feat: use sync groups for better cancellation

* feat: add support for oauth whitelist file (#817)

* Merge branch 'main' into feat/oauth-whitelist-file

* fix: fix conflicts

* tests: use testify for testing

---------

Co-authored-by: Stavros <steveiliop56@gmail.com>

.env.example

@@ -91,6 +91,8 @@ TINYAUTH_APPS_name_LDAP_GROUPS=
 
 # Comma-separated list of allowed OAuth domains.
 TINYAUTH_OAUTH_WHITELIST=
+# Path to the OAuth whitelist file.
+TINYAUTH_OAUTH_WHITELISTFILE=
 # The OAuth provider to use for automatic redirection.
 TINYAUTH_OAUTH_AUTOREDIRECT=
 # OAuth client ID.

.github/workflows/ci.yml

@@ -5,18 +5,21 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Setup go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.26.0"
 
@@ -50,6 +53,6 @@ jobs:
         run: go test -coverprofile=coverage.txt -v ./...
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/nightly.yml

@@ -4,12 +4,16 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   create-release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Delete old release
         run: gh release delete --cleanup-tag --yes nightly || echo release not found
@@ -19,7 +23,7 @@ jobs:
           REPO: ${{ github.event.repository.name }}
 
       - name: Create release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           prerelease: true
           tag_name: nightly
@@ -33,7 +37,7 @@ jobs:
       BUILD_TIMESTAMP: ${{ steps.metadata.outputs.BUILD_TIMESTAMP }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
@@ -51,15 +55,15 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.26.0"
 
@@ -80,12 +84,12 @@ jobs:
       - name: Build
         run: |
           cp -r frontend/dist internal/assets/dist
-          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/config.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-amd64 ./cmd/tinyauth
+          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/model.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-amd64 ./cmd/tinyauth
         env:
           CGO_ENABLED: 0
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tinyauth-amd64
           path: tinyauth-amd64
@@ -97,15 +101,15 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.26.0"
 
@@ -126,12 +130,12 @@ jobs:
       - name: Build
         run: |
           cp -r frontend/dist internal/assets/dist
-          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/config.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-arm64 ./cmd/tinyauth
+          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/model.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-arm64 ./cmd/tinyauth
         env:
           CGO_ENABLED: 0
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tinyauth-arm64
           path: tinyauth-arm64
@@ -143,28 +147,28 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/amd64
@@ -186,7 +190,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-linux-amd64
           path: ${{ runner.temp }}/digests/*
@@ -201,28 +205,28 @@ jobs:
       - image-build
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/amd64
@@ -245,7 +249,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-distroless-linux-amd64
           path: ${{ runner.temp }}/digests/*
@@ -259,28 +263,28 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/arm64
@@ -302,7 +306,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-linux-arm64
           path: ${{ runner.temp }}/digests/*
@@ -317,28 +321,28 @@ jobs:
       - image-build-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: nightly
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/arm64
@@ -361,7 +365,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-distroless-linux-arm64
           path: ${{ runner.temp }}/digests/*
@@ -375,25 +379,25 @@ jobs:
       - image-build-arm
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
           flavor: |
@@ -414,25 +418,25 @@ jobs:
       - image-build-arm-distroless
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-distroless-*
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
           flavor: |
@@ -452,14 +456,14 @@ jobs:
       - binary-build
       - binary-build-arm
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: tinyauth-*
           path: binaries
           merge-multiple: true
 
       - name: Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           files: binaries/*
           tag_name: nightly

.github/workflows/release.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   generate-metadata:
     runs-on: ubuntu-latest
@@ -14,7 +18,7 @@ jobs:
       BUILD_TIMESTAMP: ${{ steps.metadata.outputs.BUILD_TIMESTAMP }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate metadata
         id: metadata
@@ -29,13 +33,13 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.26.0"
 
@@ -56,12 +60,12 @@ jobs:
       - name: Build
         run: |
           cp -r frontend/dist internal/assets/dist
-          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/config.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-amd64 ./cmd/tinyauth
+          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/model.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-amd64 ./cmd/tinyauth
         env:
           CGO_ENABLED: 0
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tinyauth-amd64
           path: tinyauth-amd64
@@ -72,13 +76,13 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Install go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.26.0"
 
@@ -99,12 +103,12 @@ jobs:
       - name: Build
         run: |
           cp -r frontend/dist internal/assets/dist
-          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/config.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-arm64 ./cmd/tinyauth
+          go build -ldflags "-s -w -X github.com/tinyauthapp/tinyauth/internal/model.Version=${{ needs.generate-metadata.outputs.VERSION }} -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${{ needs.generate-metadata.outputs.COMMIT_HASH }} -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${{ needs.generate-metadata.outputs.BUILD_TIMESTAMP }}" -o tinyauth-arm64 ./cmd/tinyauth
         env:
           CGO_ENABLED: 0
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tinyauth-arm64
           path: tinyauth-arm64
@@ -115,26 +119,26 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/amd64
@@ -156,7 +160,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-linux-amd64
           path: ${{ runner.temp }}/digests/*
@@ -170,26 +174,26 @@ jobs:
       - image-build
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/amd64
@@ -212,7 +216,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-distroless-linux-amd64
           path: ${{ runner.temp }}/digests/*
@@ -225,26 +229,26 @@ jobs:
       - generate-metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/arm64
@@ -266,7 +270,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-linux-arm64
           path: ${{ runner.temp }}/digests/*
@@ -280,26 +284,26 @@ jobs:
       - image-build-arm
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
         id: build
         with:
           platforms: linux/arm64
@@ -322,7 +326,7 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-distroless-linux-arm64
           path: ${{ runner.temp }}/digests/*
@@ -336,25 +340,25 @@ jobs:
       - image-build-arm
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
           flavor: |
@@ -377,25 +381,25 @@ jobs:
       - image-build-arm-distroless
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-distroless-*
           merge-multiple: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
         with:
           images: ghcr.io/${{ github.repository_owner }}/tinyauth
           flavor: |
@@ -419,13 +423,13 @@ jobs:
       - binary-build
       - binary-build-arm
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: tinyauth-*
           path: binaries
           merge-multiple: true
 
