chore: remove dosu from sponsors

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.env.example

@@ -132,9 +132,9 @@ TINYAUTH_APPS_name_RESPONSE_BASICAUTH_USERNAME=
 TINYAUTH_APPS_name_RESPONSE_BASICAUTH_PASSWORD=
 # Path to the file containing the basic auth password.
 TINYAUTH_APPS_name_RESPONSE_BASICAUTH_PASSWORDFILE=
-# Comma-separated list of allowed paths.
+# Disable authentication for only paths that match the regex string.
 TINYAUTH_APPS_name_PATH_ALLOW=
-# Comma-separated list of blocked paths.
+# Enable authentication for only paths that match the regex string.
 TINYAUTH_APPS_name_PATH_BLOCK=
 # Comma-separated list of required LDAP groups.
 TINYAUTH_APPS_name_LDAP_GROUPS=
@@ -171,6 +171,14 @@ TINYAUTH_OAUTH_PROVIDERS_name_USERINFOURL=
 TINYAUTH_OAUTH_PROVIDERS_name_INSECURE=false
 # Provider name in UI.
 TINYAUTH_OAUTH_PROVIDERS_name_NAME=
+# Username claim.
+TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_USERNAME=
+# Email claim.
+TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_EMAIL=
+# Name claim.
+TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_NAME=
+# Groups claim.
+TINYAUTH_OAUTH_PROVIDERS_name_CLAIMS_GROUPS=
 
 # oidc config
 
@@ -227,6 +235,8 @@ TINYAUTH_LDAP_GROUPCACHETTL=900
 
 # Enable the OAuth bridge, uses a new way to format OAuth user information.
 TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false
+# Disable the fallback to forward_auth modules when auth_request or ext_authz fail.
+TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false
 
 # tailscale config
 

.github/dependabot.yml

@@ -9,8 +9,6 @@ updates:
           - "minor"
     schedule:
       interval: "daily"
-    cooldown:
-     default-days: 1
 
   - package-ecosystem: "gomod"
     directory: "/"
@@ -21,19 +19,13 @@ updates:
           - "minor"
     schedule:
       interval: "daily"
-    cooldown:
-     default-days: 1
 
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "daily"
-    cooldown:
-     default-days: 1
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "daily"
-    cooldown:
-     default-days: 1

.github/workflows/ci.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: ./frontend/package.json
 

.github/workflows/e2e.yml

@@ -0,0 +1,43 @@
+name: Run e2e tests
+on:
+  workflow_dispatch:
+  # pull_request:
+  #   branches:
+  #     - main
+
+jobs:
+  test:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        with:
+          package_json_file: ./e2e/package.json
+
+      - name: Set up Docker
+        uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0
+
+      - name: Install dependencies
+        run: pnpm ci
+        working-directory: e2e
+
+      - name: Install Playwright Browsers
+        run: pnpm exec playwright install --with-deps
+        working-directory: e2e
+
+      - name: Run Playwright tests
+        run: pnpm test
+        working-directory: e2e
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: e2e/playwright-report/
+          retention-days: 5

.github/workflows/nightly.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Delete old release
         run: gh release delete --cleanup-tag --yes nightly || echo release not found
@@ -38,7 +38,7 @@ jobs:
       BUILD_TAGS: ${{ steps.metadata.outputs.BUILD_TAGS }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
@@ -58,12 +58,12 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: ./frontend/package.json
 
@@ -107,12 +107,12 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: ./frontend/package.json
 
@@ -156,7 +156,7 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
@@ -167,14 +167,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -215,7 +215,7 @@ jobs:
       - image-build
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
@@ -226,14 +226,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -274,7 +274,7 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
@@ -285,14 +285,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -333,7 +333,7 @@ jobs:
       - image-build-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: nightly
 
@@ -344,14 +344,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -399,14 +399,14 @@ jobs:
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Docker meta
         id: meta
@@ -438,14 +438,14 @@ jobs:
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Docker meta
         id: meta

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       BUILD_TAGS: ${{ steps.metadata.outputs.BUILD_TAGS }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate metadata
         id: metadata
@@ -38,10 +38,10 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: ./frontend/package.json
 
@@ -84,10 +84,10 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: ./frontend/package.json
 
@@ -130,7 +130,7 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Docker meta
         id: meta
@@ -139,14 +139,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -187,7 +187,7 @@ jobs:
       - image-build
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Docker meta
         id: meta
@@ -196,14 +196,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -244,7 +244,7 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Docker meta
         id: meta
@@ -253,14 +253,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -301,7 +301,7 @@ jobs:
       - image-build-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Docker meta
         id: meta
@@ -310,14 +310,14 @@ jobs:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
@@ -366,14 +366,14 @@ jobs:
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Docker meta
         id: meta
@@ -407,14 +407,14 @@ jobs:
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Docker meta
         id: meta

.github/workflows/scorecard.yml

@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc
         with:
           results_file: results.sarif
           results_format: sarif
@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif

.github/workflows/sponsors.yml

@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Generate Sponsors
-        uses: JamesIves/github-sponsors-readme-action@2fd9142e765f755780202122261dc85e78459405 # v1
+        uses: JamesIves/github-sponsors-readme-action@02650b8cd445fc16dfef73195f9c406dce041623 # v1.6.1
         with:
           token: ${{ secrets.SPONSORS_GENERATOR_PAT }}
           active-only: false

.gitignore

@@ -50,7 +50,10 @@ __debug_*
 config.certify.yml
 
 # deepsec
-/.deepsec
+/.deepsec/
 
 # jetbrains
 /.idea/
+
+# claude stuff
+/.claude/

AGENTS.md

@@ -0,0 +1,151 @@
+# Agents
+
+*This file is written by Humans for Agents.*
+
+## Overview
+
+Tinyauth is a lightweight and open-source authentication server written in Go and TypeScript (React). It acts as either an authentication middleware (forward_auth, ext_authz or auth_request) to protect applications using proxy authentication or as an OpenID Connect provider to offer SSO (Single-Sign-On) to your self-hosted apps. It supports local users with optional 2FA (via TOTP), LDAP, SSO users via OAuth, and access controls (ACLs). Tinyauth can be deployed with Docker, Kubernetes or bare-metal with a binary.
+
+## Considerations
+
+- The repository we are working at is `https://github.com/tinyauthapp/tinyauth`.
+- ALWAYS follow the instructions for committing and creating a pull request as mentioned below. 
+
+## Philosophy
+
+Tinyauth is designed to run with simplicity in mind. This is why we try to avoid adding unnecessary persistent storage and configuration options.
+
+Tinyauth can run without persistent storage, and the SQLite database is only used for storing normal or OpenID Connect sessions. You MUST never store data in the database that is required for Tinyauth function.
+
+As for the configuration, we support environment variables, CLI flags and a YAML configuration file. We try to keep the required configuration at a minimal with sane defaults so users can spend the least amount of time configuring Tinyauth.
+
+We NEVER create a breaking change unless absolutely necessary and only if non-breaking changes have been discussed and deemed not ideal.
+
+## Technical Overview
+
+Tinyauth is designed to be as modular as possible. We use a repository-service-controller structure where each service/controller/middleware defines its dependencies in a Dig input struct, and then the main bootstrap entrypoint dynamically injects the dependencies to each method.
+
+All methods share one global static config struct, which contains the user configuration as is, and a runtime config struct that contains dynamically generated values on startup. If a method needs a modified version, it MUST never modify the global configuration struct but rather create a local copy.
+
+We write database migrations by hand. Migrations go in the respective database directory inside the `assets/migrations` directory and follow the `000001_migration_name_in_snake_case.sql` format where the 6-digit number is incremented on each new migration. The repository is automatically generated from SQL queries, SQLC and our own custom generator that unifies each SQLC package into one repository interface. Always ensure that migrations and queries exist for all available database drivers, else our store generation will fail. After adding your migrations and queries, run the SQLC code-gen with `make sql` and update the store code-gen with `make generate`. DO NOT EDIT the automatically generated files from SQLC or our store generator, they are marked.
+
+When updating translations, you should only update the `frontend/src/lib/i18n/locales/en.json` and `frontend/src/lib/i18n/locales/en-US.json` files (they should be exactly the same). Crowdin will handle the generation of the keys for the rest of the available locales. NEVER hard-code plain English in the frontend, instead use the available `i18next` library and the respective translations.
+
+For the REST framework we use Gin. However, functions or methods should avoid using the Gin Context (`gin.Context`) and default to stdlib arguments and outputs. The Gin Context exposes stdlib-compatible structs such as `http.Request` and `http.ResponseWriter` and is compatible with the `context` package.
+
+When you need to log in the backend, use the injected logger, NOT the global zerolog struct.
+
+In case you need toolchain versions, you can find the Node + Go version in the `Dockerfile` and the PNPM version in the `package.json` file inside the `frontend` directory.
+
+Tinyauth uses Semantic Versioning (SemVer) for versions. 
+
+## File structure
+
+Tinyauth is composed of two parts, the React frontend and the Go backend.
+
+A high level of the backend is as follows:
+
+```text
+internal 
+├── assets # Contains the embedded assets
+│   ├── dist # Dist is the compiled frontend
+│   └── migrations # Migrations in SQL for all supported databases
+│       ├── postgres
+│       └── sqlite
+├── bootstrap # The main entrypoint that bootstraps and starts Tinyauth, called by the CLI
+├── controller # All of the HTTP controllers
+├── middleware # The HTTP middlewares
+├── model # Configuration schemas
+├── repository # Repository holds all of the queries used by the services, each child-repository implements the store interface
+│   ├── memory
+│   ├── postgres
+│   └── sqlite
+├── service # The services that handle the underlying logic for the controllers
+├── test # Creates any necessary package-wide configurations and helpers used by tests 
+└── utils # Small helpers and utils used by the app
+    ├── decoders # Wrappers around paerser decoders such as the label decoder
+    ├── loaders # The env, cli and YAML wrappers around the paerser loaders
+    └── logger # A wrapper around the zerolog logging library
+```
+
+Same for the frontend:
+
+```text
+frontend/src
+├── components # Different components used by the pages
+│   ├── auth # Forms used for authentication
+│   ├── domain-warning # Domain warning when configured domain and actual domain don't match
+│   ├── icons # Hardcoded SVG icons for OAuth providers
+│   ├── layout # Main frontend layout
+│   ├── providers # Different state providers such as theme
+│   ├── quick-actions # The top right quick settings menu
+│   └── ui # ShadCN based UI components
+├── context # Holds and provides the app and user context
+├── lib # Helpers used by the pages
+│   ├── hooks # Hooks around the query parameters
+│   └── i18n # Holds translation logic
+│       └── locales # The raw JSON locales provided by Crowdin
+├── pages # The actual app pages
+└── schemas # Different schemas, mostly used for fetching data from the backend
+```
+
+## Make recipes
+
+Tinyauth uses a Makefile for simplifying development. A reference of the available recipes can be found below:
+
+- `deps` - Install the frontend and backend dependencies.
+- `clean-data` - Clean any data created by running Tinyauth.
+- `clean-webui` - Clean frontend build output.
+- `webui` - Compile the WebUI.
+- `binary` - Compile the binary for the current system.
+- `binary-linux-amd64` - Compile the binary for Linux amd64.
+- `binary-linux-arm64` - Compile the binary for Linux arm64.
+- `test` - Test the Go backend.
+- `vet` - Vet the Go backend.
+- `test-race` - Test the Go backend with the race detector enabled.
+- `dev` - Start the Docker-based development server.
+- `prod` - Start the Docker-based production deployment (used for testing pre-releases).
+- `sql` - Generate the SQLC repositories.
+- `generate` - Update Go code-gen.
+- `docker` - Build the Docker image for the current system.
+- `docker-distroless` - Build the distroless Docker image for the current system.
+- `lint-webui` - Lint the frontend with ESLint.
+- `fmt` - Format the Go code with the Go `fmt` tool.
+
+## Development lifecycle
+
+Development of Tinyauth happens inside two Docker containers. The backend is built automatically by air using a template build output for the frontend. The frontend is run with PNPM, and then backend requests are routed with the help of Vite's proxy.
+
+When developing, you should default to the `make dev` command to start everything in Docker and avoid platform-specific issues. If you need to test the CLI, use the `make binary` command.
+
+After finishing with the development, test and vet the backend with `make test` and `make vet` respectively. If you believe you need to test for race conditions, use `make test-race`. You can also test specific parts of the code using the normal `go test` command, for example to run the `TestHealthController` test, you can use `go test ./internal/controller/ -run TestHealthController -v`. Finally, format the Go code with `make fmt`.
+
+If you made any changes to the frontend, make sure to lint with  `make lint-webui`.
+
+NEVER run any destructive commands like `make clean-data` or delete any configurations without the user's approval.
+
+## Creating a pull request
+
+When committing, you MUST use the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0) standard for your commit messages. You can add a commit description if you like. You MUST also use your standard no-reply Co-Author trailer (`Co-Authored-By:`).
+
+You should work in separate branches unless it's clearly specified to work in the main branch. When working in a separate branch, follow the naming convention below:
+
+```text
+[feat/refactor/fix/tests/etc]/[small-change-description-in-kebab-case]
+```
+
+For example, if your change was to add OAuth to Tinyauth, the branch would look as follows:
+
+```text
+feat/oauth
+```
+
+Or:
+
+```text
+feat/add-oauth-support
+```
+
+Shorter branch names that still describe the general change are preferred.
+
+Finally, when creating the actual pull request and if you have access to the internet/a GitHub tool, you should look if it resolves any open issues and if it does, reference them.

Dockerfile

@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.5-alpine3.23 AS frontend-builder
+FROM node:26.7-alpine3.23 AS frontend-builder
 
 WORKDIR /frontend
 

Dockerfile.distroless

@@ -1,5 +1,5 @@
 # Site builder
-FROM node:26.5-alpine3.23 AS frontend-builder
+FROM node:26.7-alpine3.23 AS frontend-builder
 
 WORKDIR /frontend
 

Makefile

@@ -78,18 +78,10 @@ test-race:
 dev:
 	docker compose -f $(DEV_COMPOSE) up --force-recreate --pull=always --remove-orphans --build
 
-# Development - Infisical
-dev-infisical:
-	infisical run --env=dev -- docker compose -f $(DEV_COMPOSE) up --force-recreate --pull=always --remove-orphans --build
-
 # Production
 prod:
 	docker compose -f $(PROD_COMPOSE) up --force-recreate --pull=always --remove-orphans
 
-# Production - Infisical
-prod-infisical:
-	infisical run --env=dev -- docker compose -f $(PROD_COMPOSE) up --force-recreate --pull=always --remove-orphans
-
 # SQL
 sql:
 	sqlc generate
@@ -115,3 +107,11 @@ docker-distroless:
 		--build-arg=BUILD_TIMESTAMP=$(BUILD_TIMESTAMP) \
 		--build-arg=BUILD_TAGS=$(BUILD_TAGS) \
 		-f Dockerfile.distroless .
+
+# Lint the frontend
+lint-webui:
+	cd frontend && pnpm lint
+
+# Format the code
+fmt:
+	go fmt ./...

README.md

@@ -67,17 +67,22 @@ Tinyauth is licensed under the GNU Affero General Public License v3.0. TL;DR —
 A big thank-you to the following individuals and companies
 for their support for Tinyauth.
 
+### Individuals
+
+A huge thank you to [selfh.st](https://selfh.st) for their generous donation to Tinyauth.
+
+<img alt="selfh.st" width="128" src="https://selfh.st/content/images/size/w640/format/webp/2025/04/selfh-st-logo-white-1.svg">
+
+---
+
+<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https:&#x2F;&#x2F;github.com&#x2F;erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a>&nbsp;&nbsp;<a href="https://github.com/nicotsx"><img src="https:&#x2F;&#x2F;github.com&#x2F;nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a>&nbsp;&nbsp;<a href="https://github.com/SimpleHomelab"><img src="https:&#x2F;&#x2F;github.com&#x2F;SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a>&nbsp;&nbsp;<a href="https://github.com/jmadden91"><img src="https:&#x2F;&#x2F;github.com&#x2F;jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a>&nbsp;&nbsp;<a href="https://github.com/tribor"><img src="https:&#x2F;&#x2F;github.com&#x2F;tribor.png" width="64px" alt="User avatar: tribor" /></a>&nbsp;&nbsp;<a href="https://github.com/eliasbenb"><img src="https:&#x2F;&#x2F;github.com&#x2F;eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a>&nbsp;&nbsp;<a href="https://github.com/afunworm"><img src="https:&#x2F;&#x2F;github.com&#x2F;afunworm.png" width="64px" alt="User avatar: afunworm" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="64px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/Lancelot-Enguerrand"><img src="https:&#x2F;&#x2F;github.com&#x2F;Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a>&nbsp;&nbsp;<a href="https://github.com/allgoewer"><img src="https:&#x2F;&#x2F;github.com&#x2F;allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a>&nbsp;&nbsp;<a href="https://github.com/NEANC"><img src="https:&#x2F;&#x2F;github.com&#x2F;NEANC.png" width="64px" alt="User avatar: NEANC" /></a>&nbsp;&nbsp;<a href="https://github.com/axjab"><img src="https:&#x2F;&#x2F;github.com&#x2F;axjab.png" width="64px" alt="User avatar: axjab" /></a>&nbsp;&nbsp;<a href="https://github.com/stegratech"><img src="https:&#x2F;&#x2F;github.com&#x2F;stegratech.png" width="64px" alt="User avatar: stegratech" /></a>&nbsp;&nbsp;<a href="https://github.com/apearson"><img src="https:&#x2F;&#x2F;github.com&#x2F;apearson.png" width="64px" alt="User avatar: apearson" /></a>&nbsp;&nbsp;<a href="https://github.com/Micky5991"><img src="https:&#x2F;&#x2F;github.com&#x2F;Micky5991.png" width="64px" alt="User avatar: Micky5991" /></a>&nbsp;&nbsp;<!-- sponsors -->
+
 ### Companies and Organizations
 
 - [JetBrains for Open-Source](https://jb.gg/OpenSource)
 - [CodeRabbit AI](https://www.coderabbit.ai)
-- [Dosu](https://dosu.dev/)
 - [InstaPods](https://instapods.com) - [Deploy Tinyauth from 3$/month](https://app.instapods.com/dashboard/pods/create?app=tinyauth&ref=tinyauth)
 
-### Individuals
-
-<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https:&#x2F;&#x2F;github.com&#x2F;erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a>&nbsp;&nbsp;<a href="https://github.com/nicotsx"><img src="https:&#x2F;&#x2F;github.com&#x2F;nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a>&nbsp;&nbsp;<a href="https://github.com/SimpleHomelab"><img src="https:&#x2F;&#x2F;github.com&#x2F;SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a>&nbsp;&nbsp;<a href="https://github.com/jmadden91"><img src="https:&#x2F;&#x2F;github.com&#x2F;jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a>&nbsp;&nbsp;<a href="https://github.com/tribor"><img src="https:&#x2F;&#x2F;github.com&#x2F;tribor.png" width="64px" alt="User avatar: tribor" /></a>&nbsp;&nbsp;<a href="https://github.com/eliasbenb"><img src="https:&#x2F;&#x2F;github.com&#x2F;eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a>&nbsp;&nbsp;<a href="https://github.com/afunworm"><img src="https:&#x2F;&#x2F;github.com&#x2F;afunworm.png" width="64px" alt="User avatar: afunworm" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="64px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/Lancelot-Enguerrand"><img src="https:&#x2F;&#x2F;github.com&#x2F;Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a>&nbsp;&nbsp;<a href="https://github.com/allgoewer"><img src="https:&#x2F;&#x2F;github.com&#x2F;allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a>&nbsp;&nbsp;<a href="https://github.com/NEANC"><img src="https:&#x2F;&#x2F;github.com&#x2F;NEANC.png" width="64px" alt="User avatar: NEANC" /></a>&nbsp;&nbsp;<a href="https://github.com/axjab"><img src="https:&#x2F;&#x2F;github.com&#x2F;axjab.png" width="64px" alt="User avatar: axjab" /></a>&nbsp;&nbsp;<a href="https://github.com/stegratech"><img src="https:&#x2F;&#x2F;github.com&#x2F;stegratech.png" width="64px" alt="User avatar: stegratech" /></a>&nbsp;&nbsp;<a href="https://github.com/apearson"><img src="https:&#x2F;&#x2F;github.com&#x2F;apearson.png" width="64px" alt="User avatar: apearson" /></a>&nbsp;&nbsp;<a href="https://github.com/Micky5991"><img src="https:&#x2F;&#x2F;github.com&#x2F;Micky5991.png" width="64px" alt="User avatar: Micky5991" /></a>&nbsp;&nbsp;<!-- sponsors -->
-
 ## Acknowledgements
 
 - **Freepik** for providing the police hat and badge.

