionParams(arg))
 	if err != nil {
@@ -135,11 +111,3 @@ func (s *Store) UpdateSession(ctx context.Context, arg repository.UpdateSessionP
 	}
 	return repository.Session(r), nil
 }
 func (s *Store) UpsertOIDCConsent(ctx context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
 	r, err := s.q.UpsertOIDCConsent(ctx, UpsertOIDCConsentParams(arg))
 	if err != nil {
 		return repository.OidcConsent{}, mapErr(err)
 	}
 	return repository.OidcConsent(r), nil
 }
@@ -27,10 +27,4 @@ type Store interface {
 	GetOIDCSessionByRefreshTokenHash(ctx context.Context, refreshTokenHash string) (OidcSession, error)
 	GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSession, error)
 	UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionParams) (OidcSession, error)
 	// OIDC Consents
 	UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error)
 	GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error)
 	DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error
 	ListOIDCConsents(ctx context.Context) ([]OidcConsent, error)
 }
@@ -2,13 +2,11 @@ package service
 import (
 	"errors"
 	"fmt"
 	"net"
 	"strings"
 	"unicode"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 	"github.com/tinyauthapp/tinyauth/pkg/validators"
 	"go.uber.org/dig"
 )
@@ -19,7 +17,6 @@ type LabelProvider interface {
 type AccessControlsService struct {
 	log           *logger.Logger
 	config        *model.Config
 	runtime       *model.RuntimeConfig
 	labelProvider LabelProvider
 }
@@ -28,7 +25,6 @@ type AccessControlServiceInput struct {
 	Log           *logger.Logger
 	Config        *model.Config
 	Runtime       *model.RuntimeConfig
 	LabelProvider LabelProvider `optional:"true"`
 }
@@ -37,38 +33,12 @@ func NewAccessControlsService(i AccessControlServiceInput) *AccessControlsServic
 	return &AccessControlsService{
 		log:           i.Log,
 		config:        i.Config,
 		runtime:       i.Runtime,
 		labelProvider: i.LabelProvider,
 	}
 }
 func (service *AccessControlsService) ensureAscii(str string) bool {
 	for i := 0; i < len(str); i++ {
 		if str[i] > unicode.MaxASCII {
 			return false
 		}
 	}
 	return true
 }
 func (service *AccessControlsService) normalizeDomain(domain string) string {
 	if host, _, err := net.SplitHostPort(domain); err == nil {
 		domain = host
 	}
 	domain = strings.TrimRight(domain, ".")
 	return strings.ToLower(domain)
 }
 func (service *AccessControlsService) getACLs(domain string, lookup func(locator func(name string, app *model.App) bool) error) (*model.App, error) {
-	if !service.ensureAscii(domain) {
+	v := validators.NewDomainValidator(validators.DomainValidatorOptions{})
 		return nil, errors.New("domain contains non-ascii characters")
 	}
 	normalizedDomain := service.normalizeDomain(domain)
 	if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain {
 		return nil, fmt.Errorf("domain does not match cookie domain, expected %s (or a subdomain), got %s", service.runtime.CookieDomain, domain)
 	}
 	var domainMatch *model.App
 	var nameMatch *model.App
@@ -76,18 +46,16 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator
 	locatorFunc := func(name string, app *model.App) bool {
 		if app.Config.Domain != "" {
-			if !service.ensureAscii(app.Config.Domain) {
+			err := v.Validate(app.Config.Domain, domain)
-				service.log.App.Warn().Str("name", name).Str("domain", app.Config.Domain).Msg("Domain contains non-ascii characters, skipping")
+			if err == nil {
 				return false
 			}