       - name: Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           files: binaries/*

.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
         with:
           sarif_file: results.sarif

.github/workflows/sponsors.yml

@@ -2,15 +2,19 @@ name: Generate Sponsors List
 on:
   workflow_dispatch:
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   generate-sponsors:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate Sponsors
-        uses: JamesIves/github-sponsors-readme-action@v1
+        uses: JamesIves/github-sponsors-readme-action@2fd9142e765f755780202122261dc85e78459405 # v1
         with:
           token: ${{ secrets.SPONSORS_GENERATOR_PAT }}
           active-only: false
@@ -18,7 +22,7 @@ jobs:
           template: '<a href="https://github.com/{{{ login }}}"><img src="{{{ avatarUrl }}}" width="64px" alt="User avatar: {{{ login }}}" /></a>&nbsp;&nbsp;'
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: |

.github/workflows/stale.yml

@@ -3,11 +3,15 @@ on:
   schedule:
     - cron: 0 10 * * *
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
         with:
           days-before-stale: 30
           stale-pr-message: This PR has been inactive for 30 days and will be marked as stale.

.vscode/launch.json

@@ -1,15 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "Connect to server",
-      "type": "go",
-      "request": "attach",
-      "mode": "remote",
-      "remotePath": "/tinyauth",
-      "port": 4000,
-      "host": "127.0.0.1",
-      "debugAdapter": "legacy"
-    }
-  ]
-}

AI_POLICY.md

@@ -0,0 +1,27 @@
+# AI Usage Policy
+
+> [!NOTE]
+> By Tinyauth, we refer to the entire Tinyauth ([tinyauthapp](https://github.com/tinyauthapp)) organization and all of the repositories under it.
+
+## How we utilize AI in Tinyauth
+
+In Tinyauth, we see AI as another tool designed to help developers accelerate their work, ***not*** as something that should be doing the development for them. The ways we utilize large language models in Tinyauth are the following:
+
+- **Pull request reviews**: We utilize [CodeRabbit](https://www.coderabbit.ai/) for reviews in our pull requests which helps us find and fix issues faster, minimizing the time maintainers have to spend reviewing.
+- **Documentation and Issues**: We use [Dosu](https://dosu.dev/) to help resolve duplicate issues faster and automatically update our documentation based on changes in the code base.
+- **In-Line Suggestions**: GitHub's [Copilot](https://github.com/features/copilot) is partially used to fill in boilerplate code through in-line suggestions.
+
+## How we expect the community to use AI
+
+We expect the Tinyauth community to use AI as a tool for faster development and not as a way to implement entire features through prompts. For this reason, the following guidelines are in place for AI generated content:
+
+- **All usage must be clearly labeled**: Any content generated by AI must be clearly labeled as such. In the case that a pull request is clearly generated by AI and the author fails to disclose its use, it will be rejected.
+- **All generated content should be completely understood by the account holder**: The human who utilized the large language model to generate content must have a thorough understanding of it. This includes understanding the resulting output to the full extent and being able to explain it in detail in case it's needed.
+- **Automated systems are not allowed**: All forms of automated systems that utilize large language models to generate content without human oversight are forbidden. This includes any system that generates content without a human being directly involved in the process like for example with OpenClaw.
+- **No generated content other than text is allowed**: Images, videos, audio and any other form of content generated by AI other than text is not allowed in Tinyauth.
+- **AI pull requests are not guaranteed to be accepted or prioritized**: Any pull request that contains AI generated content is not guaranteed to be accepted and/or prioritized. The maintainers are responsible for reviewing all pull requests and determining whether or not they meet the standards of the project. AI generated content will be reviewed with the same standards as any other content, and may be rejected if it does not meet those standards.
+- **Large generated pull requests will be rejected**: Any pull request that contains a large amount of generated content will be rejected. This is because it is difficult for the maintainers to review and verify large amounts of generated content.
+
+## Tinyauth is developed by humans, for humans
+
+Please remember that Tinyauth is developed by humans. While AI can be a useful tool for **assisting** in the development process, it should not be used in place of the human brain. Moving forward, we are committed to ensuring that most, if not all the content in Tinyauth is created and reviewed by humans, and that AI is only used as a tool to assist in the development process.

CONTRIBUTING.md

@@ -2,6 +2,9 @@
 
 Contributing to Tinyauth is straightforward. Follow the steps below to set up a development server.
 
