fix: fix verion setting in cd and dockerfiles

tests: fix log wrapper tests
tests: remove error wrapper from context tests
2026-07-02 08:10:15 +00:00 · 2026-05-04 21:08:45 +03:00 · 2026-05-04 21:01:13 +03:00 · 2026-05-04 20:57:37 +03:00 · 2026-05-04 20:52:59 +03:00 · 2026-05-04 20:33:49 +03:00
36 changed files with 289 additions and 598 deletions
@@ -91,8 +91,6 @@ TINYAUTH_APPS_name_LDAP_GROUPS=

 # Comma-separated list of allowed OAuth domains.
 TINYAUTH_OAUTH_WHITELIST=
-# Path to the OAuth whitelist file.
-TINYAUTH_OAUTH_WHITELISTFILE=
 # The OAuth provider to use for automatic redirection.
 TINYAUTH_OAUTH_AUTOREDIRECT=
 # OAuth client ID.
@@ -49,11 +49,6 @@ jobs:
        run: |
          cp -r frontend/dist internal/assets/dist

-      - name: Lint backend
-        uses: golangci/golangci-lint-action@v9
-        with:
-          version: v2.12
-
      - name: Run tests
        run: go test -coverprofile=coverage.txt -v ./...

@@ -38,6 +38,6 @@ jobs:
          retention-days: 5

      - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
        with:
          sarif_file: results.sarif
@@ -1,17 +0,0 @@
-version: "2"
-linters:
-  settings:
-    errcheck:
-      exclude-functions:
-        - (http.ResponseWriter).Write
-        - (http.ResponseWriter).WriteString
-        - (github.com/gin-gonic/gin.ResponseWriter).Write
-        - (github.com/gin-gonic/gin.ResponseWriter).WriteString
-  exclusions:
-    rules:
-      - linters:
-          - errcheck
-        text: "//nolint:errcheck"
-      - linters:
-          - staticcheck
-        text: "//nolint:staticcheck"
@@ -65,7 +65,7 @@ Tinyauth is licensed under the GNU General Public License v3.0. TL;DR — You ma

 A big thank you to the following people for providing me with more coffee:

-<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https:&#x2F;&#x2F;github.com&#x2F;erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a>&nbsp;&nbsp;<a href="https://github.com/nicotsx"><img src="https:&#x2F;&#x2F;github.com&#x2F;nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a>&nbsp;&nbsp;<a href="https://github.com/SimpleHomelab"><img src="https:&#x2F;&#x2F;github.com&#x2F;SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a>&nbsp;&nbsp;<a href="https://github.com/jmadden91"><img src="https:&#x2F;&#x2F;github.com&#x2F;jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a>&nbsp;&nbsp;<a href="https://github.com/tribor"><img src="https:&#x2F;&#x2F;github.com&#x2F;tribor.png" width="64px" alt="User avatar: tribor" /></a>&nbsp;&nbsp;<a href="https://github.com/eliasbenb"><img src="https:&#x2F;&#x2F;github.com&#x2F;eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a>&nbsp;&nbsp;<a href="https://github.com/afunworm"><img src="https:&#x2F;&#x2F;github.com&#x2F;afunworm.png" width="64px" alt="User avatar: afunworm" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="64px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/Lancelot-Enguerrand"><img src="https:&#x2F;&#x2F;github.com&#x2F;Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a>&nbsp;&nbsp;<a href="https://github.com/allgoewer"><img src="https:&#x2F;&#x2F;github.com&#x2F;allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a>&nbsp;&nbsp;<a href="https://github.com/NEANC"><img src="https:&#x2F;&#x2F;github.com&#x2F;NEANC.png" width="64px" alt="User avatar: NEANC" /></a>&nbsp;&nbsp;<a href="https://github.com/ax-mad"><img src="https:&#x2F;&#x2F;github.com&#x2F;ax-mad.png" width="64px" alt="User avatar: ax-mad" /></a>&nbsp;&nbsp;<a href="https://github.com/stegratech"><img src="https:&#x2F;&#x2F;github.com&#x2F;stegratech.png" width="64px" alt="User avatar: stegratech" /></a>&nbsp;&nbsp;<a href="https://github.com/apearson"><img src="https:&#x2F;&#x2F;github.com&#x2F;apearson.png" width="64px" alt="User avatar: apearson" /></a>&nbsp;&nbsp;<!-- sponsors -->
+<!-- sponsors --><a href="https://github.com/erwinkramer"><img src="https:&#x2F;&#x2F;github.com&#x2F;erwinkramer.png" width="64px" alt="User avatar: erwinkramer" /></a>&nbsp;&nbsp;<a href="https://github.com/nicotsx"><img src="https:&#x2F;&#x2F;github.com&#x2F;nicotsx.png" width="64px" alt="User avatar: nicotsx" /></a>&nbsp;&nbsp;<a href="https://github.com/SimpleHomelab"><img src="https:&#x2F;&#x2F;github.com&#x2F;SimpleHomelab.png" width="64px" alt="User avatar: SimpleHomelab" /></a>&nbsp;&nbsp;<a href="https://github.com/jmadden91"><img src="https:&#x2F;&#x2F;github.com&#x2F;jmadden91.png" width="64px" alt="User avatar: jmadden91" /></a>&nbsp;&nbsp;<a href="https://github.com/tribor"><img src="https:&#x2F;&#x2F;github.com&#x2F;tribor.png" width="64px" alt="User avatar: tribor" /></a>&nbsp;&nbsp;<a href="https://github.com/eliasbenb"><img src="https:&#x2F;&#x2F;github.com&#x2F;eliasbenb.png" width="64px" alt="User avatar: eliasbenb" /></a>&nbsp;&nbsp;<a href="https://github.com/afunworm"><img src="https:&#x2F;&#x2F;github.com&#x2F;afunworm.png" width="64px" alt="User avatar: afunworm" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="64px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/Lancelot-Enguerrand"><img src="https:&#x2F;&#x2F;github.com&#x2F;Lancelot-Enguerrand.png" width="64px" alt="User avatar: Lancelot-Enguerrand" /></a>&nbsp;&nbsp;<a href="https://github.com/allgoewer"><img src="https:&#x2F;&#x2F;github.com&#x2F;allgoewer.png" width="64px" alt="User avatar: allgoewer" /></a>&nbsp;&nbsp;<a href="https://github.com/NEANC"><img src="https:&#x2F;&#x2F;github.com&#x2F;NEANC.png" width="64px" alt="User avatar: NEANC" /></a>&nbsp;&nbsp;<a href="https://github.com/ax-mad"><img src="https:&#x2F;&#x2F;github.com&#x2F;ax-mad.png" width="64px" alt="User avatar: ax-mad" /></a>&nbsp;&nbsp;<a href="https://github.com/stegratech"><img src="https:&#x2F;&#x2F;github.com&#x2F;stegratech.png" width="64px" alt="User avatar: stegratech" /></a>&nbsp;&nbsp;<!-- sponsors -->

 ## Acknowledgements

@@ -68,7 +68,10 @@ func generateTotpCmd() *cli.Command {
 				return fmt.Errorf("failed to parse user: %w", err)
 			}

-			docker := strings.Contains(tCfg.User, "$$")
+			docker := false
+			if strings.Contains(tCfg.User, "$$") {
+				docker = true
+			}

 			if user.TOTPSecret != "" {
 				return fmt.Errorf("user already has a TOTP secret")
@@ -9,8 +9,8 @@ import (
 	"os"
 	"time"

-	"github.com/tinyauthapp/paerser/cli"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/paerser/cli"
 )

 type healthzResponse struct {
@@ -45,7 +45,7 @@ func healthcheckCmd() *cli.Command {
 			}

 			if appUrl == "" {
-				return errors.New("could not determine app url")
+				return errors.New("Could not determine app URL")
 			}

 			tlog.App.Info().Str("app_url", appUrl).Msg("Performing health check")
@@ -70,7 +70,7 @@ func healthcheckCmd() *cli.Command {
 				return fmt.Errorf("service is not healthy, got: %s", resp.Status)
 			}