 			if normalizedDomain == service.normalizeDomain(app.Config.Domain) {
 				service.log.App.Debug().Str("name", name).Msg("Found matching container by domain")
 				domainMatch = app
 				return true
 			} else if !errors.Is(err, validators.ErrHostnameMismatch) {
 				service.log.App.Debug().Str("name", name).Err(err).Msg("Domain validation failed")
 			}
 			return false
 		}
-		if strings.HasPrefix(normalizedDomain, strings.ToLower(name+".")) {
+		if strings.HasPrefix(strings.ToLower(domain), strings.ToLower(name+".")) {
 			service.log.App.Debug().Str("name", name).Msg("Found matching container by app name")
 			nameMatch = app
 			nameMatchedApps = append(nameMatchedApps, name)
@@ -111,7 +79,7 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator
 	}
 	if len(nameMatchedApps) > 1 {
-		return nil, fmt.Errorf("domain matched multiple apps by name prefix, use explicit domain config")
+		service.log.App.Warn().Str("domain", domain).Strs("apps", nameMatchedApps).Msg("Multiple apps matched domain by name, app names must be unique, using last match")
 	}
 	service.log.App.Debug().Str("domain", domain).Msg("Found matching app by app name")
@@ -4,10 +4,8 @@ import (
 	"errors"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/test"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
@@ -36,25 +34,14 @@ func TestAccessControlsService(t *testing.T) {
 	log := logger.NewLogger().WithTestConfig()
 	log.Init()
 	_, runtime := test.CreateTestConfigs(t)
 	tests := []struct {
-		name      string
+		name   string
-		domain    string
+		domain string
-		acls      map[string]model.App
+		acls   map[string]model.App
-		want      *model.App
+		want   *model.App
 		errorFunc func(t *testing.T, e error)
 	}{
 		{
 			name:   "returns ACLs for domain",
 			domain: "app.example.com",
 			acls: map[string]model.App{
 				"foo": {Config: model.AppConfig{Domain: "app.example.com"}},
 			},
 			want: &model.App{Config: model.AppConfig{Domain: "app.example.com"}},
 		},
 		{
 			name:   "returns ACLs for root domain",
 			domain: "example.com",
 			acls: map[string]model.App{
 				"foo": {Config: model.AppConfig{Domain: "example.com"}},
@@ -78,11 +65,20 @@ func TestAccessControlsService(t *testing.T) {
 			want: &model.App{Config: model.AppConfig{Domain: "example.com"}},
 		},
 		{
-			name:   "returns error for non-ascii domain",
+			name:   "returns ACLs for non-ascii domain",
 			domain: "bücher.example.com",
-			errorFunc: func(t *testing.T, e error) {
+			acls: map[string]model.App{
-				assert.ErrorContains(t, e, "domain contains non-ascii characters")
+				"foo": {Config: model.AppConfig{Domain: "bücher.example.com"}},
 			},
 			want: &model.App{Config: model.AppConfig{Domain: "bücher.example.com"}},
 		},
 		{
 			name:   "returns ACLs for punycode domain and non-ascii config",
 			domain: "bücher.example.com",
 			acls: map[string]model.App{
 				"foo": {Config: model.AppConfig{Domain: "xn--bcher-kva.example.com"}},
 			},
 			want: &model.App{Config: model.AppConfig{Domain: "xn--bcher-kva.example.com"}},
 		},
 		{
 			name:   "returns ACLs with case-insensitive matching",
@@ -114,33 +110,6 @@ func TestAccessControlsService(t *testing.T) {
 			acls:   map[string]model.App{},
 			want:   nil,
 		},
 		{
 			name:   "App in domain not matching with the cookie domain should return nothing with name matching",
 			domain: "foo.bad_example.com",
 			acls: map[string]model.App{
 				"foo": {
 					Path: model.AppPath{Allow: "/foo"},