+> [!NOTE]
+> If you are using large language models to contribute to the project, please ensure that you have read and understood the [AI Policy](AI_POLICY.md).
+
 ## Requirements
 
 - Bun

Dockerfile

@@ -38,9 +38,9 @@ COPY ./internal ./internal
 COPY --from=frontend-builder /frontend/dist ./internal/assets/dist
 
 RUN CGO_ENABLED=0 go build -ldflags "-s -w \
-    -X github.com/tinyauthapp/tinyauth/internal/config.Version=${VERSION} \
+    -X github.com/tinyauthapp/tinyauth/internal/model.Version=${VERSION} \
-    -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${COMMIT_HASH} \
+    -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${COMMIT_HASH} \
-    -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${BUILD_TIMESTAMP}" ./cmd/tinyauth
+    -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${BUILD_TIMESTAMP}" ./cmd/tinyauth
 
 # Runner
 FROM alpine:3.23 AS runner

Dockerfile.distroless

@@ -40,9 +40,9 @@ COPY --from=frontend-builder /frontend/dist ./internal/assets/dist
 RUN mkdir -p data
 
 RUN CGO_ENABLED=0 go build -ldflags "-s -w \
-    -X github.com/tinyauthapp/tinyauth/internal/config.Version=${VERSION} \
+    -X github.com/tinyauthapp/tinyauth/internal/model.Version=${VERSION} \
-    -X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${COMMIT_HASH} \
+    -X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${COMMIT_HASH} \
-    -X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${BUILD_TIMESTAMP}" ./cmd/tinyauth
+    -X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${BUILD_TIMESTAMP}" ./cmd/tinyauth
 
 # Runner
 FROM gcr.io/distroless/static-debian12:latest AS runner

Makefile

@@ -17,7 +17,7 @@ PROD_COMPOSE := $(shell test -f "docker-compose.test.prod.yml" && echo "docker-c
 
 # Deps
 deps:
-	bun install --cwd frontend
+	bun install --frozen-lockfile --cwd frontend
 	go mod download
 
 # Clean data
@@ -37,9 +37,9 @@ webui: clean-webui
 # Build the binary
 binary: webui
 	CGO_ENABLED=$(CGO_ENABLED) go build -ldflags "-s -w \
-	-X github.com/tinyauthapp/tinyauth/internal/config.Version=${TAG_NAME} \
+	-X github.com/tinyauthapp/tinyauth/internal/model.Version=${TAG_NAME} \
-	-X github.com/tinyauthapp/tinyauth/internal/config.CommitHash=${COMMIT_HASH} \
+	-X github.com/tinyauthapp/tinyauth/internal/model.CommitHash=${COMMIT_HASH} \
-	-X github.com/tinyauthapp/tinyauth/internal/config.BuildTimestamp=${BUILD_TIMESTAMP}" \
+	-X github.com/tinyauthapp/tinyauth/internal/model.BuildTimestamp=${BUILD_TIMESTAMP}" \
 	-o ${BIN_NAME} ./cmd/tinyauth
 
 # Build for amd64

README.md

@@ -13,6 +13,7 @@
     <a href="https://scorecard.dev/viewer/?uri=github.com/tinyauthapp/tinyauth" target="_blank" title="OpenSSF Scorecard">
       <img src="https://api.scorecard.dev/projects/github.com/tinyauthapp/tinyauth/badge">
     </a>
+    <a href="https://www.bestpractices.dev/projects/12681" target="_blank" title="OSSF Best Practices"><img src="https://www.bestpractices.dev/projects/12681/baseline"></a>
 </div>
 
 <br />

SECURITY.md

@@ -6,4 +6,4 @@ It is recommended to use the [latest](https://github.com/tinyauthapp/tinyauth/re
 
 ## Reporting a Vulnerability
 
-Due to the nature of this app, it needs to be secure. If you discover any security issues or vulnerabilities in the app please contact me as soon as possible at <steve@doesmycode.work>. Please do not use the issues section to report security issues as I won't be able to patch them in time and they may get exploited by malicious actors.
+Due to the nature of this app, it needs to be secure. If you discover any security issues or vulnerabilities in the app please contact me as soon as possible at <security@tinyauth.app>. Please do not use the issues section to report security issues as I won't be able to patch them in time and they may get exploited by malicious actors.

cmd/tinyauth/create_user.go

@@ -6,8 +6,8 @@ import (
 	"strings"
 
 	"charm.land/huh/v2"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
 	"github.com/tinyauthapp/paerser/cli"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 	"golang.org/x/crypto/bcrypt"
 )
 
@@ -40,7 +40,8 @@ func createUserCmd() *cli.Command {
 		Configuration: tCfg,
 		Resources:     loaders,
 		Run: func(_ []string) error {
-			tlog.NewSimpleLogger().Init()
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
 			if tCfg.Interactive {
 				form := huh.NewForm(
@@ -73,7 +74,7 @@ func createUserCmd() *cli.Command {
 				return errors.New("username and password cannot be empty")
 			}
 
-			tlog.App.Info().Str("username", tCfg.Username).Msg("Creating user")
+			log.App.Info().Str("username", tCfg.Username).Msg("Creating user")
 
 			passwd, err := bcrypt.GenerateFromPassword([]byte(tCfg.Password), bcrypt.DefaultCost)
 			if err != nil {
@@ -86,7 +87,7 @@ func createUserCmd() *cli.Command {
 				passwdStr = strings.ReplaceAll(passwdStr, "$", "$$")
 			}
 
-			tlog.App.Info().Str("user", fmt.Sprintf("%s:%s", tCfg.Username, passwdStr)).Msg("User created")
+			log.App.Info().Str("user", fmt.Sprintf("%s:%s", tCfg.Username, passwdStr)).Msg("User created")
 
 			return nil
 		},

cmd/tinyauth/generate_totp.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"charm.land/huh/v2"
 	"github.com/mdp/qrterminal/v3"
@@ -40,7 +40,8 @@ func generateTotpCmd() *cli.Command {
 		Configuration: tCfg,
 		Resources:     loaders,
 		Run: func(_ []string) error {
-			tlog.NewSimpleLogger().Init()
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
 			if tCfg.Interactive {
 				form := huh.NewForm(
@@ -73,7 +74,7 @@ func generateTotpCmd() *cli.Command {
 				docker = true
 			}
 
-			if user.TotpSecret != "" {
+			if user.TOTPSecret != "" {
 				return fmt.Errorf("user already has a TOTP secret")
 			}
 