-			defer resp.Body.Close() //nolint:errcheck
+			defer resp.Body.Close()

 			var healthResp healthzResponse

@@ -20,9 +20,9 @@ require (
 	github.com/weppos/publicsuffix-go v0.50.3
 	golang.org/x/crypto v0.50.0
 	golang.org/x/oauth2 v0.36.0
-	k8s.io/apimachinery v0.36.0
-	k8s.io/client-go v0.36.0
-	modernc.org/sqlite v1.50.0
+	k8s.io/apimachinery v0.32.2
+	k8s.io/client-go v0.32.2
+	modernc.org/sqlite v1.49.1
 )

 require (
@@ -63,7 +63,7 @@ require (
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
@@ -74,6 +74,9 @@ require (
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
@@ -90,7 +93,7 @@ require (
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
@@ -118,7 +121,6 @@ require (
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/arch v0.22.0 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/net v0.52.0 // indirect
@@ -126,20 +128,18 @@ require (
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/term v0.42.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
-	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
-	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
 	modernc.org/libc v1.72.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )
@@ -97,14 +97,14 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
 github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
@@ -140,16 +140,23 @@ github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-migrate/migrate/v4 v4.19.1 h1:OCyb44lFuQfYXYLx1SCxPZQGU7mcaZ7gH9yH4jSFbBA=
 github.com/golang-migrate/migrate/v4 v4.19.1/go.mod h1:CTcgfjxhaUtsLipnLoQRWCrjYXycRz/g5+RWDuYgPrE=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
 github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -178,6 +185,8 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -219,9 +228,8 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
@@ -261,12 +269,11 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -287,6 +294,8 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
 go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
@@ -311,35 +320,56 @@ go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpu
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
 golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
 golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
 golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
 golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
 golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
 golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
 golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
 google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
@@ -347,13 +377,13 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
-gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -361,18 +391,18 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
-k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
-k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
-k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
-k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
-k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
-k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
-k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
-k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
-k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+k8s.io/api v0.32.2 h1:bZrMLEkgizC24G9eViHGOPbW+aRo9duEISRIJKfdJuw=
+k8s.io/api v0.32.2/go.mod h1:hKlhk4x1sJyYnHENsrdCWw31FEmCijNGPJO5WzHiJ6Y=
+k8s.io/apimachinery v0.32.2 h1:yoQBR9ZGkA6Rgmhbp/yuT9/g+4lxtsGYwW6dR6BDPLQ=
+k8s.io/apimachinery v0.32.2/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.2 h1:4dYCD4Nz+9RApM2b/3BtVvBHw54QjMFUl1OLcJG5yOA=
+k8s.io/client-go v0.32.2/go.mod h1:fpZ4oJXclZ3r2nDOv+Ux3XcJutfrwjKTCHz2H3sww94=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
 modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
 modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
@@ -395,19 +425,17 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
-modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=
+modernc.org/sqlite v1.49.1/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
 rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
-sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
@@ -29,9 +29,8 @@ type BootstrapApp struct {
 		csrfCookieName         string
 		redirectCookieName     string
 		oauthSessionCookieName string
-		localUsers             *[]model.LocalUser
+		localUsers             []model.LocalUser
 		oauthProviders         map[string]model.OAuthServiceConfig
-		oauthWhitelist         []string
 		configuredProviders    []controller.Provider
 		oidcClients            []model.OIDCClientConfig
 	}
@@ -70,14 +69,7 @@ func (app *BootstrapApp) Setup() error {
 		return err
 	}

-	app.context.localUsers = users
-
-	oauthWhitelist, err := utils.GetStringList(app.config.OAuth.Whitelist, app.config.OAuth.WhitelistFile)
-	if err != nil {
-		return err
-	}
-
-	app.context.oauthWhitelist = oauthWhitelist
+	app.context.localUsers = *users

 	// Setup OAuth providers
 	app.context.oauthProviders = app.config.OAuth.Providers
@@ -112,13 +104,7 @@ func (app *BootstrapApp) Setup() error {
 	}

 	// Get cookie domain
-	cookieDomainResolver := utils.GetCookieDomain
-	if !app.config.Auth.SubdomainsEnabled {
-		tlog.App.Info().Msg("Subdomains disabled, automatic authentication for proxied apps will not work")
-		cookieDomainResolver = utils.GetStandaloneCookieDomain
-	}
-
-	cookieDomain, err := cookieDomainResolver(app.context.appUrl)
+	cookieDomain, err := utils.GetCookieDomain(app.context.appUrl)

 	if err != nil {
 		return err
@@ -292,7 +278,7 @@ func (app *BootstrapApp) heartbeatRoutine() {
 			continue
 		}

-		res.Body.Close() //nolint:errcheck
+		res.Body.Close()

 		if res.StatusCode != 200 && res.StatusCode != 201 {
 			tlog.App.Debug().Str("status", res.Status).Msg("Heartbeat returned non-200/201 status")
@@ -84,7 +84,6 @@ func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
 		RedirectCookieName:     app.context.redirectCookieName,
 		CookieDomain:           app.context.cookieDomain,
 		OAuthSessionCookieName: app.context.oauthSessionCookieName,
-		SubdomainsEnabled:      app.config.Auth.SubdomainsEnabled,
 	}, apiRouter, app.services.authService)

 	oauthController.SetupRoutes()
@@ -36,7 +36,7 @@ func (app *BootstrapApp) initServices(queries *repository.Queries) (Services, er

 	if err != nil {
 		tlog.App.Warn().Err(err).Msg("Failed to setup LDAP service, starting without it")
-		ldapService.Unconfigure() //nolint:errcheck
+		ldapService.Unconfigure()
 	}

 	services.ldapService = ldapService
@@ -90,7 +90,7 @@ func (app *BootstrapApp) initServices(queries *repository.Queries) (Services, er

 	authService := service.NewAuthService(service.AuthServiceConfig{
 		LocalUsers:         app.context.localUsers,
-		OauthWhitelist:     app.context.oauthWhitelist,
+		OauthWhitelist:     app.config.OAuth.Whitelist,
 		SessionExpiry:      app.config.Auth.SessionExpiry,
 		SessionMaxLifetime: app.config.Auth.SessionMaxLifetime,
 		SecureCookie:       app.config.Auth.SecureCookie,
@@ -100,7 +100,6 @@ func (app *BootstrapApp) initServices(queries *repository.Queries) (Services, er
 		SessionCookieName:  app.context.sessionCookieName,
 		IP:                 app.config.Auth.IP,
 		LDAPGroupsCacheTTL: app.config.LDAP.GroupCacheTTL,
-		SubdomainsEnabled:  app.config.Auth.SubdomainsEnabled,
 	}, services.ldapService, queries, services.oauthBrokerService)

 	err = authService.Init()
@@ -95,7 +95,7 @@ func (controller *ContextController) userContextHandler(c *gin.Context) {
 		Username:    context.GetUsername(),
 		Name:        context.GetName(),
 		Email:       context.GetEmail(),
-		Provider:    context.GetProviderID(),
+		Provider:    context.ProviderName(),
 		OAuth:       context.IsOAuth(),
 		TOTPPending: context.TOTPPending(),
 		OAuthName:   context.OAuthName(),
@@ -26,7 +26,6 @@ type OAuthControllerConfig struct {
 	SecureCookie           bool
 	AppURL                 string
 	CookieDomain           string
-	SubdomainsEnabled      bool
 }

 type OAuthController struct {
@@ -106,7 +105,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 		return
 	}

-	c.SetCookie(controller.config.OAuthSessionCookieName, sessionId, int(time.Hour.Seconds()), "/", controller.getCookieDomain(), controller.config.SecureCookie, true)
+	c.SetCookie(controller.config.OAuthSessionCookieName, sessionId, int(time.Hour.Seconds()), "/", fmt.Sprintf(".%s", controller.config.CookieDomain), controller.config.SecureCookie, true)

 	c.JSON(200, gin.H{
 		"status":  200,
@@ -136,7 +135,7 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 		return
 	}

-	c.SetCookie(controller.config.OAuthSessionCookieName, "", -1, "/", controller.getCookieDomain(), controller.config.SecureCookie, true)
+	c.SetCookie(controller.config.OAuthSessionCookieName, "", -1, "/", fmt.Sprintf(".%s", controller.config.CookieDomain), controller.config.SecureCookie, true)

 	oauthPendingSession, err := controller.auth.GetOAuthPendingSession(sessionIdCookie)

@@ -166,12 +165,6 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {

 	user, err := controller.auth.GetOAuthUserinfo(sessionIdCookie)

-	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get user info from OAuth provider")
-		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
-		return
-	}
-
 	if user.Email == "" {
 		tlog.App.Error().Msg("OAuth provider did not return an email")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
@@ -290,10 +283,3 @@ func (controller *OAuthController) isOidcRequest(params service.OAuthURLParams)
 		params.ClientID != "" &&
 		params.RedirectURI != ""
 }
-
-func (controller *OAuthController) getCookieDomain() string {
-	if controller.config.SubdomainsEnabled {
-		return "." + controller.config.CookieDomain
-	}
-	return controller.config.CookieDomain
-}
@@ -21,7 +21,7 @@ func TestProxyController(t *testing.T) {
 	tempDir := t.TempDir()

 	authServiceCfg := service.AuthServiceConfig{
-		LocalUsers: &[]model.LocalUser{
+		LocalUsers: []model.LocalUser{
 			{
 				Username: "testuser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
@@ -98,6 +98,7 @@ func TestProxyController(t *testing.T) {
 					Name:     "Totpuser",
 					Email:    "totpuser@example.com",
 				},
+				TOTPEnabled: true,
 			},
 		})
 		c.Next()
@@ -102,7 +102,7 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 	}

 	if err := controller.auth.CheckUserPassword(*search, req.Password); err != nil {
-		tlog.App.Warn().Err(err).Str("username", req.Username).Msg("Failed to verify password")
+		tlog.App.Warn().Str("username", req.Username).Msg("Invalid password")
 		controller.auth.RecordLoginAttempt(req.Username, false)
 		tlog.AuditLoginFailure(c, req.Username, "username", "invalid password")
 		c.JSON(401, gin.H{
@@ -112,20 +112,16 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}

+	tlog.App.Info().Str("username", req.Username).Msg("Login successful")
+	tlog.AuditLoginSuccess(c, req.Username, "username")
+
+	controller.auth.RecordLoginAttempt(req.Username, true)
+
 	var localUser *model.LocalUser

 	if search.Type == model.UserLocal {
 		localUser = controller.auth.GetLocalUser(req.Username)

