feat: multiple oauth providers (#355)

* feat: add flag decoder (candidate)

* refactor: finalize flags decoder

* feat: add env decoder

* feat: add oauth config parsing logic

* feat: implement backend logic for multiple oauth providers

* feat: implement multiple oauth providers in the frontend

* feat: add some default icons

* chore: add credits for parser

* feat: style oauth auto redirect screen

* fix: bot suggestions

* refactor: rework decoders using simpler and more efficient pattern

* refactor: rework oauth name database migration

internal/assets/migrations/000002_oauth_name.down.sql

@@ -0,0 +1 @@
+ALTER TABLE "sessions" DROP COLUMN "oauth_name";

internal/assets/migrations/000002_oauth_name.up.sql

@@ -0,0 +1,10 @@
+ALTER TABLE "sessions" ADD COLUMN "oauth_name" TEXT;
+
+UPDATE "sessions"
+SET "oauth_name" = CASE
+  WHEN LOWER("provider") = 'github' THEN 'GitHub'
+  WHEN LOWER("provider") = 'google' THEN 'Google'
+  ELSE UPPER(SUBSTR("provider", 1, 1)) || SUBSTR("provider", 2)
+END
+WHERE "oauth_name" IS NULL AND "provider" IS NOT NULL;
+

internal/bootstrap/app_bootstrap.go

@@ -3,6 +3,7 @@ package bootstrap
 import (
 	"fmt"
 	"net/url"
+	"os"
 	"strings"
 	"tinyauth/internal/config"
 	"tinyauth/internal/controller"
@@ -45,6 +46,13 @@ func (app *BootstrapApp) Setup() error {
 		return err
 	}
 
+	// Get OAuth configs
+	oauthProviders, err := utils.GetOAuthProvidersConfig(os.Environ(), os.Args, app.Config.AppURL)
+
+	if err != nil {
+		return err
+	}
+
 	// Get cookie domain
 	cookieDomain, err := utils.GetCookieDomain(app.Config.AppURL)
 
@@ -112,7 +120,7 @@ func (app *BootstrapApp) Setup() error {
 	// Create services
 	dockerService := service.NewDockerService()
 	authService := service.NewAuthService(authConfig, dockerService, ldapService, database)
-	oauthBrokerService := service.NewOAuthBrokerService(app.getOAuthBrokerConfig())
+	oauthBrokerService := service.NewOAuthBrokerService(oauthProviders)
 
 	// Initialize services
 	services := []Service{
@@ -132,13 +140,41 @@ func (app *BootstrapApp) Setup() error {
 	}
 
 	// Configured providers
-	var configuredProviders []string
+	babysit := map[string]string{
+		"google": "Google",
+		"github": "GitHub",
+	}
+	configuredProviders := make([]controller.Provider, 0)
 
-	if authService.UserAuthConfigured() || ldapService != nil {
-		configuredProviders = append(configuredProviders, "username")
+	for id, provider := range oauthProviders {
+		if id == "" {
+			continue
+		}
+
+		if provider.Name == "" {
+			if name, ok := babysit[id]; ok {
+				provider.Name = name
+			} else {
+				provider.Name = utils.Capitalize(id)
+			}
+		}
+
+		configuredProviders = append(configuredProviders, controller.Provider{
+			Name:  provider.Name,
+			ID:    id,
+			OAuth: true,
+		})
 	}
 
-	configuredProviders = append(configuredProviders, oauthBrokerService.GetConfiguredServices()...)
+	if authService.UserAuthConfigured() || ldapService != nil {
+		configuredProviders = append(configuredProviders, controller.Provider{
+			Name:  "Username",
+			ID:    "username",
+			OAuth: false,
+		})
+	}
+
+	log.Debug().Interface("providers", configuredProviders).Msg("Authentication providers")
 
 	if len(configuredProviders) == 0 {
 		return fmt.Errorf("no authentication providers configured")
@@ -179,9 +215,8 @@ func (app *BootstrapApp) Setup() error {
 
 	// Create controllers
 	contextController := controller.NewContextController(controller.ContextControllerConfig{
-		ConfiguredProviders:   configuredProviders,
+		Providers:             configuredProviders,
 		Title:                 app.Config.Title,
-		GenericName:           app.Config.GenericName,
 		AppURL:                app.Config.AppURL,
 		CookieDomain:          cookieDomain,
 		ForgotPasswordMessage: app.Config.ForgotPasswordMessage,
@@ -235,30 +270,3 @@ func (app *BootstrapApp) Setup() error {
 