@@ -88,9 +89,9 @@ func generateTotpCmd() *cli.Command {
 
 			secret := key.Secret()
 
-			tlog.App.Info().Str("secret", secret).Msg("Generated TOTP secret")
+			log.App.Info().Str("secret", secret).Msg("Generated TOTP secret")
 
-			tlog.App.Info().Msg("Generated QR code")
+			log.App.Info().Msg("Generated QR code")
 
 			config := qrterminal.Config{
 				Level:     qrterminal.L,
@@ -102,14 +103,14 @@ func generateTotpCmd() *cli.Command {
 
 			qrterminal.GenerateWithConfig(key.URL(), config)
 
-			user.TotpSecret = secret
+			user.TOTPSecret = secret
 
 			// If using docker escape re-escape it
 			if docker {
 				user.Password = strings.ReplaceAll(user.Password, "$", "$$")
 			}
 
-			tlog.App.Info().Str("user", fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TotpSecret)).Msg("Add the totp secret to your authenticator app then use the verify command to ensure everything is working correctly.")
+			log.App.Info().Str("user", fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)).Msg("Add the totp secret to your authenticator app then use the verify command to ensure everything is working correctly.")
 
 			return nil
 		},

cmd/tinyauth/healthcheck.go

@@ -9,8 +9,8 @@ import (
 	"os"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
 	"github.com/tinyauthapp/paerser/cli"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
 type healthzResponse struct {
@@ -26,7 +26,8 @@ func healthcheckCmd() *cli.Command {
 		Resources:     nil,
 		AllowArg:      true,
 		Run: func(args []string) error {
-			tlog.NewSimpleLogger().Init()
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
 			srvAddr := os.Getenv("TINYAUTH_SERVER_ADDRESS")
 			if srvAddr == "" {
@@ -48,7 +49,7 @@ func healthcheckCmd() *cli.Command {
 				return errors.New("Could not determine app URL")
 			}
 
-			tlog.App.Info().Str("app_url", appUrl).Msg("Performing health check")
+			log.App.Info().Str("app_url", appUrl).Msg("Performing health check")
 
 			client := http.Client{
 				Timeout: 30 * time.Second,
@@ -86,7 +87,7 @@ func healthcheckCmd() *cli.Command {
 				return fmt.Errorf("failed to decode response: %w", err)
 			}
 
-			tlog.App.Info().Interface("response", healthResp).Msg("Tinyauth is healthy")
+			log.App.Info().Interface("response", healthResp).Msg("Tinyauth is healthy")
 
 			return nil
 		},

cmd/tinyauth/tinyauth.go

@@ -5,16 +5,15 @@ import (
 
 	"charm.land/huh/v2"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/loaders"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
 
 	"github.com/rs/zerolog/log"
 	"github.com/tinyauthapp/paerser/cli"
 )
 
 func main() {
-	tConfig := config.NewDefaultConfiguration()
+	tConfig := model.NewDefaultConfiguration()
 
 	loaders := []cli.ResourceLoader{
 		&loaders.FileLoader{},
@@ -108,12 +107,7 @@ func main() {
 	}
 }
 
-func runCmd(cfg config.Config) error {
+func runCmd(cfg model.Config) error {
-	logger := tlog.NewLogger(cfg.Log)
-	logger.Init()
-
-	tlog.App.Info().Str("version", config.Version).Msg("Starting tinyauth")
-
 	app := bootstrap.NewBootstrapApp(cfg)
 
 	err := app.Setup()

cmd/tinyauth/verify_user.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"charm.land/huh/v2"
 	"github.com/pquerna/otp/totp"
@@ -44,7 +44,8 @@ func verifyUserCmd() *cli.Command {
 		Configuration: tCfg,
 		Resources:     loaders,
 		Run: func(_ []string) error {
-			tlog.NewSimpleLogger().Init()
+			log := logger.NewLogger().WithSimpleConfig()
+			log.Init()
 
 			if tCfg.Interactive {
 				form := huh.NewForm(
@@ -95,21 +96,21 @@ func verifyUserCmd() *cli.Command {
 				return fmt.Errorf("password is incorrect: %w", err)
 			}
 
-			if user.TotpSecret == "" {
+			if user.TOTPSecret == "" {
 				if tCfg.Totp != "" {
-					tlog.App.Warn().Msg("User does not have TOTP secret")
+					log.App.Warn().Msg("User does not have TOTP secret")
 				}
-				tlog.App.Info().Msg("User verified")
+				log.App.Info().Msg("User verified")
 				return nil
 			}
 
-			ok := totp.Validate(tCfg.Totp, user.TotpSecret)
+			ok := totp.Validate(tCfg.Totp, user.TOTPSecret)
 
 			if !ok {
 				return fmt.Errorf("TOTP code incorrect")
 			}
 
-			tlog.App.Info().Msg("User verified")
+			log.App.Info().Msg("User verified")
 
 			return nil
 		},

cmd/tinyauth/version.go

@@ -3,9 +3,8 @@ package main
 import (
 	"fmt"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
-
 	"github.com/tinyauthapp/paerser/cli"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
 func versionCmd() *cli.Command {
@@ -15,9 +14,9 @@ func versionCmd() *cli.Command {
 		Configuration: nil,
 		Resources:     nil,
 		Run: func(_ []string) error {
-			fmt.Printf("Version: %s\n", config.Version)
+			fmt.Printf("Version: %s\n", model.Version)
-			fmt.Printf("Commit Hash: %s\n", config.CommitHash)
+			fmt.Printf("Commit Hash: %s\n", model.CommitHash)
-			fmt.Printf("Build Timestamp: %s\n", config.BuildTimestamp)
+			fmt.Printf("Build Timestamp: %s\n", model.BuildTimestamp)
 			return nil
 		},
 	}

frontend/Dockerfile.dev

@@ -5,7 +5,7 @@ WORKDIR /frontend
 COPY ./frontend/package.json ./
 COPY ./frontend/bun.lock ./
 