e2e/.gitignore

@@ -0,0 +1,7 @@
+# playwright files
+/node_modules/
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+/playwright/.auth/

e2e/conf/Caddyfile

@@ -0,0 +1,15 @@
+{
+	auto_https off
+}
+
+http://whoami.127.0.0.1.sslip.io {
+	forward_auth tinyauth:3000 {
+		uri /api/auth/caddy
+		copy_headers Remote-User Remote-Name Remote-Email Remote-Groups
+	}
+	reverse_proxy whoami:80
+}
+
+http://tinyauth.127.0.0.1.sslip.io {
+	reverse_proxy tinyauth:3000
+}

e2e/config.e2e.yaml

@@ -0,0 +1,22 @@
+appUrl: http://tinyauth.127.0.0.1.sslip.io
+
+log:
+  level: debug
+
+auth:
+  users:
+    # user1:password,user2:password,user3:password:token
+    - user1:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e
+    - user2:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e
+    - user3:$2a$10$h1laww4k5a4bJcG5KwE3nO45YKSC4mOKHxbcccgxr3Y7H9zHlQe8e:MVR4JQWNXYKNM6HHJEYEFP2O74QIIEJE
+  # disable rate limits for multiple workers to work
+  loginMaxRetries: 0
+
+apps:
+  whoami:
+    config:
+      domain: whoami.127.0.0.1.sslip.io
+    path:
+      allow: /foo
+    users:
+      allow: user1

e2e/docker-compose.e2e.yml

@@ -0,0 +1,24 @@
+services:
+  caddy:
+    image: caddy:2.11.4
+    pull_policy: missing
+    ports:
+      - 80:80
+    volumes:
+      - ./conf:/etc/caddy
+
+  whoami:
+    image: traefik/whoami:v1.11.0
+    pull_policy: missing
+
+  tinyauth:
+    build:
+      context: ../
+      dockerfile: Dockerfile
+      args:
+        - VERSION=e2e
+        - BUILD_TAGS=nomsgpack
+        - LDFLAGS=-s -w
+    command: ["--configfile", "/app/config.yaml"]
+    volumes:
+      - ./config.e2e.yaml:/app/config.yaml:ro

e2e/fixtures/auth.fixtures.ts

@@ -0,0 +1,47 @@
+import {expect, Page} from '@playwright/test';
+import { OTP } from 'otplib';
+
+export class LoginFixture {
+    constructor(public readonly page: Page) {}
+
+    async run(username: string, password: string) {
+        await expect(this.page.getByText('Welcome back, please login')).toBeVisible();
+        await this.page.getByLabel('Username').fill(username);
+        await this.page.getByLabel('Password').fill(password);
+        await this.page.getByRole('button', { name: 'Login' }).click();
+    }
+
+    async expectSuccess(username: string) {
+        await expect(this.page.getByText(`You are currently logged in as ${username}.`)).toBeVisible()
+    }
+}
+
+export class LogoutFixture {
+    constructor(public readonly page: Page) {}
+
+    async run() {
+        await expect(this.page.getByText('Click the button below to logout.')).toBeVisible();
+        await this.page.getByRole('button', { name: 'Logout' }).click();
+    }
+
+    async expectSuccess() {
+        await expect(this.page.getByText('Welcome back, please login')).toBeVisible();
+    }
+}
+
+export class TOTPFixture {
+    constructor(public readonly page: Page) {}
+
+    async run(secret: string) {
+        await expect(this.page.getByText('Enter your TOTP code')).toBeVisible();
+        const otp = new OTP();
+        const token = await otp.generate({ secret });
+        await this.page.getByPlaceholder('XXXXXX').fill(token);
+        // we shouldn't need to click continue, it will auto submit
+        // await this.page.getByRole('button', { name: 'Continue' }).click();
+    }
+
+    async expectSuccess(username: string) {
+        await expect(this.page.getByText(`You are currently logged in as ${username}.`)).toBeVisible()
+    }
+}

e2e/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "e2e",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "down": "docker compose -f docker-compose.e2e.yml down",
+    "up": "docker compose -f docker-compose.e2e.yml up --build --force-recreate --remove-orphans",
+    "test": "playwright test",
+    "report": "playwright show-report"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "^11.1.2",
+      "onFail": "download"
+    }
+  },
+  "type": "module",
+  "devDependencies": {
+    "@playwright/test": "^1.61.1",
+    "@types/node": "^26.1.1"
+  },
+  "dependencies": {
+    "otplib": "^13.4.1"
+  }
+}

e2e/playwright.config.ts

@@ -0,0 +1,49 @@
+import { defineConfig, devices } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './specs',
+  fullyParallel: true,
+  forbidOnly: false,
+  retries: 0,
+  workers: 4,
+  reporter: 'html',
+  use: {
+    trace: 'on-first-retry',
+    video: 'on',
+  },
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] },
+    },
+    {
+      name: 'firefox',
+      use: { ...devices['Desktop Firefox'] },
+    },
+
+    {
+      name: 'webkit',
+      use: { ...devices['Desktop Safari'] },
+    },
+    {
+      name: 'Mobile Chrome',
+      use: { ...devices['Pixel 5'] },
+    },
+    {
+      name: 'Mobile Safari',
+      use: { ...devices['iPhone 12'] },
+    },
+  ],
+  webServer: {
+    command: 'pnpm run up',
+    url: 'http://tinyauth.127.0.0.1.sslip.io/api/healthz',
+    reuseExistingServer: true,
+    timeout: 5 * 60 * 1000,
+    gracefulShutdown: {
+      signal: 'SIGINT',
+      timeout: 1000,
+    },
+    stderr: 'pipe',
+    stdout: 'pipe',
+  },
+});

e2e/pnpm-lock.yaml

@@ -0,0 +1,338 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      '@pnpm/exe':
+        specifier: ^11.1.2
+        version: 11.13.1
+      pnpm:
+        specifier: ^11.1.2
+        version: 11.13.1
+
+packages:
+
+  '@pnpm/exe@11.13.1':
+    resolution: {integrity: sha512-P4euEK6lOFnd5oTHEc5M/HhvyF4XUhTnVsklEcM6rmY0QJxPD6xbT+u1+gskEIBp4nSRorz20IJQtAU1Nerggg==}
+    hasBin: true
+
+  '@pnpm/linux-arm64@11.13.1':
+    resolution: {integrity: sha512-wB8zloqrYrudPyuA5qbuTCnJGe4eETPwqOjoPjoyyyvA4zFI5XfLpxgqOOcaY5UJBoqzckcGpRVDwhSRfsQ/6A==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@pnpm/linux-x64@11.13.1':
+    resolution: {integrity: sha512-A+wnEvzfWEvanXiwww3tnOPmtjPSrrf5tOP6vk8+K0BRFEe/Df0oPytm2nWgGcn5iwPnqtr1Btkof913McnSPA==}
+    cpu: [x64]
+    os: [linux]
+
+  '@pnpm/linuxstatic-arm64@11.13.1':
+    resolution: {integrity: sha512-k4t65VeqRX4COMFe45TF58CVmCpmAsKZShaR1HobmUeleo98mWTctggKolrA2MHcVUeSS+12yB5Urb3uDazhmw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/linuxstatic-x64@11.13.1':
+    resolution: {integrity: sha512-A65GqPzwCl0bAMk3kRWfbjSRBm5RRaqR2oMxV/9AYZrwO0X9yEfngbLBISCPHjt6/Qe4nH7DFemyhy6yODYwEw==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/macos-arm64@11.13.1':
+    resolution: {integrity: sha512-MJvOtyGOWSfBoqdVEfAH8ljmHs13mt82k/UxN4f+q7koDxJRR2n4Nie6Og6RwbnbaubCz0Fh2bTeL1+MxDSFpA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/win-arm64@11.13.1':
+    resolution: {integrity: sha512-kl/g1cCKOJPe4HntspyrAJW0LRco0UHnVfxHSspezo4Zj4AanJAZ8WzLqfa6/w3lBSKHTEN4x0pb3m4J7B7Vpw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/win-x64@11.13.1':
+    resolution: {integrity: sha512-Bcb14NeBlbHS2Gq1qr8VnCiAz5eC1lYzXOls7zH0bnV0Taaj4/xyfm0HVO4dn9R2TQtVtz1qnBZHHL9PDFumqQ==}
+    cpu: [x64]
+    os: [win32]
+
+  '@reflink/reflink-darwin-arm64@0.1.19':
+    resolution: {integrity: sha512-ruy44Lpepdk1FqDz38vExBY/PVUsjxZA+chd9wozjUH9JjuDT/HEaQYA6wYN9mf041l0yLVar6BCZuWABJvHSA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@reflink/reflink-darwin-x64@0.1.19':
+    resolution: {integrity: sha512-By85MSWrMZa+c26TcnAy8SDk0sTUkYlNnwknSchkhHpGXOtjNDUOxJE9oByBnGbeuIE1PiQsxDG3Ud+IVV9yuA==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@reflink/reflink-linux-arm64-gnu@0.1.19':
+    resolution: {integrity: sha512-7P+er8+rP9iNeN+bfmccM4hTAaLP6PQJPKWSA4iSk2bNvo6KU6RyPgYeHxXmzNKzPVRcypZQTpFgstHam6maVg==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@reflink/reflink-linux-arm64-musl@0.1.19':
+    resolution: {integrity: sha512-37iO/Dp6m5DDaC2sf3zPtx/hl9FV3Xze4xoYidrxxS9bgP3S8ALroxRK6xBG/1TtfXKTvolvp+IjrUU6ujIGmA==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@reflink/reflink-linux-x64-gnu@0.1.19':
+    resolution: {integrity: sha512-jbI8jvuYCaA3MVUdu8vLoLAFqC+iNMpiSuLbxlAgg7x3K5bsS8nOpTRnkLF7vISJ+rVR8W+7ThXlXlUQ93ulkw==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@reflink/reflink-linux-x64-musl@0.1.19':
+    resolution: {integrity: sha512-e9FBWDe+lv7QKAwtKOt6A2W/fyy/aEEfr0g6j/hWzvQcrzHCsz07BNQYlNOjTfeytrtLU7k449H1PI95jA4OjQ==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@reflink/reflink-win32-arm64-msvc@0.1.19':
+    resolution: {integrity: sha512-09PxnVIQcd+UOn4WAW73WU6PXL7DwGS6wPlkMhMg2zlHHG65F3vHepOw06HFCq+N42qkaNAc8AKIabWvtk6cIQ==}
+    engines: {node: '>= 10'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@reflink/reflink-win32-x64-msvc@0.1.19':
+    resolution: {integrity: sha512-E//yT4ni2SyhwP8JRjVGWr3cbnhWDiPLgnQ66qqaanjjnMiu3O/2tjCPQXlcGc/DEYofpDc9fvhv6tALQsMV9w==}
+    engines: {node: '>= 10'}
+    cpu: [x64]
+    os: [win32]
+
+  '@reflink/reflink@0.1.19':
+    resolution: {integrity: sha512-DmCG8GzysnCZ15bres3N5AHCmwBwYgp0As6xjhQ47rAUTUXxJiK+lLUxaGsX3hd/30qUpVElh05PbGuxRPgJwA==}
+    engines: {node: '>= 10'}
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  pnpm@11.13.1:
+    resolution: {integrity: sha512-svx2g7imUlQU59E+G6KMqt3elr9m7FQL+ut+cCuB8+C+TR8pXt9/n+A5Z0Co3ORQnFgt33mJH0VD/qMtN2RfJQ==}
+    engines: {node: '>=22.13'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe@11.13.1':
+    dependencies:
+      '@reflink/reflink': 0.1.19
+      detect-libc: 2.1.2
+    optionalDependencies:
+      '@pnpm/linux-arm64': 11.13.1
+      '@pnpm/linux-x64': 11.13.1
+      '@pnpm/linuxstatic-arm64': 11.13.1
+      '@pnpm/linuxstatic-x64': 11.13.1
+      '@pnpm/macos-arm64': 11.13.1
+      '@pnpm/win-arm64': 11.13.1
+      '@pnpm/win-x64': 11.13.1
+
+  '@pnpm/linux-arm64@11.13.1':
+    optional: true
+
+  '@pnpm/linux-x64@11.13.1':
+    optional: true
+
+  '@pnpm/linuxstatic-arm64@11.13.1':
+    optional: true
+
+  '@pnpm/linuxstatic-x64@11.13.1':
+    optional: true
+
+  '@pnpm/macos-arm64@11.13.1':
+    optional: true
+
+  '@pnpm/win-arm64@11.13.1':
+    optional: true
+
+  '@pnpm/win-x64@11.13.1':
+    optional: true
+
+  '@reflink/reflink-darwin-arm64@0.1.19':
+    optional: true
+
+  '@reflink/reflink-darwin-x64@0.1.19':
+    optional: true
+
+  '@reflink/reflink-linux-arm64-gnu@0.1.19':
+    optional: true
+
+  '@reflink/reflink-linux-arm64-musl@0.1.19':
+    optional: true
+
+  '@reflink/reflink-linux-x64-gnu@0.1.19':
+    optional: true
+
+  '@reflink/reflink-linux-x64-musl@0.1.19':
+    optional: true
+
+  '@reflink/reflink-win32-arm64-msvc@0.1.19':
+    optional: true
+
+  '@reflink/reflink-win32-x64-msvc@0.1.19':
+    optional: true
+
+  '@reflink/reflink@0.1.19':
+    optionalDependencies:
+      '@reflink/reflink-darwin-arm64': 0.1.19
+      '@reflink/reflink-darwin-x64': 0.1.19
+      '@reflink/reflink-linux-arm64-gnu': 0.1.19
+      '@reflink/reflink-linux-arm64-musl': 0.1.19
+      '@reflink/reflink-linux-x64-gnu': 0.1.19
+      '@reflink/reflink-linux-x64-musl': 0.1.19
+      '@reflink/reflink-win32-arm64-msvc': 0.1.19
+      '@reflink/reflink-win32-x64-msvc': 0.1.19
+
+  detect-libc@2.1.2: {}
+
+  pnpm@11.13.1: {}
+
+---
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      otplib:
+        specifier: ^13.4.1
+        version: 13.4.1
+    devDependencies:
+      '@playwright/test':
+        specifier: ^1.61.1
+        version: 1.61.1
+      '@types/node':
+        specifier: ^26.1.1
+        version: 26.1.1
+
+packages:
+
+  '@noble/hashes@2.2.0':
+    resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
+    engines: {node: '>= 20.19.0'}
+
+  '@otplib/core@13.4.1':
+    resolution: {integrity: sha512-KIXgK1hNtWJEBMTastbe1bpmuais+3f+ATeO8TkMs2rNkfGO1FbQy8+/UWVEu3TR/iTJerU0idkPudaPmLP2BA==}
+
+  '@otplib/hotp@13.4.1':
+    resolution: {integrity: sha512-g9q04SwpG5ZtMnVkUcgcoAlwCH4YLROZN1qhyBwgkBzqYYVSYhpP6gSGaxGHwePLt1c+e6NqDlgIZN+e1/XPuA==}
+
+  '@otplib/plugin-base32-scure@13.4.1':
+    resolution: {integrity: sha512-Fs/r5qisC05SRhT6xWXaypB6PVC0vgWf6zztmi0J5RnQ09OJiPDWCJFH6cDm6ANsrdvB9di7X+Jb7L13BoEbUA==}
+
+  '@otplib/plugin-crypto-noble@13.4.1':
+    resolution: {integrity: sha512-PJfVW8/1hdS6CfxLheKPZSLTwDq4TijZbN4yRjxlv0ODdzmxpM+wGwWr1JXMdy0xJPxLziydQD5gdVqrR4/gAg==}
+
+  '@otplib/totp@13.4.1':
+    resolution: {integrity: sha512-QOkBVPrf6AM4qZaReZPSk9/I8ATVdZpIISJz115MqeVtcrbcr5llPZ0J7804tpnjnp1vCRkI5Qjd47HhgVteBQ==}
+
+  '@otplib/uri@13.4.1':
+    resolution: {integrity: sha512-xaIm7bvICMhoB2rZIR5luiaMdssWR5nY5nXnR1fdezUgZuEO58D6zrGzLp7pQuBmlpmL0HagnscDQFoskp9yiA==}
+
+  '@playwright/test@1.61.1':
+    resolution: {integrity: sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  '@scure/base@2.2.0':
+    resolution: {integrity: sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg==}
+
+  '@types/node@26.1.1':
+    resolution: {integrity: sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw==}
+
+  fsevents@2.3.2:
+    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  otplib@13.4.1:
+    resolution: {integrity: sha512-o5CxfDw6bh7hoDv0NUUIcc0RqzJ9ipfUrzeKheKJ+vs4rXZnDlA9n4a/7R1cDjpmLjKLix4BgNVRmoDkm5rLSQ==}
+
+  playwright-core@1.61.1:
+    resolution: {integrity: sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  playwright@1.61.1:
+    resolution: {integrity: sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  undici-types@8.3.0:
+    resolution: {integrity: sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==}
+
+snapshots:
+
+  '@noble/hashes@2.2.0': {}
+
+  '@otplib/core@13.4.1': {}
+
+  '@otplib/hotp@13.4.1':
+    dependencies:
+      '@otplib/core': 13.4.1
+      '@otplib/uri': 13.4.1
+
+  '@otplib/plugin-base32-scure@13.4.1':
+    dependencies:
+      '@otplib/core': 13.4.1
+      '@scure/base': 2.2.0
+
+  '@otplib/plugin-crypto-noble@13.4.1':
+    dependencies:
+      '@noble/hashes': 2.2.0
+      '@otplib/core': 13.4.1
+
+  '@otplib/totp@13.4.1':
+    dependencies:
+      '@otplib/core': 13.4.1
+      '@otplib/hotp': 13.4.1
+      '@otplib/uri': 13.4.1
+
+  '@otplib/uri@13.4.1':
+    dependencies:
+      '@otplib/core': 13.4.1
+
+  '@playwright/test@1.61.1':
+    dependencies:
+      playwright: 1.61.1
+
+  '@scure/base@2.2.0': {}
+
+  '@types/node@26.1.1':
+    dependencies:
+      undici-types: 8.3.0
+
+  fsevents@2.3.2:
+    optional: true
+
+  otplib@13.4.1:
+    dependencies:
+      '@otplib/core': 13.4.1
+      '@otplib/hotp': 13.4.1
+      '@otplib/plugin-base32-scure': 13.4.1
+      '@otplib/plugin-crypto-noble': 13.4.1
+      '@otplib/totp': 13.4.1
+      '@otplib/uri': 13.4.1
+
+  playwright-core@1.61.1: {}
+
+  playwright@1.61.1:
+    dependencies:
+      playwright-core: 1.61.1
+    optionalDependencies:
+      fsevents: 2.3.2
+
+  undici-types@8.3.0: {}

e2e/specs/apps.spec.ts

@@ -0,0 +1,28 @@
+import {expect, test} from '@playwright/test';
+import {LoginFixture} from "../fixtures/auth.fixtures";
+
+test('should be able to login to app with forward-auth', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    await page.goto('http://whoami.127.0.0.1.sslip.io');
+    // redirect to tinyauth
+    await expect(page.getByText('Welcome back, please login')).toBeVisible()
+    await loginFixture.run('user1', 'password')
+    // redirect to app
+    await expect(page.getByText('whoami.127.0.0.1.sslip.io')).toBeVisible()
+});
+
+test('non authorized user should not be able to access app', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    await page.goto('http://whoami.127.0.0.1.sslip.io');
+    // redirect to tinyauth
+    await expect(page.getByText('Welcome back, please login')).toBeVisible()
+    // user2 is not authorized to access app
+    await loginFixture.run('user2', 'password')
+    // redirect to app
+    await expect(page.getByText('The user with username user2 is not authorized to access the resource whoami.')).toBeVisible()
+})
+
+test('allowed path should skip authentication', async ({ page }) => {
+    await page.goto('http://whoami.127.0.0.1.sslip.io/foo');
+    await expect(page.getByText('whoami.127.0.0.1.sslip.io')).toBeVisible()
+})

e2e/specs/auth.spec.ts

@@ -0,0 +1,48 @@
+import { test, expect } from '@playwright/test';
+import {LoginFixture, LogoutFixture, TOTPFixture} from "../fixtures/auth.fixtures";
+
+test('should be able to login', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
+    await loginFixture.run('user1', 'password')
+    await loginFixture.expectSuccess('user1')
+});
+
+test('should fail to login with wrong credentials', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
+    await loginFixture.run('user27267', 'password')
+    const toast = page.locator('[data-sonner-toast]').first();
+    await expect(toast).toBeVisible();
+    await expect(toast).toContainText('Failed to log in');
+});
+
+
+test('should be able to logout', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
+    await loginFixture.run('user1', 'password')
+    await loginFixture.expectSuccess('user1')
+    const logoutFixture = new LogoutFixture(page);
+    await logoutFixture.run()
+})
+
+test('should be able to login with totp', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    const totpFixture = new TOTPFixture(page);
+    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
+    await loginFixture.run('user3', 'password')
+    await totpFixture.run('MVR4JQWNXYKNM6HHJEYEFP2O74QIIEJE')
+    await loginFixture.expectSuccess('user3');
+});
+
+test('should fail to login with wrong totp', async ({ page }) => {
+    const loginFixture = new LoginFixture(page);
+    const totpFixture = new TOTPFixture(page);
+    await page.goto('http://tinyauth.127.0.0.1.sslip.io');
+    await loginFixture.run('user3', 'password')
+    await totpFixture.run('VZVMOMQCBN24DJ5VRFAL5TJAZGBHXMN3')
+    const toast = page.locator('[data-sonner-toast]').first();
+    await expect(toast).toBeVisible();
+    await expect(toast).toContainText('Failed to verify code');
+});