 	return nil
 }
-
-// Temporary
-func (app *BootstrapApp) getOAuthBrokerConfig() map[string]config.OAuthServiceConfig {
-	return map[string]config.OAuthServiceConfig{
-		"google": {
-			ClientID:     app.Config.GoogleClientId,
-			ClientSecret: app.Config.GoogleClientSecret,
-			RedirectURL:  fmt.Sprintf("%s/api/oauth/callback/google", app.Config.AppURL),
-		},
-		"github": {
-			ClientID:     app.Config.GithubClientId,
-			ClientSecret: app.Config.GithubClientSecret,
-			RedirectURL:  fmt.Sprintf("%s/api/oauth/callback/github", app.Config.AppURL),
-		},
-		"generic": {
-			ClientID:           app.Config.GenericClientId,
-			ClientSecret:       app.Config.GenericClientSecret,
-			RedirectURL:        fmt.Sprintf("%s/api/oauth/callback/generic", app.Config.AppURL),
-			Scopes:             strings.Split(app.Config.GenericScopes, ","),
-			AuthURL:            app.Config.GenericAuthURL,
-			TokenURL:           app.Config.GenericTokenURL,
-			UserinfoURL:        app.Config.GenericUserURL,
-			InsecureSkipVerify: app.Config.GenericSkipSSL,
-		},
-	}
-
-}

internal/config/config.go

@@ -15,45 +15,30 @@ var RedirectCookieName = "tinyauth-redirect"
 // Main app config
 
 type Config struct {
-	Port                    int    `mapstructure:"port" validate:"required"`
-	Address                 string `validate:"required,ip4_addr" mapstructure:"address"`
-	AppURL                  string `validate:"required,url" mapstructure:"app-url"`
-	Users                   string `mapstructure:"users"`
-	UsersFile               string `mapstructure:"users-file"`
-	SecureCookie            bool   `mapstructure:"secure-cookie"`
-	GithubClientId          string `mapstructure:"github-client-id"`
-	GithubClientSecret      string `mapstructure:"github-client-secret"`
-	GithubClientSecretFile  string `mapstructure:"github-client-secret-file"`
-	GoogleClientId          string `mapstructure:"google-client-id"`
-	GoogleClientSecret      string `mapstructure:"google-client-secret"`
-	GoogleClientSecretFile  string `mapstructure:"google-client-secret-file"`
-	GenericClientId         string `mapstructure:"generic-client-id"`
-	GenericClientSecret     string `mapstructure:"generic-client-secret"`
-	GenericClientSecretFile string `mapstructure:"generic-client-secret-file"`
-	GenericScopes           string `mapstructure:"generic-scopes"`
-	GenericAuthURL          string `mapstructure:"generic-auth-url"`
-	GenericTokenURL         string `mapstructure:"generic-token-url"`
-	GenericUserURL          string `mapstructure:"generic-user-url"`
-	GenericName             string `mapstructure:"generic-name"`
-	GenericSkipSSL          bool   `mapstructure:"generic-skip-ssl"`
-	OAuthWhitelist          string `mapstructure:"oauth-whitelist"`
-	OAuthAutoRedirect       string `mapstructure:"oauth-auto-redirect" validate:"oneof=none github google generic"`
-	SessionExpiry           int    `mapstructure:"session-expiry"`
-	LogLevel                string `mapstructure:"log-level" validate:"oneof=trace debug info warn error fatal panic"`
-	Title                   string `mapstructure:"app-title"`
-	LoginTimeout            int    `mapstructure:"login-timeout"`
-	LoginMaxRetries         int    `mapstructure:"login-max-retries"`
-	ForgotPasswordMessage   string `mapstructure:"forgot-password-message"`
-	BackgroundImage         string `mapstructure:"background-image" validate:"required"`
-	LdapAddress             string `mapstructure:"ldap-address"`
-	LdapBindDN              string `mapstructure:"ldap-bind-dn"`
-	LdapBindPassword        string `mapstructure:"ldap-bind-password"`
-	LdapBaseDN              string `mapstructure:"ldap-base-dn"`
-	LdapInsecure            bool   `mapstructure:"ldap-insecure"`
-	LdapSearchFilter        string `mapstructure:"ldap-search-filter"`
-	ResourcesDir            string `mapstructure:"resources-dir"`
-	DatabasePath            string `mapstructure:"database-path" validate:"required"`
-	TrustedProxies          string `mapstructure:"trusted-proxies"`
+	Port                  int    `mapstructure:"port" validate:"required"`
+	Address               string `validate:"required,ip4_addr" mapstructure:"address"`
+	AppURL                string `validate:"required,url" mapstructure:"app-url"`
+	Users                 string `mapstructure:"users"`
+	UsersFile             string `mapstructure:"users-file"`
+	SecureCookie          bool   `mapstructure:"secure-cookie"`
+	OAuthWhitelist        string `mapstructure:"oauth-whitelist"`
+	OAuthAutoRedirect     string `mapstructure:"oauth-auto-redirect"`
+	SessionExpiry         int    `mapstructure:"session-expiry"`
+	LogLevel              string `mapstructure:"log-level" validate:"oneof=trace debug info warn error fatal panic"`
+	Title                 string `mapstructure:"app-title"`
+	LoginTimeout          int    `mapstructure:"login-timeout"`
+	LoginMaxRetries       int    `mapstructure:"login-max-retries"`
+	ForgotPasswordMessage string `mapstructure:"forgot-password-message"`
+	BackgroundImage       string `mapstructure:"background-image" validate:"required"`
+	LdapAddress           string `mapstructure:"ldap-address"`
+	LdapBindDN            string `mapstructure:"ldap-bind-dn"`
+	LdapBindPassword      string `mapstructure:"ldap-bind-password"`
+	LdapBaseDN            string `mapstructure:"ldap-base-dn"`
+	LdapInsecure          bool   `mapstructure:"ldap-insecure"`
+	LdapSearchFilter      string `mapstructure:"ldap-search-filter"`
+	ResourcesDir          string `mapstructure:"resources-dir"`
+	DatabasePath          string `mapstructure:"database-path" validate:"required"`
+	TrustedProxies        string `mapstructure:"trusted-proxies"`
 }
 