 				},
 			},
 			want: nil,
 			errorFunc: func(t *testing.T, e error) {
 				assert.ErrorContains(t, e, "domain does not match cookie domain")
 			},
 		},
 		{
 			name:   "App in domain not matching with the cookie domain should return nothing with domain matching",
 			domain: "foo.bad_example.com",
 			acls: map[string]model.App{
 				"foo": {
 					Path:   model.AppPath{Allow: "/foo"},
 					Config: model.AppConfig{Domain: "foo.bad_example.com"},
 				},
 			},
 			want: nil,
 			errorFunc: func(t *testing.T, e error) {
 				assert.ErrorContains(t, e, "domain does not match cookie domain")
 			},
 		},
 	}
 	// run once for a mock provider
@@ -149,15 +118,10 @@ func TestAccessControlsService(t *testing.T) {
 			mock := newMockProvider(test.acls, false)
 			acls := NewAccessControlsService(AccessControlServiceInput{
 				Log:           log,
 				Runtime:       &runtime,
 				Config:        &model.Config{},
 				LabelProvider: mock,
 			})
 			app, err := acls.getACLs(test.domain, mock.Lookup)
 			if test.errorFunc != nil {
 				test.errorFunc(t, err)
 				return
 			}
 			require.NoError(t, err)
 			require.Equal(t, test.want, app)
 		})
@@ -167,17 +131,12 @@ func TestAccessControlsService(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.name+"(staticACLs)", func(t *testing.T) {
 			acls := NewAccessControlsService(AccessControlServiceInput{
-				Log:     log,
+				Log: log,
 				Runtime: &runtime,
 				Config: &model.Config{
 					Apps: test.acls,
 				},
 			})
 			app, err := acls.lookupStaticACLs(test.domain)
 			if test.errorFunc != nil {
 				test.errorFunc(t, err)
 				return
 			}
 			require.NoError(t, err)
 			require.Equal(t, test.want, app)
 		})
@@ -186,32 +145,16 @@ func TestAccessControlsService(t *testing.T) {
 	// get acls should return an error when the provider fails
 	mock := newMockProvider(map[string]model.App{}, true)
 	acls := NewAccessControlsService(AccessControlServiceInput{
-		Log:     log,
+		Log:    log,
-		Runtime: &runtime,
+		Config: &model.Config{},
 		Config:  &model.Config{},
 	})
 	_, err := acls.getACLs("example.com", mock.Lookup)
-	assert.Error(t, err)
+	require.Error(t, err)
 	// get acls should return an error when multiple apps with the same domain exist
 	acls = NewAccessControlsService(AccessControlServiceInput{
 		Log:     log,
 		Runtime: &runtime,
 		Config: &model.Config{
 			Apps: map[string]model.App{
 				"foo":     {Path: model.AppPath{Allow: "/foo"}},
 				"foo.bar": {Path: model.AppPath{Allow: "/bar"}},
 			},
 		},
 	})
 	_, err = acls.GetAccessControls("foo.bar.example.com")
 	assert.ErrorContains(t, err, "domain matched multiple apps by name prefix, use explicit domain config")
 	// get access controls should get acls from
 	// static when static acls are configured
 	acls = NewAccessControlsService(AccessControlServiceInput{
-		Log:     log,
+		Log: log,
 		Runtime: &runtime,
 		Config: &model.Config{
 			Apps: map[string]model.App{
 				"foo": {Config: model.AppConfig{Domain: "foo.example.com"}},
@@ -220,12 +163,12 @@ func TestAccessControlsService(t *testing.T) {
 	})
 	app, err := acls.GetAccessControls("foo.example.com")
 	require.NoError(t, err)
-	assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "foo.example.com"}}, app)
+	require.Equal(t, &model.App{Config: model.AppConfig{Domain: "foo.example.com"}}, app)
 	// should return nil for no apps
 	app, err = acls.GetAccessControls("bar.example.com")
 	require.NoError(t, err)