-		if localUser == nil {
-			tlog.App.Warn().Str("username", req.Username).Msg("User disappeared during login")
-			c.JSON(401, gin.H{
-				"status":  401,
-				"message": "Unauthorized",
-			})
-			return
-		}
-
 		if localUser.TOTPSecret != "" {
 			tlog.App.Debug().Str("username", req.Username).Msg("User has TOTP enabled, requiring TOTP verification")

@@ -202,11 +198,6 @@ func (controller *UserController) loginHandler(c *gin.Context) {

 	http.SetCookie(c.Writer, cookie)

-	tlog.App.Info().Str("username", req.Username).Msg("Login successful")
-	tlog.AuditLoginSuccess(c, req.Username, "username")
-
-	controller.auth.RecordLoginAttempt(req.Username, true)
-
 	c.JSON(200, gin.H{
 		"status":  200,
 		"message": "Login successful",
@@ -235,6 +226,17 @@ func (controller *UserController) logoutHandler(c *gin.Context) {
 		return
 	}

+	context, err := new(model.UserContext).NewFromGin(c)
+
+	if err != nil {
+		tlog.App.Error().Err(err).Msg("Failed to get user context on logout")
+		c.JSON(500, gin.H{
+			"status":  500,
+			"message": "Internal Server Error",
+		})
+		return
+	}
+
 	cookie, err := controller.auth.DeleteSession(c, uuid)

 	if err != nil {
@@ -246,14 +248,7 @@ func (controller *UserController) logoutHandler(c *gin.Context) {
 		return
 	}

-	context, err := new(model.UserContext).NewFromGin(c)
-
-	if err == nil {
-		tlog.AuditLogout(c, context.GetUsername(), context.GetProviderID())
-	} else {
-		tlog.App.Warn().Err(err).Msg("Failed to get user context for logout audit, proceeding without username")
-		tlog.AuditLogout(c, "unknown", "unknown")
-	}
+	tlog.AuditLogout(c, context.GetUsername(), context.ProviderName())

 	http.SetCookie(c.Writer, cookie)

@@ -313,15 +308,6 @@ func (controller *UserController) totpHandler(c *gin.Context) {

 	user := controller.auth.GetLocalUser(context.GetUsername())

-	if user == nil {
-		tlog.App.Error().Str("username", context.GetUsername()).Msg("User not found in TOTP handler")
-		c.JSON(401, gin.H{
-			"status":  401,
-			"message": "Unauthorized",
-		})
-		return
-	}
-
 	ok := totp.Validate(req.Code, user.TOTPSecret)

 	if !ok {
@@ -335,16 +321,8 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}

-	uuid, err := c.Cookie(controller.config.SessionCookieName)
-
-	if err == nil {
-		_, err = controller.auth.DeleteSession(c, uuid)
-		if err != nil {
-			tlog.App.Warn().Err(err).Msg("Failed to delete pending TOTP session")
-		}
-	} else {
-		tlog.App.Warn().Err(err).Msg("Failed to retrieve session cookie for pending TOTP session, proceeding without deleting it")
-	}
+	tlog.App.Info().Str("username", context.GetUsername()).Msg("TOTP verification successful")
+	tlog.AuditLoginSuccess(c, context.GetUsername(), "totp")

 	controller.auth.RecordLoginAttempt(context.GetUsername(), true)

@@ -377,9 +355,6 @@ func (controller *UserController) totpHandler(c *gin.Context) {

 	http.SetCookie(c.Writer, cookie)

-	tlog.App.Info().Str("username", context.GetUsername()).Msg("TOTP verification successful")
-	tlog.AuditLoginSuccess(c, context.GetUsername(), "totp")
-
 	c.JSON(200, gin.H{
 		"status":  200,
 		"message": "Login successful",
@@ -1,9 +1,7 @@
 package controller_test

 import (
-	"context"
 	"encoding/json"
-	"net/http"
 	"net/http/httptest"
 	"path"
 	"strings"
@@ -27,7 +25,7 @@ func TestUserController(t *testing.T) {
 	tempDir := t.TempDir()

 	authServiceCfg := service.AuthServiceConfig{
-		LocalUsers: &[]model.LocalUser{
+		LocalUsers: []model.LocalUser{
 			{
 				Username: "testuser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
@@ -69,7 +67,7 @@ func TestUserController(t *testing.T) {

 	totpCtx := func(c *gin.Context) {
 		c.Set("context", &model.UserContext{
-			Authenticated: false,
+			Authenticated: true,
 			Provider:      model.ProviderLocal,
 			Local: &model.LocalContext{
 				BaseContext: model.BaseContext{
@@ -78,13 +76,14 @@ func TestUserController(t *testing.T) {
 					Email:    "totpuser@example.com",
 				},
 				TOTPPending: true,
+				TOTPEnabled: true,
 			},
 		})
 	}

 	totpAttrCtx := func(c *gin.Context) {
 		c.Set("context", &model.UserContext{
-			Authenticated: false,
+			Authenticated: true,
 			Provider:      model.ProviderLocal,
 			Local: &model.LocalContext{
 				BaseContext: model.BaseContext{
@@ -93,6 +92,7 @@ func TestUserController(t *testing.T) {
 					Email:    "bob@example.com",
 				},
 				TOTPPending: true,
+				TOTPEnabled: true,
 			},
 		})
 	}
@@ -111,15 +111,6 @@ func TestUserController(t *testing.T) {
 		})
 	}

-	oauthBrokerCfgs := make(map[string]model.OAuthServiceConfig)
-
-	app := bootstrap.NewBootstrapApp(model.Config{})
-
-	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
-	require.NoError(t, err)
-
-	queries := repository.New(db)
-
 	type testCase struct {
 		description string
 		middlewares []gin.HandlerFunc
@@ -150,9 +141,7 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", cookie.Name)
 				assert.True(t, cookie.HttpOnly)
 				assert.Equal(t, "example.com", cookie.Domain)
-				// 3 seconds should be more than enough for even slow test environments
-				assert.GreaterOrEqual(t, cookie.MaxAge, 7)
-				assert.LessOrEqual(t, cookie.MaxAge, 10)
+				assert.Equal(t, 10, cookie.MaxAge)
 			},
 		},
 		{
@@ -179,7 +168,7 @@ func TestUserController(t *testing.T) {
 		{
 			description: "Should rate limit on 3 invalid attempts",
 			middlewares: []gin.HandlerFunc{},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { //nolint:staticcheck
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				loginReq := controller.LoginRequest{
 					Username: "testuser",
 					Password: "wrongpassword",
@@ -201,7 +190,7 @@ func TestUserController(t *testing.T) {
 				}

 				// 4th attempt should be rate limited
-				recorder = httptest.NewRecorder() //nolint:staticcheck
+				recorder = httptest.NewRecorder()
 				req := httptest.NewRequest("POST", "/api/user/login", strings.NewReader(string(loginReqBody)))
 				req.Header.Set("Content-Type", "application/json")

@@ -241,8 +230,7 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", cookie.Name)
 				assert.True(t, cookie.HttpOnly)
 				assert.Equal(t, "example.com", cookie.Domain)
-				assert.GreaterOrEqual(t, cookie.MaxAge, 3597)
-				assert.LessOrEqual(t, cookie.MaxAge, 3600)
+				assert.Equal(t, 3600, cookie.MaxAge) // 1 hour, default for totp pending sessions
 			},
 		},
 		{
@@ -293,19 +281,7 @@ func TestUserController(t *testing.T) {
 			middlewares: []gin.HandlerFunc{
 				totpCtx,
 			},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { //nolint:staticcheck
-				_, err := queries.CreateSession(context.TODO(), repository.CreateSessionParams{
-					UUID:        "test-totp-login-uuid",
-					Username:    "test",
-					Email:       "test@example.com",
-					Name:        "Test",
-					Provider:    "local",
-					TotpPending: true,
-					Expiry:      time.Now().Add(1 * time.Hour).Unix(),
-					CreatedAt:   time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				code, err := totp.GenerateCode("JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK", time.Now())
 				assert.NoError(t, err)

@@ -316,16 +292,10 @@ func TestUserController(t *testing.T) {
 				totpReqBody, err := json.Marshal(totpReq)
 				assert.NoError(t, err)

-				recorder = httptest.NewRecorder() //nolint:staticcheck
+				recorder = httptest.NewRecorder()
 				req := httptest.NewRequest("POST", "/api/user/totp", strings.NewReader(string(totpReqBody)))
 				req.Header.Set("Content-Type", "application/json")
-				req.AddCookie(&http.Cookie{
-					Name:     "tinyauth-session",
-					Value:    "test-totp-login-uuid",
-					HttpOnly: true,
-					MaxAge:   3600,
-					Expires:  time.Now().Add(1 * time.Hour),
-				})
+
 				router.ServeHTTP(recorder, req)

 				assert.Equal(t, 200, recorder.Code)
@@ -336,8 +306,7 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", totpCookie.Name)
 				assert.True(t, totpCookie.HttpOnly)
 				assert.Equal(t, "example.com", totpCookie.Domain)
-				assert.GreaterOrEqual(t, totpCookie.MaxAge, 7)
-				assert.LessOrEqual(t, totpCookie.MaxAge, 10)
+				assert.Equal(t, 10, totpCookie.MaxAge) // should use the regular session expiry time
 			},
 		},
 		{
@@ -345,7 +314,7 @@ func TestUserController(t *testing.T) {
 			middlewares: []gin.HandlerFunc{
 				totpCtx,
 			},
-			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) { //nolint:staticcheck
+			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				for range 3 {
 					totpReq := controller.TotpRequest{
 						Code: "000000", // invalid code
@@ -354,7 +323,7 @@ func TestUserController(t *testing.T) {
 					totpReqBody, err := json.Marshal(totpReq)
 					assert.NoError(t, err)