 // OAuth/OIDC config
@@ -66,14 +51,16 @@ type Claims struct {
 }
 
 type OAuthServiceConfig struct {
-	ClientID           string
-	ClientSecret       string
-	Scopes             []string
-	RedirectURL        string
-	AuthURL            string
-	TokenURL           string
-	UserinfoURL        string
-	InsecureSkipVerify bool
+	ClientID           string   `key:"client-id"`
+	ClientSecret       string   `key:"client-secret"`
+	ClientSecretFile   string   `key:"client-secret-file"`
+	Scopes             []string `key:"scopes"`
+	RedirectURL        string   `key:"redirect-url"`
+	AuthURL            string   `key:"auth-url"`
+	TokenURL           string   `key:"token-url"`
+	UserinfoURL        string   `key:"user-info-url"`
+	InsecureSkipVerify bool     `key:"insecure-skip-verify"`
+	Name               string   `key:"name"`
 }
 
 // User/session related stuff
@@ -97,6 +84,7 @@ type SessionCookie struct {
 	Provider    string
 	TotpPending bool
 	OAuthGroups string
+	OAuthName   string
 }
 
 type UserContext struct {
@@ -109,6 +97,7 @@ type UserContext struct {
 	TotpPending bool
 	OAuthGroups string
 	TotpEnabled bool
+	OAuthName   string
 }
 
 // API responses and queries
@@ -174,3 +163,9 @@ type AppPath struct {
 	Allow string
 	Block string
 }
+
+// Flags
+
+type Providers struct {
+	Providers map[string]OAuthServiceConfig
+}

internal/controller/context_controller.go

@@ -19,25 +19,30 @@ type UserContextResponse struct {
 	Provider    string `json:"provider"`
 	OAuth       bool   `json:"oauth"`
 	TotpPending bool   `json:"totpPending"`
+	OAuthName   string `json:"oauthName"`
 }
 
 type AppContextResponse struct {
-	Status                int      `json:"status"`
-	Message               string   `json:"message"`
-	ConfiguredProviders   []string `json:"configuredProviders"`
-	Title                 string   `json:"title"`
-	GenericName           string   `json:"genericName"`
-	AppURL                string   `json:"appUrl"`
-	CookieDomain          string   `json:"cookieDomain"`
-	ForgotPasswordMessage string   `json:"forgotPasswordMessage"`
-	BackgroundImage       string   `json:"backgroundImage"`
-	OAuthAutoRedirect     string   `json:"oauthAutoRedirect"`
+	Status                int        `json:"status"`
+	Message               string     `json:"message"`
+	Providers             []Provider `json:"providers"`
+	Title                 string     `json:"title"`
+	AppURL                string     `json:"appUrl"`
+	CookieDomain          string     `json:"cookieDomain"`
+	ForgotPasswordMessage string     `json:"forgotPasswordMessage"`
+	BackgroundImage       string     `json:"backgroundImage"`
+	OAuthAutoRedirect     string     `json:"oauthAutoRedirect"`
+}
+
+type Provider struct {
+	Name  string `json:"name"`
+	ID    string `json:"id"`
+	OAuth bool   `json:"oauth"`
 }
 
 type ContextControllerConfig struct {
-	ConfiguredProviders   []string
+	Providers             []Provider
 	Title                 string
-	GenericName           string
 	AppURL                string
 	CookieDomain          string
 	ForgotPasswordMessage string
@@ -76,6 +81,7 @@ func (controller *ContextController) userContextHandler(c *gin.Context) {
 		Provider:    context.Provider,
 		OAuth:       context.OAuth,
 		TotpPending: context.TotpPending,
+		OAuthName:   context.OAuthName,
 	}
 