-RUN bun install
+RUN bun install --frozen-lockfile
 
 COPY ./frontend/public ./public
 COPY ./frontend/src ./src
@@ -19,4 +19,4 @@ COPY ./frontend/vite.config.ts ./
 
 EXPOSE 5173
 
-ENTRYPOINT ["bun", "run", "dev"]
+ENTRYPOINT ["bun", "run", "dev"]

gen/gen_env.go

@@ -10,7 +10,7 @@ import (
 	"reflect"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
 type EnvEntry struct {
@@ -20,7 +20,7 @@ type EnvEntry struct {
 }
 
 func generateExampleEnv() {
-	cfg := config.NewDefaultConfiguration()
+	cfg := model.NewDefaultConfiguration()
 	entries := make([]EnvEntry, 0)
 
 	root := reflect.TypeOf(cfg).Elem()

gen/gen_md.go

@@ -10,7 +10,7 @@ import (
 	"reflect"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
 type MarkdownEntry struct {
@@ -21,7 +21,7 @@ type MarkdownEntry struct {
 }
 
 func generateMarkdown() {
-	cfg := config.NewDefaultConfiguration()
+	cfg := model.NewDefaultConfiguration()
 	entries := make([]MarkdownEntry, 0)
 
 	root := reflect.TypeOf(cfg).Elem()

go.mod

@@ -19,10 +19,10 @@ require (
 	github.com/tinyauthapp/paerser v0.0.0-20260410140347-85c3740d6298
 	github.com/weppos/publicsuffix-go v0.50.3
 	golang.org/x/crypto v0.50.0
-	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/oauth2 v0.36.0
-	gotest.tools/v3 v3.5.2
+	k8s.io/apimachinery v0.36.0
-	modernc.org/sqlite v1.49.1
+	k8s.io/client-go v0.36.0
+	modernc.org/sqlite v1.50.0
 )
 
 require (
@@ -63,6 +63,7 @@ require (
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
@@ -73,7 +74,6 @@ require (
 	github.com/go-playground/validator/v10 v10.30.1 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
@@ -90,8 +90,9 @@ require (
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
@@ -106,6 +107,7 @@ require (
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -116,16 +118,28 @@ require (
 	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
 	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/arch v0.22.0 // indirect
+	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/term v0.42.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
 	modernc.org/libc v1.72.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 	rsc.io/qr v0.2.0 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )

go.sum

@@ -97,10 +97,14 @@ github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
+github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
 github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
@@ -118,6 +122,12 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -132,6 +142,8 @@ github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/golang-migrate/migrate/v4 v4.19.1 h1:OCyb44lFuQfYXYLx1SCxPZQGU7mcaZ7gH9yH4jSFbBA=
 github.com/golang-migrate/migrate/v4 v4.19.1/go.mod h1:CTcgfjxhaUtsLipnLoQRWCrjYXycRz/g5+RWDuYgPrE=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
@@ -162,6 +174,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
@@ -176,6 +190,8 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
@@ -203,12 +219,15 @@ github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFL
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -242,9 +261,12 @@ github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -261,6 +283,8 @@ github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 github.com/weppos/publicsuffix-go v0.50.3 h1:eT5dcjHQcVDNc0igpFEsGHKIip30feuB2zuuI9eJxiE=
 github.com/weppos/publicsuffix-go v0.50.3/go.mod h1:/rOa781xBykZhHK/I3QeHo92qdDKVmKZKF7s8qAEM/4=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
@@ -287,6 +311,10 @@ go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpu
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
 golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
@@ -308,8 +336,8 @@ golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
 golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
 golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
-golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
 golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
@@ -319,16 +347,32 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
 google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
+gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+k8s.io/api v0.36.0 h1:SgqDhZzHdOtMk40xVSvCXkP9ME0H05hPM3p9AB1kL80=
+k8s.io/api v0.36.0/go.mod h1:m1LVrGPNYax5NBHdO+QuAedXyuzTt4RryI/qnmNvs34=
+k8s.io/apimachinery v0.36.0 h1:jZyPzhd5Z+3h9vJLt0z9XdzW9VzNzWAUw+P1xZ9PXtQ=
+k8s.io/apimachinery v0.36.0/go.mod h1:FklypaRJt6n5wUIwWXIP6GJlIpUizTgfo1T/As+Tyxc=
+k8s.io/client-go v0.36.0 h1:pOYi7C4RHChYjMiHpZSpSbIM6ZxVbRXBy7CuiIwqA3c=
+k8s.io/client-go v0.36.0/go.mod h1:ZKKcpwF0aLYfkHFCjillCKaTK/yBkEDHTDXCFY6AS9Y=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
+k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
+k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
 modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
 modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
 modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
@@ -351,11 +395,19 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.49.1 h1:dYGHTKcX1sJ+EQDnUzvz4TJ5GbuvhNJa8Fg6ElGx73U=
+modernc.org/sqlite v1.50.0 h1:eMowQSWLK0MeiQTdmz3lqoF5dqclujdlIKeJA11+7oM=
-modernc.org/sqlite v1.49.1/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
+modernc.org/sqlite v1.50.0/go.mod h1:m0w8xhwYUVY3H6pSDwc3gkJ/irZT/0YEXwBlhaxQEew=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
 rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