frontend/package.json

@@ -12,49 +12,49 @@
   },
   "packageManager": "pnpm@11.1.2",
   "dependencies": {
-    "@hookform/resolvers": "^5.4.0",
+    "@hookform/resolvers": "^5.9.1",
-    "@radix-ui/react-dropdown-menu": "^2.1.20",
+    "@radix-ui/react-dropdown-menu": "^2.1.24",
-    "@radix-ui/react-label": "^2.1.11",
+    "@radix-ui/react-label": "^2.1.15",
-    "@radix-ui/react-select": "^2.3.3",
+    "@radix-ui/react-select": "^2.3.7",
-    "@radix-ui/react-separator": "^1.1.11",
+    "@radix-ui/react-separator": "^1.1.15",
-    "@radix-ui/react-slot": "^1.3.0",
+    "@radix-ui/react-slot": "^1.3.3",
-    "@tailwindcss/vite": "^4.3.2",
+    "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/react-query": "^5.101.2",
+    "@tanstack/react-query": "^5.101.4",
-    "axios": "^1.18.1",
+    "axios": "^1.19.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "i18next": "^26.3.6",
+    "i18next": "^26.4.0",
     "i18next-browser-languagedetector": "^8.2.1",
-    "i18next-resources-to-backend": "^1.2.1",
+    "i18next-resources-to-backend": "^1.2.3",
-    "lucide-react": "^1.24.0",
+    "lucide-react": "^1.33.0",
     "next-themes": "^0.4.6",
-    "radix-ui": "^1.6.2",
+    "radix-ui": "^1.6.7",
-    "react": "^19.2.7",
+    "react": "^19.2.8",
-    "react-dom": "^19.2.7",
+    "react-dom": "^19.2.8",
-    "react-hook-form": "^7.81.0",
+    "react-hook-form": "^7.86.0",
-    "react-i18next": "^17.0.10",
+    "react-i18next": "^17.0.12",
     "react-markdown": "^10.1.0",
-    "react-router": "^8.2.0",
+    "react-router": "^8.3.0",
-    "sonner": "^2.0.7",
+    "sonner": "^2.0.8",
     "tailwind-merge": "^3.5.0",
-    "tailwindcss": "^4.3.2",
+    "tailwindcss": "^4.3.3",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@tanstack/eslint-plugin-query": "^5.101.2",
+    "@tanstack/eslint-plugin-query": "^5.101.4",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
-    "@types/react": "^19.2.17",
+    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.3",
+    "@types/react-dom": "^19.2.4",
-    "@vitejs/plugin-react": "^6.0.3",
+    "@vitejs/plugin-react": "^6.1.0",
-    "eslint": "^10.7.0",
+    "eslint": "^10.9.0",
     "eslint-plugin-react-hooks": "^7.0.1",
-    "eslint-plugin-react-refresh": "^0.5.3",
+    "eslint-plugin-react-refresh": "^0.5.4",
-    "globals": "^17.7.0",
+    "globals": "^17.11.0",
-    "rollup-plugin-visualizer": "^7.0.1",
+    "rollup-plugin-visualizer": "^7.1.1",
     "tw-animate-css": "^1.4.0",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.64.0",
+    "typescript-eslint": "^8.67.0",
-    "vite": "^8.1.5"
+    "vite": "^8.2.2"
   }
 }

frontend/src/lib/i18n/locales/cs-CZ.json

@@ -15,16 +15,16 @@
   "loginOauthSuccessTitle": "Přesměrování",
   "loginOauthSuccessSubtitle": "Přesměrování k poskytovateli OAuth",
   "loginOauthAutoRedirectTitle": "Automatické přesměrování OAuth",
-  "loginOauthAutoRedirectSubtitle": "You will be automatically redirected to your OAuth provider to authenticate.",
+  "loginOauthAutoRedirectSubtitle": "Pro ověření budete automaticky přesměrování na svého poskytovatele OAuth.",
-  "loginOauthAutoRedirectButton": "Redirect now",
+  "loginOauthAutoRedirectButton": "Přesměrovat nyní",
   "continueTitle": "Pokračovat",
   "continueRedirectingTitle": "Přesměrování...",
   "continueRedirectingSubtitle": "Brzy budete přesměrováni do aplikace",
-  "continueRedirectManually": "Redirect me manually",
+  "continueRedirectManually": "Přesměrovat ručně",
   "continueInsecureRedirectTitle": "Nezabezpečené přesměrování",
   "continueInsecureRedirectSubtitle": "Pokoušíte se přesměrovat z <code>https</code> na <code>http</code>, které není bezpečné. Opravdu chcete pokračovat?",
-  "continueUntrustedRedirectTitle": "Untrusted redirect",
+  "continueUntrustedRedirectTitle": "Nedůvěryhodné přesměrování",
-  "continueUntrustedRedirectSubtitle": "You are trying to redirect to a domain that does not match your configured domain (<code>{{cookieDomain}}</code>). Are you sure you want to continue?",
+  "continueUntrustedRedirectSubtitle": "Pokoušíte se přesměrovat na doménu, která neodpovídá vaší nakonfigurované doméně (<code>{{cookieDomain}}</code>). Opravdu chcete pokračovat?",
   "logoutFailTitle": "Odhlášení se nezdařilo",
   "logoutFailSubtitle": "Zkuste to prosím znovu",
   "logoutSuccessTitle": "Odhlášen",
@@ -51,53 +51,53 @@
   "forgotPasswordTitle": "Zapomněli jste heslo?",
   "failedToFetchProvidersTitle": "Nepodařilo se načíst poskytovatele ověřování. Zkontrolujte prosím konfiguraci.",
   "errorTitle": "Došlo k chybě",
-  "errorSubtitleInfo": "The following error occurred while processing your request:",
+  "errorSubtitleInfo": "Při zpracování požadavku došlo k následující chybě:",
   "errorSubtitle": "Nastala chyba při pokusu o provedení této akce. Pro více informací prosím zkontrolujte konzolu.",
   "forgotPasswordMessage": "Heslo můžete obnovit změnou proměnné `USERS`.",
   "fieldRequired": "Toto pole je povinné",
   "invalidInput": "Neplatný údaj",
-  "domainWarningTitle": "Invalid Domain",
+  "domainWarningTitle": "Neplatná doména",
-  "domainWarningSubtitle": "You are accessing this instance from an incorrect domain. If you proceed, you may encounter issues with authentication.",
+  "domainWarningSubtitle": "Pro přístup k této instanci používáte špatnou doménu. Při pokračování mohou nastat problémy s autentizací.",
-  "domainWarningCurrent": "Current:",
+  "domainWarningCurrent": "Aktuální:",
-  "domainWarningExpected": "Expected:",
+  "domainWarningExpected": "Vyžadovaná:",
-  "ignoreTitle": "Ignore",
+  "ignoreTitle": "Ignorovat",
-  "goToCorrectDomainTitle": "Go to correct domain",
+  "goToCorrectDomainTitle": "Přejít na správnou doménu",
-  "authorizeTitle": "Authorize",
+  "authorizeTitle": "Autorizovat",
-  "authorizeCardTitle": "Continue to {{app}}?",
+  "authorizeCardTitle": "Pokračovat do {{app}}?",
-  "authorizeSubtitle": "Would you like to continue to this app? Please carefully review the permissions requested by the app.",
+  "authorizeSubtitle": "Chcete pokračovat do této aplikace? Pečlivě si zkontrolujte jí vyžadovaná oprávnění, prosím.",
-  "authorizeSubtitleOAuth": "Would you like to continue to this app?",
+  "authorizeSubtitleOAuth": "Chcete pokračovat do této aplikace?",
-  "authorizeLoadingTitle": "Loading...",
+  "authorizeLoadingTitle": "Načítání...",
   "authorizeLoadingSubtitle": "Please wait while we load the client information.",
-  "authorizeSuccessTitle": "Authorized",
+  "authorizeSuccessTitle": "Autorizováno",
-  "authorizeSuccessSubtitle": "You will be redirected to the app in a few seconds.",
+  "authorizeSuccessSubtitle": "Během několika vteřin budete přesměrováni do aplikace.",
-  "authorizeErrorClientInfo": "An error occurred while loading the client information. Please try again later.",
+  "authorizeErrorClientInfo": "Při načítání klientských informací došlo k chybě. Zkuste to prosím později.",
-  "authorizeErrorInvalidParams": "The request is missing required parameters or has invalid parameters. Please check the URL and try again.",
+  "authorizeErrorInvalidParams": "Parametry požadavku jsou chybné/neplatné. Prosím, zkontrolujte URL a zkuste znovu.",
   "openidScopeName": "OpenID Connect",
-  "openidScopeDescription": "Allows the app to access your OpenID Connect information.",
+  "openidScopeDescription": "Povolí aplikaci přístup k Vaším informacím OpenID Connect.",
-  "emailScopeName": "Email",
+  "emailScopeName": "E-mail",
-  "emailScopeDescription": "Allows the app to access your email address.",
+  "emailScopeDescription": "Povolí aplikaci přístup k Vaší e-mailové adrese.",
-  "profileScopeName": "Profile",
+  "profileScopeName": "Profil",
-  "profileScopeDescription": "Allows the app to access your profile information.",
+  "profileScopeDescription": "Povolí aplikaci přístup k informacím o Vašem profilu.",
-  "groupsScopeName": "Groups",
+  "groupsScopeName": "Skupiny",
-  "groupsScopeDescription": "Allows the app to access your group information.",
+  "groupsScopeDescription": "Povolí aplikaci přístup k informacím o Vaší skupině.",
-  "backToLoginButton": "Back to login",
+  "backToLoginButton": "Zpět na přihlášení",
-  "phoneScopeName": "Phone",
+  "phoneScopeName": "Telefon",
-  "phoneScopeDescription": "Allows the app to access your phone number.",
+  "phoneScopeDescription": "Povolí aplikaci přístup k Vašemu telefonnímu číslu.",
-  "addressScopeName": "Address",
+  "addressScopeName": "Adresa",
-  "addressScopeDescription": "Allows the app to access your address.",
+  "addressScopeDescription": "Povolí aplikaci přístup k Vaší adrese.",
-  "loginTailscaleTitle": "Continue with Tailscale",
+  "loginTailscaleTitle": "Pokračovat přes Tailscale",
   "loginTailscaleDescription": "You appear to be accessing Tinyauth from an authorized Tailscale device. Would you like to continue with your Tailscale connection?",
-  "loginTailscaleDeviceName": "Device name:",
+  "loginTailscaleDeviceName": "Název zařízení:",
-  "loginTailscaleOtherMethod": "Login with another method",
+  "loginTailscaleOtherMethod": "Přihlásit jinou metodou",
-  "loginTailscaleSuccess": "Successfully authenticated with Tailscale.",
+  "loginTailscaleSuccess": "Úspěšně přihlášeno přes Tailscale.",
-  "loginTailscaleFail": "Failed to authenticate with Tailscale. Please try again or use another login method.",
+  "loginTailscaleFail": "Chyba při přihlášení přes Tailscale. Zkuste znovu, případně se přihlašte jiným způsobem, prosím.",
   "logoutTailscaleSubtitle": "You are currently logged in with Tailscale on your device <code>{{deviceName}}</code>. Click the button below to logout.",
-  "quickActionsLanguage": "Language",
+  "quickActionsLanguage": "Jazyk",
-  "quickActionsTheme": "Theme",
+  "quickActionsTheme": "Motiv",
-  "quickActionsThemeLight": "Light",
+  "quickActionsThemeLight": "Světlý",
-  "quickActionsThemeDark": "Dark",
+  "quickActionsThemeDark": "Tmavý",
-  "quickActionsThemeSystem": "System",
+  "quickActionsThemeSystem": "Systémový",
-  "quickActionsLogout": "Logout",
+  "quickActionsLogout": "Odhlásit se",
   "quickActionsTitle": "Quick Actions",
   "quickActionsProviderLocal": "Local",
   "quickActionsProviderLDAP": "LDAP",

frontend/src/pages/authorize-page.tsx

@@ -190,8 +190,7 @@ export const AuthorizePage = () => {
       <CardFooter className="flex flex-col items-stretch gap-3">
         <Button
           onClick={() => authorizeMutate()}
-          loading={authorizePending}
+          loading={authorizePending || shouldAutoAuthorize}
-          disabled={shouldAutoAuthorize}
         >
           {t("authorizeTitle")}
         </Button>

go.mod

@@ -4,7 +4,7 @@ go 1.26.4
 
 require (
 	charm.land/huh/v2 v2.0.3
-	charm.land/lipgloss/v2 v2.0.5
+	charm.land/lipgloss/v2 v2.0.6
 	github.com/cenkalti/backoff/v5 v5.0.3
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/gin-gonic/gin v1.12.0
@@ -19,18 +19,18 @@ require (
 	github.com/pquerna/otp v1.5.0
 	github.com/rs/zerolog v1.35.1
 	github.com/steveiliop56/ding v0.2.0
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298
 	github.com/weppos/publicsuffix-go v0.50.3
 	go.uber.org/dig v1.19.0
-	golang.org/x/crypto v0.54.0
+	golang.org/x/crypto v0.55.0
-	golang.org/x/net v0.57.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/tools v0.48.0
+	golang.org/x/tools v0.49.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.36.2
+	k8s.io/apimachinery v0.36.4
-	k8s.io/client-go v0.36.2
+	k8s.io/client-go v0.36.4
-	modernc.org/sqlite v1.54.0
+	modernc.org/sqlite v1.57.0
 )
 
 require (
@@ -51,8 +51,8 @@ require (
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
+	github.com/charmbracelet/x/ansi v0.11.8 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
@@ -90,10 +90,10 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.4.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
@@ -110,7 +110,6 @@ require (
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/quic-go/quic-go v0.59.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -133,13 +132,14 @@ require (
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	golang.org/x/arch v0.22.0 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
-	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/mod v0.39.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
@@ -147,12 +147,12 @@ require (
 	k8s.io/klog/v2 v2.140.0 // indirect
 	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
 	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
-	modernc.org/libc v1.74.1 // indirect
+	modernc.org/libc v1.74.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.3 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )

go.sum

@@ -4,8 +4,8 @@ charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
 charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
 charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
 charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
-charm.land/lipgloss/v2 v2.0.5 h1:kbNxgeeUOYv5J0YdpxFjfvf3dFvqH8Aci4zB6xqFtrY=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
-charm.land/lipgloss/v2 v2.0.5/go.mod h1:9oqhxt4yxIMe6q5A4kHr44DremZk7J9UNh74GlWa5nc=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -47,10 +47,10 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
 github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4jxsAuEs=
 github.com/charmbracelet/x/conpty v0.1.1/go.mod h1:OmtR77VODEFbiTzGE9G1XiRJAga6011PIm4u5fTNZpk=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 h1:JSt3B+U9iqk37QUU2Rvb6DSBYRLtWqFqfxf8l5hOZUA=
@@ -154,8 +154,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
@@ -202,16 +202,16 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mdp/qrterminal/v3 v3.2.1 h1:6+yQjiiOsSuXT5n9/m60E54vdgFsw0zhADHhHLrFet4=
@@ -282,16 +282,17 @@ github.com/steveiliop56/ding v0.2.0/go.mod h1:bE2u2XH7CjhPzbb/0Ems+D8YZlf2Ae+eKh
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298 h1:EYSb5jv8ZL/0/NVFZtY7Ejplk0QG5+3lrdL3mSrjFZQ=
 github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298/go.mod h1:TlUDoCF66hMqFZqoBym9bUdJ0bKAWYMir6hLJeYN5z0=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
@@ -332,33 +333,32 @@ go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
 golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
@@ -380,20 +380,20 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.36.2 h1:TF6YDLIzKfccK7cq9YpTcGX8TJmEkHVRv78DM51fRYY=
+k8s.io/api v0.36.4 h1:RxrvqCL6vgH5/+UnTeu1IIFqYmGfy0hnyrod1rn35Oo=
-k8s.io/api v0.36.2/go.mod h1:F4LbMO4brjZYh7yFkXWhynSvtB7YauxV4c+HHkNRGNg=
+k8s.io/api v0.36.4/go.mod h1:S2B3orCFBDhrgyWbLeuKcT2QdHIpQesBkCYSlWtwUOw=
-k8s.io/apimachinery v0.36.2 h1:0PE/W/WNy1UX61NLbXY5TMbJ6UwLL6E6lAPkYrKFxbQ=
+k8s.io/apimachinery v0.36.4 h1:PT2UzkupGuAx/+xT5XjiMJ1WGpY3fn9/hdAvjweRet4=
-k8s.io/apimachinery v0.36.2/go.mod h1:fvf/HOLXq9RId0rnDIbN1OEBvHXdQbLMM8nu0LcBUf4=
+k8s.io/apimachinery v0.36.4/go.mod h1:p2I2dipt7JHG+quVwQ1d02d28O4GdDi77RByQ13MTpk=
-k8s.io/client-go v0.36.2 h1:bfgxmFKc9CgqsgX4xKLAAdmTQlWee7Ob/HlDOrJ5TBI=
+k8s.io/client-go v0.36.4 h1:MDvfDNvMSt0Br94SK8neviVlwL9qifw9B26hJCpD1K0=
-k8s.io/client-go v0.36.2/go.mod h1:1vgO4OAlfPnoLcb+Rze2GF5rAr14w8qjrYMoyXJzQj0=
+k8s.io/client-go v0.36.4/go.mod h1:pNK4WKELbwlEDvtbE8l22lEZL5THYF61H5EealokZmA=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
 k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
-modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
 modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
 modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
@@ -404,8 +404,8 @@ modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
 modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
+modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
-modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
+modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -414,8 +414,8 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog=
+modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg=
-modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
+modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
@@ -426,7 +426,7 @@ sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5E
 sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
 sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3 h1:u08YRbVUi59ri4YD6cg0UqNM4Dimn0sIl+wldcx5PYw=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.3/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
 sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

internal/assets/migrations/postgres/000003_oidc_consent.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS "oidc_consents";

internal/assets/migrations/postgres/000003_oidc_consent.up.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" BIGINT NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);

internal/assets/migrations/sqlite/000011_oidc_consent.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS "oidc_consents";

internal/assets/migrations/sqlite/000011_oidc_consent.up.sql

@@ -0,0 +1,7 @@
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" INTEGER NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);

internal/bootstrap/app_bootstrap.go

@@ -179,8 +179,6 @@ func (app *BootstrapApp) Setup() error {
 	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
 
 	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
-	app.runtime.CSRFCookieName = fmt.Sprintf("%s-%s", model.CSRFCookieName, cookieId)
-	app.runtime.RedirectCookieName = fmt.Sprintf("%s-%s", model.RedirectCookieName, cookieId)
 	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
 
 	// database

internal/controller/oauth_controller.go

@@ -294,7 +294,9 @@ func (controller *OAuthController) getCookieDomain() string {
 
 func (controller *OAuthController) isRedirectSafe(redirectURI string) bool {
 	v := validators.NewDomainValidator(validators.DomainValidatorOptions{
-		WithPort: true,
+		WithPort:       true,
+		WithScheme:     true,
+		AllowedSchemes: []string{"https", "http"},
 	})
 
 	_, err := v.SafeHostname(controller.runtime.AppURL)

internal/controller/oidc_controller.go

@@ -242,6 +242,16 @@ func (controller *OIDCController) authorize(c *gin.Context) {
 		}
 	}
 
+	if userContext != nil && userContext.Authenticated && values.OIDCPrompt != service.OIDCPromptLogin {
+		consent, err := controller.oidc.GetOIDCConsent(c, userContext.GetUsername(), req.ClientID)
+
+		if err != nil {
+			controller.log.App.Warn().Err(err).Msg("Failed to get OIDC consent")
+		} else if consent != nil && scopesGranted(consent.Scope, req.Scope) {
+			values.OIDCPrompt = service.OIDCPromptNone
+		}
+	}
+
 	queries, err := query.Values(values)
 
 	if err != nil {
@@ -320,6 +330,19 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
+	// Get the client
+	client, ok := controller.oidc.GetClient(authorizeReq.ClientID)
+
+	if !ok {
+		controller.authorizeError(c, authorizeErrorParams{
+			err:          errors.New("client not found"),
+			reason:       "Client not found",
+			reasonPublic: "The client is not configured",
+			json:         true,
+		})
+		return
+	}
+
 	// We no longer need the ticket
 	controller.oidc.DeleteAuthorizeRequestTicket(req.Ticket)
 
@@ -356,6 +379,11 @@ func (controller *OIDCController) authorizeComplete(c *gin.Context) {
 		return
 	}
 
+	// Store the consent granted by the user for this client
+	if _, err := controller.oidc.UpsertOIDCConsent(c, userContext.GetUsername(), authorizeReq.Scope, client.ClientID); err != nil {
+		controller.log.App.Warn().Err(err).Msg("Failed to store OIDC consent")
+	}
+
 	q := cu.Query()
 
 	q.Set("code", code)
@@ -756,3 +784,20 @@ func (controller *OIDCController) resolveNormalParams(c *gin.Context) (*service.
 
