Commit Graph

290 Commits

Author SHA1 Message Date
Contre 956d2f55c3 feat(access-control): Add support for Kubernetes Label (#627)
* feat(access-control): Add support for Kubernetes Label

* feat(access-control): Defaults to Docker

* feat(access-control): Remove kubeconfig fallback

* feat(watcher): Watcher for kubernetes service

* feat(watcher): Merge with main + remove nightly fix redirect

* fix(go): Go mod + Go sum after sync with main

* fix(config): Ser default value for LabelProvider to Docker

* feat(go): go mod tidy

* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22

* feat(k8s_service): (Watcher) -> Wait 5s before breaking to outer loop again

* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22

* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22

* feat(k8s_service): Remove logic for deprecated Ingress k8s v1.22

* feat(k8s_service): Remove
var _ = unstructured.Unstructured{} + comments + msg edits

* feat(bootstrap): Remove dockerService from bootstrap svc

* feat(auth_svc): Remove dockerService from authservice

* feat(test): Add tests for kubernetes_services

* feat(test): Remove docker serivce form proxy/user test

* fix(refactor): Remove update logic from watcher and resync

* fix(refactor): Split watchGVR to make it more readable

* fix(refactor): Remove discovery + drop K 1.22 completely

* fix(refactor): Move interface to acess_controls_service

* feat: Autodetect labelprovider if TINYAUTH_LABELPROVIDER not set

* fix(test): Match testing scheme to the controllers

* fix: service bootstrap import after merge

* fix: service bootstrap import after merge
2026-04-29 16:16:21 +03:00
Stavros 5e822d99e1 chore: fix typos in oidc service 2026-04-29 16:08:21 +03:00
Stavros 373ee8806e chore: prefer errors.is instead of comparison 2026-04-29 16:04:27 +03:00
Stavros a14d64c8ba chore: remove exp slices package and use stdlib 2026-04-29 15:56:35 +03:00
Scott McKendry 5d95123dcb feat(oidc): support for all in-spec attributes and scopes (#777)
* feat(oidc): support for all in-spec attributes and scopes

* add tests

* assert phone/email verified when either is set

* update tests

* add claims back to userinfo

* remove redundant column drop in migration

* fix duplicate migration id

* fix clobbered imports post-rebase
2026-04-27 19:25:52 +03:00
Ryc O'Chet f3186571cc Organisation update, steveiliop56 to tinyauthapp (#793)
* infrastructure and docs

* code

* fix issue templates

* chore: fix scoreboard url

* chore: remove migration warning

* chore: fix readme docs link

---------

Co-authored-by: Stavros <steveiliop56@gmail.com>
2026-04-26 17:13:53 +03:00
Stavros 479f165781 fix: fail app on empty app url before parsing 2026-04-16 12:44:24 +03:00
Stavros f257d00648 fix: use fmt println to show warning regardless of log level 2026-04-14 13:43:24 +03:00
Stavros 9f77816a1d feat: add organization migration note 2026-04-14 13:26:55 +03:00
Stavros 93d6191139 fix: lighthouse fixes 2026-04-14 13:16:15 +03:00
Stavros 6f99e7acff fix: revoke access token on duplicate auth code user (#786)
* fix: revoke access token on duplicate auth code user

* fix: review comments

* tests: fix tests
2026-04-14 12:45:27 +03:00
Scott McKendry 18c8413ea3 feat: support unsigned oidc request objects (#785) 2026-04-12 19:19:47 +03:00
Stavros cc94294ece feat: add x-tinyauth-location to nginx response (#783)
* feat: add x-tinyauth-location to nginx response

Solves #773. Normally you let Nginx handle the login URL creation but with this "hack"
we can set an arbitary header with where Tinyauth wants the user to go to. Later the
Nginx error page can get this header and redirect accordingly.

* tests: fix assert.Equal order
2026-04-11 18:04:56 +03:00
Stavros b44dc75f54 fix: return 307 redirects for envoy proxy instead of 401 (#782)
* fix: return 307 redirects for envoy proxy instead of 401

* tests: extend testing for non browser detection in all proxies
2026-04-10 18:11:10 +03:00
Stavros 061d28f5e3 refactor: use tinyauthapp/paerser instead of traefik/paerser (#781)
* refactor: use own paerser library instead of traefik

* chore: remove submodules from release images and workflows
2026-04-10 17:36:13 +03:00
Stavros 2c1b62f464 feat: preserve oidc params in oauth flow (#772) 2026-04-10 15:58:31 +03:00
Scott McKendry 646e24d98c feat(oidc): support access token in body for user info post (#769) 2026-04-08 09:54:54 +01:00
Scott McKendry 0d286d1864 feat(oidc): add post route for /userinfo (#767)
easy two-liner to pass `oidcc-userinfo-post-header` test in conformance
suite.
2026-04-07 23:28:38 +01:00
Stavros 165197e472 feat: add pkce support to oidc server (#766)
* feat: add pkce support to oidc server