internal/bootstrap/app_bootstrap.go

@@ -3,156 +3,187 @@ package bootstrap
 import (
 	"bytes"
 	"context"
+	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"os/signal"
 	"sort"
 	"strings"
+	"sync"
+	"syscall"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/gin-gonic/gin"
-	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
+	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
-type BootstrapApp struct {
+type Services struct {
-	config  config.Config
+	accessControlService *service.AccessControlsService
-	context struct {
+	authService          *service.AuthService
-		appUrl                 string
+	dockerService        *service.DockerService
-		uuid                   string
+	kubernetesService    *service.KubernetesService
-		cookieDomain           string
+	ldapService          *service.LdapService
-		sessionCookieName      string
+	oauthBrokerService   *service.OAuthBrokerService
-		csrfCookieName         string
+	oidcService          *service.OIDCService
-		redirectCookieName     string
-		oauthSessionCookieName string
-		users                  []config.User
-		oauthProviders         map[string]config.OAuthServiceConfig
-		configuredProviders    []controller.Provider
-		oidcClients            []config.OIDCClientConfig
-	}
-	services Services
 }
 
-func NewBootstrapApp(config config.Config) *BootstrapApp {
+type BootstrapApp struct {
+	config   model.Config
+	runtime  model.RuntimeConfig
+	services Services
+	log      *logger.Logger
+	ctx      context.Context
+	cancel   context.CancelFunc
+	queries  *repository.Queries
+	router   *gin.Engine
+	db       *sql.DB
+	wg       sync.WaitGroup
+}
+
+func NewBootstrapApp(config model.Config) *BootstrapApp {
 	return &BootstrapApp{
 		config: config,
 	}
 }
 
 func (app *BootstrapApp) Setup() error {
+	// create context
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	app.ctx = ctx
+	app.cancel = cancel
+
+	// setup logger
+	log := logger.NewLogger().WithConfig(app.config.Log)
+	log.Init()
+	app.log = log
+
 	// get app url
 	if app.config.AppURL == "" {
-		return fmt.Errorf("app URL cannot be empty, perhaps config loading failed")
+		return errors.New("app url cannot be empty, perhaps config loading failed")
 	}
 
 	appUrl, err := url.Parse(app.config.AppURL)
 
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to parse app url: %w", err)
 	}
 
-	app.context.appUrl = appUrl.Scheme + "://" + appUrl.Host
+	app.runtime.AppURL = appUrl.Scheme + "://" + appUrl.Host
 
 	// validate session config
 	if app.config.Auth.SessionMaxLifetime != 0 && app.config.Auth.SessionMaxLifetime < app.config.Auth.SessionExpiry {
-		return fmt.Errorf("session max lifetime cannot be less than session expiry")
+		return errors.New("session max lifetime cannot be less than session expiry")
 	}
 
-	// Parse users
+	// parse users
 	users, err := utils.GetUsers(app.config.Auth.Users, app.config.Auth.UsersFile, app.config.Auth.UserAttributes)
 
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to load users: %w", err)
 	}
 
-	app.context.users = users
+	app.runtime.LocalUsers = *users
 
-	// Setup OAuth providers
+	// load oauth whitelist
-	app.context.oauthProviders = app.config.OAuth.Providers
+	oauthWhitelist, err := utils.GetStringList(app.config.OAuth.Whitelist, app.config.OAuth.WhitelistFile)
 
-	for name, provider := range app.context.oauthProviders {
+	if err != nil {
+		return fmt.Errorf("failed to load oauth whitelist: %w", err)
+	}
+
+	app.runtime.OAuthWhitelist = oauthWhitelist
+
+	// Setup oauth providers
+	app.runtime.OAuthProviders = app.config.OAuth.Providers
+
+	for id, provider := range app.runtime.OAuthProviders {
 		secret := utils.GetSecret(provider.ClientSecret, provider.ClientSecretFile)
 		provider.ClientSecret = secret
 		provider.ClientSecretFile = ""
 
 		if provider.RedirectURL == "" {
-			provider.RedirectURL = app.context.appUrl + "/api/oauth/callback/" + name
+			provider.RedirectURL = app.runtime.AppURL + "/api/oauth/callback/" + id
 		}
 
-		app.context.oauthProviders[name] = provider
+		app.runtime.OAuthProviders[id] = provider
 	}
 
-	for id, provider := range app.context.oauthProviders {
+	// set presets for built-in providers
+	for id, provider := range app.runtime.OAuthProviders {
 		if provider.Name == "" {
-			if name, ok := config.OverrideProviders[id]; ok {
+			if name, ok := model.OverrideProviders[id]; ok {
 				provider.Name = name
 			} else {
 				provider.Name = utils.Capitalize(id)
 			}
 		}
-		app.context.oauthProviders[id] = provider
+		app.runtime.OAuthProviders[id] = provider
 	}
 
-	// Setup OIDC clients
+	// setup oidc clients
 	for id, client := range app.config.OIDC.Clients {
 		client.ID = id
-		app.context.oidcClients = append(app.context.oidcClients, client)
+		app.runtime.OIDCClients = append(app.runtime.OIDCClients, client)
 	}
 
-	// Get cookie domain
+	// cookie domain
-	cookieDomain, err := utils.GetCookieDomain(app.context.appUrl)
+	cookieDomainResolver := utils.GetCookieDomain
+
+	if !app.config.Auth.SubdomainsEnabled {
+		app.log.App.Warn().Msg("Subdomains are disabled, using standalone cookie domain resolver which will not work with subdomains")
+		cookieDomainResolver = utils.GetStandaloneCookieDomain
+	}
+
+	cookieDomain, err := cookieDomainResolver(app.runtime.AppURL)
 
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get cookie domain: %w", err)
 	}
 
-	app.context.cookieDomain = cookieDomain
+	app.runtime.CookieDomain = cookieDomain
 