 	return &req, nil
 }
+
+// scopesGranted reports whether every scope in requested is present in the
+// space-separated granted scope string.
+func scopesGranted(granted, requested string) bool {
+	grantedScopes := strings.Split(granted, " ")
+
+	for _, scope := range strings.Split(requested, " ") {
+		if scope == "" {
+			continue
+		}
+		if !slices.Contains(grantedScopes, scope) {
+			return false
+		}
+	}
+
+	return true
+}

internal/controller/oidc_controller_test.go

@@ -170,6 +170,102 @@ func TestOIDCController(t *testing.T) {
 				assert.Contains(t, location, "oidc_name="+url.QueryEscape("Test Client"))
 			},
 		},
+		{
+			description: "Authorize skips the consent screen when all requested scopes were already granted",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid profile", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when a new scope is requested",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.NotContains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize skips the consent screen for a subset of already granted scopes",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := store.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "testuser", ClientID: "some-client-id",
+					Scope: "openid profile email", CreatedAt: time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.Contains(t, location, "oidc_prompt=none")
+			},
+		},
+		{
+			description: "Authorize shows the consent screen when no consent was granted yet",
+			middlewares: []gin.HandlerFunc{authedUser},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				require.NoError(t, store.DeleteOIDCConsentByClientID(ctx, "some-client-id"))
+
+				q := url.Values{}
+				q.Set("scope", "openid profile")
+				q.Set("response_type", "code")
+				q.Set("client_id", "some-client-id")
+				q.Set("redirect_uri", "https://test.example.com/callback")
+
+				req := httptest.NewRequest("GET", "/authorize?"+q.Encode(), nil)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.True(t, strings.HasPrefix(location, oidcService.GetIssuer()+"/oidc/authorize?"))
+				assert.NotContains(t, location, "oidc_prompt=none")
+			},
+		},
 		{
 			description: "Authorize redirects to error screen when the request object is invalid",
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {

internal/controller/proxy_controller.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path"
 	"regexp"
 	"strings"
 
@@ -46,6 +47,7 @@ type ProxyContext struct {
 	Host      string
 	Proto     string
 	Path      string
+	PathRaw   string
 	Method    string
 	Type      AuthModuleType
 	IsBrowser bool
@@ -55,6 +57,7 @@ type ProxyContext struct {
 type ProxyController struct {
 	log          *logger.Logger
 	runtime      *model.RuntimeConfig
+	config       *model.Config
 	acls         *service.AccessControlsService
 	auth         *service.AuthService
 	policyEngine *service.PolicyEngine
@@ -65,6 +68,7 @@ type ProxyControllerInput struct {
 
 	Log           *logger.Logger
 	RuntimeConfig *model.RuntimeConfig
+	Config        *model.Config
 	RouterGroup   *gin.RouterGroup `name:"apiRouterGroup"`
 	ACLsService   *service.AccessControlsService
 	AuthService   *service.AuthService
@@ -75,6 +79,7 @@ func NewProxyController(i ProxyControllerInput) *ProxyController {
 	controller := &ProxyController{
 		log:          i.Log,
 		runtime:      i.RuntimeConfig,
+		config:       i.Config,
 		acls:         i.ACLsService,
 		auth:         i.AuthService,
 		policyEngine: i.PolicyEngine,
@@ -280,7 +285,7 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 	}
 
 	queries, err := query.Values(RedirectQuery{
-		RedirectURI: fmt.Sprintf("%s://%s%s", proxyCtx.Proto, proxyCtx.Host, proxyCtx.Path),
+		RedirectURI: fmt.Sprintf("%s://%s%s", proxyCtx.Proto, proxyCtx.Host, proxyCtx.PathRaw),
 		LoginFor:    FrontendLoginForApp,
 	})
 
@@ -401,11 +406,11 @@ func (controller *ProxyController) getForwardAuthContext(c *gin.Context) (ProxyC
 	method := c.Request.Method
 
 	return ProxyContext{
-		Host:   host,
+		Host:    host,
-		Proto:  proto,
+		Proto:   proto,
-		Path:   uri,
+		PathRaw: uri,
-		Method: method,
+		Method:  method,
-		Type:   ForwardAuth,
+		Type:    ForwardAuth,
 	}, nil
 }
 
@@ -434,15 +439,14 @@ func (controller *ProxyController) getAuthRequestContext(c *gin.Context) (ProxyC
 		return ProxyContext{}, errors.New("proto not found")
 	}
 
-	path := url.Path
 	method := c.Request.Method
 
 	return ProxyContext{
-		Host:   host,
+		Host:    host,
-		Proto:  proto,
+		Proto:   proto,
-		Path:   path,
+		PathRaw: url.RequestURI(),
-		Method: method,
+		Method:  method,
-		Type:   AuthRequest,
+		Type:    AuthRequest,
 	}, nil
 }
 
@@ -464,26 +468,38 @@ func (controller *ProxyController) getExtAuthzContext(c *gin.Context) (ProxyCont
 	// We get the path from the query string
 	path := c.Query("path")
 
+	if strings.TrimSpace(path) == "" {
+		return ProxyContext{}, errors.New("path not found")
+	}
+
 	// For envoy we need to support every method
 	method := c.Request.Method
 
 	return ProxyContext{
-		Host:   host,
+		Host:    host,
-		Proto:  proto,
+		Proto:   proto,
-		Path:   path,
+		PathRaw: path,
-		Method: method,
+		Method:  method,
-		Type:   ExtAuthz,
+		Type:    ExtAuthz,
 	}, nil
 }
 
-func (controller *ProxyController) determineAuthModules(proxy ProxyType) []AuthModuleType {
+func (controller *ProxyController) determineAuthModules(proxy ProxyType, fallbacks bool) []AuthModuleType {
 	switch proxy {
 	case Traefik, Caddy:
 		return []AuthModuleType{ForwardAuth}
 	case Envoy:
-		return []AuthModuleType{ExtAuthz, ForwardAuth}
+		authModules := []AuthModuleType{ExtAuthz}
+		if fallbacks {
+			authModules = append(authModules, ForwardAuth)
+		}
+		return authModules
 	case Nginx:
-		return []AuthModuleType{AuthRequest, ForwardAuth}
+		authModules := []AuthModuleType{AuthRequest}
+		if fallbacks {
+			authModules = append(authModules, ForwardAuth)
+		}
+		return authModules
 	default:
 		return []AuthModuleType{}
 	}
@@ -513,6 +529,39 @@ func (controller *ProxyController) getContextFromAuthModule(c *gin.Context, modu
 	return ProxyContext{}, fmt.Errorf("unsupported auth module: %v", module)
 }
 
+func (controller *ProxyController) authModuleIdentifiersPresent(c *gin.Context, module AuthModuleType) bool {
+	switch module {
+	case ForwardAuth:
+		_, host := controller.getHeader(c, "x-forwarded-host")
+		_, uri := controller.getHeader(c, "x-forwarded-uri")
+		return host || uri
+	case AuthRequest:
+		_, ok := controller.getHeader(c, "x-original-url")
+		return ok
+	case ExtAuthz:
+		return strings.TrimSpace(c.Query("path")) != ""
+	default:
+		return false
+	}
+}
+
+func (controller *ProxyController) ensureNoMultipleAuthModules(c *gin.Context, authModules []AuthModuleType) error {
+	present := 0
+
+	for _, module := range authModules {
+		if controller.authModuleIdentifiersPresent(c, module) {
+			present++
+		}
+	}
+
+	if present > 1 {
+		controller.log.App.Warn().Msg("Request carries headers for multiple auth modules, possible spoofing attempt, denying")
+		return fmt.Errorf("conflicting auth module headers")
+	}
+
+	return nil
+}
+
 func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext, error) {
 	var req Proxy
 
@@ -529,28 +578,49 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 
 	controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy)
 
-	authModules := controller.determineAuthModules(proxy)
+	authModules := controller.determineAuthModules(proxy, !controller.config.Experimental.DisableAuthModuleFallback)
 
 	if len(authModules) == 0 {
 		return ProxyContext{}, fmt.Errorf("no auth modules supported for proxy: %v", req.Proxy)
 	}
 
-	var ctx ProxyContext
+	err = controller.ensureNoMultipleAuthModules(c, controller.determineAuthModules(proxy, true))
-
-	for _, module := range authModules {
-		controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module)
-		ctx, err = controller.getContextFromAuthModule(c, module)
-		if err == nil {
-			controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module)
-			break
-		}
-		controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err)
-	}
 
 	if err != nil {
 		return ProxyContext{}, err
 	}
 
+	var ctx *ProxyContext
+
+	for _, module := range authModules {
+		controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module)
+		authModuleCtx, err := controller.getContextFromAuthModule(c, module)
+		if err != nil {
+			controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err)
+			continue
+		}
+		controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module)
+		ctx = &authModuleCtx
+		break
+	}
+
+	if ctx == nil {
+		return ProxyContext{}, fmt.Errorf("failed to get context from any auth module")
+	}
+
+	// Parse the raw path to populate the cleaned path used for ACLs
+	upath, err := url.Parse(ctx.PathRaw)
+
+	if err != nil {
+		return ProxyContext{}, fmt.Errorf("failed to parse request path: %v", err)
+	}
+
+	if upath.Host != "" || !strings.HasPrefix(upath.Path, "/") {
+		return ProxyContext{}, fmt.Errorf("invalid request path")
+	}
+
+	ctx.Path = path.Clean(upath.Path)
+
 	// We don't care if the header is empty, we will just assume it's not a browser
 	userAgent, _ := controller.getHeader(c, "user-agent")
 	isBrowser := BrowserUserAgentRegex.MatchString(userAgent)
@@ -563,5 +633,5 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 
 	ctx.IsBrowser = isBrowser
 	ctx.ProxyType = proxy
-	return ctx, nil
+	return *ctx, nil
 }

internal/controller/proxy_controller_test.go

@@ -95,6 +95,38 @@ func TestProxyController(t *testing.T) {
 				assert.Contains(t, location, "https://tinyauth.example.com/login")
 			},
 		},
+		{
+			description: "Forward auth login redirect should preserve query parameters",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "test.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/search?foo=bar")
+				req.Header.Set("user-agent", browserUserAgent)
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.Contains(t, location, url.QueryEscape("https://test.example.com/search?foo=bar"))
+				assert.Contains(t, location, "login_for=app")
+				assert.Contains(t, location, "https://tinyauth.example.com/login")
+			},
+		},
+		{
+			description: "Auth request (nginx) login redirect should preserve query parameters",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/nginx", nil)
+				req.Header.Set("x-original-url", "https://test.example.com/search?foo=bar")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+				location := recorder.Header().Get("x-tinyauth-location")
+				assert.Contains(t, location, url.QueryEscape("https://test.example.com/search?foo=bar"))
+				assert.Contains(t, location, "login_for=app")
+				assert.Contains(t, location, "https://tinyauth.example.com/login")
+			},
+		},
 		{
 			description: "Auth request (nginx) should be detected and used",
 			middlewares: []gin.HandlerFunc{},
@@ -126,6 +158,22 @@ func TestProxyController(t *testing.T) {
 				assert.Contains(t, location, "https://tinyauth.example.com/login")
 			},
 		},
+		{
+			description: "Ext authz (envoy) login redirect should preserve query parameters",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=%2Fhello%3Ffoo%3Dbar", nil)
+				req.Host = "test.example.com"
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("user-agent", browserUserAgent)
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusFound, recorder.Code)
+				location := recorder.Header().Get("Location")
+				assert.Contains(t, location, url.QueryEscape("https://test.example.com/hello?foo=bar"))
+				assert.Contains(t, location, "login_for=app")
+				assert.Contains(t, location, "https://tinyauth.example.com/login")
+			},
+		},
 		{
 			description: "Forward auth with caddy should be detected and used",
 			middlewares: []gin.HandlerFunc{},
@@ -165,7 +213,7 @@ func TestProxyController(t *testing.T) {
 			description: "Ensure forward auth fallback for envoy",
 			middlewares: []gin.HandlerFunc{},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil)
 				req.Host = ""
 				req.Header.Set("x-forwarded-host", "test.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
@@ -213,7 +261,7 @@ func TestProxyController(t *testing.T) {
 			description: "Ensure extauthz with envoy non browser returns json",
 			middlewares: []gin.HandlerFunc{},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy", nil)
 				req.Header.Set("x-forwarded-host", "test.example.com")
 				req.Header.Set("x-forwarded-proto", "https")
 				req.Header.Set("x-forwarded-uri", "/hello")
@@ -308,6 +356,171 @@ func TestProxyController(t *testing.T) {
 				assert.Equal(t, http.StatusOK, recorder.Code)
 			},
 		},
+		{
+			description: "Ensure path block ACL requires auth on exact match",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/admin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL skips auth for non-matching path",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/public")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusOK, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with query params",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/admin?foo=bar")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with a trailing slash",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/admin/")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with dot segments",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/foo/../admin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with percent-encoded characters",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/%61dmin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with a percent-encoded double slash",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/%2Fadmin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure a protocol-relative x-forwarded-uri is rejected",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "//admin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusBadRequest, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure a relative x-forwarded-uri is rejected",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-block.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "public")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusBadRequest, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with query params on envoy ext authz",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/admin%3Ffoo=bar", nil)
+				req.Host = "path-block.example.com"
+				req.Header.Set("x-forwarded-proto", "https")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path block ACL cannot be bypassed with dot segments on nginx auth request",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/nginx", nil)
+				req.Header.Set("x-original-url", "https://path-block.example.com/foo/../admin")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path allow ACL still matches when query params are present",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-allow.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/allowed?foo=bar")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusOK, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure path allow ACL cannot be extended with dot segments",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-allow.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/allowed/../secret")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
+		{
+			description: "Ensure an allowed path inside the query string does not bypass auth",
+			middlewares: []gin.HandlerFunc{},
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/traefik", nil)
+				req.Header.Set("x-forwarded-host", "path-allow.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/secret?next=/allowed")
+				router.ServeHTTP(recorder, req)
+				assert.Equal(t, http.StatusUnauthorized, recorder.Code)
+			},
+		},
 		{
 			description: "Ensure ip bypass ACL works on forward auth",
 			middlewares: []gin.HandlerFunc{},
@@ -664,6 +877,32 @@ func TestProxyController(t *testing.T) {
 				assert.Equal(t, "bar", recorder.Header().Get("x-foo"))
 			},
 		},
+		{
+			description: "Forward auth and auth request headers should fail for nginx",
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("GET", "/api/auth/nginx", nil)
+				req.Header.Set("x-forwarded-host", "foo.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/foo?bar=foo")
+				req.Header.Set("x-original-url", "https://foo.example.com/foo?bar=foo")
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusBadRequest, recorder.Code)
+			},
+		},
+		{
+			description: "Forward auth and ext authz headers should fail for envoy",
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				req := httptest.NewRequest("HEAD", "/api/auth/envoy?path=/hello", nil)
+				req.Host = "foo.example.com"
+				req.Header.Set("x-forwarded-host", "foo.example.com")
+				req.Header.Set("x-forwarded-proto", "https")
+				req.Header.Set("x-forwarded-uri", "/foo?bar=foo")
+				router.ServeHTTP(recorder, req)
+
+				assert.Equal(t, http.StatusBadRequest, recorder.Code)
+			},
+		},
 	}
 
 	store := memory.New()
@@ -679,6 +918,7 @@ func TestProxyController(t *testing.T) {
 	aclsService := service.NewAccessControlsService(service.AccessControlServiceInput{
 		Log:           log,
 		Config:        &cfg,
+		Runtime:       &runtime,
 		LabelProvider: nil,
 	})
 
@@ -739,6 +979,7 @@ func TestProxyController(t *testing.T) {
 			NewProxyController(ProxyControllerInput{
 				Log:           log,
 				RuntimeConfig: &runtime,
+				Config:        &cfg,
 				RouterGroup:   group,
 				ACLsService:   aclsService,
 				AuthService:   authService,

internal/controller/user_controller.go

@@ -194,6 +194,9 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		if search.Email != "" {
 			sessionCookie.Email = search.Email
 		}
+		if search.Name != "" {
+			sessionCookie.Name = search.Name
+		}
 	}
 
 	cookie, err := controller.auth.CreateSession(c, sessionCookie)

internal/middleware/context_middleware.go

@@ -204,7 +204,11 @@ func (m *ContextMiddleware) cookieAuth(ctx context.Context, uuid string, ip stri
 		}
 
 		userContext.LDAP.Groups = user.Groups
-		userContext.LDAP.Name = utils.Capitalize(userContext.LDAP.Username)
+		if search.Name != "" {
+			userContext.LDAP.Name = search.Name
+		} else {
+			userContext.LDAP.Name = utils.Capitalize(userContext.LDAP.Username)
+		}
 
 		userContext.LDAP.Email = utils.CompileUserEmail(userContext.LDAP.Username, m.runtime.CookieDomain)
 		if search.Email != "" {
@@ -291,10 +295,14 @@ func (m *ContextMiddleware) basicAuth(username string, password string) (*model.
 			return nil, nil, fmt.Errorf("error retrieving ldap user details: %w", err)
 		}
 
+		name := search.Name
+		if name == "" {
+			name = utils.Capitalize(username)
+		}
 		userContext.LDAP = &model.LDAPContext{
 			BaseContext: model.BaseContext{
 				Username: username,
-				Name:     utils.Capitalize(username),
+				Name:     name,
 			},
 			Groups: user.Groups,
 		}

internal/model/config.go

@@ -239,7 +239,8 @@ type LogStreamConfig struct {
 }
 
 type ExperimentalConfig struct {
-	OAuthBridgeEnabled bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
+	OAuthBridgeEnabled        bool `description:"Enable the OAuth bridge, uses a new way to format OAuth user information." yaml:"oauthBridgeEnabled,omitempty"`
+	DisableAuthModuleFallback bool `description:"Disable the fallback to forward_auth modules when auth_request or ext_authz fail." yaml:"disableAuthModuleFallback,omitempty"`
 }
 
 type TailscaleConfig struct {
@@ -253,18 +254,26 @@ type TailscaleConfig struct {
 // OAuth/OIDC config
 
 type OAuthServiceConfig struct {
-	ClientID         string   `description:"OAuth client ID." yaml:"clientId,omitempty"`
+	ClientID         string                `description:"OAuth client ID." yaml:"clientId,omitempty"`
-	ClientSecret     string   `description:"OAuth client secret." yaml:"clientSecret,omitempty"`
+	ClientSecret     string                `description:"OAuth client secret." yaml:"clientSecret,omitempty"`
-	ClientSecretFile string   `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile,omitempty"`
+	ClientSecretFile string                `description:"Path to the file containing the OAuth client secret." yaml:"clientSecretFile,omitempty"`
-	Whitelist        []string `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist,omitempty"`
+	Whitelist        []string              `description:"Comma-separated list of allowed OAuth domains for this provider." yaml:"whitelist,omitempty"`
-	WhitelistFile    string   `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile,omitempty"`
+	WhitelistFile    string                `description:"Path to the OAuth whitelist file for this provider." yaml:"whitelistFile,omitempty"`
-	Scopes           []string `description:"OAuth scopes." yaml:"scopes,omitempty"`
+	Scopes           []string              `description:"OAuth scopes." yaml:"scopes,omitempty"`
-	RedirectURL      string   `description:"OAuth redirect URL." yaml:"redirectUrl,omitempty"`
+	RedirectURL      string                `description:"OAuth redirect URL." yaml:"redirectUrl,omitempty"`
-	AuthURL          string   `description:"OAuth authorization URL." yaml:"authUrl,omitempty"`
+	AuthURL          string                `description:"OAuth authorization URL." yaml:"authUrl,omitempty"`
-	TokenURL         string   `description:"OAuth token URL." yaml:"tokenUrl,omitempty"`
+	TokenURL         string                `description:"OAuth token URL." yaml:"tokenUrl,omitempty"`
-	UserinfoURL      string   `description:"OAuth userinfo URL." yaml:"userinfoUrl,omitempty"`
+	UserinfoURL      string                `description:"OAuth userinfo URL." yaml:"userinfoUrl,omitempty"`
-	Insecure         bool     `description:"Allow insecure OAuth connections." yaml:"insecure,omitempty"`
+	Insecure         bool                  `description:"Allow insecure OAuth connections." yaml:"insecure,omitempty"`
-	Name             string   `description:"Provider name in UI." yaml:"name,omitempty"`
+	Name             string                `description:"Provider name in UI." yaml:"name,omitempty"`
+	Claims           OAuthServiceClaimsMap `description:"Map of claims to extract from the userinfo response." yaml:"claims,omitempty"`
+}
+
+type OAuthServiceClaimsMap struct {
+	Username string `description:"Username claim." yaml:"username,omitempty"`
+	Email    string `description:"Email claim." yaml:"email,omitempty"`
+	Name     string `description:"Name claim." yaml:"name,omitempty"`
+	Groups   string `description:"Groups claim." yaml:"groups,omitempty"`
 }
 
 type OIDCClientConfig struct {
@@ -332,6 +341,6 @@ type AppBasicAuth struct {
 }
 
 type AppPath struct {
-	Allow string `description:"Comma-separated list of allowed paths." yaml:"allow,omitempty"`
+	Allow string `description:"Disable authentication for only paths that match the regex string." yaml:"allow,omitempty"`
-	Block string `description:"Comma-separated list of blocked paths." yaml:"block,omitempty"`
+	Block string `description:"Enable authentication for only paths that match the regex string." yaml:"block,omitempty"`
 }