-	assert.Nil(t, app)
+	require.Nil(t, app)
 	// Should use label provider if available
 	mock = newMockProvider(map[string]model.App{
@@ -235,11 +178,10 @@ func TestAccessControlsService(t *testing.T) {
 	}, false)
 	acls = NewAccessControlsService(AccessControlServiceInput{
 		Log:           log,
 		Runtime:       &runtime,
 		Config:        &model.Config{},
 		LabelProvider: mock,
 	})
 	app, err = acls.GetAccessControls("bar.example.com")
 	require.NoError(t, err)
-	assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "bar.example.com"}}, app)
+	require.Equal(t, &model.App{Config: model.AppConfig{Domain: "bar.example.com"}}, app)
 }
@@ -2,12 +2,8 @@ package service
 import (
 	"context"
 	"errors"
 	"fmt"
 	"os"
 	"time"
 	"github.com/cenkalti/backoff/v5"
 	"github.com/steveiliop56/ding"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/decoders"
@@ -18,10 +14,6 @@ import (
 	"github.com/docker/docker/client"
 )
 var (
 	ErrPingFailed = fmt.Errorf("failed to ping docker")
 )
 type DockerService struct {
 	log     *logger.Logger
 	client  *client.Client
@@ -39,52 +31,24 @@ type DockerServiceInput struct {
 }
 func NewDockerService(i DockerServiceInput) (*DockerService, error) {
-	service := &DockerService{
+	client, err := client.NewClientWithOpts(client.FromEnv)
-		log:     i.Log,
+	if err != nil {
-		context: i.Ctx,
+		return nil, err
 	}
-	service.log.App.Debug().Msg("Attempting to connect to Docker")
+	client.NegotiateAPIVersion(i.Ctx)
-	if os.Getenv("DOCKER_HOST") == "" {
+	_, err = client.Ping(i.Ctx)
 		cli, err := service.connect()
 		if err != nil {
 			if errors.Is(err, ErrPingFailed) {
 				service.log.App.Debug().Msg("Docker not connected")
 				return nil, nil
 			}
 			return nil, fmt.Errorf("failed to connect to docker: %w", err)
 		}
 		service.client = cli
 	} else {
 		exp := backoff.NewExponentialBackOff()
 		exp.InitialInterval = 3 * time.Second
 		exp.RandomizationFactor = 0.1
 		exp.Multiplier = 1.5
 		exp.Reset()
-		operation := func() (*client.Client, error) {
+	if err != nil {
-			if service.client != nil {
+		i.Log.App.Debug().Err(err).Msg("Docker not connected")
-				service.client.Close()
+		return nil, nil
-			}
+	}
 			cli, err := service.connect()
 			if err != nil {
 				return nil, err
 			}
 			return cli, nil
 		}
-		cli, err := backoff.Retry(service.context, operation, backoff.WithBackOff(exp), backoff.WithMaxTries(3))
+	service := &DockerService{
-
+		log:     i.Log,
-		if err != nil {
+		client:  client,
-			if errors.Is(err, ErrPingFailed) {
+		context: i.Ctx,
 				service.log.App.Debug().Msg("Docker not connected after retrying")
 				return nil, nil
 			}
 			return nil, fmt.Errorf("failed to connect to docker after retrying: %w", err)
 		}
 		service.client = cli
 	}
 	service.isConnected = true
@@ -95,22 +59,6 @@ func NewDockerService(i DockerServiceInput) (*DockerService, error) {
 	return service, nil
 }
 func (docker *DockerService) connect() (*client.Client, error) {
 	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
 	if err != nil {
 		return nil, err
 	}
 	_, err = cli.Ping(docker.context)
 	if err != nil {
 		return nil, ErrPingFailed
 	}
 	return cli, nil
 }
 func (docker *DockerService) getContainers() ([]container.Summary, error) {
 	return docker.client.ContainerList(docker.context, container.ListOptions{})
 }
@@ -21,15 +21,11 @@ type GithubUserinfoResponse struct {
 	ID    int    `json:"id"`
 }