-					recorder = httptest.NewRecorder() //nolint:staticcheck
+					recorder = httptest.NewRecorder()
 					req := httptest.NewRequest("POST", "/api/user/totp", strings.NewReader(string(totpReqBody)))
 					req.Header.Set("Content-Type", "application/json")

@@ -418,18 +387,6 @@ func TestUserController(t *testing.T) {
 				totpAttrCtx,
 			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
-				_, err := queries.CreateSession(context.TODO(), repository.CreateSessionParams{
-					UUID:        "test-totp-login-attributes-uuid",
-					Username:    "test",
-					Email:       "test@example.com",
-					Name:        "Test",
-					Provider:    "local",
-					TotpPending: true,
-					Expiry:      time.Now().Add(1 * time.Hour).Unix(),
-					CreatedAt:   time.Now().Unix(),
-				})
-				require.NoError(t, err)
-
 				code, err := totp.GenerateCode("JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK", time.Now())
 				require.NoError(t, err)

@@ -439,13 +396,6 @@ func TestUserController(t *testing.T) {

 				req := httptest.NewRequest("POST", "/api/user/totp", strings.NewReader(string(body)))
 				req.Header.Set("Content-Type", "application/json")
-				req.AddCookie(&http.Cookie{
-					Name:     "tinyauth-session",
-					Value:    "test-totp-login-attributes-uuid",
-					HttpOnly: true,
-					MaxAge:   3600,
-					Expires:  time.Now().Add(1 * time.Hour),
-				})
 				router.ServeHTTP(recorder, req)

 				require.Equal(t, 200, recorder.Code)
@@ -456,6 +406,15 @@ func TestUserController(t *testing.T) {
 		},
 	}

+	oauthBrokerCfgs := make(map[string]model.OAuthServiceConfig)
+
+	app := bootstrap.NewBootstrapApp(model.Config{})
+
+	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
+	require.NoError(t, err)
+
+	queries := repository.New(db)
+
 	docker := service.NewDockerService()
 	err = docker.Init()
 	require.NoError(t, err)
@@ -70,18 +70,20 @@ func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 		if err == nil {
 			userContext, cookie, err := m.cookieAuth(c.Request.Context(), uuid)

-			if err == nil {
-				if cookie != nil {
-					http.SetCookie(c.Writer, cookie)
-				}
-
-				tlog.App.Trace().Msgf("Authenticated user from session cookie: %s", userContext.GetUsername())
-				c.Set("context", userContext)
+			if err != nil {
+				tlog.App.Error().Msgf("Error authenticating session cookie: %v", err)
 				c.Next()
 				return
-			} else {
-				tlog.App.Error().Msgf("Error authenticating session cookie: %v", err)
 			}
+
+			if cookie != nil {
+				http.SetCookie(c.Writer, cookie)
+			}
+
+			tlog.App.Trace().Msgf("Authenticated user from session cookie: %s", userContext.GetUsername())
+			c.Set("context", userContext)
+			c.Next()
+			return
 		}

 		username, password, ok := c.Request.BasicAuth()
@@ -123,6 +125,7 @@ func (m *ContextMiddleware) cookieAuth(ctx context.Context, uuid string) (*model

 	if userContext.Provider == model.ProviderLocal &&
 		userContext.Local.TOTPPending {
+		userContext.Local.TOTPEnabled = true
 		return userContext, nil, nil
 	}

@@ -171,7 +174,7 @@ func (m *ContextMiddleware) cookieAuth(ctx context.Context, uuid string) (*model
 		}

 		if !m.auth.IsEmailWhitelisted(userContext.OAuth.Email) {
-			m.auth.DeleteSession(ctx, uuid) //nolint:errcheck
+			m.auth.DeleteSession(ctx, uuid)
 			return nil, nil, fmt.Errorf("email from session cookie not whitelisted: %s", userContext.OAuth.Email)
 		}
 	}
@@ -25,7 +25,7 @@ func TestContextMiddleware(t *testing.T) {
 	tempDir := t.TempDir()

 	authServiceCfg := service.AuthServiceConfig{
-		LocalUsers: &[]model.LocalUser{
+		LocalUsers: []model.LocalUser{
 			{
 				Username: "testuser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
@@ -109,6 +109,7 @@ func TestContextMiddleware(t *testing.T) {
 				assert.Equal(t, "testuser", userCtx.GetUsername())
 				assert.True(t, userCtx.Authenticated)
 				require.NotNil(t, userCtx.Local)
+				assert.False(t, userCtx.Local.TOTPEnabled)
 			},
 		},
 		{
@@ -133,6 +134,7 @@ func TestContextMiddleware(t *testing.T) {
 				assert.False(t, userCtx.Authenticated)
 				require.NotNil(t, userCtx.Local)
 				assert.True(t, userCtx.Local.TOTPPending)
+				assert.True(t, userCtx.Local.TOTPEnabled)
 			},
 		},
 		{
@@ -251,18 +253,6 @@ func TestContextMiddleware(t *testing.T) {
 				req.Header.Set("Authorization", basicAuthHeader("totpuser", "password"))
 				userCtx, _ := args.do(req)

-				require.NotNil(t, userCtx)
-				assert.Equal(t, "testuser", userCtx.GetUsername())
-				assert.True(t, userCtx.Authenticated)
-			},
-		},
-		{
-			description: "Ensure fallback to basic auth when cookie is missing",
-			run: func(t *testing.T, args runArgs) {
-				req := httptest.NewRequest("GET", "/api/test", nil)
-				req.Header.Set("Authorization", basicAuthHeader("testuser", "password"))
-				userCtx, _ := args.do(req)
-
 				require.NotNil(t, userCtx)
 				assert.Equal(t, "testuser", userCtx.GetUsername())
 				assert.True(t, userCtx.Authenticated)
@@ -18,7 +18,6 @@ func NewDefaultConfiguration() *Config {
 			Address: "0.0.0.0",
 		},
 		Auth: AuthConfig{
-			SubdomainsEnabled:  true,
 			SessionExpiry:      86400, // 1 day
 			SessionMaxLifetime: 0,     // disabled
 			LoginTimeout:       300,   // 5 minutes
@@ -103,7 +102,6 @@ type ServerConfig struct {
 type AuthConfig struct {
 	IP                 IPConfig                  `description:"IP whitelisting config options." yaml:"ip"`
 	Users              []string                  `description:"Comma-separated list of users (username:hashed_password)." yaml:"users"`
-	SubdomainsEnabled  bool                      `description:"Enable subdomains support." yaml:"subdomainsEnabled"`
 	UserAttributes     map[string]UserAttributes `description:"Map of per-user OIDC attributes (username -> attributes)." yaml:"userAttributes"`
 	UsersFile          string                    `description:"Path to the users file." yaml:"usersFile"`
 	SecureCookie       bool                      `description:"Enable secure cookies." yaml:"secureCookie"`
@@ -148,7 +146,6 @@ type IPConfig struct {

 type OAuthConfig struct {
 	Whitelist    []string                      `description:"Comma-separated list of allowed OAuth domains." yaml:"whitelist"`
-	WhitelistFile string                       `description:"Path to the OAuth whitelist file." yaml:"whitelistFile"`
 	AutoRedirect string                        `description:"The OAuth provider to use for automatic redirection." yaml:"autoRedirect"`
 	Providers    map[string]OAuthServiceConfig `description:"OAuth providers configuration." yaml:"providers"`
 }
@@ -34,6 +34,7 @@ type BaseContext struct {
 type LocalContext struct {
 	BaseContext
 	TOTPPending bool
+	TOTPEnabled bool
 	Attributes  UserAttributes
 }

@@ -55,19 +56,19 @@ func (c *UserContext) IsAuthenticated() bool {
 }

 func (c *UserContext) IsLocal() bool {
-	return c.Provider == ProviderLocal && c.Local != nil
+	return c.Provider == ProviderLocal
 }

 func (c *UserContext) IsOAuth() bool {
-	return c.Provider == ProviderOAuth && c.OAuth != nil
+	return c.Provider == ProviderOAuth
 }

 func (c *UserContext) IsLDAP() bool {
-	return c.Provider == ProviderLDAP && c.LDAP != nil
+	return c.Provider == ProviderLDAP
 }

 func (c *UserContext) IsBasicAuth() bool {
-	return c.Provider == ProviderBasicAuth && c.Local != nil
+	return c.Provider == ProviderBasicAuth
 }

 func (c *UserContext) NewFromGin(ginctx *gin.Context) (*UserContext, error) {
@@ -79,24 +80,16 @@ func (c *UserContext) NewFromGin(ginctx *gin.Context) (*UserContext, error) {

 	userContext, ok := userContextValue.(*UserContext)