internal/model/constants.go

@@ -20,8 +20,6 @@ var OverrideProviders = map[string]string{
 var ReservedProviderNames = []string{"local", "ldap", "tailscale"}
 
 const SessionCookieName = "tinyauth-session"
-const CSRFCookieName = "tinyauth-csrf"
-const RedirectCookieName = "tinyauth-redirect"
 const OAuthSessionCookieName = "tinyauth-oauth"
 
 const GracefulShutdownTimeout = 5 // seconds

internal/model/runtime.go

@@ -5,8 +5,6 @@ type RuntimeConfig struct {
 	UUID                     string
 	CookieDomain             string
 	SessionCookieName        string
-	CSRFCookieName           string
-	RedirectCookieName       string
 	OAuthSessionCookieName   string
 	LocalUsers               []LocalUser
 	OAuthProviders           map[string]OAuthServiceConfig

internal/model/users.go

@@ -32,5 +32,6 @@ type LocalUser struct {
 type UserSearch struct {
 	Username string
 	Email    string // used for LDAP, we can't throw it to LDAPUser because it would need another cache or an LDAP lookup every time
+	Name     string // used for LDAP cn attribute
 	Type     UserSearchType
 }

internal/repository/memory/memory_test.go

@@ -277,6 +277,80 @@ func TestMemoryStore(t *testing.T) {
 				assert.NoError(t, err)
 			},
 		},
+		{
+			description: "Upsert creates a consent for each user+client pair",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid profile", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-b", Scope: "openid email", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 2)
+
+				gotA, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid profile", gotA.Scope)
+
+				gotB, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-b"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid email", gotB.Scope)
+			},
+		},
+		{
+			description: "Upsert overwrites the same consent row",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid email", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 1)
+
+				got, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				require.NoError(t, err)
+				assert.Equal(t, "openid email", got.Scope)
+			},
+		},
+		{
+			description: "Get consent by username and client not found",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{Username: "alice", ClientID: "client-a"})
+				assert.ErrorIs(t, err, repository.ErrNotFound)
+			},
+		},
+		{
+			description: "Delete consent by client id",
+			run: func(t *testing.T, s repository.Store) {
+				_, err := s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-a", Scope: "openid", CreatedAt: 1,
+				})
+				require.NoError(t, err)
+				_, err = s.UpsertOIDCConsent(ctx, repository.UpsertOIDCConsentParams{
+					Username: "alice", ClientID: "client-b", Scope: "openid", CreatedAt: 2,
+				})
+				require.NoError(t, err)
+
+				require.NoError(t, s.DeleteOIDCConsentByClientID(ctx, "client-a"))
+
+				consents, err := s.ListOIDCConsents(ctx)
+				require.NoError(t, err)
+				assert.Len(t, consents, 1)
+				assert.Equal(t, "client-b", consents[0].ClientID)
+			},
+		},
 	}
 
 	for _, test := range tests {

internal/repository/memory/oidc_queries.go

@@ -94,3 +94,46 @@ func (s *Store) DeleteExpiredOIDCSessions(_ context.Context, arg repository.Dele
 	}
 	return nil
 }
+
+func consentKey(username, clientID string) string {
+	return username + "\x00" + clientID
+}
+
+func (s *Store) UpsertOIDCConsent(_ context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	oc := repository.OidcConsent(arg)
+	s.oidcConsents[consentKey(arg.Username, arg.ClientID)] = oc
+	return oc, nil
+}
+
+func (s *Store) GetOIDCConsentByUsernameAndClientID(_ context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	oc, ok := s.oidcConsents[consentKey(arg.Username, arg.ClientID)]
+	if !ok {
+		return repository.OidcConsent{}, repository.ErrNotFound
+	}
+	return oc, nil
+}
+
+func (s *Store) DeleteOIDCConsentByClientID(_ context.Context, clientID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for key, oc := range s.oidcConsents {
+		if oc.ClientID == clientID {
+			delete(s.oidcConsents, key)
+		}
+	}
+	return nil
+}
+
+func (s *Store) ListOIDCConsents(_ context.Context) ([]repository.OidcConsent, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	out := make([]repository.OidcConsent, 0, len(s.oidcConsents))
+	for _, oc := range s.oidcConsents {
+		out = append(out, oc)
+	}
+	return out, nil
+}

internal/repository/memory/store.go

@@ -12,6 +12,7 @@ type Store struct {
 	mu           sync.RWMutex
 	sessions     map[string]repository.Session
 	oidcSessions map[string]repository.OidcSession
+	oidcConsents map[string]repository.OidcConsent
 }
 
 // New returns a new empty in-memory Store.
@@ -19,5 +20,6 @@ func New() repository.Store {
 	return &Store{
 		sessions:     make(map[string]repository.Session),
 		oidcSessions: make(map[string]repository.OidcSession),
+		oidcConsents: make(map[string]repository.OidcConsent),
 	}
 }

internal/repository/models.go

@@ -84,3 +84,22 @@ type DeleteExpiredOIDCSessionsParams struct {
 	TokenExpiresAt        int64
 	RefreshTokenExpiresAt int64
 }
+
+type OidcConsent struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+type UpsertOIDCConsentParams struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+type GetOIDCConsentByUsernameAndClientIDParams struct {
+	Username string
+	ClientID string
+}

internal/repository/postgres/models.go

@@ -4,6 +4,13 @@
 
 package postgres
 
+type OidcConsent struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
 type OidcSession struct {
 	Sub                   string
 	AccessTokenHash       string

internal/repository/postgres/oidc_queries.sql.go

@@ -80,6 +80,16 @@ func (q *Queries) DeleteExpiredOIDCSessions(ctx context.Context, arg DeleteExpir
 	return err
 }
 
+const deleteOIDCConsentByClientID = `-- name: DeleteOIDCConsentByClientID :exec
+DELETE FROM "oidc_consents"
+WHERE "client_id" = $1
+`
+
+func (q *Queries) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
+	_, err := q.db.ExecContext(ctx, deleteOIDCConsentByClientID, clientID)
+	return err
+}
+
 const deleteOIDCSessionBySub = `-- name: DeleteOIDCSessionBySub :exec
 DELETE FROM "oidc_sessions"
 WHERE "sub" = $1
@@ -90,6 +100,28 @@ func (q *Queries) DeleteOIDCSessionBySub(ctx context.Context, sub string) error
 	return err
 }
 
+const getOIDCConsentByUsernameAndClientID = `-- name: GetOIDCConsentByUsernameAndClientID :one
+SELECT username, client_id, scope, created_at FROM "oidc_consents"
+WHERE "username" = $1 AND "client_id" = $2
+`
+
+type GetOIDCConsentByUsernameAndClientIDParams struct {
+	Username string
+	ClientID string
+}
+
+func (q *Queries) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error) {
+	row := q.db.QueryRowContext(ctx, getOIDCConsentByUsernameAndClientID, arg.Username, arg.ClientID)
+	var i OidcConsent
+	err := row.Scan(
+		&i.Username,
+		&i.ClientID,
+		&i.Scope,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
 const getOIDCSessionByAccessTokenHash = `-- name: GetOIDCSessionByAccessTokenHash :one
 SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce, userinfo_json FROM "oidc_sessions"
 WHERE "access_token_hash" = $1
@@ -156,6 +188,38 @@ func (q *Queries) GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSess
 	return i, err
 }
 
+const listOIDCConsents = `-- name: ListOIDCConsents :many
+SELECT username, client_id, scope, created_at FROM "oidc_consents"
+`
+
+func (q *Queries) ListOIDCConsents(ctx context.Context) ([]OidcConsent, error) {
+	rows, err := q.db.QueryContext(ctx, listOIDCConsents)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []OidcConsent
+	for rows.Next() {
+		var i OidcConsent
+		if err := rows.Scan(
+			&i.Username,
+			&i.ClientID,
+			&i.Scope,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const updateOIDCSession = `-- name: UpdateOIDCSession :one
 UPDATE "oidc_sessions" SET
     "access_token_hash" = $1,
@@ -208,3 +272,43 @@ func (q *Queries) UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionPa
 	)
 	return i, err
 }
+
+const upsertOIDCConsent = `-- name: UpsertOIDCConsent :one
+INSERT INTO "oidc_consents" (
+    "username",
+    "client_id",
+    "scope",
+    "created_at"
+) VALUES (
+    $1, $2, $3, $4
+)
+ON CONFLICT ("username", "client_id")
+DO UPDATE SET
+    "scope" = excluded.scope,
+    "created_at" = excluded.created_at
+RETURNING username, client_id, scope, created_at
+`
+
+type UpsertOIDCConsentParams struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+func (q *Queries) UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error) {
+	row := q.db.QueryRowContext(ctx, upsertOIDCConsent,
+		arg.Username,
+		arg.ClientID,
+		arg.Scope,
+		arg.CreatedAt,
+	)
+	var i OidcConsent
+	err := row.Scan(
+		&i.Username,
+		&i.ClientID,
+		&i.Scope,
+		&i.CreatedAt,
+	)
+	return i, err
+}

internal/repository/postgres/store.go

@@ -56,6 +56,10 @@ func (s *Store) DeleteExpiredSessions(ctx context.Context, expiry int64) error {
 	return mapErr(s.q.DeleteExpiredSessions(ctx, expiry))
 }
 
+func (s *Store) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
+	return mapErr(s.q.DeleteOIDCConsentByClientID(ctx, clientID))
+}
+
 func (s *Store) DeleteOIDCSessionBySub(ctx context.Context, sub string) error {
 	return mapErr(s.q.DeleteOIDCSessionBySub(ctx, sub))
 }
@@ -64,6 +68,14 @@ func (s *Store) DeleteSession(ctx context.Context, uuid string) error {
 	return mapErr(s.q.DeleteSession(ctx, uuid))
 }
 
+func (s *Store) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
+	r, err := s.q.GetOIDCConsentByUsernameAndClientID(ctx, GetOIDCConsentByUsernameAndClientIDParams(arg))
+	if err != nil {
+		return repository.OidcConsent{}, mapErr(err)
+	}
+	return repository.OidcConsent(r), nil
+}
+
 func (s *Store) GetOIDCSessionByAccessTokenHash(ctx context.Context, accessTokenHash string) (repository.OidcSession, error) {
 	r, err := s.q.GetOIDCSessionByAccessTokenHash(ctx, accessTokenHash)
 	if err != nil {
@@ -96,6 +108,18 @@ func (s *Store) GetSession(ctx context.Context, uuid string) (repository.Session
 	return repository.Session(r), nil
 }
 
+func (s *Store) ListOIDCConsents(ctx context.Context) ([]repository.OidcConsent, error) {
+	rows, err := s.q.ListOIDCConsents(ctx)
+	if err != nil {
+		return nil, mapErr(err)
+	}
+	out := make([]repository.OidcConsent, len(rows))
+	for i, row := range rows {
+		out[i] = repository.OidcConsent(row)
+	}
+	return out, nil
+}
+
 func (s *Store) UpdateOIDCSession(ctx context.Context, arg repository.UpdateOIDCSessionParams) (repository.OidcSession, error) {
 	r, err := s.q.UpdateOIDCSession(ctx, UpdateOIDCSessionParams(arg))
 	if err != nil {
@@ -111,3 +135,11 @@ func (s *Store) UpdateSession(ctx context.Context, arg repository.UpdateSessionP
 	}
 	return repository.Session(r), nil
 }
+
+func (s *Store) UpsertOIDCConsent(ctx context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
+	r, err := s.q.UpsertOIDCConsent(ctx, UpsertOIDCConsentParams(arg))
+	if err != nil {
+		return repository.OidcConsent{}, mapErr(err)
+	}
+	return repository.OidcConsent(r), nil
+}

internal/repository/sqlite/models.go

@@ -4,6 +4,13 @@
 
 package sqlite
 
+type OidcConsent struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
 type OidcSession struct {
 	Sub                   string
 	AccessTokenHash       string

internal/repository/sqlite/oidc_queries.sql.go

@@ -80,6 +80,16 @@ func (q *Queries) DeleteExpiredOIDCSessions(ctx context.Context, arg DeleteExpir
 	return err
 }
 
+const deleteOIDCConsentByClientID = `-- name: DeleteOIDCConsentByClientID :exec
+DELETE FROM "oidc_consents"
+WHERE "client_id" = ?
+`
+
+func (q *Queries) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
+	_, err := q.db.ExecContext(ctx, deleteOIDCConsentByClientID, clientID)
+	return err
+}
+
 const deleteOIDCSessionBySub = `-- name: DeleteOIDCSessionBySub :exec
 DELETE FROM "oidc_sessions"
 WHERE "sub" = ?
@@ -90,6 +100,28 @@ func (q *Queries) DeleteOIDCSessionBySub(ctx context.Context, sub string) error
 	return err
 }
 
+const getOIDCConsentByUsernameAndClientID = `-- name: GetOIDCConsentByUsernameAndClientID :one
+SELECT username, client_id, scope, created_at FROM "oidc_consents"
+WHERE "username" = ? AND "client_id" = ?
+`
+
+type GetOIDCConsentByUsernameAndClientIDParams struct {
+	Username string
+	ClientID string
+}
+
+func (q *Queries) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error) {
+	row := q.db.QueryRowContext(ctx, getOIDCConsentByUsernameAndClientID, arg.Username, arg.ClientID)
+	var i OidcConsent
+	err := row.Scan(
+		&i.Username,
+		&i.ClientID,
+		&i.Scope,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
 const getOIDCSessionByAccessTokenHash = `-- name: GetOIDCSessionByAccessTokenHash :one
 SELECT sub, access_token_hash, refresh_token_hash, scope, client_id, token_expires_at, refresh_token_expires_at, nonce, userinfo_json FROM "oidc_sessions"
 WHERE "access_token_hash" = ?
@@ -156,6 +188,38 @@ func (q *Queries) GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSess
 	return i, err
 }
 
+const listOIDCConsents = `-- name: ListOIDCConsents :many
+SELECT username, client_id, scope, created_at FROM "oidc_consents"
+`
+
+func (q *Queries) ListOIDCConsents(ctx context.Context) ([]OidcConsent, error) {
+	rows, err := q.db.QueryContext(ctx, listOIDCConsents)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []OidcConsent
+	for rows.Next() {
+		var i OidcConsent
+		if err := rows.Scan(
+			&i.Username,
+			&i.ClientID,
+			&i.Scope,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const updateOIDCSession = `-- name: UpdateOIDCSession :one
 UPDATE "oidc_sessions" SET
     "access_token_hash" = ?,
@@ -208,3 +272,43 @@ func (q *Queries) UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionPa
 	)
 	return i, err
 }
+
+const upsertOIDCConsent = `-- name: UpsertOIDCConsent :one
+INSERT INTO "oidc_consents" (
+    "username",
+    "client_id",
+    "scope",
+    "created_at"
+) VALUES (
+    ?, ?, ?, ?
+)
+ON CONFLICT ("username", "client_id")
+DO UPDATE SET
+    "scope" = excluded.scope,
+    "created_at" = excluded.created_at
+RETURNING username, client_id, scope, created_at
+`
+
+type UpsertOIDCConsentParams struct {
+	Username  string
+	ClientID  string
+	Scope     string
+	CreatedAt int64
+}
+
+func (q *Queries) UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error) {
+	row := q.db.QueryRowContext(ctx, upsertOIDCConsent,
+		arg.Username,
+		arg.ClientID,
+		arg.Scope,
+		arg.CreatedAt,
+	)
+	var i OidcConsent
+	err := row.Scan(
+		&i.Username,
+		&i.ClientID,
+		&i.Scope,
+		&i.CreatedAt,
+	)
+	return i, err
+}

internal/repository/sqlite/store.go

@@ -56,6 +56,10 @@ func (s *Store) DeleteExpiredSessions(ctx context.Context, expiry int64) error {
 	return mapErr(s.q.DeleteExpiredSessions(ctx, expiry))
 }
 
+func (s *Store) DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error {
+	return mapErr(s.q.DeleteOIDCConsentByClientID(ctx, clientID))
+}
+
 func (s *Store) DeleteOIDCSessionBySub(ctx context.Context, sub string) error {
 	return mapErr(s.q.DeleteOIDCSessionBySub(ctx, sub))
 }
@@ -64,6 +68,14 @@ func (s *Store) DeleteSession(ctx context.Context, uuid string) error {
 	return mapErr(s.q.DeleteSession(ctx, uuid))
 }
 
+func (s *Store) GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg repository.GetOIDCConsentByUsernameAndClientIDParams) (repository.OidcConsent, error) {
+	r, err := s.q.GetOIDCConsentByUsernameAndClientID(ctx, GetOIDCConsentByUsernameAndClientIDParams(arg))
+	if err != nil {
+		return repository.OidcConsent{}, mapErr(err)
+	}
+	return repository.OidcConsent(r), nil
+}
+
 func (s *Store) GetOIDCSessionByAccessTokenHash(ctx context.Context, accessTokenHash string) (repository.OidcSession, error) {
 	r, err := s.q.GetOIDCSessionByAccessTokenHash(ctx, accessTokenHash)
 	if err != nil {
@@ -96,6 +108,18 @@ func (s *Store) GetSession(ctx context.Context, uuid string) (repository.Session
 	return repository.Session(r), nil
 }
 
+func (s *Store) ListOIDCConsents(ctx context.Context) ([]repository.OidcConsent, error) {
+	rows, err := s.q.ListOIDCConsents(ctx)
+	if err != nil {
+		return nil, mapErr(err)
+	}
+	out := make([]repository.OidcConsent, len(rows))
+	for i, row := range rows {
+		out[i] = repository.OidcConsent(row)
+	}
+	return out, nil
+}
+
 func (s *Store) UpdateOIDCSession(ctx context.Context, arg repository.UpdateOIDCSessionParams) (repository.OidcSession, error) {
 	r, err := s.q.UpdateOIDCSession(ctx, UpdateOIDCSessionParams(arg))
 	if err != nil {
@@ -111,3 +135,11 @@ func (s *Store) UpdateSession(ctx context.Context, arg repository.UpdateSessionP
 	}
 	return repository.Session(r), nil
 }
+
+func (s *Store) UpsertOIDCConsent(ctx context.Context, arg repository.UpsertOIDCConsentParams) (repository.OidcConsent, error) {
+	r, err := s.q.UpsertOIDCConsent(ctx, UpsertOIDCConsentParams(arg))
+	if err != nil {
+		return repository.OidcConsent{}, mapErr(err)
+	}
+	return repository.OidcConsent(r), nil
+}

internal/repository/store.go

@@ -27,4 +27,10 @@ type Store interface {
 	GetOIDCSessionByRefreshTokenHash(ctx context.Context, refreshTokenHash string) (OidcSession, error)
 	GetOIDCSessionBySub(ctx context.Context, sub string) (OidcSession, error)
 	UpdateOIDCSession(ctx context.Context, arg UpdateOIDCSessionParams) (OidcSession, error)
+
+	// OIDC Consents
+	UpsertOIDCConsent(ctx context.Context, arg UpsertOIDCConsentParams) (OidcConsent, error)
+	GetOIDCConsentByUsernameAndClientID(ctx context.Context, arg GetOIDCConsentByUsernameAndClientIDParams) (OidcConsent, error)
+	DeleteOIDCConsentByClientID(ctx context.Context, clientID string) error
+	ListOIDCConsents(ctx context.Context) ([]OidcConsent, error)
 }

internal/service/access_controls_service.go

@@ -2,21 +2,24 @@ package service
 
 import (
 	"errors"
+	"fmt"
+	"net"
 	"strings"
+	"unicode"
 
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
-	"github.com/tinyauthapp/tinyauth/pkg/validators"
 	"go.uber.org/dig"
 )
 
 type LabelProvider interface {
-	GetLabels(appDomain string) (*model.App, error)
+	Lookup(locator func(name string, app *model.App) bool) error
 }
 
 type AccessControlsService struct {
 	log           *logger.Logger
 	config        *model.Config
+	runtime       *model.RuntimeConfig
 	labelProvider LabelProvider
 }
 
@@ -25,6 +28,7 @@ type AccessControlServiceInput struct {
 
 	Log           *logger.Logger
 	Config        *model.Config
+	Runtime       *model.RuntimeConfig
 	LabelProvider LabelProvider `optional:"true"`
 }
 
@@ -33,39 +37,106 @@ func NewAccessControlsService(i AccessControlServiceInput) *AccessControlsServic
 	return &AccessControlsService{
 		log:           i.Log,
 		config:        i.Config,
+		runtime:       i.Runtime,
 		labelProvider: i.LabelProvider,
 	}
 }
 
-func (service *AccessControlsService) lookupStaticACLs(domain string) *model.App {
+func (service *AccessControlsService) ensureAscii(str string) bool {
-	var nameMatch *model.App
+	for i := 0; i < len(str); i++ {
-
+		if str[i] > unicode.MaxASCII {
-	v := validators.NewDomainValidator(validators.DomainValidatorOptions{})
+			return false
-
-	// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
-	for app, config := range service.config.Apps {
-		if config.Config.Domain != "" {
-			err := v.Validate(config.Config.Domain, domain)
-			if err == nil {
-				service.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
-				return &config
-			}
-			if !errors.Is(err, validators.ErrHostnameMismatch) {
-				service.log.App.Debug().Str("name", app).Err(err).Msg("Domain validation failed")
-			}
-		}
-		if strings.HasPrefix(strings.ToLower(domain), strings.ToLower(app+".")) {
-			service.log.App.Debug().Str("name", app).Msg("Found matching container by app name")
-			nameMatch = &config
 		}
 	}
+	return true
+}
 