 	if err != nil {
@@ -96,9 +102,8 @@ func (controller *ContextController) appContextHandler(c *gin.Context) {
 	c.JSON(200, AppContextResponse{
 		Status:                200,
 		Message:               "Success",
-		ConfiguredProviders:   controller.config.ConfiguredProviders,
+		Providers:             controller.config.Providers,
 		Title:                 controller.config.Title,
-		GenericName:           controller.config.GenericName,
 		AppURL:                fmt.Sprintf("%s://%s", appUrl.Scheme, appUrl.Host),
 		CookieDomain:          controller.config.CookieDomain,
 		ForgotPasswordMessage: controller.config.ForgotPasswordMessage,

internal/controller/context_controller_test.go

@@ -12,9 +12,19 @@ import (
 )
 
 var controllerCfg = controller.ContextControllerConfig{
-	ConfiguredProviders:   []string{"github", "google", "generic"},
+	Providers: []controller.Provider{
+		{
+			Name:  "Username",
+			ID:    "username",
+			OAuth: false,
+		},
+		{
+			Name:  "Google",
+			ID:    "google",
+			OAuth: true,
+		},
+	},
 	Title:                 "Test App",
-	GenericName:           "Generic",
 	AppURL:                "http://localhost:8080",
 	CookieDomain:          "localhost",
 	ForgotPasswordMessage: "Contact admin to reset your password.",
@@ -58,9 +68,8 @@ func TestAppContextHandler(t *testing.T) {
 	expectedRes := controller.AppContextResponse{
 		Status:                200,
 		Message:               "Success",
-		ConfiguredProviders:   controllerCfg.ConfiguredProviders,
+		Providers:             controllerCfg.Providers,
 		Title:                 controllerCfg.Title,
-		GenericName:           controllerCfg.GenericName,
 		AppURL:                controllerCfg.AppURL,
 		CookieDomain:          controllerCfg.CookieDomain,
 		ForgotPasswordMessage: controllerCfg.ForgotPasswordMessage,

internal/controller/oauth_controller.go

@@ -186,6 +186,7 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 		Email:       user.Email,
 		Provider:    req.Provider,
 		OAuthGroups: utils.CoalesceToString(user.Groups),
+		OAuthName:   service.GetName(),
 	})
 
 	if err != nil {

internal/middleware/context_middleware.go

@@ -95,6 +95,7 @@ func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 				Email:       cookie.Email,
 				Provider:    cookie.Provider,
 				OAuthGroups: cookie.OAuthGroups,
+				OAuthName:   cookie.OAuthName,
 				IsLoggedIn:  true,
 				OAuth:       true,
 			})

internal/model/session_model.go

@@ -9,4 +9,5 @@ type Session struct {
 	TOTPPending bool   `gorm:"column:totp_pending"`
 	OAuthGroups string `gorm:"column:oauth_groups"`
 	Expiry      int64  `gorm:"column:expiry"`
+	OAuthName   string `gorm:"column:oauth_name"`
 }

internal/service/auth_service.go

@@ -210,6 +210,7 @@ func (auth *AuthService) CreateSessionCookie(c *gin.Context, data *config.Sessio
 		TOTPPending: data.TotpPending,
 		OAuthGroups: data.OAuthGroups,
 		Expiry:      time.Now().Add(time.Duration(expiry) * time.Second).Unix(),
+		OAuthName:   data.OAuthName,
 	}
 
 	err = auth.database.Create(&session).Error
@@ -278,6 +279,7 @@ func (auth *AuthService) GetSessionCookie(c *gin.Context) (config.SessionCookie,
 		Provider:    session.Provider,
 		TotpPending: session.TOTPPending,
 		OAuthGroups: session.OAuthGroups,
+		OAuthName:   session.OAuthName,
 	}, nil
 }
 

internal/service/generic_oauth_service.go

@@ -22,6 +22,7 @@ type GenericOAuthService struct {
 	verifier           string
 	insecureSkipVerify bool
 	userinfoUrl        string
+	name               string
 }
 
 func NewGenericOAuthService(config config.OAuthServiceConfig) *GenericOAuthService {
@@ -38,6 +39,7 @@ func NewGenericOAuthService(config config.OAuthServiceConfig) *GenericOAuthServi
 		},
 		insecureSkipVerify: config.InsecureSkipVerify,
 		userinfoUrl:        config.UserinfoURL,
+		name:               config.Name,
 	}
 }
 
@@ -115,3 +117,7 @@ func (generic *GenericOAuthService) Userinfo() (config.Claims, error) {
 
 	return user, nil
 }
+
+func (generic *GenericOAuthService) GetName() string {
+	return generic.name
+}

internal/service/github_oauth_service.go

@@ -33,6 +33,7 @@ type GithubOAuthService struct {
 	context  context.Context
 	token    *oauth2.Token
 	verifier string
+	name     string
 }
 
 func NewGithubOAuthService(config config.OAuthServiceConfig) *GithubOAuthService {
@@ -44,6 +45,7 @@ func NewGithubOAuthService(config config.OAuthServiceConfig) *GithubOAuthService
 			Scopes:       GithubOAuthScopes,
 			Endpoint:     endpoints.GitHub,
 		},
+		name: config.Name,
 	}
 }
 