-	if !ok || userContext == nil {
+	if !ok {
 		return nil, errors.New("invalid user context type")
 	}

-	if userContext.LDAP == nil && userContext.Local == nil && userContext.OAuth == nil {
-		return nil, errors.New("incomplete user context")
-	}
-
 	*c = *userContext
 	return c, nil
 }

 // Compatability layer until we get an excuse to drop in database migrations
 func (c *UserContext) NewFromSession(session *repository.Session) (*UserContext, error) {
-	*c = UserContext{
-		Authenticated: !session.TotpPending,
-	}
-
 	switch session.Provider {
 	case "local":
 		c.Provider = ProviderLocal
@@ -126,42 +119,29 @@ func (c *UserContext) NewFromSession(session *repository.Session) (*UserContext,
 				Name:     session.Name,
 				Email:    session.Email,
 			},
-			Groups: func() []string {
-				if session.OAuthGroups == "" {
-					return nil
-				}
-				return strings.Split(session.OAuthGroups, ",")
-			}(),
+			Groups:      strings.Split(session.OAuthGroups, ","),
 			Sub:         session.OAuthSub,
 			DisplayName: session.OAuthName,
 			ID:          session.Provider,
 		}
 	}

+	if !session.TotpPending {
+		c.Authenticated = true
+	}
+
 	return c, nil
 }

 func (c *UserContext) GetUsername() string {
 	switch c.Provider {
 	case ProviderLocal:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Username
 	case ProviderLDAP:
-		if c.LDAP == nil {
-			return ""
-		}
 		return c.LDAP.Username
 	case ProviderBasicAuth:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Username
 	case ProviderOAuth:
-		if c.OAuth == nil {
-			return ""
-		}
 		return c.OAuth.Username
 	default:
 		return ""
@@ -171,24 +151,12 @@ func (c *UserContext) GetUsername() string {
 func (c *UserContext) GetEmail() string {
 	switch c.Provider {
 	case ProviderLocal:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Email
 	case ProviderLDAP:
-		if c.LDAP == nil {
-			return ""
-		}
 		return c.LDAP.Email
 	case ProviderBasicAuth:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Email
 	case ProviderOAuth:
-		if c.OAuth == nil {
-			return ""
-		}
 		return c.OAuth.Email
 	default:
 		return ""
@@ -198,52 +166,40 @@ func (c *UserContext) GetEmail() string {
 func (c *UserContext) GetName() string {
 	switch c.Provider {
 	case ProviderLocal:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Name
 	case ProviderLDAP:
-		if c.LDAP == nil {
-			return ""
-		}
 		return c.LDAP.Name
 	case ProviderBasicAuth:
-		if c.Local == nil {
-			return ""
-		}
 		return c.Local.Name
 	case ProviderOAuth:
-		if c.OAuth == nil {
-			return ""
-		}
 		return c.OAuth.Name
 	default:
 		return ""
 	}
 }

-func (c *UserContext) GetProviderID() string {
+func (c *UserContext) ProviderName() string {
 	switch c.Provider {
 	case ProviderBasicAuth, ProviderLocal:
 		return "local"
 	case ProviderLDAP:
 		return "ldap"
 	case ProviderOAuth:
-		return c.OAuth.ID
+		return c.OAuth.DisplayName // compatability
 	default:
 		return "unknown"
 	}
 }

 func (c *UserContext) TOTPPending() bool {
-	if c.Provider == ProviderLocal && c.Local != nil {
+	if c.Provider == ProviderLocal {
 		return c.Local.TOTPPending
 	}
 	return false
 }

 func (c *UserContext) OAuthName() string {
-	if c.Provider == ProviderOAuth && c.OAuth != nil {
+	if c.Provider == ProviderOAuth {
 		return c.OAuth.DisplayName
 	}
 	return ""
@@ -6,7 +6,6 @@ import (

 	"github.com/gin-gonic/gin"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 )
@@ -23,48 +22,47 @@ func TestContext(t *testing.T) {
 	tests := []struct {
 		description string
 		context     *model.UserContext
-		run         func(*testing.T, *model.UserContext) any
+		run         func(*model.UserContext) any
 		expected    any
 	}{
 		{
 			description: "IsAuthenticated reflects Authenticated field",
 			context:     &model.UserContext{Authenticated: true},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.IsAuthenticated() },
+			run:         func(c *model.UserContext) any { return c.IsAuthenticated() },
 			expected:    true,
 		},
 		{
 			description: "IsLocal returns true for ProviderLocal",
-			context:     &model.UserContext{Provider: model.ProviderLocal, Local: &model.LocalContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.IsLocal() },
+			context:     &model.UserContext{Provider: model.ProviderLocal},
+			run:         func(c *model.UserContext) any { return c.IsLocal() },
 			expected:    true,
 		},
 		{
 			description: "IsOAuth returns true for ProviderOAuth",
-			context:     &model.UserContext{Provider: model.ProviderOAuth, OAuth: &model.OAuthContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.IsOAuth() },
+			context:     &model.UserContext{Provider: model.ProviderOAuth},
+			run:         func(c *model.UserContext) any { return c.IsOAuth() },
 			expected:    true,
 		},
 		{
 			description: "IsLDAP returns true for ProviderLDAP",
-			context:     &model.UserContext{Provider: model.ProviderLDAP, LDAP: &model.LDAPContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.IsLDAP() },
+			context:     &model.UserContext{Provider: model.ProviderLDAP},
+			run:         func(c *model.UserContext) any { return c.IsLDAP() },
 			expected:    true,
 		},
 		{
 			description: "IsBasicAuth returns true for ProviderBasicAuth",
-			context:     &model.UserContext{Provider: model.ProviderBasicAuth, Local: &model.LocalContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.IsBasicAuth() },
+			context:     &model.UserContext{Provider: model.ProviderBasicAuth},
+			run:         func(c *model.UserContext) any { return c.IsBasicAuth() },
 			expected:    true,
 		},
 		{
 			description: "NewFromSession local session is authenticated and ProviderLocal",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
-				got, err := c.NewFromSession(&repository.Session{
+			run: func(c *model.UserContext) any {
+				got, _ := c.NewFromSession(&repository.Session{
 					Username: "alice", Email: "alice@example.com", Name: "Alice",
 					Provider: "local",
 				})
-				require.NoError(t, err)
 				return [2]any{got.Provider, got.Authenticated}
 			},
 			expected: [2]any{model.ProviderLocal, true},
@@ -72,11 +70,10 @@ func TestContext(t *testing.T) {
 		{
 			description: "NewFromSession local session with TotpPending is not authenticated",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
-				got, err := c.NewFromSession(&repository.Session{
+			run: func(c *model.UserContext) any {
+				got, _ := c.NewFromSession(&repository.Session{
 					Username: "bob", Provider: "local", TotpPending: true,
 				})
-				require.NoError(t, err)
 				return got.Authenticated
 			},
 			expected: false,
@@ -84,11 +81,10 @@ func TestContext(t *testing.T) {
 		{
 			description: "NewFromSession ldap session is ProviderLDAP",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
-				got, err := c.NewFromSession(&repository.Session{
+			run: func(c *model.UserContext) any {
+				got, _ := c.NewFromSession(&repository.Session{
 					Username: "carol", Provider: "ldap",
 				})
-				require.NoError(t, err)
 				return got.Provider
 			},
 			expected: model.ProviderLDAP,
@@ -96,12 +92,11 @@ func TestContext(t *testing.T) {
 		{
 			description: "NewFromSession unknown provider defaults to OAuth and populates oauth fields",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
-				got, err := c.NewFromSession(&repository.Session{
+			run: func(c *model.UserContext) any {
+				got, _ := c.NewFromSession(&repository.Session{
 					Username: "dave", Provider: "github",
 					OAuthGroups: "devs,admins", OAuthSub: "sub-123", OAuthName: "GitHub",
 				})
-				require.NoError(t, err)
 				return [5]any{got.Provider, got.OAuth.ID, got.OAuth.Sub, got.OAuth.DisplayName, got.OAuth.Groups}
 			},
 			expected: [5]any{model.ProviderOAuth, "github", "sub-123", "GitHub", []string{"devs", "admins"}},
@@ -112,7 +107,7 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderLocal,
 				Local:    &model.LocalContext{BaseContext: model.BaseContext{Username: "alice", Email: "alice@example.com", Name: "Alice"}},
 			},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
 			},
 			expected: [3]string{"alice", "alice@example.com", "Alice"},
@@ -123,7 +118,7 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderBasicAuth,
 				Local:    &model.LocalContext{BaseContext: model.BaseContext{Username: "bob", Email: "bob@example.com", Name: "Bob"}},
 			},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
 			},
 			expected: [3]string{"bob", "bob@example.com", "Bob"},
@@ -134,7 +129,7 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderLDAP,
 				LDAP:     &model.LDAPContext{BaseContext: model.BaseContext{Username: "carol", Email: "carol@example.com", Name: "Carol"}},
 			},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
 			},
 			expected: [3]string{"carol", "carol@example.com", "Carol"},
@@ -145,7 +140,7 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderOAuth,
 				OAuth:    &model.OAuthContext{BaseContext: model.BaseContext{Username: "dave", Email: "dave@example.com", Name: "Dave"}},
 			},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
 			},
 			expected: [3]string{"dave", "dave@example.com", "Dave"},
@@ -153,29 +148,29 @@ func TestContext(t *testing.T) {
 		{
 			description: "ProviderName returns 'local' for ProviderLocal",
 			context:     &model.UserContext{Provider: model.ProviderLocal},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			run:         func(c *model.UserContext) any { return c.ProviderName() },
 			expected:    "local",
 		},
 		{
 			description: "ProviderName returns 'local' for ProviderBasicAuth",
 			context:     &model.UserContext{Provider: model.ProviderBasicAuth},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			run:         func(c *model.UserContext) any { return c.ProviderName() },
 			expected:    "local",
 		},
 		{
 			description: "ProviderName returns 'ldap' for ProviderLDAP",
 			context:     &model.UserContext{Provider: model.ProviderLDAP},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			run:         func(c *model.UserContext) any { return c.ProviderName() },
 			expected:    "ldap",
 		},
 		{
-			description: "ProviderName returns OAuth provider ID for ProviderOAuth",
+			description: "ProviderName returns OAuth DisplayName for ProviderOAuth",
 			context: &model.UserContext{
 				Provider: model.ProviderOAuth,
-				OAuth:    &model.OAuthContext{ID: "github"},
+				OAuth:    &model.OAuthContext{DisplayName: "GitHub"},
 			},
-			run:      func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
-			expected: "github",
+			run:      func(c *model.UserContext) any { return c.ProviderName() },
+			expected: "GitHub",
 		},
 		{
 			description: "TOTPPending returns true when local context is pending",
@@ -183,7 +178,7 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderLocal,
 				Local:    &model.LocalContext{TOTPPending: true},
 			},
-			run:      func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			run:      func(c *model.UserContext) any { return c.TOTPPending() },
 			expected: true,
 		},
 		{
@@ -192,13 +187,13 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderLocal,
 				Local:    &model.LocalContext{TOTPPending: false},
 			},
-			run:      func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			run:      func(c *model.UserContext) any { return c.TOTPPending() },
 			expected: false,
 		},
 		{
 			description: "TOTPPending returns false for non-local providers",
 			context:     &model.UserContext{Provider: model.ProviderOAuth, OAuth: &model.OAuthContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			run:         func(c *model.UserContext) any { return c.TOTPPending() },
 			expected:    false,
 		},
 		{
@@ -207,26 +202,28 @@ func TestContext(t *testing.T) {
 				Provider: model.ProviderOAuth,
 				OAuth:    &model.OAuthContext{DisplayName: "Google"},
 			},
-			run:      func(t *testing.T, c *model.UserContext) any { return c.OAuthName() },
+			run:      func(c *model.UserContext) any { return c.OAuthName() },
 			expected: "Google",
 		},
 		{
 			description: "OAuthName returns empty string for non-oauth providers",
 			context:     &model.UserContext{Provider: model.ProviderLocal, Local: &model.LocalContext{}},
-			run:         func(t *testing.T, c *model.UserContext) any { return c.OAuthName() },
+			run:         func(c *model.UserContext) any { return c.OAuthName() },
 			expected:    "",
 		},
 		{
 			description: "NewFromGin populates context from gin value",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				stored := &model.UserContext{
 					Authenticated: true,
 					Provider:      model.ProviderLocal,
 					Local:         &model.LocalContext{BaseContext: model.BaseContext{Username: "alice"}},
 				}
 				got, err := c.NewFromGin(newGinCtx(stored, true))
-				require.NoError(t, err)
+				if err != nil {
+					return err.Error()
+				}
 				return [2]any{got.Authenticated, got.GetUsername()}
 			},
 			expected: [2]any{true, "alice"},
@@ -234,7 +231,7 @@ func TestContext(t *testing.T) {
 		{
 			description: "NewFromGin returns error when context value is missing",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				_, err := c.NewFromGin(newGinCtx(nil, false))
 				return err.Error()
 			},
@@ -243,34 +240,17 @@ func TestContext(t *testing.T) {
 		{
 			description: "NewFromGin returns error when context value has wrong type",
 			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
+			run: func(c *model.UserContext) any {
 				_, err := c.NewFromGin(newGinCtx("not a user context", true))
 				return err.Error()
 			},
 			expected: "invalid user context type",
 		},
-		{
-			description: "NewFromGin returns an error when context doesn't include user information",
-			context:     &model.UserContext{},
-			run: func(t *testing.T, c *model.UserContext) any {
-				_, err := c.NewFromGin(newGinCtx(&model.UserContext{Provider: model.ProviderLocal}, true))
-				return err.Error()
-			},
-			expected: "incomplete user context",
-		},
-		{
-			description: "Getters should not panic if provider context is empty",
-			context:     &model.UserContext{Provider: model.ProviderLocal},
-			run: func(t *testing.T, c *model.UserContext) any {
-				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
-			},
-			expected: [3]string{"", "", ""},
-		},
 	}