-	return nameMatch
+func (service *AccessControlsService) normalizeDomain(domain string) string {
+	if host, _, err := net.SplitHostPort(domain); err == nil {
+		domain = host
+	}
+	domain = strings.TrimRight(domain, ".")
+	return strings.ToLower(domain)
+}
+
+func (service *AccessControlsService) getACLs(domain string, lookup func(locator func(name string, app *model.App) bool) error) (*model.App, error) {
+	if !service.ensureAscii(domain) {
+		return nil, errors.New("domain contains non-ascii characters")
+	}
+
+	normalizedDomain := service.normalizeDomain(domain)
+
+	if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain {
+		return nil, fmt.Errorf("domain does not match cookie domain, expected %s (or a subdomain), got %s", service.runtime.CookieDomain, domain)
+	}
+
+	var domainMatch *model.App
+	var nameMatch *model.App
+	var nameMatchedApps []string
+
+	locatorFunc := func(name string, app *model.App) bool {
+		if app.Config.Domain != "" {
+			if !service.ensureAscii(app.Config.Domain) {
+				service.log.App.Warn().Str("name", name).Str("domain", app.Config.Domain).Msg("Domain contains non-ascii characters, skipping")
+				return false
+			}
+			if normalizedDomain == service.normalizeDomain(app.Config.Domain) {
+				service.log.App.Debug().Str("name", name).Msg("Found matching container by domain")
+				domainMatch = app
+				return true
+			}
+			return false
+		}
+		if strings.HasPrefix(normalizedDomain, strings.ToLower(name+".")) {
+			service.log.App.Debug().Str("name", name).Msg("Found matching container by app name")
+			nameMatch = app
+			nameMatchedApps = append(nameMatchedApps, name)
+		}
+		return false
+	}
+
+	err := lookup(locatorFunc)
+	if err != nil {
+		return nil, err
+	}
+
+	if domainMatch != nil {
+		service.log.App.Debug().Str("domain", domain).Msg("Found matching app by domain")
+		return domainMatch, nil
+	}
+
+	if nameMatch == nil {
+		service.log.App.Debug().Str("domain", domain).Msg("No match found for domain, skipping")
+		return nil, nil
+	}
+
+	if len(nameMatchedApps) > 1 {
+		return nil, fmt.Errorf("domain matched multiple apps by name prefix, use explicit domain config")
+	}
+
+	service.log.App.Debug().Str("domain", domain).Msg("Found matching app by app name")
+	return nameMatch, nil
+}
+
+func (service *AccessControlsService) lookupStaticACLs(domain string) (*model.App, error) {
+	return service.getACLs(domain, func(locator func(name string, app *model.App) bool) error {
+		for app, config := range service.config.Apps {
+			if ok := locator(app, &config); ok {
+				return nil
+			}
+		}
+		return nil
+	})
 }
 
 func (service *AccessControlsService) GetAccessControls(domain string) (*model.App, error) {
 	// First check in the static config
-	app := service.lookupStaticACLs(domain)
+	app, err := service.lookupStaticACLs(domain)
+
+	// Will never return an error here, but we need to check it
+	if err != nil {
+		return nil, err
+	}
 
 	if app != nil {
 		service.log.App.Debug().Msg("Using static ACLs for app")
@@ -74,9 +145,9 @@ func (service *AccessControlsService) GetAccessControls(domain string) (*model.A
 
 	// If we have a label provider configured, try to get ACLs from it
 	if service.labelProvider != nil {
-		return service.labelProvider.GetLabels(domain)
+		return service.getACLs(domain, service.labelProvider.Lookup)
 	}
 
-	// no labels
+	// No labels
 	return nil, nil
 }

internal/service/access_controls_service_test.go

@@ -7,221 +7,239 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/test"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
-type mockLabelProvider struct {
+type mockProvider struct {
-	getLabelsFn func(appDomain string) (*model.App, error)
+	acls        map[string]model.App
-	calledWith  string
+	shouldError bool
-	callCount   int
 }
 
-func (m *mockLabelProvider) GetLabels(appDomain string) (*model.App, error) {
+func newMockProvider(acls map[string]model.App, shouldError bool) *mockProvider {
-	m.calledWith = appDomain
+	return &mockProvider{acls: acls, shouldError: shouldError}
-	m.callCount++
+}
-	if m.getLabelsFn != nil {
+
-		return m.getLabelsFn(appDomain)
+func (m *mockProvider) Lookup(locator func(name string, app *model.App) bool) error {
+	if m.shouldError {
+		return errors.New("mock error")
 	}
-	return nil, nil
+	for name, app := range m.acls {
+		if ok := locator(name, &app); ok {
+			return nil
+		}
+	}
+	return nil
 }
 
-func TestLookupStaticACLs(t *testing.T) {
+func TestAccessControlsService(t *testing.T) {
 	log := logger.NewLogger().WithTestConfig()
 	log.Init()
 
+	_, runtime := test.CreateTestConfigs(t)
+
 	tests := []struct {
-		name           string
+		name      string
-		apps           map[string]model.App
+		domain    string
-		domain         string
+		acls      map[string]model.App
-		expectNil      bool
+		want      *model.App
-		expectedDomain string
+		errorFunc func(t *testing.T, e error)
 	}{
 		{
-			name:      "returns nil when no apps are configured",
+			name:   "returns ACLs for domain",
-			apps:      nil,
+			domain: "app.example.com",
-			domain:    "foo.example.com",
+			acls: map[string]model.App{
-			expectNil: true,
+				"foo": {Config: model.AppConfig{Domain: "app.example.com"}},
+			},
+			want: &model.App{Config: model.AppConfig{Domain: "app.example.com"}},
 		},
 		{
-			name: "returns nil when no app matches",
+			name:   "returns ACLs for root domain",
-			apps: map[string]model.App{
+			domain: "example.com",
-				"foo": {Config: model.AppConfig{Domain: "foo.example.com"}},
+			acls: map[string]model.App{
+				"foo": {Config: model.AppConfig{Domain: "example.com"}},
 			},
-			domain:    "bar.example.com",
+			want: &model.App{Config: model.AppConfig{Domain: "example.com"}},
-			expectNil: true,
 		},
 		{
-			name: "matches by exact domain",
+			name:   "returns ACLs for domain with port",
-			apps: map[string]model.App{
+			domain: "example.com:8080",
-				"foo": {Config: model.AppConfig{Domain: "foo.example.com"}},
+			acls: map[string]model.App{
+				"foo": {Config: model.AppConfig{Domain: "example.com"}},
 			},
-			domain:         "foo.example.com",
+			want: &model.App{Config: model.AppConfig{Domain: "example.com"}},
-			expectedDomain: "foo.example.com",
 		},
 		{
-			name: "matches by app name when domain does not match any app",
+			name:   "returns ACLs for domain with trailing dot",
-			apps: map[string]model.App{
+			domain: "example.com.",
-				"foo": {Config: model.AppConfig{Domain: "configured.example.com"}},
+			acls: map[string]model.App{
+				"foo": {Config: model.AppConfig{Domain: "example.com"}},
 			},
-			domain:         "foo.example.com",
+			want: &model.App{Config: model.AppConfig{Domain: "example.com"}},
-			expectedDomain: "configured.example.com",
 		},
 		{
-			name: "matches by app name for nested subdomains",
+			name:   "returns error for non-ascii domain",
-			apps: map[string]model.App{
+			domain: "bücher.example.com",
-				"foo": {Config: model.AppConfig{Domain: "configured.example.com"}},
+			errorFunc: func(t *testing.T, e error) {
+				assert.ErrorContains(t, e, "domain contains non-ascii characters")
 			},
-			domain:         "foo.sub.example.com",
-			expectedDomain: "configured.example.com",
 		},
 		{
-			name: "selects the app matching by domain among multiple apps",
+			name:   "returns ACLs with case-insensitive matching",
-			apps: map[string]model.App{
+			domain: "Example.com",
-				"unrelated": {Config: model.AppConfig{Domain: "other.example.com"}},
+			acls: map[string]model.App{
-				"target":    {Config: model.AppConfig{Domain: "foo.example.com"}},
+				"foo": {Config: model.AppConfig{Domain: "example.com"}},
 			},
-			domain:         "foo.example.com",
+			want: &model.App{Config: model.AppConfig{Domain: "example.com"}},
-			expectedDomain: "foo.example.com",
 		},
-	}
+		{
-
+			name:   "falls back to name matching when domain fails",
-	for _, tt := range tests {
+			domain: "app.example.com",
-		t.Run(tt.name, func(t *testing.T) {
+			acls: map[string]model.App{
-			svc := NewAccessControlsService(AccessControlServiceInput{
+				"app": {Path: model.AppPath{Allow: "/foo"}},
-				Log:           log,
+			},
-				Config:        &model.Config{Apps: tt.apps},
+			want: &model.App{Path: model.AppPath{Allow: "/foo"}},
-				LabelProvider: nil,
+		},
-			})
+		{
-			got := svc.lookupStaticACLs(tt.domain)
+			name:   "name matching is case-insensitive",
-			if tt.expectNil {
+			domain: "aPp.example.com",
-				assert.Nil(t, got)
+			acls: map[string]model.App{
-				return
+				"APP": {Path: model.AppPath{Allow: "/foo"}},
-			}
+			},
-			require.NotNil(t, got)
+			want: &model.App{Path: model.AppPath{Allow: "/foo"}},
-			assert.Equal(t, tt.expectedDomain, got.Config.Domain)
+		},
-		})
+		{
-	}
+			name:   "returns nil when no ACLs are found",
-}
+			domain: "example.com",
-
+			acls:   map[string]model.App{},
-func TestGetAccessControls(t *testing.T) {
+			want:   nil,
-	log := logger.NewLogger().WithTestConfig()
+		},
-	log.Init()
+		{
-
+			name:   "App in domain not matching with the cookie domain should return nothing with name matching",
-	t.Run("returns static ACLs when domain matches", func(t *testing.T) {
+			domain: "foo.bad_example.com",
-		config := model.Config{
+			acls: map[string]model.App{
-			Apps: map[string]model.App{
 				"foo": {
-					Config: model.AppConfig{Domain: "foo.example.com"},
+					Path: model.AppPath{Allow: "/foo"},
-					Users:  model.AppUsers{Allow: "alice"},
 				},
 			},
-		}
+			want: nil,
-		svc := NewAccessControlsService(AccessControlServiceInput{
+			errorFunc: func(t *testing.T, e error) {
-			Log:           log,
+				assert.ErrorContains(t, e, "domain does not match cookie domain")
-			Config:        &config,
-			LabelProvider: nil,
-		})
-
-		got, err := svc.GetAccessControls("foo.example.com")
-
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "foo.example.com", got.Config.Domain)
-		assert.Equal(t, "alice", got.Users.Allow)
-	})
-
-	t.Run("returns nil when no static match and no label provider", func(t *testing.T) {
-		svc := NewAccessControlsService(AccessControlServiceInput{
-			Log:           log,
-			Config:        &model.Config{},
-			LabelProvider: nil,
-		})
-
-		got, err := svc.GetAccessControls("unknown.example.com")
-
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("returns nil when label provider pointer wraps a nil interface", func(t *testing.T) {
-		var provider LabelProvider
-		svc := NewAccessControlsService(AccessControlServiceInput{
-			Log:           log,
-			Config:        &model.Config{},
-			LabelProvider: provider, // nil provider
-		})
-
-		got, err := svc.GetAccessControls("unknown.example.com")
-
-		require.NoError(t, err)
-		assert.Nil(t, got)
-	})
-
-	t.Run("falls back to label provider when no static match", func(t *testing.T) {
-		expected := &model.App{
-			Config: model.AppConfig{Domain: "dynamic.example.com"},
-			Users:  model.AppUsers{Allow: "bob"},
-		}
-		mock := &mockLabelProvider{
-			getLabelsFn: func(appDomain string) (*model.App, error) {
-				return expected, nil
 			},
-		}
+		},
-		var provider LabelProvider = mock
+		{
-		svc := NewAccessControlsService(AccessControlServiceInput{
+			name:   "App in domain not matching with the cookie domain should return nothing with domain matching",
-			Log:           log,
+			domain: "foo.bad_example.com",
-			Config:        &model.Config{},
+			acls: map[string]model.App{
-			LabelProvider: provider,
+				"foo": {
+					Path:   model.AppPath{Allow: "/foo"},
+					Config: model.AppConfig{Domain: "foo.bad_example.com"},
+				},
+			},
+			want: nil,
+			errorFunc: func(t *testing.T, e error) {
+				assert.ErrorContains(t, e, "domain does not match cookie domain")
+			},
+		},
+	}
+
+	// run once for a mock provider
+	for _, test := range tests {
+		t.Run(test.name+"(getACLs)", func(t *testing.T) {
+			mock := newMockProvider(test.acls, false)
+			acls := NewAccessControlsService(AccessControlServiceInput{
+				Log:           log,
+				Runtime:       &runtime,
+				Config:        &model.Config{},
+				LabelProvider: mock,
+			})
+			app, err := acls.getACLs(test.domain, mock.Lookup)
+			if test.errorFunc != nil {
+				test.errorFunc(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.want, app)
 		})
+	}
 
-		got, err := svc.GetAccessControls("dynamic.example.com")
+	// run again for static acls
+	for _, test := range tests {
+		t.Run(test.name+"(staticACLs)", func(t *testing.T) {
+			acls := NewAccessControlsService(AccessControlServiceInput{
+				Log:     log,
+				Runtime: &runtime,
+				Config: &model.Config{
+					Apps: test.acls,
+				},
+			})
+			app, err := acls.lookupStaticACLs(test.domain)
+			if test.errorFunc != nil {
+				test.errorFunc(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, test.want, app)
+		})
+	}
 
-		require.NoError(t, err)
+	// get acls should return an error when the provider fails
-		assert.Same(t, expected, got)
+	mock := newMockProvider(map[string]model.App{}, true)
-		assert.Equal(t, "dynamic.example.com", mock.calledWith)
+	acls := NewAccessControlsService(AccessControlServiceInput{
-		assert.Equal(t, 1, mock.callCount)
+		Log:     log,
+		Runtime: &runtime,
+		Config:  &model.Config{},
 	})
+	_, err := acls.getACLs("example.com", mock.Lookup)
+	assert.Error(t, err)
 
-	t.Run("does not call label provider when static match found", func(t *testing.T) {
+	// get acls should return an error when multiple apps with the same domain exist
-		mock := &mockLabelProvider{}
+	acls = NewAccessControlsService(AccessControlServiceInput{
-		var provider LabelProvider = mock
+		Log:     log,
-		config := model.Config{
+		Runtime: &runtime,
+		Config: &model.Config{
+			Apps: map[string]model.App{
+				"foo":     {Path: model.AppPath{Allow: "/foo"}},
+				"foo.bar": {Path: model.AppPath{Allow: "/bar"}},
+			},
+		},
+	})
+	_, err = acls.GetAccessControls("foo.bar.example.com")
+	assert.ErrorContains(t, err, "domain matched multiple apps by name prefix, use explicit domain config")
+
+	// get access controls should get acls from
+	// static when static acls are configured
+	acls = NewAccessControlsService(AccessControlServiceInput{
+		Log:     log,
+		Runtime: &runtime,
+		Config: &model.Config{
 			Apps: map[string]model.App{
 				"foo": {Config: model.AppConfig{Domain: "foo.example.com"}},
 			},
-		}
+		},
-		svc := NewAccessControlsService(AccessControlServiceInput{
-			Log:           log,
-			Config:        &config,
-			LabelProvider: provider,
-		})
-
-		got, err := svc.GetAccessControls("foo.example.com")
-
-		require.NoError(t, err)
-		require.NotNil(t, got)
-		assert.Equal(t, "foo.example.com", got.Config.Domain)
-		assert.Equal(t, 0, mock.callCount)
 	})
+	app, err := acls.GetAccessControls("foo.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "foo.example.com"}}, app)
 
-	t.Run("propagates label provider errors", func(t *testing.T) {
+	// should return nil for no apps
-		providerErr := errors.New("provider boom")
+	app, err = acls.GetAccessControls("bar.example.com")
-		mock := &mockLabelProvider{
+	require.NoError(t, err)
-			getLabelsFn: func(appDomain string) (*model.App, error) {
+	assert.Nil(t, app)
-				return nil, providerErr
-			},
-		}
-		var provider LabelProvider = mock
-		svc := NewAccessControlsService(AccessControlServiceInput{
-			Log:           log,
-			Config:        &model.Config{},
-			LabelProvider: provider,
-		})
 
-		got, err := svc.GetAccessControls("dynamic.example.com")
+	// Should use label provider if available
-
+	mock = newMockProvider(map[string]model.App{
-		assert.Nil(t, got)
+		"bar": {
-		assert.ErrorIs(t, err, providerErr)
+			Config: model.AppConfig{Domain: "bar.example.com"},
-		assert.Equal(t, 1, mock.callCount)
+		},
+	}, false)
+	acls = NewAccessControlsService(AccessControlServiceInput{
+		Log:           log,
+		Runtime:       &runtime,
+		Config:        &model.Config{},
+		LabelProvider: mock,
 	})
+	app, err = acls.GetAccessControls("bar.example.com")
+	require.NoError(t, err)
+	assert.Equal(t, &model.App{Config: model.AppConfig{Domain: "bar.example.com"}}, app)
 }

internal/service/auth_service.go

@@ -173,7 +173,7 @@ func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error)
 	}
 
 	if auth.ldap != nil {
-		userDN, email, err := auth.ldap.GetUserInfo(username)
+		userDN, email, cn, err := auth.ldap.GetUserInfo(username)
 
 		if err != nil {
 			return nil, fmt.Errorf("failed to get ldap user: %w", err)
@@ -182,6 +182,7 @@ func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error)
 		return &model.UserSearch{
 			Username: userDN,
 			Email:    email,
+			Name:     cn,
 			Type:     model.UserLDAP,
 		}, nil
 	}

internal/service/docker_service.go

@@ -2,7 +2,7 @@ package service
 
 import (
 	"context"
-	"strings"
+	"fmt"
 
 	"github.com/steveiliop56/ding"
 	"github.com/tinyauthapp/tinyauth/internal/model"
@@ -31,7 +31,6 @@ type DockerServiceInput struct {
 }
 
 func NewDockerService(i DockerServiceInput) (*DockerService, error) {
-
 	client, err := client.NewClientWithOpts(client.FromEnv)
 	if err != nil {
 		return nil, err
@@ -68,49 +67,38 @@ func (docker *DockerService) inspectContainer(containerId string) (container.Ins
 	return docker.client.ContainerInspect(docker.context, containerId)
 }
 
-func (docker *DockerService) GetLabels(appDomain string) (*model.App, error) {
+func (docker *DockerService) Lookup(locator func(name string, app *model.App) bool) error {
 	if !docker.isConnected {
 		docker.log.App.Debug().Msg("Docker service not connected, returning empty labels")
-		return nil, nil
+		return nil
 	}
 
 	containers, err := docker.getContainers()
 	if err != nil {
-		return nil, err
+		return fmt.Errorf("failed to get containers: %w", err)
 	}
 
 	for _, ctr := range containers {
 		inspect, err := docker.inspectContainer(ctr.ID)
 		if err != nil {
-			return nil, err
+			docker.log.App.Error().Err(err).Msgf("Failed to inspect container %s", ctr.ID)
+			continue
 		}
 
 		labels, err := decoders.DecodeLabels[model.Apps](inspect.Config.Labels, "apps")
 		if err != nil {
-			return nil, err
+			docker.log.App.Warn().Err(err).Msgf("Failed to decode labels for container %s", ctr.ID)
+			continue
 		}
 
-		var nameMatch *model.App
+		for app, config := range labels.Apps {
-
+			if ok := locator(app, &config); ok {
-		// First try to find a matching app by domain, then fallback to matching by app name (subdomain)
+				return nil
-		for appName, appLabels := range labels.Apps {
-			if appLabels.Config.Domain == appDomain {
-				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by domain")
-				return &appLabels, nil
 			}
-			if strings.SplitN(appDomain, ".", 2)[0] == appName {
-				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by app name")
-				nameMatch = &appLabels
-			}
-		}
-
-		if nameMatch != nil {
-			return nameMatch, nil
 		}
 	}
 
-	docker.log.App.Debug().Str("domain", appDomain).Msg("No matching container found for domain")
+	return nil
-	return nil, nil
 }
 
 func (docker *DockerService) watchAndClose(ctx context.Context) {

internal/service/kubernetes_service.go

@@ -12,6 +12,7 @@ import (
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/decoders"
 	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+	"github.com/tinyauthapp/tinyauth/pkg/validators"
 	"go.uber.org/dig"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -22,31 +23,23 @@ import (
 	"k8s.io/client-go/rest"
 )
 
+type ingressEntry struct {
+	name string
+	app  model.App
+}
+
 type ingressKey struct {
 	namespace string
 	name      string
 }
 