-func defaultExtractor(client *http.Client, ctx context.Context, url string, mapClaims MapClaims) (*model.Claims, error) {
+func defaultExtractor(client *http.Client, ctx context.Context, url string) (*model.Claims, error) {
-	claims, err := simpleReq[map[string]any](client, ctx, url, nil)
+	return simpleReq[model.Claims](client, ctx, url, nil)
 	if err != nil {
 		return nil, err
 	}
 	return new(mapClaims(*claims)), nil
 }
-func githubExtractor(client *http.Client, ctx context.Context, _ string, _ MapClaims) (*model.Claims, error) {
+func githubExtractor(client *http.Client, ctx context.Context, _ string) (*model.Claims, error) {
 	var user model.Claims
 	userInfo, err := simpleReq[GithubUserinfoResponse](client, ctx, "https://api.github.com/user", map[string]string{
@@ -10,8 +10,7 @@ import (
 	"golang.org/x/oauth2"
 )
-type MapClaims func(claims map[string]any) model.Claims
+type OAuthUserinfoExtractor func(client *http.Client, ctx context.Context, url string) (*model.Claims, error)
 type OAuthUserinfoExtractor func(client *http.Client, ctx context.Context, url string, mapClaims MapClaims) (*model.Claims, error)
 type OAuthService struct {
 	serviceCfg        model.OAuthServiceConfig
@@ -82,7 +81,7 @@ func (s *OAuthService) GetToken(code string, verifier string) (*oauth2.Token, er
 func (s *OAuthService) GetUserinfo(token *oauth2.Token) (*model.Claims, error) {
 	client := oauth2.NewClient(s.ctx, oauth2.StaticTokenSource(token))
-	return s.userinfoExtractor(client, s.ctx, s.serviceCfg.UserinfoURL, s.mapClaims)
+	return s.userinfoExtractor(client, s.ctx, s.serviceCfg.UserinfoURL)
 }
 func (s *OAuthService) GetConfig() model.OAuthServiceConfig {
@@ -98,26 +97,3 @@ func (s *OAuthService) UpdateConfig(config model.OAuthServiceConfig) {
 	s.config.Endpoint.TokenURL = config.TokenURL
 	s.config.RedirectURL = config.RedirectURL
 }
 func (s *OAuthService) mapClaims(claims map[string]any) model.Claims {
 	return model.Claims{
 		Sub:               mapClaim[string]("sub", "", claims),
 		Name:              mapClaim[string]("name", s.serviceCfg.Claims.Name, claims),
 		PreferredUsername: mapClaim[string]("preferred_username", s.serviceCfg.Claims.Username, claims),
 		Email:             mapClaim[string]("email", s.serviceCfg.Claims.Email, claims),
 		Groups:            mapClaim[any]("groups", s.serviceCfg.Claims.Groups, claims),
 	}
 }
 func mapClaim[T any](fallback, override string, kv map[string]any) T {
 	key := fallback
 	if override != "" {
 		key = override
 	}
 	v, ok := kv[key].(T)
 	if !ok {
 		var zero T
 		return zero
 	}
 	return v
 }
@@ -6,7 +6,6 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/subtle"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
@@ -17,7 +16,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 	"slices"
@@ -54,17 +52,6 @@ const (
 	OIDCPromptNone  OIDCPrompt = "none"
 )
 func (p OIDCPrompt) String() string {
 	switch p {
 	case OIDCPromptLogin:
 		return "login"
 	case OIDCPromptNone:
 		return "none"
 	default:
 		return "login"
 	}
 }
 var SupportedPrompts = []string{string(OIDCPromptLogin), string(OIDCPromptNone)}
 // This is not spec-compliant, the ID token SHOULD NOT contain user info claims but,
@@ -176,10 +163,6 @@ type OIDCService struct {
 		usedCode  *cache.CacheStore[UsedCodeEntry]
 		authorize *cache.CacheStore[AuthorizeRequest]
 	}
 	mus struct {
 		consent sync.RWMutex
 	}
 }
 type OIDCServiceInput struct {
@@ -353,11 +336,6 @@ func NewOIDCService(i OIDCServiceInput) (*OIDCService, error) {
