refactor: rework auth and session layer

.env.example

@@ -39,6 +39,8 @@ TINYAUTH_SERVER_SOCKETPATH=
 
 # auth config
 
+# Linking mode for users (username, email, both).
+TINYAUTH_AUTH_LINKINGMODE="both"
 # List of allowed IPs or CIDR ranges.
 TINYAUTH_AUTH_IP_ALLOW=
 # List of blocked IPs or CIDR ranges.
@@ -245,10 +247,10 @@ TINYAUTH_LDAP_GROUPCACHETTL=900
 
 # experimental config
 
-# Enable the OAuth bridge, uses a new way to format OAuth user information.
-TINYAUTH_EXPERIMENTAL_OAUTHBRIDGEENABLED=false
 # Disable the fallback to forward_auth modules when auth_request or ext_authz fail.
 TINYAUTH_EXPERIMENTAL_DISABLEAUTHMODULEFALLBACK=false
+# Disable the generation of additional OAuth user information, avoids things like myuser_myprovider.
+TINYAUTH_EXPERIMENTAL_NOOAUTHUSERINFOGEN=false
 
 # tailscale config
 

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Go dependencies
         run: go mod download
@@ -36,13 +36,6 @@ jobs:
       - name: Setup controller-gen
         run: go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.22.0
 
-      - name: Check codegen is up to date
-        run: |
-          sqlc generate
-          go generate ./...
-          git diff --exit-code
-          git status --porcelain | grep -q . && echo "untracked files code gen files" && exit 1 || true
-
       - name: Install frontend dependencies
         working-directory: ./frontend
         run: pnpm ci
@@ -61,6 +54,13 @@ jobs:
       - name: Copy frontend
         run: cp -r frontend/dist internal/assets/dist
 
+      - name: Check codegen is up to date
+        run: |
+          sqlc generate
+          go generate ./...
+          git diff --exit-code
+          git status --porcelain | grep -q . && echo "untracked files code gen files" && exit 1 || true
+
       - name: Run tests
         run: go test -coverprofile=coverage.txt -v ./...
 

.github/workflows/nightly.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -119,7 +119,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

.github/workflows/release.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend
@@ -94,7 +94,7 @@ jobs:
       - name: Install go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "^1.26.4"
+          go-version: "^1.27.3"
 
       - name: Install frontend dependencies
         working-directory: ./frontend

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Contributing to Tinyauth is straightforward. Follow the steps below to set up a
 ## Requirements
 
 - pnpm
-- Golang v1.26.4 or later
+- Golang v1.27.3 or later
 - Git
 - Docker
 - Make

Dockerfile

@@ -22,7 +22,7 @@ COPY ./frontend/vite.config.ts ./
 RUN pnpm run build
 
 # Builder
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.27-alpine3.23 AS builder
 
 ARG VERSION
 ARG COMMIT_HASH

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.26-alpine3.23
+FROM golang:1.27-alpine3.23
 
 WORKDIR /tinyauth
 
@@ -8,7 +8,7 @@ COPY go.sum ./
 RUN go mod download
 
 RUN go install github.com/air-verse/air@v1.61.7
-RUN go install github.com/go-delve/delve/cmd/dlv@v1.26.3
+RUN go install github.com/go-delve/delve/cmd/dlv@v1.27.2
 
 COPY ./cmd ./cmd
 COPY ./internal ./internal

Dockerfile.distroless

@@ -22,7 +22,7 @@ COPY ./frontend/vite.config.ts ./
 RUN pnpm run build
 
 # Builder
-FROM golang:1.26-alpine3.23 AS builder
+FROM golang:1.27-alpine3.23 AS builder
 
 ARG VERSION
 ARG COMMIT_HASH

Makefile

@@ -92,7 +92,7 @@ sql:
 	sqlc generate
 
 # Go gen
-generate:
+generate: webui
 	go generate ./...
 
 # an alias for generate

cmd/tinyauth/create_oidc_client.go

@@ -34,7 +34,7 @@ func createOidcClientCmd() *cli.Command {
 
 			u := uuid.New()
 			clientId := u.String()
-			clientSecret := "ta-" + utils.GenerateString(61)
+			clientSecret := "ta-" + utils.GenerateSecureString(61)
 
 			uclientName := strings.ToUpper(clientName)
 			lclientName := strings.ToLower(clientName)

frontend/src/components/domain-warning/domain-warning.tsx

@@ -20,7 +20,7 @@ export const DomainWarning = (props: Props) => {
   const { t } = useTranslation();
   const { search } = useLocation();
 
-  const searchParams = new URLSearchParams(search);
+  const searchParams = (new URLSearchParams(search)).toString();
 
   return (
     <Card role="alert" aria-live="assertive">
@@ -45,7 +45,7 @@ export const DomainWarning = (props: Props) => {
       <CardFooter className="flex flex-col items-stretch gap-3">
         <Button
           onClick={() =>
-            window.location.assign(`${appUrl}/login?${searchParams.toString()}`)
+            window.location.assign(`${appUrl}/login${searchParams ? `?${searchParams}` : ""}`)
           }
           variant="outline"
         >

go.mod

@@ -1,6 +1,6 @@
 module github.com/tinyauthapp/tinyauth
 
-go 1.26.4
+go 1.27.3
 
 require (
 	charm.land/huh/v2 v2.0.3

sql/postgres/session_schemas.sql → internal/assets/migrations/postgres/000004_identity.down.sql