-type ingressAppKey struct {
-	ingressKey
-	appName string
-}
-
-type ingressApp struct {
-	domain  string
-	appName string
-	app     model.App
-}
-
 type KubernetesService struct {
 	log *logger.Logger
 
-	client       dynamic.Interface
+	client         dynamic.Interface
-	started      bool
+	connected      bool
-	mu           sync.RWMutex
+	mu             sync.RWMutex
-	ingressApps  map[ingressKey][]ingressApp
+	ingressEntries map[ingressKey][]ingressEntry
-	domainIndex  map[string]ingressAppKey
-	appNameIndex map[string]ingressAppKey
 }
 
 type KubernetesServiceInput struct {
@@ -86,90 +79,45 @@ func NewKubernetesService(i KubernetesServiceInput) (*KubernetesService, error)
 	i.Log.App.Debug().Str("api", gvr.GroupVersion().String()).Msg("Successfully accessed Ingress API, starting watcher")
 
 	service := &KubernetesService{
-		log:          i.Log,
+		log:            i.Log,
-		client:       client,
+		client:         client,
-		ingressApps:  make(map[ingressKey][]ingressApp),
+		ingressEntries: make(map[ingressKey][]ingressEntry),
-		domainIndex:  make(map[string]ingressAppKey),
-		appNameIndex: make(map[string]ingressAppKey),
 	}
 
 	i.Ding.Go(func(ctx context.Context) {
 		service.watchGVR(gvr, ctx)
 	}, ding.RingMajor)
 
-	service.started = true
+	service.connected = true
 	i.Log.App.Debug().Msg("Kubernetes label provider started successfully")
 
 	return service, nil
 }
 
-func (k *KubernetesService) addIngressApps(namespace, name string, apps []ingressApp) {
+func (k *KubernetesService) addIngressEntries(key ingressKey, entries []ingressEntry) {
 	k.mu.Lock()
 	defer k.mu.Unlock()
-
+	k.ingressEntries[key] = entries
-	key := ingressKey{namespace, name}
-	// Remove existing entries for this ingress
-	if existing, ok := k.ingressApps[key]; ok {
-		for _, app := range existing {
-			delete(k.domainIndex, app.domain)
-			delete(k.appNameIndex, app.appName)
-		}
-	}
-	// Add new entries
-	k.ingressApps[key] = apps
-	for _, app := range apps {
-		appKey := ingressAppKey{key, app.appName}
-		k.domainIndex[app.domain] = appKey
-		k.appNameIndex[app.appName] = appKey
-	}
 }
 
-func (k *KubernetesService) removeIngress(namespace, name string) {
+func (k *KubernetesService) removeIngress(key ingressKey) {
 	k.mu.Lock()
 	defer k.mu.Unlock()
-
+	delete(k.ingressEntries, key)
-	key := ingressKey{namespace, name}
-	if apps, ok := k.ingressApps[key]; ok {
-		for _, app := range apps {
-			delete(k.domainIndex, app.domain)
-			delete(k.appNameIndex, app.appName)
-		}
-		delete(k.ingressApps, key)
-	}
 }
 
-func (k *KubernetesService) getByDomain(domain string) *model.App {
+func (k *KubernetesService) getEntry(locator func(name string, app *model.App) bool) {
 	k.mu.RLock()
 	defer k.mu.RUnlock()
 
-	if appKey, ok := k.domainIndex[domain]; ok {
+	// O(n^2) is not great but the number of ingress entries is expected to be small
-		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
+	for _, entries := range k.ingressEntries {
-			for i := range apps {
+		for _, entry := range entries {
-				app := &apps[i]
+			if ok := locator(entry.name, &entry.app); ok {
-				if app.domain == domain && app.appName == appKey.appName {
+				return
-					return &app.app
-				}
 			}
 		}
 	}
-	return nil
-}
-
-func (k *KubernetesService) getByAppName(appName string) *model.App {
-	k.mu.RLock()
-	defer k.mu.RUnlock()
-
-	if appKey, ok := k.appNameIndex[appName]; ok {
-		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
-			for i := range apps {
-				app := &apps[i]
-				if app.appName == appName {
-					return &app.app
-				}
-			}
-		}
-	}
-	return nil
 }
 
 func (k *KubernetesService) extractPaths(rule map[string]any) ([]string, error) {
@@ -219,7 +167,8 @@ func (k *KubernetesService) extractHosts(item *unstructured.Unstructured) ([]str
 		}
 		paths, err := k.extractPaths(rule)
 		if err != nil {
-			// This is purely to warn users, it doesn't affect our ability to extract hosts so we won't fail the whole operation
+			// This is purely to warn users
+			// It doesn't affect our ability to extract hosts, so we won't fail the whole operation
 			k.log.App.Warn().Err(err).Str("namespace", item.GetNamespace()).Str("name", item.GetName()).Msg("Failed to extract paths from ingress rule")
 			continue
 		}
@@ -235,44 +184,71 @@ func (k *KubernetesService) extractHosts(item *unstructured.Unstructured) ([]str
 }
 
 func (k *KubernetesService) updateFromItem(item *unstructured.Unstructured) {
-	namespace := item.GetNamespace()
+	key := ingressKey{
-	name := item.GetName()
+		namespace: item.GetNamespace(),
+		name:      item.GetName(),
+	}
+
 	annotations := item.GetAnnotations()
 	if annotations == nil {
-		k.removeIngress(namespace, name)
+		k.removeIngress(key)
 		return
 	}
+
 	hosts, err := k.extractHosts(item)
 	if err != nil {
-		k.removeIngress(namespace, name)
+		k.removeIngress(key)
 		return
 	}
+
+	if len(hosts) == 0 {
+		k.log.App.Warn().Str("namespace", key.namespace).Str("name", key.name).Msg("No hosts found in ingress, skipping")
+		k.removeIngress(key)
+		return
+	}
+
 	labels, err := decoders.DecodeLabels[model.Apps](annotations, "apps")
 	if err != nil {
-		k.log.App.Warn().Err(err).Str("namespace", namespace).Str("name", name).Msg("Failed to decode ingress labels, skipping")
+		k.log.App.Warn().Err(err).Str("namespace", key.namespace).Str("name", key.name).Msg("Failed to decode ingress labels, skipping")
-		k.removeIngress(namespace, name)
+		k.removeIngress(key)
 		return
 	}
-	var apps []ingressApp
+
-	for appName, appLabels := range labels.Apps {
+	var entries []ingressEntry
-		if appLabels.Config.Domain == "" {
+
-			continue
+	v := validators.NewDomainValidator(validators.DomainValidatorOptions{})
+
+	for name, config := range labels.Apps {
+		if config.Config.Domain != "" {
+			hostname, err := v.SafeHostname(config.Config.Domain)
+			if err != nil {
+				k.log.App.Warn().Err(err).Str("namespace", key.namespace).Str("name", key.name).Str("domain", config.Config.Domain).Msg("Domain is invalid, matching will rely on app name")
+			} else if slices.Contains(hosts, hostname) {
+				entries = append(entries, ingressEntry{
+					name: name,
+					app:  config,
+				})
+				continue
+			}
 		}
-		if len(hosts) > 0 && !slices.Contains(hosts, appLabels.Config.Domain) {
+
-			k.log.App.Warn().Str("namespace", namespace).Str("name", name).Str("appName", appName).Str("domain", appLabels.Config.Domain).Msg("App domain does not match any hosts defined in ingress rules, skipping")
+		for _, host := range hosts {
-			continue
+			if strings.HasPrefix(strings.ToLower(host), strings.ToLower(name+".")) {
+				entries = append(entries, ingressEntry{
+					name: name,
+					app:  config,
+				})
+				break
+			}
 		}
-		apps = append(apps, ingressApp{
-			domain:  appLabels.Config.Domain,
-			appName: appName,
-			app:     appLabels,
-		})
 	}
-	if len(apps) == 0 {
+
-		k.removeIngress(namespace, name)
+	if len(entries) == 0 {
-	} else {
+		k.removeIngress(key)
-		k.addIngressApps(namespace, name, apps)
+		return
 	}
+
+	k.addIngressEntries(key, entries)
 }
 
 func (k *KubernetesService) resyncGVR(gvr schema.GroupVersionResource, ctx context.Context) error {
@@ -315,7 +291,10 @@ func (k *KubernetesService) runWatcher(gvr schema.GroupVersionResource, w watch.
 			case watch.Added, watch.Modified:
 				k.updateFromItem(item)
 			case watch.Deleted:
-				k.removeIngress(item.GetNamespace(), item.GetName())
+				k.removeIngress(ingressKey{
+					namespace: item.GetNamespace(),
+					name:      item.GetName(),
+				})
 			}
 		case <-resyncTicker.C:
 			if err := k.resyncGVR(gvr, ctx); err != nil {
@@ -362,25 +341,13 @@ func (k *KubernetesService) watchGVR(gvr schema.GroupVersionResource, ctx contex
 	}
 }
 
-func (k *KubernetesService) GetLabels(appDomain string) (*model.App, error) {
+func (k *KubernetesService) Lookup(locator func(name string, app *model.App) bool) error {
-	if !k.started {
+	if !k.connected {
-		k.log.App.Debug().Str("domain", appDomain).Msg("Kubernetes label provider not started, skipping")
+		k.log.App.Debug().Msg("Kubernetes label provider not started, skipping")
-		return nil, nil
+		return nil
 	}
 
-	// First check cache
+	k.getEntry(locator)
-	app := k.getByDomain(appDomain)
-	if app != nil {
-		k.log.App.Debug().Str("domain", appDomain).Msg("Found labels in cache by domain")
-		return app, nil
-	}
-	appName := strings.SplitN(appDomain, ".", 2)[0]
-	app = k.getByAppName(appName)
-	if app != nil {
-		k.log.App.Debug().Str("domain", appDomain).Str("appName", appName).Msg("Found labels in cache by app name")
-		return app, nil
-	}
 
-	k.log.App.Debug().Str("domain", appDomain).Msg("No labels found for domain")
+	return nil
-	return nil, nil
 }

internal/service/kubernetes_service_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"strings"
 	"testing"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -25,47 +26,66 @@ func TestKubernetesService(t *testing.T) {
 			description: "Cache by domain returns app and misses unknown domain",
 			run: func(t *testing.T, svc *KubernetesService) {
 				app := model.App{Config: model.AppConfig{Domain: "foo.example.com"}}
-				svc.addIngressApps("default", "my-ingress", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "foo.example.com", appName: "foo", app: app},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  app,
+						name: "foo",
+					},
 				})
 
-				got := svc.getByDomain("foo.example.com")
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "foo.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				require.NotNil(t, got)
 				assert.Equal(t, "foo.example.com", got.Config.Domain)
-
-				got = svc.getByDomain("notfound.example.com")
-				assert.Nil(t, got)
-			},
-		},
-		{
-			description: "Cache by app name returns app and misses unknown name",
-			run: func(t *testing.T, svc *KubernetesService) {
-				app := model.App{Config: model.AppConfig{Domain: "bar.example.com"}}
-				svc.addIngressApps("default", "my-ingress", []ingressApp{
-					{domain: "bar.example.com", appName: "bar", app: app},
-				})
-
-				got := svc.getByAppName("bar")
-				require.NotNil(t, got)
-				assert.Equal(t, "bar.example.com", got.Config.Domain)
-
-				got = svc.getByAppName("notfound")
-				assert.Nil(t, got)
 			},
 		},
 		{
 			description: "RemoveIngress clears domain and app name entries",
 			run: func(t *testing.T, svc *KubernetesService) {
-				app := model.App{Config: model.AppConfig{Domain: "baz.example.com"}}
+				app := model.App{Config: model.AppConfig{Domain: "foo.example.com"}}
-				svc.addIngressApps("default", "my-ingress", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "baz.example.com", appName: "baz", app: app},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  app,
+						name: "foo",
+					},
 				})
 
-				svc.removeIngress("default", "my-ingress")
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "foo.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+				require.NotNil(t, got)
+				assert.Equal(t, "foo.example.com", got.Config.Domain)
 
-				got := svc.getByDomain("baz.example.com")
+				got = nil
-				assert.Nil(t, got)
+				svc.removeIngress(ingressKey{
-				got = svc.getByAppName("baz")
+					namespace: "default",
+					name:      "my-ingress",
+				})
+
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "foo.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				assert.Nil(t, got)
 			},
 		},
@@ -73,67 +93,130 @@ func TestKubernetesService(t *testing.T) {
 			description: "AddIngressApps replaces stale entries for the same ingress",
 			run: func(t *testing.T, svc *KubernetesService) {
 				old := model.App{Config: model.AppConfig{Domain: "old.example.com"}}
-				svc.addIngressApps("default", "my-ingress", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "old.example.com", appName: "old", app: old},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  old,
+						name: "foo",
+					},
 				})
 
 				updated := model.App{Config: model.AppConfig{Domain: "new.example.com"}}
-				svc.addIngressApps("default", "my-ingress", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "new.example.com", appName: "new", app: updated},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  updated,
+						name: "foo",
+					},
 				})
 
-				got := svc.getByDomain("old.example.com")
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "old.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				assert.Nil(t, got)
 
-				got = svc.getByDomain("new.example.com")
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "new.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				require.NotNil(t, got)
 				assert.Equal(t, "new.example.com", got.Config.Domain)
 			},
 		},
 		{
-			description: "GetLabels returns app from cache when started",
+			description: "GetLabels returns app from cache when connected",
 			run: func(t *testing.T, svc *KubernetesService) {
-				svc.started = true
+				svc.connected = true
 
 				app := model.App{Config: model.AppConfig{Domain: "hit.example.com"}}
-				svc.addIngressApps("default", "ing", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "hit.example.com", appName: "hit", app: app},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  app,
+						name: "foo",
+					},
 				})
 
-				got, err := svc.GetLabels("hit.example.com")
+				var got *model.App
+				err := svc.Lookup(func(name string, app *model.App) bool {
+					if app.Config.Domain == "hit.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				require.NoError(t, err)
+				require.NotNil(t, got)
 				assert.Equal(t, "hit.example.com", got.Config.Domain)
 			},
 		},
 		{
 			description: "GetLabels returns empty app on cache miss when started",
 			run: func(t *testing.T, svc *KubernetesService) {
-				svc.started = true
+				svc.connected = true
 
-				got, err := svc.GetLabels("notfound.example.com")
+				var got *model.App
+				err := svc.Lookup(func(name string, app *model.App) bool {
+					if app.Config.Domain == "notfound.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
 				require.NoError(t, err)
-				assert.Nil(t, got)
+				require.Nil(t, got)
 			},
 		},
 		{
 			description: "GetLabels resolves app by app name",
 			run: func(t *testing.T, svc *KubernetesService) {
-				svc.started = true
+				svc.connected = true
 
-				app := model.App{Config: model.AppConfig{Domain: "myapp.internal.example.com"}}
+				app := model.App{Path: model.AppPath{Allow: "/foo"}}
-				svc.addIngressApps("default", "ing", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "myapp.internal.example.com", appName: "myapp", app: app},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  app,
+						name: "foo",
+					},
 				})
 
-				got, err := svc.GetLabels("myapp.internal.example.com")
+				var got *model.App
+				err := svc.Lookup(func(name string, app *model.App) bool {
+					if strings.HasPrefix("foo.internal.example.com", "foo.") {
+						got = app
+						return true
+					}
+					return false
+				})
 				require.NoError(t, err)
-				assert.Equal(t, "myapp.internal.example.com", got.Config.Domain)
+				require.NotNil(t, got)
+				assert.Equal(t, "/foo", got.Path.Allow)
 			},
 		},
 		{
 			description: "GetLabels returns empty app when service not yet started",
 			run: func(t *testing.T, svc *KubernetesService) {
-				got, err := svc.GetLabels("anything.example.com")
+				var got *model.App
+				err := svc.Lookup(func(name string, app *model.App) bool {
+					return false
+				})
 				require.NoError(t, err)
 				assert.Nil(t, got)
 			},
@@ -148,30 +231,437 @@ func TestKubernetesService(t *testing.T) {
 					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
 					"tinyauth.apps.myapp.users.allow":   "alice",
 				})
+				item.Object["spec"] = map[string]any{
+					"rules": []any{
+						map[string]any{
+							"host": "myapp.example.com",
+						},
+					},
+				}
 
 				svc.updateFromItem(&item)
 
-				got := svc.getByDomain("myapp.example.com")
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "myapp.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+
 				require.NotNil(t, got)
 				assert.Equal(t, "myapp.example.com", got.Config.Domain)
 				assert.Equal(t, "alice", got.Users.Allow)
 			},
 		},
+		{
+			description: "Update from item skips annotations with no hosts",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+				})
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "myapp.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem fails when label parsing fails",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+					"tinyauth.apps.myapp.users.break":   "i-dont-exist",
+				})
+				item.Object["spec"] = map[string]any{
+					"rules": []any{
+						map[string]any{
+							"host": "myapp.example.com",
+						},
+					},
+				}
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "myapp.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+
+				require.Nil(t, got)
+			},
+		},
 		{
 			description: "UpdateFromItem with no annotations removes existing cache entries",
 			run: func(t *testing.T, svc *KubernetesService) {
 				app := model.App{Config: model.AppConfig{Domain: "todelete.example.com"}}
-				svc.addIngressApps("default", "test-ingress", []ingressApp{
+				svc.addIngressEntries(ingressKey{
-					{domain: "todelete.example.com", appName: "todelete", app: app},
+					namespace: "default",
+					name:      "my-ingress",
+				}, []ingressEntry{
+					{
+						app:  app,
+						name: "foo",
+					},
 				})
 
 				item := unstructured.Unstructured{}
 				item.SetNamespace("default")
-				item.SetName("test-ingress")
+				item.SetName("my-ingress")
 
 				svc.updateFromItem(&item)
 
-				got := svc.getByDomain("todelete.example.com")
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if app.Config.Domain == "todelete.example.com" {
+						got = app
+						return true
+					}
+					return false
+				})
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "ExtractPaths returns all non empty paths from a rule",
+			run: func(t *testing.T, svc *KubernetesService) {
+				rule := map[string]any{
+					"http": map[string]any{
+						"paths": []any{
+							map[string]any{"path": "/"},
+							map[string]any{"path": "/api"},
+							map[string]any{"path": ""},
+							map[string]any{"pathType": "Prefix"},
+							"not-a-map",
+						},
+					},
+				}
+
+				paths, err := svc.extractPaths(rule)
+				require.NoError(t, err)
+				assert.Equal(t, []string{"/", "/api"}, paths)
+			},
+		},
+		{
+			description: "ExtractPaths returns nothing when http or paths are missing",
+			run: func(t *testing.T, svc *KubernetesService) {
+				paths, err := svc.extractPaths(map[string]any{})
+				require.NoError(t, err)
+				assert.Empty(t, paths)
+
+				paths, err = svc.extractPaths(map[string]any{
+					"http": map[string]any{},
+				})
+				require.NoError(t, err)
+				assert.Empty(t, paths)
+			},
+		},
+		{
+			description: "ExtractPaths errors when http is not a map",
+			run: func(t *testing.T, svc *KubernetesService) {
+				paths, err := svc.extractPaths(map[string]any{
+					"http": "invalid",
+				})
+				require.Error(t, err)
+				assert.Nil(t, paths)
+			},
+		},
+		{
+			description: "ExtractPaths errors when paths is not a slice",
+			run: func(t *testing.T, svc *KubernetesService) {
+				paths, err := svc.extractPaths(map[string]any{
+					"http": map[string]any{
+						"paths": "invalid",
+					},
+				})
+				require.Error(t, err)
+				assert.Nil(t, paths)
+			},
+		},
+		{
+			description: "ExtractHosts returns hosts from all rules",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "foo.example.com",
+						"http": map[string]any{
+							"paths": []any{
+								map[string]any{"path": "/"},
+							},
+						},
+					},
+					map[string]any{
+						"host": "bar.example.com",
+					},
+					map[string]any{
+						"host": "",
+					},
+					"not-a-map",
+				}, "spec", "rules"))
+
+				hosts, err := svc.extractHosts(&item)
+				require.NoError(t, err)
+				assert.Equal(t, []string{"foo.example.com", "bar.example.com"}, hosts)
+			},
+		},
+		{
+			description: "ExtractHosts still returns hosts when a rule has no catch all path",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "foo.example.com",
+						"http": map[string]any{
+							"paths": []any{
+								map[string]any{"path": "/api"},
+							},
+						},
+					},
+				}, "spec", "rules"))
+
+				hosts, err := svc.extractHosts(&item)
+				require.NoError(t, err)
+				assert.Equal(t, []string{"foo.example.com"}, hosts)
+			},
+		},
+		{
+			description: "ExtractHosts still returns hosts when path extraction fails",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "foo.example.com",
+						"http": "invalid",
+					},
+				}, "spec", "rules"))
+
+				hosts, err := svc.extractHosts(&item)
+				require.NoError(t, err)
+				assert.Equal(t, []string{"foo.example.com"}, hosts)
+			},
+		},
+		{
+			description: "ExtractHosts returns nothing when spec.rules is missing",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+
+				hosts, err := svc.extractHosts(&item)
+				require.NoError(t, err)
+				assert.Empty(t, hosts)
+			},
+		},
+		{
+			description: "ExtractHosts errors when spec.rules is not a slice",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				require.NoError(t, unstructured.SetNestedField(item.Object, "invalid", "spec", "rules"))
+
+				hosts, err := svc.extractHosts(&item)
+				require.Error(t, err)
+				assert.Nil(t, hosts)
+			},
+		},
+		{
+			description: "UpdateFromItem registers app when its domain matches an ingress host",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+				})
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "myapp.example.com",
+					},
+				}, "spec", "rules"))
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if name == "myapp" {
+						got = app
+						return true
+					}
+					return false
+				})
+				require.NotNil(t, got)
+				assert.Equal(t, "myapp.example.com", got.Config.Domain)
+			},
+		},
+		{
+			description: "UpdateFromItem registers app when its name matches an ingress host prefix",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.users.allow": "alice",
+				})
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "MyApp.example.com",
+					},
+				}, "spec", "rules"))
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if name == "myapp" {
+						got = app
+						return true
+					}
+					return false
+				})
+				require.NotNil(t, got)
+				assert.Equal(t, "alice", got.Users.Allow)
+			},
+		},
+		{
+			description: "UpdateFromItem skips apps that match neither host nor name",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+				})
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "other.example.com",
+					},
+				}, "spec", "rules"))
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					got = app
+					return true
+				})
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem falls back to app name when the domain is invalid",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "not a domain",
+				})
+				require.NoError(t, unstructured.SetNestedSlice(item.Object, []any{
+					map[string]any{
+						"host": "myapp.example.com",
+					},
+				}, "spec", "rules"))
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					if name == "myapp" {
+						got = app
+						return true
+					}
+					return false
+				})
+				require.NotNil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem removes entries when host extraction fails",
+			run: func(t *testing.T, svc *KubernetesService) {
+				key := ingressKey{
+					namespace: "default",
+					name:      "test-ingress",
+				}
+				svc.addIngressEntries(key, []ingressEntry{
+					{
+						app:  model.App{Config: model.AppConfig{Domain: "stale.example.com"}},
+						name: "foo",
+					},
+				})
+
+				item := unstructured.Unstructured{}
+				item.SetNamespace(key.namespace)
+				item.SetName(key.name)
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+				})
+				require.NoError(t, unstructured.SetNestedField(item.Object, "invalid", "spec", "rules"))
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					got = app
+					return true
+				})
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem removes entries when annotations are not decodable",
+			run: func(t *testing.T, svc *KubernetesService) {
+				key := ingressKey{
+					namespace: "default",
+					name:      "test-ingress",
+				}
+				svc.addIngressEntries(key, []ingressEntry{
+					{
+						app:  model.App{Config: model.AppConfig{Domain: "stale.example.com"}},
+						name: "foo",
+					},
+				})
+
+				item := unstructured.Unstructured{}
+				item.SetNamespace(key.namespace)
+				item.SetName(key.name)
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.oauthWhitelist": "[",
+				})
+
+				svc.updateFromItem(&item)
+
+				var got *model.App
+				svc.getEntry(func(name string, app *model.App) bool {
+					got = app
+					return true
+				})
 				assert.Nil(t, got)
 			},
 		},
@@ -180,10 +670,8 @@ func TestKubernetesService(t *testing.T) {
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
 			svc := &KubernetesService{
-				ingressApps:  make(map[ingressKey][]ingressApp),
+				ingressEntries: make(map[ingressKey][]ingressEntry),
-				domainIndex:  make(map[string]ingressAppKey),
+				log:            log,
-				appNameIndex: make(map[string]ingressAppKey),
-				log:          log,
 			}
 			test.run(t, svc)
 		})