-	// Cookie names
+	// cookie names
-	app.context.uuid = utils.GenerateUUID(appUrl.Hostname())
+	app.runtime.UUID = utils.GenerateUUID(appUrl.Hostname())
-	cookieId := strings.Split(app.context.uuid, "-")[0]
-	app.context.sessionCookieName = fmt.Sprintf("%s-%s", config.SessionCookieName, cookieId)
-	app.context.csrfCookieName = fmt.Sprintf("%s-%s", config.CSRFCookieName, cookieId)
-	app.context.redirectCookieName = fmt.Sprintf("%s-%s", config.RedirectCookieName, cookieId)
-	app.context.oauthSessionCookieName = fmt.Sprintf("%s-%s", config.OAuthSessionCookieName, cookieId)
 
-	// Dumps
+	cookieId := strings.Split(app.runtime.UUID, "-")[0] // first 8 characters of the uuid should be good enough
-	tlog.App.Trace().Interface("config", app.config).Msg("Config dump")
-	tlog.App.Trace().Interface("users", app.context.users).Msg("Users dump")
-	tlog.App.Trace().Interface("oauthProviders", app.context.oauthProviders).Msg("OAuth providers dump")
-	tlog.App.Trace().Str("cookieDomain", app.context.cookieDomain).Msg("Cookie domain")
-	tlog.App.Trace().Str("sessionCookieName", app.context.sessionCookieName).Msg("Session cookie name")
-	tlog.App.Trace().Str("csrfCookieName", app.context.csrfCookieName).Msg("CSRF cookie name")
-	tlog.App.Trace().Str("redirectCookieName", app.context.redirectCookieName).Msg("Redirect cookie name")
 
-	// Database
+	app.runtime.SessionCookieName = fmt.Sprintf("%s-%s", model.SessionCookieName, cookieId)
-	db, err := app.SetupDatabase(app.config.Database.Path)
+	app.runtime.CSRFCookieName = fmt.Sprintf("%s-%s", model.CSRFCookieName, cookieId)
+	app.runtime.RedirectCookieName = fmt.Sprintf("%s-%s", model.RedirectCookieName, cookieId)
+	app.runtime.OAuthSessionCookieName = fmt.Sprintf("%s-%s", model.OAuthSessionCookieName, cookieId)
+
+	// database
+	err = app.SetupDatabase()
 
 	if err != nil {
 		return fmt.Errorf("failed to setup database: %w", err)
 	}
 
-	// Queries
+	// queries
-	queries := repository.New(db)
+	queries := repository.New(app.db)
+	app.queries = queries
 
-	// Services
+	// services
-	services, err := app.initServices(queries)
+	err = app.setupServices()
 
 	if err != nil {
 		return fmt.Errorf("failed to initialize services: %w", err)
 	}
 
-	app.services = services
+	// configured providers
+	configuredProviders := make([]model.Provider, 0)
 
-	// Configured providers
+	for id, provider := range app.runtime.OAuthProviders {
-	configuredProviders := make([]controller.Provider, 0)
+		configuredProviders = append(configuredProviders, model.Provider{
-
-	for id, provider := range app.context.oauthProviders {
-		configuredProviders = append(configuredProviders, controller.Provider{
 			Name:  provider.Name,
 			ID:    id,
 			OAuth: true,
@@ -163,70 +194,152 @@ func (app *BootstrapApp) Setup() error {
 		return configuredProviders[i].Name < configuredProviders[j].Name
 	})
 
-	if services.authService.LocalAuthConfigured() {
+	if app.services.authService.LocalAuthConfigured() {
-		configuredProviders = append(configuredProviders, controller.Provider{
+		configuredProviders = append(configuredProviders, model.Provider{
 			Name:  "Local",
 			ID:    "local",
 			OAuth: false,
 		})
 	}
 
-	if services.authService.LdapAuthConfigured() {
+	if app.services.authService.LDAPAuthConfigured() {
-		configuredProviders = append(configuredProviders, controller.Provider{
+		configuredProviders = append(configuredProviders, model.Provider{
 			Name:  "LDAP",
 			ID:    "ldap",
 			OAuth: false,
 		})
 	}
 
-	tlog.App.Debug().Interface("providers", configuredProviders).Msg("Authentication providers")
-
 	if len(configuredProviders) == 0 {
-		return fmt.Errorf("no authentication providers configured")
+		return errors.New("no authentication providers configured")
 	}
 
-	app.context.configuredProviders = configuredProviders
+	for _, provider := range app.runtime.ConfiguredProviders {
+		app.log.App.Debug().Str("provider", provider.Name).Msg("Configured authentication provider")
+	}
 
-	// Setup router
+	app.runtime.ConfiguredProviders = configuredProviders
-	router, err := app.setupRouter()
+
+	// setup router
+	err = app.setupRouter()
 
 	if err != nil {
 		return fmt.Errorf("failed to setup routes: %w", err)
 	}
 
-	// Start db cleanup routine
+	// start db cleanup routine
-	tlog.App.Debug().Msg("Starting database cleanup routine")
+	app.log.App.Debug().Msg("Starting database cleanup routine")
-	go app.dbCleanupRoutine(queries)
+	app.wg.Go(app.dbCleanupRoutine)
 
-	// If analytics are not disabled, start heartbeat
+	// if analytics are not disabled, start heartbeat
 	if app.config.Analytics.Enabled {
-		tlog.App.Debug().Msg("Starting heartbeat routine")
+		app.log.App.Debug().Msg("Starting heartbeat routine")
-		go app.heartbeatRoutine()
+		app.wg.Go(app.heartbeatRoutine)
 	}
 