* tests: add test cases for pkce

* fix: review comments

* chore: remove debug line

* chore: remove simple logger from testing

* tests: add test for invalid challenge method

* chore: fix typo
2026-04-07 19:04:20 +03:00
Stavros 3373dcc412 test: extend traefik browser tests 2026-04-02 18:46:38 +03:00
Stavros 9d666dc108 fix: skip browser detection for nginx and envoy 2026-04-02 18:24:38 +03:00
Stavros 892097dc4d fix: account for proxy type in browser response 2026-04-02 15:35:55 +03:00
Stavros fc1d4f2082 refactor: use better ignore paths in context middleware (#743) 2026-04-01 17:07:14 +03:00
Stavros da247f8552 fix: handle oauth provider id mismatch correctly 2026-03-30 23:02:20 +03:00
Stavros 5811218dbf refactor: tests (#731)
* tests: rework tests for context controller

* tests: add tests for health controller

* tests: add tests for oidc controller

* tests: use testify assert in context and health controller

* tests: add tests for user controller

* tests: add tests for resources controller

* tests: add well known controller tests

* test: add proxy controller tests

* chore: review comments

* chore: more review comments

* chore: cancel lockdown in testing

* tests: fix get cookie domain tests

* chore: add comment for testing passwords
2026-03-30 15:31:34 +03:00
Stavros f65df872f0 refactor: allow root domain app urls for testing 2026-03-29 20:27:09 +03:00
Stavros d3cda06a75 feat: add lockdown mode on multiple login attempts (#727)
* feat: add lockdown mode on multiple login attempts

* fix: review comments

* fix: fix typo
2026-03-28 20:35:49 +02:00
Stavros f26c217161 refactor: oauth flow (#726)
* wip

* feat: add oauth session impl in auth service

* feat: move oauth logic into auth service and handle multiple sessions

* tests: fix tests

* fix: review comments

* fix: prevent ddos attacks in oauth rate limit
2026-03-22 21:03:32 +02:00
Stavros dc3fa58d21 refactor: refactor proxy controller to handle proxy auth modules better (#714)
* wip

* fix: add extauthz to friendly error messages

* refactor: better module handling per proxy

* fix: get envoy host from the gin request

* tests: rework tests for proxy controller

* fix: review comments
2026-03-14 19:56:15 +02:00
Stavros b3de69e5d6 chore: add comment explaining uri header 2026-03-12 16:36:13 +02:00
Stavros 016a954963 fix: make a x forwarded uri an non required header 2026-03-12 16:26:42 +02:00
Stavros b2a1bfb1f5 fix: validate client id on oidc token endpoint 2026-03-11 16:48:04 +02:00
Stavros f1e869a920 fix: ensure user context has is logged in set to true 2026-03-11 15:57:50 +02:00
Stavros cc5a6d73cf tests: ensure all forwarded headers are set on tests 2026-03-11 15:53:39 +02:00
Stavros 2e03eb9612 fix: do not continue auth on empty x-forwarded headers 2026-03-11 15:46:09 +02:00
Stavros b6eb902d47 fix: fix typo in public key loading 2026-03-08 15:54:50 +02:00
Stavros e3bd834b85 fix: support pkix public keys in oidc 2026-03-08 11:39:16 +02:00
Stavros d7d540000f fix: state should not be a required field in oidc 2026-03-08 11:17:44 +02:00
Stavros 766270f5d6 fix: add kid header to id token 2026-03-08 11:07:15 +02:00
Stavros 69c6c0ba1d fix: add cache control header to token response 2026-03-04 19:38:52 +02:00
Stavros a71f61df8d feat: add email verified claim 2026-03-04 15:52:31 +02:00
Stavros 6bf444010b feat: add nonce claim support to oidc server (#686)
* feat: add nonce claim support to oidc server

* fix: review feedback
2026-03-04 15:34:11 +02:00
Stavros 0e6bcf9713 fix: lookup config file options correctly in file loader 2026-03-03 22:48:44 +02:00
Stavros de980815ce fix: include kid in jwks response 2026-03-03 22:48:44 +02:00
Stavros cd410b6cdf refactor: categorize leftover config options (#682)
* refactor: categorize leftover config options

* chore: update config description
2026-03-02 19:49:59 +02:00
Stavros 24c5b35bdf feat: add user info claims to id token (#681)
* feat: add user info claims to id token

* fix: omit empty user info values
2026-03-02 16:08:17 +02:00
Stavros 43e0f3e713 chore: add correct oidc service documetation url 2026-02-26 17:37:47 +02:00
Stavros 4a1889c20b feat: oidc client create command (#672)
* feat: add oidc client create command

* refactor: use own utility for creating random strings (more flexible
than stdlib)

* feat: validate client name to avoid config errors

* refactor: limit to only alphanumeric characters and hyphens

* refactor: remove the need of the logger in the create oidc client cmd
2026-02-26 17:28:58 +02:00
Stavros 6112f977ea feat: auto generate example env file (#647)
* feat: auto generate example env file

* refactor: simplify build paths func and better slice handling

* chore: forgot to stage everything

* chore: review comments

* refactor: remove square brackets because they mess up the syntax
highlighting

* refactor: use lowercase name to mark dynamic values
2026-02-16 23:39:05 +02:00
Stavros e078e8a3f0 refactor: move disable ui warnings to ui cfg and trusted proxies to auth
cfg
2026-02-16 19:18:40 +02:00