 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
-			assert.Equal(t, test.expected, test.run(t, test.context))
+			assert.Equal(t, test.expected, test.run(test.context))
 		})
 	}
 }
@@ -28,21 +28,18 @@ func (acls *AccessControlsService) Init() error {
 }

 func (acls *AccessControlsService) lookupStaticACLs(domain string) *model.App {
-	var appAcls *model.App
 	for app, config := range acls.static {
 		if config.Config.Domain == domain {
 			tlog.App.Debug().Str("name", app).Msg("Found matching container by domain")
-			appAcls = &config
-			break // If we find a match by domain, we can stop searching
+			return &config
 		}

 		if strings.SplitN(domain, ".", 2)[0] == app {
 			tlog.App.Debug().Str("name", app).Msg("Found matching container by app name")
-			appAcls = &config
-			break // If we find a match by app name, we can stop searching
+			return &config
 		}
 	}
-	return appAcls
+	return nil
 }

 func (acls *AccessControlsService) GetAccessControls(domain string) (*model.App, error) {
@@ -73,7 +73,7 @@ type Lockdown struct {
 }

 type AuthServiceConfig struct {
-	LocalUsers         *[]model.LocalUser
+	LocalUsers         []model.LocalUser
 	OauthWhitelist     []string
 	SessionExpiry      int
 	SessionMaxLifetime int
@@ -84,7 +84,6 @@ type AuthServiceConfig struct {
 	SessionCookieName  string
 	IP                 model.IPConfig
 	LDAPGroupsCacheTTL int
-	SubdomainsEnabled  bool
 }

 type AuthService struct {
@@ -121,7 +120,7 @@ func (auth *AuthService) Init() error {
 }

 func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error) {
-	if auth.GetLocalUser(username) != nil {
+	if auth.GetLocalUser(username).Username != "" {
 		return &model.UserSearch{
 			Username: username,
 			Type:     model.UserLocal,
@@ -148,9 +147,6 @@ func (auth *AuthService) CheckUserPassword(search model.UserSearch, password str
 	switch search.Type {
 	case model.UserLocal:
 		user := auth.GetLocalUser(search.Username)
-		if user == nil {
-			return ErrUserNotFound
-		}
 		return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
 	case model.UserLDAP:
 		if auth.ldap.IsConfigured() {
@@ -173,10 +169,7 @@ func (auth *AuthService) CheckUserPassword(search model.UserSearch, password str
 }

 func (auth *AuthService) GetLocalUser(username string) *model.LocalUser {
-	if auth.config.LocalUsers == nil {
-		return nil
-	}
-	for _, user := range *auth.config.LocalUsers {
+	for _, user := range auth.config.LocalUsers {
 		if user.Username == username {
 			return &user
 		}
@@ -302,8 +295,6 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
 		expiry = auth.config.SessionExpiry
 	}

-	expiresAt := time.Now().Add(time.Duration(expiry) * time.Second)
-
 	session := repository.CreateSessionParams{
 		UUID:        uuid.String(),
 		Username:    data.Username,
@@ -312,7 +303,7 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
 		Provider:    data.Provider,
 		TotpPending: data.TotpPending,
 		OAuthGroups: data.OAuthGroups,
-		Expiry:      expiresAt.Unix(),
+		Expiry:      time.Now().Add(time.Duration(expiry) * time.Second).Unix(),
 		CreatedAt:   time.Now().Unix(),
 		OAuthName:   data.OAuthName,
 		OAuthSub:    data.OAuthSub,
@@ -329,8 +320,8 @@ func (auth *AuthService) CreateSession(ctx context.Context, data repository.Sess
 		Value:    session.UUID,
 		Path:     "/",
 		Domain:   fmt.Sprintf(".%s", auth.config.CookieDomain),
-		Expires:  expiresAt,
-		MaxAge:   int(time.Until(expiresAt).Seconds()),
+		Expires:  time.Now().Add(time.Duration(expiry) * time.Second),
+		MaxAge:   expiry,
 		Secure:   auth.config.SecureCookie,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -383,7 +374,7 @@ func (auth *AuthService) RefreshSession(ctx context.Context, uuid string) (*http
 		Path:     "/",
 		Domain:   fmt.Sprintf(".%s", auth.config.CookieDomain),
 		Expires:  time.Now().Add(time.Duration(newExpiry-currentTime) * time.Second),
-		MaxAge:   int(newExpiry - currentTime),
+		MaxAge:   auth.config.SessionExpiry,
 		Secure:   auth.config.SecureCookie,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,
@@ -398,12 +389,6 @@ func (auth *AuthService) DeleteSession(ctx context.Context, uuid string) (*http.
 		tlog.App.Warn().Err(err).Msg("Failed to delete session from database, proceeding to clear cookie anyway")
 	}