@@ -167,3 +169,7 @@ func (github *GithubOAuthService) Userinfo() (config.Claims, error) {
 
 	return user, nil
 }
+
+func (github *GithubOAuthService) GetName() string {
+	return github.name
+}

internal/service/google_oauth_service.go

@@ -28,6 +28,7 @@ type GoogleOAuthService struct {
 	context  context.Context
 	token    *oauth2.Token
 	verifier string
+	name     string
 }
 
 func NewGoogleOAuthService(config config.OAuthServiceConfig) *GoogleOAuthService {
@@ -39,6 +40,7 @@ func NewGoogleOAuthService(config config.OAuthServiceConfig) *GoogleOAuthService
 			Scopes:       GoogleOAuthScopes,
 			Endpoint:     endpoints.Google,
 		},
+		name: config.Name,
 	}
 }
 
@@ -111,3 +113,7 @@ func (google *GoogleOAuthService) Userinfo() (config.Claims, error) {
 
 	return user, nil
 }
+
+func (google *GoogleOAuthService) GetName() string {
+	return google.name
+}

internal/service/oauth_broker_service.go

@@ -14,6 +14,7 @@ type OAuthService interface {
 	GetAuthURL(state string) string
 	VerifyCode(code string) error
 	Userinfo() (config.Claims, error)
+	GetName() string
 }
 
 type OAuthBrokerService struct {

internal/utils/app_utils.go

@@ -6,6 +6,9 @@ import (
 	"net/url"
 	"strings"
 	"tinyauth/internal/config"
+	"tinyauth/internal/utils/decoders"
+
+	"maps"
 
 	"github.com/gin-gonic/gin"
 	"github.com/rs/zerolog"
@@ -130,3 +133,68 @@ func GetLogLevel(level string) zerolog.Level {
 		return zerolog.InfoLevel
 	}
 }
+
+func GetOAuthProvidersConfig(env []string, args []string, appUrl string) (map[string]config.OAuthServiceConfig, error) {
+	providers := make(map[string]config.OAuthServiceConfig)
+
+	// Get from environment variables
+	envMap := make(map[string]string)
+
+	for _, e := range env {
+		pair := strings.SplitN(e, "=", 2)
+		if len(pair) == 2 {
+			envMap[pair[0]] = pair[1]
+		}
+	}
+
+	envProviders, err := decoders.DecodeEnv(envMap)
+
+	if err != nil {
+		return nil, err
+	}
+
+	maps.Copy(providers, envProviders.Providers)
+
+	// Get from flags
+	flagsMap := make(map[string]string)
+
+	for _, arg := range args[1:] {
+		if strings.HasPrefix(arg, "--") {
+			pair := strings.SplitN(arg[2:], "=", 2)
+			if len(pair) == 2 {
+				flagsMap[pair[0]] = pair[1]
+			}
+		}
+	}
+
+	flagProviders, err := decoders.DecodeFlags(flagsMap)
+
+	if err != nil {
+		return nil, err
+	}
+
+	maps.Copy(providers, flagProviders.Providers)
+
+	// For every provider get correct secret from file if set
+	for name, provider := range providers {
+		secret := GetSecret(provider.ClientSecret, provider.ClientSecretFile)
+		provider.ClientSecret = secret
+		provider.ClientSecretFile = ""
+		providers[name] = provider
+	}
+
+	// If we have google/github providers and no redirect URL babysit them
+	babysitProviders := []string{"google", "github"}
+
+	for _, name := range babysitProviders {
+		if provider, exists := providers[name]; exists {
+			if provider.RedirectURL == "" {
+				provider.RedirectURL = appUrl + "/api/oauth/callback/" + name
+				providers[name] = provider
+			}
+		}
+	}
+
+	// Return combined providers
+	return providers, nil
+}