 		issuer:     issuer,
 	}
 	// Remove consents for clients that are no longer configured
 	if err := service.reconcileOIDCConsents(context.Background()); err != nil {
 		i.Log.App.Warn().Err(err).Msg("Failed to reconcile OIDC consents")
 	}
 	// Start cleanup routine
 	i.Ding.Go(service.cleanupRoutine, ding.RingMinor)
@@ -883,7 +861,7 @@ func (service *OIDCService) ValidatePKCE(codeChallenge string, codeVerifier stri
 	if codeChallenge == "" {
 		return true
 	}
-	return subtle.ConstantTimeCompare([]byte(codeChallenge), []byte(service.hashAndEncodePKCE(codeVerifier))) == 1
+	return codeChallenge == service.hashAndEncodePKCE(codeVerifier)
 }
 func (service *OIDCService) hashAndEncodePKCE(codeVerifier string) string {
@@ -942,7 +920,7 @@ func (service *OIDCService) DeleteAuthorizeRequestTicket(ticket string) {
 	service.caches.authorize.Delete(ticket)
 }
-// DecodeAuthorizeJWT TODO: support signed request objects in the future
+// TODO: support signed request objects in the future
 func (service *OIDCService) DecodeAuthorizeJWT(tokenString string) (*AuthorizeRequest, error) {
 	var claims jwt.MapClaims
@@ -992,114 +970,3 @@ func (service *OIDCService) GetPrompt(prompt string) []OIDCPrompt {
 	return parsedPromps
 }
 func (service *OIDCService) getOIDCConsentUnsafe(ctx context.Context, username, clientId string) (*repository.OidcConsent, error) {
 	entry, err := service.queries.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{
 		Username: username,
 		ClientID: clientId,
 	})
 	if err != nil {
 		if errors.Is(err, repository.ErrNotFound) {
 			return nil, nil
 		}
 		return nil, fmt.Errorf("failed to get oidc consent: %w", err)
 	}
 	return &entry, nil
 }
 func (service *OIDCService) GetOIDCConsent(ctx context.Context, username, clientId string) (*repository.OidcConsent, error) {
 	service.mus.consent.RLock()
 	defer service.mus.consent.RUnlock()
 	return service.getOIDCConsentUnsafe(ctx, username, clientId)
 }
 func (service *OIDCService) UpsertOIDCConsent(ctx context.Context, username, scope, clientId string) (repository.OidcConsent, error) {
 	service.mus.consent.Lock()
 	defer service.mus.consent.Unlock()
 	existing, err := service.getOIDCConsentUnsafe(ctx, username, clientId)
 	if err != nil {
 		return repository.OidcConsent{}, err
 	}
 	merged := scope
 	if existing != nil {
 		merged = mergeScopes(existing.Scope, scope)
 	}
 	entry := repository.UpsertOIDCConsentParams{
 		Username:  username,
 		Scope:     merged,
 		ClientID:  clientId,
 		CreatedAt: time.Now().Unix(),
 	}
 	consent, err := service.queries.UpsertOIDCConsent(ctx, entry)
 	if err != nil {
 		service.log.App.Error().Err(err).Msg("Failed to upsert OIDC consent")
 		return repository.OidcConsent{}, err
 	}
 	return consent, nil
 }
 func (service *OIDCService) reconcileOIDCConsents(ctx context.Context) error {
 	consents, err := service.queries.ListOIDCConsents(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to list oidc consents: %w", err)
 	}
 	cleaned := make(map[string]struct{})
 	for _, consent := range consents {
 		if _, ok := cleaned[consent.ClientID]; ok {
 			continue
 		}
 		cleaned[consent.ClientID] = struct{}{}
 		if _, ok := service.clients[consent.ClientID]; ok {
 			continue
 		}
 		service.log.App.Info().Str("clientId", consent.ClientID).Msg("Removed OIDC client no longer in configuration, deleting its consents")
 		if err := service.queries.DeleteOIDCConsentByClientID(ctx, consent.ClientID); err != nil {