internal/service/ldap_service.go

@@ -146,7 +146,7 @@ func (ldap *LdapService) connect() (*ldapgo.Conn, error) {
 	return ldap.conn, nil
 }
 
-func (ldap *LdapService) GetUserInfo(username string) (dn string, email string, err error) {
+func (ldap *LdapService) GetUserInfo(username string) (dn string, email string, cn string, err error) {
 	escapedUsername := ldapgo.EscapeFilter(username)
 	filter := fmt.Sprintf(ldap.config.LDAP.SearchFilter, escapedUsername)
 
@@ -154,7 +154,7 @@ func (ldap *LdapService) GetUserInfo(username string) (dn string, email string,
 		ldap.config.LDAP.BaseDN,
 		ldapgo.ScopeWholeSubtree, ldapgo.NeverDerefAliases, 0, 0, false,
 		filter,
-		[]string{"dn", "mail"},
+		[]string{"dn", "mail", "cn"},
 		nil,
 	)
 
@@ -163,15 +163,15 @@ func (ldap *LdapService) GetUserInfo(username string) (dn string, email string,
 
 	searchResult, err := ldap.conn.Search(searchRequest)
 	if err != nil {
-		return "", "", err
+		return "", "", "", err
 	}
 
 	if len(searchResult.Entries) != 1 {
-		return "", "", fmt.Errorf("multiple or no entries found for user %s", username)
+		return "", "", "", fmt.Errorf("multiple or no entries found for user %s", username)
 	}
 
 	entry := searchResult.Entries[0]
-	return entry.DN, entry.GetAttributeValue("mail"), nil
+	return entry.DN, entry.GetAttributeValue("mail"), entry.GetAttributeValue("cn"), nil
 }
 
 func (ldap *LdapService) GetUserCount() (int, error) {

internal/service/oauth_extractors.go

@@ -21,11 +21,15 @@ type GithubUserinfoResponse struct {
 	ID    int    `json:"id"`
 }
 
-func defaultExtractor(client *http.Client, ctx context.Context, url string) (*model.Claims, error) {
+func defaultExtractor(client *http.Client, ctx context.Context, url string, mapClaims MapClaims) (*model.Claims, error) {
-	return simpleReq[model.Claims](client, ctx, url, nil)
+	claims, err := simpleReq[map[string]any](client, ctx, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	return new(mapClaims(*claims)), nil
 }
 
-func githubExtractor(client *http.Client, ctx context.Context, _ string) (*model.Claims, error) {
+func githubExtractor(client *http.Client, ctx context.Context, _ string, _ MapClaims) (*model.Claims, error) {
 	var user model.Claims
 
 	userInfo, err := simpleReq[GithubUserinfoResponse](client, ctx, "https://api.github.com/user", map[string]string{

internal/service/oauth_service.go

@@ -10,7 +10,8 @@ import (
 	"golang.org/x/oauth2"
 )
 
-type OAuthUserinfoExtractor func(client *http.Client, ctx context.Context, url string) (*model.Claims, error)
+type MapClaims func(claims map[string]any) model.Claims
+type OAuthUserinfoExtractor func(client *http.Client, ctx context.Context, url string, mapClaims MapClaims) (*model.Claims, error)
 
 type OAuthService struct {
 	serviceCfg        model.OAuthServiceConfig
@@ -81,7 +82,7 @@ func (s *OAuthService) GetToken(code string, verifier string) (*oauth2.Token, er
 
 func (s *OAuthService) GetUserinfo(token *oauth2.Token) (*model.Claims, error) {
 	client := oauth2.NewClient(s.ctx, oauth2.StaticTokenSource(token))
-	return s.userinfoExtractor(client, s.ctx, s.serviceCfg.UserinfoURL)
+	return s.userinfoExtractor(client, s.ctx, s.serviceCfg.UserinfoURL, s.mapClaims)
 }
 
 func (s *OAuthService) GetConfig() model.OAuthServiceConfig {
@@ -97,3 +98,26 @@ func (s *OAuthService) UpdateConfig(config model.OAuthServiceConfig) {
 	s.config.Endpoint.TokenURL = config.TokenURL
 	s.config.RedirectURL = config.RedirectURL
 }
+
+func (s *OAuthService) mapClaims(claims map[string]any) model.Claims {
+	return model.Claims{
+		Sub:               mapClaim[string]("sub", "", claims),
+		Name:              mapClaim[string]("name", s.serviceCfg.Claims.Name, claims),
+		PreferredUsername: mapClaim[string]("preferred_username", s.serviceCfg.Claims.Username, claims),
+		Email:             mapClaim[string]("email", s.serviceCfg.Claims.Email, claims),
+		Groups:            mapClaim[any]("groups", s.serviceCfg.Claims.Groups, claims),
+	}
+}
+
+func mapClaim[T any](fallback, override string, kv map[string]any) T {
+	key := fallback
+	if override != "" {
+		key = override
+	}
+	v, ok := kv[key].(T)
+	if !ok {
+		var zero T
+		return zero
+	}
+	return v
+}

internal/service/oidc_service.go

@@ -16,6 +16,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"slices"
@@ -163,6 +164,10 @@ type OIDCService struct {
 		usedCode  *cache.CacheStore[UsedCodeEntry]
 		authorize *cache.CacheStore[AuthorizeRequest]
 	}
+
+	mus struct {
+		consent sync.RWMutex
+	}
 }
 
 type OIDCServiceInput struct {
@@ -336,6 +341,11 @@ func NewOIDCService(i OIDCServiceInput) (*OIDCService, error) {
 		issuer:     issuer,
 	}
 
+	// Remove consents for clients that are no longer configured
+	if err := service.reconcileOIDCConsents(context.Background()); err != nil {
+		i.Log.App.Warn().Err(err).Msg("Failed to reconcile OIDC consents")
+	}
+
 	// Start cleanup routine
 	i.Ding.Go(service.cleanupRoutine, ding.RingMinor)
 
@@ -920,7 +930,7 @@ func (service *OIDCService) DeleteAuthorizeRequestTicket(ticket string) {
 	service.caches.authorize.Delete(ticket)
 }
 
-// TODO: support signed request objects in the future
+// DecodeAuthorizeJWT TODO: support signed request objects in the future
 func (service *OIDCService) DecodeAuthorizeJWT(tokenString string) (*AuthorizeRequest, error) {
 	var claims jwt.MapClaims
 
@@ -970,3 +980,114 @@ func (service *OIDCService) GetPrompt(prompt string) []OIDCPrompt {
 
 	return parsedPromps
 }
+
+func (service *OIDCService) getOIDCConsentUnsafe(ctx context.Context, username, clientId string) (*repository.OidcConsent, error) {
+	entry, err := service.queries.GetOIDCConsentByUsernameAndClientID(ctx, repository.GetOIDCConsentByUsernameAndClientIDParams{
+		Username: username,
+		ClientID: clientId,
+	})
+
+	if err != nil {
+		if errors.Is(err, repository.ErrNotFound) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("failed to get oidc consent: %w", err)
+	}
+
+	return &entry, nil
+}
+
+func (service *OIDCService) GetOIDCConsent(ctx context.Context, username, clientId string) (*repository.OidcConsent, error) {
+	service.mus.consent.RLock()
+	defer service.mus.consent.RUnlock()
+	return service.getOIDCConsentUnsafe(ctx, username, clientId)
+}
+
+func (service *OIDCService) UpsertOIDCConsent(ctx context.Context, username, scope, clientId string) (repository.OidcConsent, error) {
+	service.mus.consent.Lock()
+	defer service.mus.consent.Unlock()
+
+	existing, err := service.getOIDCConsentUnsafe(ctx, username, clientId)
+
+	if err != nil {
+		return repository.OidcConsent{}, err
+	}
+
+	merged := scope
+
+	if existing != nil {
+		merged = mergeScopes(existing.Scope, scope)
+	}
+
+	entry := repository.UpsertOIDCConsentParams{
+		Username:  username,
+		Scope:     merged,
+		ClientID:  clientId,
+		CreatedAt: time.Now().Unix(),
+	}
+
+	consent, err := service.queries.UpsertOIDCConsent(ctx, entry)
+
+	if err != nil {
+		service.log.App.Error().Err(err).Msg("Failed to upsert OIDC consent")
+		return repository.OidcConsent{}, err
+	}
+
+	return consent, nil
+}
+
+func (service *OIDCService) reconcileOIDCConsents(ctx context.Context) error {
+	consents, err := service.queries.ListOIDCConsents(ctx)
+
+	if err != nil {
+		return fmt.Errorf("failed to list oidc consents: %w", err)
+	}
+
+	cleaned := make(map[string]struct{})
+
+	for _, consent := range consents {
+		if _, ok := cleaned[consent.ClientID]; ok {
+			continue
+		}
+
+		cleaned[consent.ClientID] = struct{}{}
+
+		if _, ok := service.clients[consent.ClientID]; ok {
+			continue
+		}
+
+		service.log.App.Info().Str("clientId", consent.ClientID).Msg("Removed OIDC client no longer in configuration, deleting its consents")
+
+		if err := service.queries.DeleteOIDCConsentByClientID(ctx, consent.ClientID); err != nil {
+			service.log.App.Warn().Err(err).Str("clientId", consent.ClientID).Msg("Failed to delete OIDC consents for removed client")
+		}
+	}
+
+	return nil
+}
+
+func mergeScopes(existing, requested string) string {
+	set := make(map[string]struct{})
+
+	for _, scope := range strings.Split(existing, " ") {
+		if scope != "" {
+			set[scope] = struct{}{}
+		}
+	}
+
+	for _, scope := range strings.Split(requested, " ") {
+		if scope != "" {
+			set[scope] = struct{}{}
+		}
+	}
+
+	scopes := make([]string, 0, len(set))
+
+	for scope := range set {
+		scopes = append(scopes, scope)
+	}
+
+	slices.Sort(scopes)
+
+	return strings.Join(scopes, " ")
+}

internal/test/test.go

@@ -58,7 +58,15 @@ func CreateTestConfigs(t *testing.T) (model.Config, model.RuntimeConfig) {
 					Domain: "path-allow.example.com",
 				},
 				Path: model.AppPath{
-					Allow: "/allowed",
+					Allow: "^/allowed$",
+				},
+			},
+			"app_path_block": {
+				Config: model.AppConfig{
+					Domain: "path-block.example.com",
+				},
+				Path: model.AppPath{
+					Block: "^/admin$",
 				},
 			},
 			"app_user_allow": {

internal/utils/app_utils.go

@@ -38,7 +38,16 @@ func SafeParseAppURL(str string) (string, error) {
 		return "", fmt.Errorf("ip addresses not allowed")
 	}
 
-	hostname, err = idna.Lookup.ToASCII(hostname)
+	i := idna.New(
+		idna.MapForLookup(),
+		idna.Transitional(false),
+		idna.BidiRule(),
+		idna.StrictDomainName(false),
+		idna.CheckHyphens(true),
+		idna.CheckJoiners(false),
+	)
+
+	hostname, err = i.ToASCII(hostname)
 
 	if err != nil {
 		return "", fmt.Errorf("failed to convert hostname to ascii: %w", err)

internal/utils/app_utils_test.go

@@ -43,6 +43,13 @@ func TestSafeParseAPPURL(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 
+	// Underscores
+	appURL = "http://sub_tinyauth.app"
+	expected = "http://sub_tinyauth.app"
+	result, err = utils.SafeParseAppURL(appURL)
+	assert.NoError(t, err)
+	assert.Equal(t, expected, result)
+
 	// Lowercase
 	appURL = "HTTP://SUb.tinyAUth.aPP"
 	expected = "http://sub.tinyauth.app"
@@ -66,7 +73,7 @@ func TestSafeParseAPPURL(t *testing.T) {
 	assert.ErrorContains(t, err, "invalid url")
 
 	// Invalid punycode
-	appURL = "http://ab--cd.example.com"
+	appURL = "http://xn--h-kva.example.com"
 	_, err = utils.SafeParseAppURL(appURL)
 	assert.ErrorContains(t, err, "failed to convert hostname to ascii")
 

pkg/validators/domain_validator.go

@@ -11,8 +11,6 @@ import (
 	"net"
 	"net/url"
 	"strings"
-
-	"golang.org/x/net/idna"
 )
 
 // Errors
@@ -115,14 +113,10 @@ func (v *DomainValidator) getURL(i string) (*url.URL, error) {
 
 func (v *DomainValidator) getHostname(hostname string) (string, error) {
 	hostname = strings.ToLower(hostname)
-	hostname = strings.TrimSuffix(hostname, ".")
+	hostname = strings.TrimRight(hostname, ".")
 	if net.ParseIP(hostname) != nil {
 		return "", fmt.Errorf("ip addresses are not supported")
 	}
-	hostname, err := idna.Lookup.ToASCII(hostname)
-	if err != nil {
-		return "", fmt.Errorf("failed to convert hostname to ascii: %w", err)
-	}
 	return hostname, nil
 }
 

pkg/validators/domain_validator_test.go

@@ -101,18 +101,6 @@ func TestDomainValidator_SafeHostname(t *testing.T) {
 				assert.ErrorContains(t, e, "ip addresses are not supported")
 			},
 		},
-		{
-			description: "Domains with unicode characters should be allowed",
-			input:       "bücher.example.com",
-			expected:    "xn--bcher-kva.example.com",
-		},
-		{
-			description: "Invalid IDNA domain should fail",
-			input:       "ab--cd.example.com",
-			errorFunc: func(t *testing.T, e error) {
-				assert.ErrorContains(t, e, "invalid label")
-			},
-		},
 		{
 			description: "With port enabled without any port should work",
 			options:     DomainValidatorOptions{WithPort: true},
@@ -194,22 +182,6 @@ func TestDomainValidator_Validate(t *testing.T) {
 			expected:    "https://example.com:443",
 			actual:      "https://example.com:443",
 		},
-		{
-			description: "Failure to format expected domain should fail",
-			expected:    "ab--cd.example.com",
-			actual:      "example.com",
-			errorFunc: func(t *testing.T, e error) {
-				assert.ErrorContains(t, e, "idna: invalid label")
-			},
-		},
-		{
-			description: "Failure to format check domain should fail",
-			expected:    "example.com",
-			actual:      "ab--cd.example.com",
-			errorFunc: func(t *testing.T, e error) {
-				assert.ErrorContains(t, e, "idna: invalid label")
-			},
-		},
 		{
 			description: "Valid domains with matching schemes and ports should pass",
 			options:     DomainValidatorOptions{WithScheme: true, AllowedSchemes: []string{"https", "http"}, WithPort: true},
@@ -236,16 +208,6 @@ func TestDomainValidator_Validate(t *testing.T) {
 			actual:      "example.com",
 			expected:    "example.com",
 		},
-		{
-			description: "Unicode valid domains should pass",
-			expected:    "xn--bcher-kva.example.com",
-			actual:      "bücher.example.com",
-		},
-		{
-			description: "Unicode valid domains should pass (reverse)",
-			expected:    "bücher.example.com",
-			actual:      "xn--bcher-kva.example.com",
-		},
 		{
 			description: "Non matching hostnames should fail",
 			expected:    "example.com",

sql/postgres/oidc_queries.sql

@@ -46,3 +46,29 @@ UPDATE "oidc_sessions" SET
     "userinfo_json" = $8
 WHERE "sub" = $9
 RETURNING *;
+
+-- name: UpsertOIDCConsent :one
+INSERT INTO "oidc_consents" (
+    "username",
+    "client_id",
+    "scope",
+    "created_at"
+) VALUES (
+    $1, $2, $3, $4
+)
+ON CONFLICT ("username", "client_id")
+DO UPDATE SET
+    "scope" = excluded.scope,
+    "created_at" = excluded.created_at
+RETURNING *;
+
+-- name: GetOIDCConsentByUsernameAndClientID :one
+SELECT * FROM "oidc_consents"
+WHERE "username" = $1 AND "client_id" = $2;
+
+-- name: DeleteOIDCConsentByClientID :exec
+DELETE FROM "oidc_consents"
+WHERE "client_id" = $1;
+
+-- name: ListOIDCConsents :many
+SELECT * FROM "oidc_consents";

sql/postgres/oidc_schemas.sql

@@ -9,3 +9,12 @@ CREATE TABLE IF NOT EXISTS "oidc_sessions" (
     "nonce" TEXT NOT NULL DEFAULT '',
     "userinfo_json" TEXT NOT NULL
 );
+
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" BIGINT NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);
+

sql/sqlite/oidc_queries.sql

@@ -46,3 +46,29 @@ UPDATE "oidc_sessions" SET
     "userinfo_json" = ?
 WHERE "sub" = ?
 RETURNING *;
+
+-- name: UpsertOIDCConsent :one
+INSERT INTO "oidc_consents" (
+    "username",
+    "client_id",
+    "scope",
+    "created_at"
+) VALUES (
+    ?, ?, ?, ?
+)
+ON CONFLICT ("username", "client_id")
+DO UPDATE SET
+    "scope" = excluded.scope,
+    "created_at" = excluded.created_at
+RETURNING *;
+
+-- name: GetOIDCConsentByUsernameAndClientID :one
+SELECT * FROM "oidc_consents"
+WHERE "username" = ? AND "client_id" = ?;
+
+-- name: DeleteOIDCConsentByClientID :exec
+DELETE FROM "oidc_consents"
+WHERE "client_id" = ?;
+
+-- name: ListOIDCConsents :many
+SELECT * FROM "oidc_consents";

sql/sqlite/oidc_schemas.sql

@@ -9,3 +9,11 @@ CREATE TABLE IF NOT EXISTS "oidc_sessions" (
     "nonce" TEXT NOT NULL DEFAULT "",
     "userinfo_json" TEXT NOT NULL
 );
+
+CREATE TABLE IF NOT EXISTS "oidc_consents" (
+    "username" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "scope" TEXT NOT NULL,
+    "created_at" INTEGER NOT NULL,
+    PRIMARY KEY ("username", "client_id")
+);