internal/utils/app_utils_test.go

@@ -1,6 +1,7 @@
 package utils_test
 
 import (
+	"os"
 	"testing"
 	"tinyauth/internal/config"
 	"tinyauth/internal/utils"
@@ -200,3 +201,71 @@ func TestIsRedirectSafe(t *testing.T) {
 	result = utils.IsRedirectSafe(redirectURL, domain)
 	assert.Equal(t, false, result)
 }
+
+func TestGetOAuthProvidersConfig(t *testing.T) {
+	env := []string{"PROVIDERS_CLIENT1_CLIENT_ID=client1-id", "PROVIDERS_CLIENT1_CLIENT_SECRET=client1-secret"}
+	args := []string{"/tinyauth/tinyauth", "--providers-client2-client-id=client2-id", "--providers-client2-client-secret=client2-secret"}
+
+	expected := map[string]config.OAuthServiceConfig{
+		"client1": {
+			ClientID:     "client1-id",
+			ClientSecret: "client1-secret",
+		},
+		"client2": {
+			ClientID:     "client2-id",
+			ClientSecret: "client2-secret",
+		},
+	}
+
+	result, err := utils.GetOAuthProvidersConfig(env, args, "")
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, result)
+
+	// Case with no providers
+	env = []string{}
+	args = []string{"/tinyauth/tinyauth"}
+	expected = map[string]config.OAuthServiceConfig{}
+
+	result, err = utils.GetOAuthProvidersConfig(env, args, "")
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, result)
+
+	// Case with secret from file
+	file, err := os.Create("/tmp/tinyauth_test_file")
+	assert.NilError(t, err)
+
+	_, err = file.WriteString("file content\n")
+	assert.NilError(t, err)
+
+	err = file.Close()
+	assert.NilError(t, err)
+	defer os.Remove("/tmp/tinyauth_test_file")
+
+	env = []string{"PROVIDERS_CLIENT1_CLIENT_ID=client1-id", "PROVIDERS_CLIENT1_CLIENT_SECRET_FILE=/tmp/tinyauth_test_file"}
+	args = []string{"/tinyauth/tinyauth"}
+	expected = map[string]config.OAuthServiceConfig{
+		"client1": {
+			ClientID:     "client1-id",
+			ClientSecret: "file content",
+		},
+	}
+
+	result, err = utils.GetOAuthProvidersConfig(env, args, "")
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, result)
+
+	// Case with google provider and no redirect URL
+	env = []string{"PROVIDERS_GOOGLE_CLIENT_ID=google-id", "PROVIDERS_GOOGLE_CLIENT_SECRET=google-secret"}
+	args = []string{"/tinyauth/tinyauth"}
+	expected = map[string]config.OAuthServiceConfig{
+		"google": {
+			ClientID:     "google-id",
+			ClientSecret: "google-secret",
+			RedirectURL:  "http://app.url/api/oauth/callback/google",
+		},
+	}
+
+	result, err = utils.GetOAuthProvidersConfig(env, args, "http://app.url")
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, result)
+}

internal/utils/decoders/decoders.go

@@ -0,0 +1,81 @@
+package decoders
+
+import (
+	"reflect"
+	"strings"
+	"tinyauth/internal/config"
+)
+
+func NormalizeKeys(keys map[string]string, rootName string, sep string) map[string]string {
+	normalized := make(map[string]string)
+	knownKeys := getKnownKeys()
+
+	for k, v := range keys {
+		var finalKey []string
+		var suffix string
+		var camelClientName string
+		var camelField string
+
+		finalKey = append(finalKey, rootName)
+		finalKey = append(finalKey, "providers")
+		cebabKey := strings.ToLower(k)
+
+		for _, known := range knownKeys {
+			if strings.HasSuffix(cebabKey, strings.ReplaceAll(known, "-", sep)) {
+				suffix = known
+				break
+			}
+		}
+
+		if suffix == "" {
+			continue
+		}
+
+		clientNameParts := strings.Split(strings.TrimPrefix(strings.TrimSuffix(cebabKey, sep+strings.ReplaceAll(suffix, "-", sep)), "providers"+sep), sep)
+
+		for i, p := range clientNameParts {
+			if i == 0 {
+				camelClientName += p
+				continue
+			}
+			if p == "" {
+				continue
+			}
+			camelClientName += strings.ToUpper(string([]rune(p)[0])) + string([]rune(p)[1:])
+		}
+
+		finalKey = append(finalKey, camelClientName)
+
+		filedParts := strings.Split(suffix, "-")
+
+		for i, p := range filedParts {
+			if i == 0 {
+				camelField += p
+				continue
+			}
+			if p == "" {
+				continue
+			}
+			camelField += strings.ToUpper(string([]rune(p)[0])) + string([]rune(p)[1:])
+		}
+
+		finalKey = append(finalKey, camelField)
+		normalized[strings.Join(finalKey, ".")] = v
+	}
+
+	return normalized
+}
+
+func getKnownKeys() []string {
+	var known []string
+
+	p := config.OAuthServiceConfig{}
+	v := reflect.ValueOf(p)
+	typeOfP := v.Type()
+
+	for field := range typeOfP.NumField() {
+		known = append(known, typeOfP.Field(field).Tag.Get("key"))
+	}
+
+	return known
+}