-	err = auth.queries.DeleteSession(ctx, uuid)
-
-	if err != nil {
-		return nil, err
-	}
-
 	return &http.Cookie{
 		Name:     auth.config.SessionCookieName,
 		Value:    "",
@@ -451,7 +436,7 @@ func (auth *AuthService) GetSession(ctx context.Context, uuid string) (*reposito
 }

 func (auth *AuthService) LocalAuthConfigured() bool {
-	return auth.config.LocalUsers != nil && len(*auth.config.LocalUsers) > 0
+	return len(auth.config.LocalUsers) > 0
 }

 func (auth *AuthService) LDAPAuthConfigured() bool {
@@ -95,8 +95,7 @@ func (k *KubernetesService) getByDomain(domain string) *model.App {

 	if appKey, ok := k.domainIndex[domain]; ok {
 		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
-			for i := range apps {
-				app := &apps[i]
+			for _, app := range apps {
 				if app.domain == domain && app.appName == appKey.appName {
 					return &app.app
 				}
@@ -112,8 +111,7 @@ func (k *KubernetesService) getByAppName(appName string) *model.App {

 	if appKey, ok := k.appNameIndex[appName]; ok {
 		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
-			for i := range apps {
-				app := &apps[i]
+			for _, app := range apps {
 				if app.appName == appName {
 					return &app.app
 				}
@@ -269,7 +269,7 @@ func (ldap *LdapService) reconnect() error {
 	exp.Reset()

 	operation := func() (*ldapgo.Conn, error) {
-		ldap.conn.Close() //nolint:errcheck
+		ldap.conn.Close()
 		conn, err := ldap.connect()
 		if err != nil {
 			return nil, err
@@ -12,9 +12,8 @@ import (
 )

 type GithubEmailResponse []struct {
-	Email    string `json:"email"`
-	Primary  bool   `json:"primary"`
-	Verified bool   `json:"verified"`
+	Email   string `json:"email"`
+	Primary bool   `json:"primary"`
 }

 type GithubUserInfoResponse struct {
@@ -27,7 +26,7 @@ func defaultExtractor(client *http.Client, url string) (*model.Claims, error) {
 	return simpleReq[model.Claims](client, url, nil)
 }

-func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {
+func githubExtractor(client *http.Client, url string) (*model.Claims, error) {
 	var user model.Claims

 	userInfo, err := simpleReq[GithubUserInfoResponse](client, "https://api.github.com/user", map[string]string{
@@ -49,7 +48,7 @@ func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {
 	}

 	for _, email := range *userEmails {
-		if email.Primary && email.Verified {
+		if email.Primary {
 			user.Email = email.Email
 			break
 		}
@@ -57,16 +56,7 @@ func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {

 	// Use first available email if no primary email was found
 	if user.Email == "" {
-		for _, email := range *userEmails {
-			if email.Verified {
-				user.Email = email.Email
-				break
-			}
-		}
-	}
-
-	if user.Email == "" {
-		return nil, errors.New("no verified email found")
+		user.Email = (*userEmails)[0].Email
 	}

 	user.PreferredUsername = userInfo.Login
@@ -92,7 +82,7 @@ func simpleReq[T any](client *http.Client, url string, headers map[string]string
 	if err != nil {
 		return nil, err
 	}
-	defer res.Body.Close() //nolint:errcheck
+	defer res.Body.Close()

 	if res.StatusCode < 200 || res.StatusCode >= 300 {
 		return nil, fmt.Errorf("request failed with status: %s", res.Status)
@@ -22,7 +22,7 @@ func GetCookieDomain(u string) (string, error) {
 	host := parsed.Hostname()

 	if netIP := net.ParseIP(host); netIP != nil {
-		return "", errors.New("ip addresses not allowed")
+		return "", errors.New("IP addresses not allowed")
 	}

 	parts := strings.Split(host, ".")
@@ -47,27 +47,6 @@ func GetCookieDomain(u string) (string, error) {
 	return domain, nil
 }

-func GetStandaloneCookieDomain(u string) (string, error) {
-	parsed, err := url.Parse(u)
-	if err != nil {
-		return "", err
-	}
-
-	host := parsed.Hostname()
-
-	if netIP := net.ParseIP(host); netIP != nil {
-		return "", errors.New("ip addresses not allowed")
-	}
-
-	parts := strings.Split(host, ".")
-
-	if len(parts) < 2 {
-		return "", errors.New("invalid app url")
-	}
-
-	return host, nil
-}
-
 func ParseFileToLine(content string) string {
 	lines := strings.Split(content, "\n")
 	users := make([]string, 0)
@@ -30,7 +30,7 @@ func TestGetRootDomain(t *testing.T) {
 	// IP address
 	domain = "http://10.10.10.10"
 	_, err = utils.GetCookieDomain(domain)
-	assert.ErrorContains(t, err, "ip addresses not allowed")
+	assert.ErrorContains(t, err, "IP addresses not allowed")

 	// Invalid URL
 	domain = "http://[::1]:namedport"
@@ -180,48 +180,3 @@ func TestIsRedirectSafe(t *testing.T) {
 	result = utils.IsRedirectSafe(redirectURL, domain)
 	assert.False(t, result)
 }
-
-func TestGetStandaloneCookieDomain(t *testing.T) {
-	// Normal case
-	domain := "http://tinyauth.app"
-	expected := "tinyauth.app"
-	result, err := utils.GetStandaloneCookieDomain(domain)
-	assert.NoError(t, err)
-	assert.Equal(t, expected, result)
-
-	// URL with subdomain (full hostname is returned, no subdomain stripping)
-	domain = "http://sub.tinyauth.app"
-	expected = "sub.tinyauth.app"
-	result, err = utils.GetStandaloneCookieDomain(domain)
-	assert.NoError(t, err)
-	assert.Equal(t, expected, result)
-
-	// URL with port (port should be stripped)
-	domain = "http://tinyauth.app:8080"
-	expected = "tinyauth.app"
-	result, err = utils.GetStandaloneCookieDomain(domain)
-	assert.NoError(t, err)
-	assert.Equal(t, expected, result)
-
-	// URL with path
-	domain = "https://tinyauth.app/some/path"
-	expected = "tinyauth.app"
-	result, err = utils.GetStandaloneCookieDomain(domain)
-	assert.NoError(t, err)
-	assert.Equal(t, expected, result)
-
-	// IP address
-	domain = "http://10.10.10.10"
-	_, err = utils.GetStandaloneCookieDomain(domain)
-	assert.ErrorContains(t, err, "ip addresses not allowed")
-
-	// Invalid domain (only TLD)
-	domain = "com"
-	_, err = utils.GetStandaloneCookieDomain(domain)
-	assert.ErrorContains(t, err, "invalid app url")
-
-	// Invalid URL
-	domain = "http://[::1]:namedport"
-	_, err = utils.GetStandaloneCookieDomain(domain)
-	assert.ErrorContains(t, err, "parse \"http://[::1]:namedport\": invalid port \":namedport\" after host")
-}
@@ -5,20 +5,19 @@ import (
 	"testing"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )

 func TestReadFile(t *testing.T) {
 	// Setup
 	file, err := os.Create("/tmp/tinyauth_test_file")
-	require.NoError(t, err)
+	assert.NoError(t, err)

 	_, err = file.WriteString("file content\n")
-	require.NoError(t, err)
+	assert.NoError(t, err)

 	err = file.Close()
-	require.NoError(t, err)
-	defer os.Remove("/tmp/tinyauth_test_file") //nolint:errcheck
+	assert.NoError(t, err)
+	defer os.Remove("/tmp/tinyauth_test_file")

 	// Normal case
 	content, err := ReadFile("/tmp/tinyauth_test_file")
@@ -53,7 +53,7 @@ func FilterIP(filter string, ip string) (bool, error) {
 		return false, errors.New("invalid IP address")
 	}

-	filter = strings.ReplaceAll(filter, "-", "/")
+	filter = strings.Replace(filter, "-", "/", -1)

 	if strings.Contains(filter, "/") {
 		_, cidr, err := net.ParseCIDR(filter)
@@ -5,21 +5,20 @@ import (
 	"testing"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 )

 func TestGetSecret(t *testing.T) {
 	// Setup
 	file, err := os.Create("/tmp/tinyauth_test_secret")
-	require.NoError(t, err)
+	assert.NoError(t, err)

 	_, err = file.WriteString("       secret       \n")
-	require.NoError(t, err)
+	assert.NoError(t, err)

 	err = file.Close()
-	require.NoError(t, err)
-	defer os.Remove("/tmp/tinyauth_test_secret") //nolint:errcheck
+	assert.NoError(t, err)
+	defer os.Remove("/tmp/tinyauth_test_secret")