 			service.log.App.Warn().Err(err).Str("clientId", consent.ClientID).Msg("Failed to delete OIDC consents for removed client")
 		}
 	}
 	return nil
 }
 func mergeScopes(existing, requested string) string {
 	set := make(map[string]struct{})
 	for _, scope := range strings.Split(existing, " ") {
 		if scope != "" {
 			set[scope] = struct{}{}
 		}
 	}
 	for _, scope := range strings.Split(requested, " ") {
 		if scope != "" {
 			set[scope] = struct{}{}
 		}
 	}
 	scopes := make([]string, 0, len(set))
 	for scope := range set {
 		scopes = append(scopes, scope)
 	}
 	slices.Sort(scopes)
 	return strings.Join(scopes, " ")
 }
@@ -18,7 +18,7 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
 		UI: model.UIConfig{
 			Title:                 "Tinyauth Test",
 			ForgotPasswordMessage: "foo",
-			BackgroundImage:       "/background.webp",
+			BackgroundImage:       "/background.jpg",
 			WarningsEnabled:       true,
 		},
 		OAuth: model.OAuthConfig{
@@ -38,16 +38,7 @@ func SafeParseAppURL(str string) (string, error) {
 		return "", fmt.Errorf("ip addresses not allowed")
 	}
-	i := idna.New(
+	hostname, err = idna.Lookup.ToASCII(hostname)
 		idna.MapForLookup(),
 		idna.Transitional(false),
 		idna.BidiRule(),
 		idna.StrictDomainName(false),
 		idna.CheckHyphens(true),
 		idna.CheckJoiners(false),
 	)
 	hostname, err = i.ToASCII(hostname)
 	if err != nil {
 		return "", fmt.Errorf("failed to convert hostname to ascii: %w", err)
@@ -43,13 +43,6 @@ func TestSafeParseAPPURL(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 	// Underscores
 	appURL = "http://sub_tinyauth.app"
 	expected = "http://sub_tinyauth.app"
 	result, err = utils.SafeParseAppURL(appURL)
 	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 	// Lowercase
 	appURL = "HTTP://SUb.tinyAUth.aPP"
 	expected = "http://sub.tinyauth.app"
@@ -73,7 +66,7 @@ func TestSafeParseAPPURL(t *testing.T) {
 	assert.ErrorContains(t, err, "invalid url")
 	// Invalid punycode
-	appURL = "http://xn--h-kva.example.com"
+	appURL = "http://ab--cd.example.com"
 	_, err = utils.SafeParseAppURL(appURL)
 	assert.ErrorContains(t, err, "failed to convert hostname to ascii")
@@ -11,6 +11,8 @@ import (
 	"net"
 	"net/url"
 	"strings"
 	"golang.org/x/net/idna"
 )
 // Errors
@@ -113,10 +115,14 @@ func (v *DomainValidator) getURL(i string) (*url.URL, error) {
 func (v *DomainValidator) getHostname(hostname string) (string, error) {
 	hostname = strings.ToLower(hostname)
-	hostname = strings.TrimRight(hostname, ".")
+	hostname = strings.TrimSuffix(hostname, ".")
 	if net.ParseIP(hostname) != nil {
 		return "", fmt.Errorf("ip addresses are not supported")
 	}
 	hostname, err := idna.Lookup.ToASCII(hostname)
 	if err != nil {
 		return "", fmt.Errorf("failed to convert hostname to ascii: %w", err)
 	}
 	return hostname, nil
 }
@@ -101,6 +101,18 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
 				assert.ErrorContains(t, e, "ip addresses are not supported")
 			},
 		},
 		{
 			description: "Domains with unicode characters should be allowed",
 			input:       "bücher.example.com",
 			expected:    "xn--bcher-kva.example.com",
 		},
 		{
 			description: "Invalid IDNA domain should fail",
 			input:       "ab--cd.example.com",
 			errorFunc: func(t *testing.T, e error) {
 				assert.ErrorContains(t, e, "invalid label")
 			},
 		},
 		{
 			description: "With port enabled without any port should work",
 			options:     DomainValidatorOptions{WithPort: true},