internal/utils/decoders/decoders_test.go

@@ -0,0 +1,44 @@
+package decoders_test
+
+import (
+	"testing"
+	"tinyauth/internal/utils/decoders"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestNormalizeKeys(t *testing.T) {
+	// Test with env
+	test := map[string]string{
+		"PROVIDERS_CLIENT1_CLIENT_ID":                    "my-client-id",
+		"PROVIDERS_CLIENT1_CLIENT_SECRET":                "my-client-secret",
+		"PROVIDERS_MY_AWESOME_CLIENT_CLIENT_ID":          "my-awesome-client-id",
+		"PROVIDERS_MY_AWESOME_CLIENT_CLIENT_SECRET_FILE": "/path/to/secret",
+	}
+	expected := map[string]string{
+		"tinyauth.providers.client1.clientId":                 "my-client-id",
+		"tinyauth.providers.client1.clientSecret":             "my-client-secret",
+		"tinyauth.providers.myAwesomeClient.clientId":         "my-awesome-client-id",
+		"tinyauth.providers.myAwesomeClient.clientSecretFile": "/path/to/secret",
+	}
+
+	normalized := decoders.NormalizeKeys(test, "tinyauth", "_")
+	assert.DeepEqual(t, normalized, expected)
+
+	// Test with flags (assume -- is already stripped)
+	test = map[string]string{
+		"providers-client1-client-id":                    "my-client-id",
+		"providers-client1-client-secret":                "my-client-secret",
+		"providers-my-awesome-client-client-id":          "my-awesome-client-id",
+		"providers-my-awesome-client-client-secret-file": "/path/to/secret",
+	}
+	expected = map[string]string{
+		"tinyauth.providers.client1.clientId":                 "my-client-id",
+		"tinyauth.providers.client1.clientSecret":             "my-client-secret",
+		"tinyauth.providers.myAwesomeClient.clientId":         "my-awesome-client-id",
+		"tinyauth.providers.myAwesomeClient.clientSecretFile": "/path/to/secret",
+	}
+
+	normalized = decoders.NormalizeKeys(test, "tinyauth", "-")
+	assert.DeepEqual(t, normalized, expected)
+}

internal/utils/decoders/env_decoder.go

@@ -0,0 +1,20 @@
+package decoders
+
+import (
+	"tinyauth/internal/config"
+
+	"github.com/traefik/paerser/parser"
+)
+
+func DecodeEnv(env map[string]string) (config.Providers, error) {
+	normalized := NormalizeKeys(env, "tinyauth", "_")
+	var providers config.Providers
+
+	err := parser.Decode(normalized, &providers, "tinyauth", "tinyauth.providers")
+
+	if err != nil {
+		return config.Providers{}, err
+	}
+
+	return providers, nil
+}

internal/utils/decoders/env_decoder_test.go

@@ -0,0 +1,60 @@
+package decoders_test
+
+import (
+	"testing"
+	"tinyauth/internal/config"
+	"tinyauth/internal/utils/decoders"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestDecodeEnv(t *testing.T) {
+	// Variables
+	expected := config.Providers{
+		Providers: map[string]config.OAuthServiceConfig{
+			"client1": {
+				ClientID:           "client1-id",
+				ClientSecret:       "client1-secret",
+				Scopes:             []string{"client1-scope1", "client1-scope2"},
+				RedirectURL:        "client1-redirect-url",
+				AuthURL:            "client1-auth-url",
+				UserinfoURL:        "client1-user-info-url",
+				Name:               "Client1",
+				InsecureSkipVerify: false,
+			},
+			"client2": {
+				ClientID:           "client2-id",
+				ClientSecret:       "client2-secret",
+				Scopes:             []string{"client2-scope1", "client2-scope2"},
+				RedirectURL:        "client2-redirect-url",
+				AuthURL:            "client2-auth-url",
+				UserinfoURL:        "client2-user-info-url",
+				Name:               "My Awesome Client2",
+				InsecureSkipVerify: false,
+			},
+		},
+	}
+	test := map[string]string{
+		"PROVIDERS_CLIENT1_CLIENT_ID":            "client1-id",
+		"PROVIDERS_CLIENT1_CLIENT_SECRET":        "client1-secret",
+		"PROVIDERS_CLIENT1_SCOPES":               "client1-scope1,client1-scope2",
+		"PROVIDERS_CLIENT1_REDIRECT_URL":         "client1-redirect-url",
+		"PROVIDERS_CLIENT1_AUTH_URL":             "client1-auth-url",
+		"PROVIDERS_CLIENT1_USER_INFO_URL":        "client1-user-info-url",
+		"PROVIDERS_CLIENT1_NAME":                 "Client1",
+		"PROVIDERS_CLIENT1_INSECURE_SKIP_VERIFY": "false",
+		"PROVIDERS_CLIENT2_CLIENT_ID":            "client2-id",
+		"PROVIDERS_CLIENT2_CLIENT_SECRET":        "client2-secret",
+		"PROVIDERS_CLIENT2_SCOPES":               "client2-scope1,client2-scope2",
+		"PROVIDERS_CLIENT2_REDIRECT_URL":         "client2-redirect-url",
+		"PROVIDERS_CLIENT2_AUTH_URL":             "client2-auth-url",
+		"PROVIDERS_CLIENT2_USER_INFO_URL":        "client2-user-info-url",
+		"PROVIDERS_CLIENT2_NAME":                 "My Awesome Client2",
+		"PROVIDERS_CLIENT2_INSECURE_SKIP_VERIFY": "false",
+	}
+
+	// Test
+	res, err := decoders.DecodeEnv(test)
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, res)
+}