 	// Get from config
 	assert.Equal(t, "mysecret", utils.GetSecret("mysecret", ""))
@@ -28,41 +28,3 @@ func CoalesceToString(value any) string {
 		return ""
 	}
 }
-
-func ParseNonEmptyLines(contents string) []string {
-	lines := make([]string, 0)
-
-	for line := range strings.SplitSeq(contents, "\n") {
-		lineTrimmed := strings.TrimSpace(line)
-		if lineTrimmed == "" {
-			continue
-		}
-		lines = append(lines, lineTrimmed)
-	}
-
-	return lines
-}
-
-func GetStringList(valuesCfg []string, valuesPath string) ([]string, error) {
-	values := make([]string, 0, len(valuesCfg))
-
-	for _, value := range valuesCfg {
-		valueTrimmed := strings.TrimSpace(value)
-		if valueTrimmed == "" {
-			continue
-		}
-		values = append(values, valueTrimmed)
-	}
-
-	if valuesPath == "" {
-		return values, nil
-	}
-
-	contents, err := ReadFile(valuesPath)
-	if err != nil {
-		return []string{}, err
-	}
-
-	values = append(values, ParseNonEmptyLines(contents)...)
-	return values, nil
-}
@@ -1,7 +1,6 @@
 package utils_test

 import (
-	"os"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -57,33 +56,3 @@ func TestCompileUserEmail(t *testing.T) {
 	// Test with invalid email
 	assert.Equal(t, "user@example.com", utils.CompileUserEmail("user", "example.com"))
 }
-
-func TestParseNonEmptyLines(t *testing.T) {
-	lines := utils.ParseNonEmptyLines(" first@example.com \n\n second@example.com \n   \n")
-
-	assert.Equal(t, []string{"first@example.com", "second@example.com"}, lines)
-}
-
-func TestGetStringList(t *testing.T) {
-	file, err := os.Create("/tmp/tinyauth_list_test_file")
-	assert.NoError(t, err)
-
-	_, err = file.WriteString(" third@example.com \n\n fourth@example.com \n")
-	assert.NoError(t, err)
-
-	err = file.Close()
-	assert.NoError(t, err)
-	defer os.Remove("/tmp/tinyauth_list_test_file") //nolint:errcheck
-
-	values, err := utils.GetStringList([]string{" first@example.com ", "", "second@example.com"}, "/tmp/tinyauth_list_test_file")
-	assert.NoError(t, err)
-	assert.Equal(t, []string{"first@example.com", "second@example.com", "third@example.com", "fourth@example.com"}, values)
-
-	values, err = utils.GetStringList(nil, "")
-	assert.NoError(t, err)
-	assert.Equal(t, []string{}, values)
-
-	values, err = utils.GetStringList(nil, "/tmp/non_existing_list_file")
-	assert.ErrorContains(t, err, "no such file or directory")
-	assert.Equal(t, []string{}, values)
-}
@@ -13,7 +13,7 @@ func ParseUsers(usersStr []string, userAttributes map[string]model.UserAttribute
 	var users []model.LocalUser

 	if len(usersStr) == 0 {
-		return nil, nil
+		return &users, nil
 	}

 	for _, user := range usersStr {
@@ -34,9 +34,32 @@ func ParseUsers(usersStr []string, userAttributes map[string]model.UserAttribute
 }

 func GetUsers(usersCfg []string, usersPath string, userAttributes map[string]model.UserAttributes) (*[]model.LocalUser, error) {
-	usersStr, err := GetStringList(usersCfg, usersPath)
-	if err != nil {
-		return nil, err
+	var usersStr []string
+
+	if len(usersCfg) == 0 && usersPath == "" {
+		return nil, nil
+	}
+
+	if len(usersCfg) > 0 {
+		usersStr = append(usersStr, usersCfg...)
+	}
+
+	if usersPath != "" {
+		contents, err := ReadFile(usersPath)
+
+		if err != nil {
+			return nil, err
+		}
+
+		lines := strings.SplitSeq(contents, "\n")
+
+		for line := range lines {
+			lineTrimmed := strings.TrimSpace(line)
+			if lineTrimmed == "" {
+				continue
+			}
+			usersStr = append(usersStr, lineTrimmed)
+		}
 	}

 	return ParseUsers(usersStr, userAttributes)
@@ -5,31 +5,28 @@ import (
 	"testing"

 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 )

 func TestGetUsers(t *testing.T) {
-	tmpDir := t.TempDir()
-
 	hash := "$2a$10$Mz5xhkfSJUtPWkzCd/TdaePh9CaXc5QcGII5wIMPLSR46eTwma30G"

 	// Setup
-	file, err := os.Create(tmpDir + "/tinyauth_users_test.txt")
-	require.NoError(t, err)
+	file, err := os.Create("/tmp/tinyauth_users_test.txt")
+	assert.NoError(t, err)

 	_, err = file.WriteString("      user1:" + hash + "        \n         user2:" + hash + "                    ") // Spacing is on purpose
-	require.NoError(t, err)
+	assert.NoError(t, err)

 	err = file.Close()
-	require.NoError(t, err)
-	defer os.Remove(tmpDir + "/tinyauth_users_test.txt") //nolint:errcheck
+	assert.NoError(t, err)
+	defer os.Remove("/tmp/tinyauth_users_test.txt")

 	noAttrs := map[string]model.UserAttributes{}

 	// Test file only
-	users, err := utils.GetUsers([]string{}, tmpDir+"/tinyauth_users_test.txt", noAttrs)
+	users, err := utils.GetUsers([]string{}, "/tmp/tinyauth_users_test.txt", noAttrs)

 	assert.NoError(t, err)
 	assert.NotNil(t, users)
@@ -50,7 +47,7 @@ func TestGetUsers(t *testing.T) {
 	assert.Equal(t, "user4", (*users)[1].Username)

 	// Test both
-	users, err = utils.GetUsers([]string{"user5:" + hash}, tmpDir+"/tinyauth_users_test.txt", noAttrs)
+	users, err = utils.GetUsers([]string{"user5:" + hash}, "/tmp/tinyauth_users_test.txt", noAttrs)

 	assert.NoError(t, err)

@@ -68,7 +65,7 @@ func TestGetUsers(t *testing.T) {
 	attrs := map[string]model.UserAttributes{
 		"user1": {Name: "User One", Email: "user1@example.com"},
 	}
-	users, err = utils.GetUsers([]string{}, tmpDir+"/tinyauth_users_test.txt", attrs)
+	users, err = utils.GetUsers([]string{}, "/tmp/tinyauth_users_test.txt", attrs)

 	assert.NoError(t, err)
 	assert.Len(t, *users, 2)
@@ -90,7 +87,7 @@ func TestGetUsers(t *testing.T) {
 	assert.Nil(t, users)

 	// Test non-existent file
-	users, err = utils.GetUsers([]string{}, tmpDir+"/non_existent_file.txt", noAttrs)
+	users, err = utils.GetUsers([]string{}, "/tmp/non_existent_file.txt", noAttrs)

 	assert.ErrorContains(t, err, "no such file or directory")
 	assert.Nil(t, users)
Author	SHA1	Message	Date
Stavros	f3965a7470	fix: fix verion setting in cd and dockerfiles	2026-05-04 21:08:45 +03:00
Stavros	36d4e3ec52	tests: fix log wrapper tests	2026-05-04 21:01:13 +03:00
Stavros	eab9f71110	tests: remove error wrapper from context tests	2026-05-04 20:57:37 +03:00
Stavros	e13598bf3c	tests: add tests for context middleware	2026-05-04 20:52:59 +03:00
Stavros	4d3860f860	tests: add tests for context parsing	2026-05-04 20:33:49 +03:00
Stavros	3b5da06862	fix: fix config reference generator	2026-05-04 20:25:56 +03:00
Stavros	8f337aaff8	tests: move to testify for testing in utils	2026-05-04 20:25:16 +03:00
Stavros	ff3c25c09d	tests: fix utils tests	2026-05-04 20:18:34 +03:00
Stavros	26daef7d4e	tests: fix service tests	2026-05-04 20:11:07 +03:00
Stavros	c932817757	fix: fix controller tests	2026-05-04 20:07:03 +03:00
Stavros	004df2f852	chore: rename get basic auth to encode basic auth for clarity	2026-05-04 16:14:45 +03:00
Stavros	df56708b9a	refactor: simplify acls checking logic by passing the entire acl struct	2026-05-04 16:13:39 +03:00
Stavros	62ffd2fd11	feat: finalize context functionality	2026-04-29 20:11:43 +03:00
Stavros	a3ec07230c	fix: fix oauth and oidc controller imports and context	2026-04-29 20:00:36 +03:00
Stavros	b4eb7090bd	fix: fix imports and context in proxy controller	2026-04-29 19:58:39 +03:00
Stavros	2f24f823eb	fix: use new context in user controller	2026-04-29 19:45:23 +03:00
Stavros	9a219046ac	fix: context controller	2026-04-29 19:31:44 +03:00
Stavros	97d58b376d	fix: fix cli imports	2026-04-29 19:28:40 +03:00
Stavros	b426a1529e	fix: fix bootstrap import issues	2026-04-29 19:27:38 +03:00
Stavros	c7efb71a5a	fix: fix util imports	2026-04-29 19:25:23 +03:00
Stavros	eec75a6f49	wip	2026-04-29 19:21:07 +03:00