@@ -182,6 +194,22 @@ func TestDomainValidator_Validate(t *testing.T) {
 			expected:    "https://example.com:443",
 			actual:      "https://example.com:443",
 		},
 		{
 			description: "Failure to format expected domain should fail",
 			expected:    "ab--cd.example.com",
 			actual:      "example.com",
 			errorFunc: func(t *testing.T, e error) {
 				assert.ErrorContains(t, e, "idna: invalid label")
 			},
 		},
 		{
 			description: "Failure to format check domain should fail",
 			expected:    "example.com",
 			actual:      "ab--cd.example.com",
 			errorFunc: func(t *testing.T, e error) {
 				assert.ErrorContains(t, e, "idna: invalid label")
 			},
 		},
 		{
 			description: "Valid domains with matching schemes and ports should pass",
 			options:     DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https", "http"}, WithPort: true},
@@ -208,6 +236,16 @@ func TestDomainValidator_Validate(t *testing.T) {
 			actual:      "example.com",
 			expected:    "example.com",
 		},
 		{
 			description: "Unicode valid domains should pass",
 			expected:    "xn--bcher-kva.example.com",
 			actual:      "bücher.example.com",
 		},
 		{
 			description: "Unicode valid domains should pass (reverse)",
 			expected:    "bücher.example.com",
 			actual:      "xn--bcher-kva.example.com",
 		},
 		{
 			description: "Non matching hostnames should fail",
 			expected:    "example.com",
@@ -46,29 +46,3 @@ UPDATE "oidc_sessions" SET
    "userinfo_json" = $8
 WHERE "sub" = $9
 RETURNING *;
 -- name: UpsertOIDCConsent :one
 INSERT INTO "oidc_consents" (
    "username",
    "client_id",
    "scope",
    "created_at"
 ) VALUES (
    $1, $2, $3, $4
 )
 ON CONFLICT ("username", "client_id")
 DO UPDATE SET
    "scope" = excluded.scope,
    "created_at" = excluded.created_at
 RETURNING *;
 -- name: GetOIDCConsentByUsernameAndClientID :one
 SELECT * FROM "oidc_consents"
 WHERE "username" = $1 AND "client_id" = $2;
 -- name: DeleteOIDCConsentByClientID :exec
 DELETE FROM "oidc_consents"
 WHERE "client_id" = $1;
 -- name: ListOIDCConsents :many
 SELECT * FROM "oidc_consents";
@@ -9,12 +9,3 @@ CREATE TABLE IF NOT EXISTS "oidc_sessions" (
    "nonce" TEXT NOT NULL DEFAULT '',
    "userinfo_json" TEXT NOT NULL
 );
 CREATE TABLE IF NOT EXISTS "oidc_consents" (
    "username" TEXT NOT NULL,
    "client_id" TEXT NOT NULL,
    "scope" TEXT NOT NULL,
    "created_at" BIGINT NOT NULL,
    PRIMARY KEY ("username", "client_id")
 );
@@ -46,29 +46,3 @@ UPDATE "oidc_sessions" SET
    "userinfo_json" = ?
 WHERE "sub" = ?
 RETURNING *;
 -- name: UpsertOIDCConsent :one
 INSERT INTO "oidc_consents" (
    "username",
    "client_id",
    "scope",
    "created_at"
 ) VALUES (
    ?, ?, ?, ?
 )
 ON CONFLICT ("username", "client_id")
 DO UPDATE SET
    "scope" = excluded.scope,
    "created_at" = excluded.created_at
 RETURNING *;
 -- name: GetOIDCConsentByUsernameAndClientID :one
 SELECT * FROM "oidc_consents"
 WHERE "username" = ? AND "client_id" = ?;
 -- name: DeleteOIDCConsentByClientID :exec
 DELETE FROM "oidc_consents"
 WHERE "client_id" = ?;
 -- name: ListOIDCConsents :many
 SELECT * FROM "oidc_consents";
@@ -9,11 +9,3 @@ CREATE TABLE IF NOT EXISTS "oidc_sessions" (
    "nonce" TEXT NOT NULL DEFAULT "",
    "userinfo_json" TEXT NOT NULL
 );
 CREATE TABLE IF NOT EXISTS "oidc_consents" (
    "username" TEXT NOT NULL,
    "client_id" TEXT NOT NULL,
    "scope" TEXT NOT NULL,
    "created_at" INTEGER NOT NULL,
    PRIMARY KEY ("username", "client_id")
 );