@@ -1,3 +1,7 @@
+DROP TABLE IF EXISTS "users";
+DROP TABLE IF EXISTS "identities";
+DROP TABLE IF EXISTS "sessions";
+
 CREATE TABLE IF NOT EXISTS "sessions" (
     "uuid"         TEXT    NOT NULL PRIMARY KEY,
     "username"     TEXT    NOT NULL,

internal/assets/migrations/postgres/000004_identity.up.sql

@@ -0,0 +1,41 @@
+/*
+ Drop the old, legacy, terrible sessions table
+
+ Will log out all users, but that's fine.
+ */
+
+DROP TABLE IF EXISTS "sessions";
+
+/*
+ The new structure consists of the following:
+
+ Users: holds the user data like the username, password, etc.
+ Identities: links the user to the identity provider.
+ Sessions: holds the session data like the UUID, CSRF, expiration time, etc.
+ */
+
+CREATE TABLE IF NOT EXISTS "users" (
+    "uuid" TEXT PRIMARY KEY,
+    "username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "name" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "identities" (
+    "uuid" TEXT PRIMARY KEY,
+    "user_uuid" TEXT NOT NULL,
+    "provider_type" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_user_id" TEXT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("user_uuid") REFERENCES "users"("uuid") ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS "sessions" (
+    "uuid" TEXT PRIMARY KEY,
+    "identity_uuid" TEXT NOT NULL,
+    "expires_at" BIGINT NOT NULL,
+    "created_at" BIGINT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("identity_uuid") REFERENCES "identities"("uuid") ON DELETE CASCADE
+);

sql/sqlite/session_schemas.sql → internal/assets/migrations/sqlite/000012_identity.down.sql

@@ -1,3 +1,7 @@
+DROP TABLE IF EXISTS "users";
+DROP TABLE IF EXISTS "identities";
+DROP TABLE IF EXISTS "sessions";
+
 CREATE TABLE IF NOT EXISTS "sessions" (
     "uuid" TEXT NOT NULL PRIMARY KEY UNIQUE,
     "username" TEXT NOT NULL,

internal/assets/migrations/sqlite/000012_identity.up.sql

@@ -0,0 +1,41 @@
+/*
+ Drop the old, legacy, terrible sessions table
+
+ Will log out all users, but that's fine.
+ */
+
+DROP TABLE IF EXISTS "sessions";
+
+/*
+ The new structure consists of the following:
+
+ Users: holds the user data like the username, password, etc.
+ Identities: links the user to the identity provider.
+ Sessions: holds the session data like the UUID, CSRF, expiration time, etc.
+ */
+
+CREATE TABLE IF NOT EXISTS "users" (
+    "uuid" TEXT PRIMARY KEY,
+    "username" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "name" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "identities" (
+    "uuid" TEXT PRIMARY KEY,
+    "user_uuid" TEXT NOT NULL,
+    "provider_type" TEXT NOT NULL,
+    "provider" TEXT NOT NULL,
+    "provider_user_id" TEXT NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("user_uuid") REFERENCES "users"("uuid") ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS "sessions" (
+    "uuid" TEXT PRIMARY KEY,
+    "identity_uuid" TEXT NOT NULL,
+    "expires_at" INTEGER NOT NULL,
+    "created_at" INTEGER NOT NULL,
+    "context_json" TEXT NOT NULL,
+    FOREIGN KEY("identity_uuid") REFERENCES "identities"("uuid") ON DELETE CASCADE
+);

internal/bootstrap/app_bootstrap.go

@@ -38,12 +38,14 @@ type Services struct {
 	accessControlService *service.AccessControlsService
 	authService          *service.AuthService
 	dockerService        *service.DockerService
+	identityService      *service.IdentityService
 	kubernetesService    *service.KubernetesService
 	ldapService          *service.LdapService
 	oauthBrokerService   *service.OAuthBrokerService
 	oidcService          *service.OIDCService
 	tailscaleService     *service.TailscaleService
 	policyEngine         *service.PolicyEngine
+	sessionsService      *service.SessionsService
 }
 
 type BootstrapApp struct {
@@ -178,10 +180,10 @@ func (app *BootstrapApp) Setup() error {
 	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
 
 	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
-	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
+	app.runtime.OAuthFlowCookieName = fmt.Sprintf("%s-%s", model.OAuthFlowCookieName, cookieId)
 
 	// database
-	store, err := app.SetupStore()
+	store, err := app.setupStore()
 
 	if err != nil {
 		return fmt.Errorf("failed to setup database: %w", err)
@@ -253,17 +255,22 @@ func (app *BootstrapApp) Setup() error {
 
 	if app.services.authService.LocalAuthConfigured() {
 		configuredProviders = append(configuredProviders, model.Provider{
-			Name:  "Local",
-			ID:    "local",
-			OAuth: false,
+			Name: "Local",
+			ID:   "local",
 		})
 	}
 
 	if app.services.authService.LDAPAuthConfigured() {
 		configuredProviders = append(configuredProviders, model.Provider{
-			Name:  "LDAP",
-			ID:    "ldap",
-			OAuth: false,
+			Name: "LDAP",
+			ID:   "ldap",
+		})
+	}
+
+	if app.services.authService.TailscaleAuthConfigured() {
+		configuredProviders = append(configuredProviders, model.Provider{
+			Name: "Tailscale",
+			ID:   "tailscale",
 		})
 	}