internal/utils/decoders/flags_decoder.go

@@ -0,0 +1,30 @@
+package decoders
+
+import (
+	"strings"
+	"tinyauth/internal/config"
+
+	"github.com/traefik/paerser/parser"
+)
+
+func DecodeFlags(flags map[string]string) (config.Providers, error) {
+	filtered := filterFlags(flags)
+	normalized := NormalizeKeys(filtered, "tinyauth", "-")
+	var providers config.Providers
+
+	err := parser.Decode(normalized, &providers, "tinyauth", "tinyauth.providers")
+
+	if err != nil {
+		return config.Providers{}, err
+	}
+
+	return providers, nil
+}
+
+func filterFlags(flags map[string]string) map[string]string {
+	filtered := make(map[string]string)
+	for k, v := range flags {
+		filtered[strings.TrimPrefix(k, "--")] = v
+	}
+	return filtered
+}

internal/utils/decoders/flags_decoder_test.go

@@ -0,0 +1,60 @@
+package decoders_test
+
+import (
+	"testing"
+	"tinyauth/internal/config"
+	"tinyauth/internal/utils/decoders"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestDecodeFlags(t *testing.T) {
+	// Variables
+	expected := config.Providers{
+		Providers: map[string]config.OAuthServiceConfig{
+			"client1": {
+				ClientID:           "client1-id",
+				ClientSecret:       "client1-secret",
+				Scopes:             []string{"client1-scope1", "client1-scope2"},
+				RedirectURL:        "client1-redirect-url",
+				AuthURL:            "client1-auth-url",
+				UserinfoURL:        "client1-user-info-url",
+				Name:               "Client1",
+				InsecureSkipVerify: false,
+			},
+			"client2": {
+				ClientID:           "client2-id",
+				ClientSecret:       "client2-secret",
+				Scopes:             []string{"client2-scope1", "client2-scope2"},
+				RedirectURL:        "client2-redirect-url",
+				AuthURL:            "client2-auth-url",
+				UserinfoURL:        "client2-user-info-url",
+				Name:               "My Awesome Client2",
+				InsecureSkipVerify: false,
+			},
+		},
+	}
+	test := map[string]string{
+		"--providers-client1-client-id":            "client1-id",
+		"--providers-client1-client-secret":        "client1-secret",
+		"--providers-client1-scopes":               "client1-scope1,client1-scope2",
+		"--providers-client1-redirect-url":         "client1-redirect-url",
+		"--providers-client1-auth-url":             "client1-auth-url",
+		"--providers-client1-user-info-url":        "client1-user-info-url",
+		"--providers-client1-name":                 "Client1",
+		"--providers-client1-insecure-skip-verify": "false",
+		"--providers-client2-client-id":            "client2-id",
+		"--providers-client2-client-secret":        "client2-secret",
+		"--providers-client2-scopes":               "client2-scope1,client2-scope2",
+		"--providers-client2-redirect-url":         "client2-redirect-url",
+		"--providers-client2-auth-url":             "client2-auth-url",
+		"--providers-client2-user-info-url":        "client2-user-info-url",
+		"--providers-client2-name":                 "My Awesome Client2",
+		"--providers-client2-insecure-skip-verify": "false",
+	}
+
+	// Test
+	res, err := decoders.DecodeFlags(test)
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, res)
+}

internal/utils/decoders/label_decoder_test.go

@@ -1,10 +1,11 @@
 package decoders_test
 
 import (
-	"reflect"
 	"testing"
 	"tinyauth/internal/config"
 	"tinyauth/internal/utils/decoders"
+
+	"gotest.tools/v3/assert"
 )
 
 func TestDecodeLabels(t *testing.T) {
@@ -62,12 +63,6 @@ func TestDecodeLabels(t *testing.T) {
 
 	// Test
 	result, err := decoders.DecodeLabels(test)
-
-	if err != nil {
-		t.Fatalf("Unexpected error: %v", err)
-	}
-
-	if reflect.DeepEqual(expected, result) == false {
-		t.Fatalf("Expected %v but got %v", expected, result)
-	}
+	assert.NilError(t, err)
+	assert.DeepEqual(t, expected, result)
 }