-	// If we have an socket path, bind to it
+	// create err channel to listen for server errors
-	if app.config.Server.SocketPath != "" {
+	errChan := make(chan error, 1)
-		if _, err := os.Stat(app.config.Server.SocketPath); err == nil {
+
-			tlog.App.Info().Msgf("Removing existing socket file %s", app.config.Server.SocketPath)
+	// serve unix
-			err := os.Remove(app.config.Server.SocketPath)
+	app.wg.Go(func() {
+		if err := app.serveUnix(); err != nil {
+			errChan <- err
+		}
+	})
+
+	// serve to http
+	app.wg.Go(func() {
+		if err := app.serveHTTP(); err != nil {
+			errChan <- err
+		}
+	})
+
+	// monitor cancellation and server errors
+	for {
+		select {
+		case <-app.ctx.Done():
+			app.wg.Wait()
+			app.log.App.Debug().Msg("Closing database")
+			app.db.Close()
+			app.log.App.Info().Msg("Oh, it's time for me to go, bye!")
+			return nil
+		case err := <-errChan:
 			if err != nil {
-				return fmt.Errorf("failed to remove existing socket file: %w", err)
+				return fmt.Errorf("server error: %w", err)
 			}
 		}
+	}
+}
 
-		tlog.App.Info().Msgf("Starting server on unix socket %s", app.config.Server.SocketPath)
+func (app *BootstrapApp) serveHTTP() error {
-		if err := router.RunUnix(app.config.Server.SocketPath); err != nil {
+	address := fmt.Sprintf("%s:%d", app.config.Server.Address, app.config.Server.Port)
-			tlog.App.Fatal().Err(err).Msg("Failed to start server")
-		}
 
+	app.log.App.Info().Msgf("Starting server on %s", address)
+
+	server := &http.Server{
+		Addr:    address,
+		Handler: app.router.Handler(),
+	}
+
+	go func() {
+		<-app.ctx.Done()
+		app.log.App.Debug().Msg("Shutting down http listener")
+		server.Close()
+	}()
+
+	err := server.ListenAndServe()
+
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return fmt.Errorf("failed to start http listener: %w", err)
+	}
+
+	return nil
+}
+
+func (app *BootstrapApp) serveUnix() error {
+	if app.config.Server.SocketPath == "" {
 		return nil
 	}
 
-	// Start server
+	_, err := os.Stat(app.config.Server.SocketPath)
-	address := fmt.Sprintf("%s:%d", app.config.Server.Address, app.config.Server.Port)
+
-	tlog.App.Info().Msgf("Starting server on %s", address)
+	if err == nil {
-	if err := router.Run(address); err != nil {
+		app.log.App.Info().Msgf("Removing existing socket file %s", app.config.Server.SocketPath)
-		tlog.App.Fatal().Err(err).Msg("Failed to start server")
+		err := os.Remove(app.config.Server.SocketPath)
+
+		if err != nil {
+			return fmt.Errorf("failed to remove existing socket file: %w", err)
+		}
+	}
+
+	app.log.App.Info().Msgf("Starting server on unix socket %s", app.config.Server.SocketPath)
+
+	listener, err := net.Listen("unix", app.config.Server.SocketPath)
+
+	if err != nil {
+		return fmt.Errorf("failed to create unix socket listner: %w", err)
+	}
+
+	server := &http.Server{
+		Handler: app.router.Handler(),
+	}
+
+	defer server.Close()
+	defer listener.Close()
+	defer os.Remove(app.config.Server.SocketPath)
+
+	go func() {
+		<-app.ctx.Done()
+		app.log.App.Debug().Msg("Shutting down unix sokcet listener")
+		server.Close()
+		listener.Close()
+		os.Remove(app.config.Server.SocketPath)
+	}()
+
+	err = server.Serve(listener)
+
+	if err != nil && (!errors.Is(err, net.ErrClosed) || !errors.Is(err, http.ErrServerClosed)) {
+		return fmt.Errorf("failed to start unix socket listener: %w", err)
 	}
 
 	return nil
@@ -236,20 +349,20 @@ func (app *BootstrapApp) heartbeatRoutine() {
 	ticker := time.NewTicker(time.Duration(12) * time.Hour)
 	defer ticker.Stop()
 
-	type heartbeat struct {
+	type Heartbeat struct {
 		UUID    string `json:"uuid"`
 		Version string `json:"version"`
 	}
 
-	var body heartbeat
+	var body Heartbeat
 
-	body.UUID = app.context.uuid
+	body.UUID = app.runtime.UUID
-	body.Version = config.Version
+	body.Version = model.Version
 
 	bodyJson, err := json.Marshal(body)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to marshal heartbeat body")
+		app.log.App.Error().Err(err).Msg("Failed to marshal heartbeat body, heartbeat routine will not start")
 		return
 	}
 
@@ -257,45 +370,62 @@ func (app *BootstrapApp) heartbeatRoutine() {
 		Timeout: 30 * time.Second, // The server should never take more than 30 seconds to respond
 	}
 
-	heartbeatURL := config.ApiServer + "/v1/instances/heartbeat"
+	heartbeatURL := model.APIServer + "/v1/instances/heartbeat"
 
-	for range ticker.C {
+	for {
-		tlog.App.Debug().Msg("Sending heartbeat")
+		select {
+		case <-ticker.C:
+			app.log.App.Debug().Msg("Sending heartbeat")
 
-		req, err := http.NewRequest(http.MethodPost, heartbeatURL, bytes.NewReader(bodyJson))
+			req, err := http.NewRequest(http.MethodPost, heartbeatURL, bytes.NewReader(bodyJson))
 
-		if err != nil {
+			if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to create heartbeat request")
+				app.log.App.Error().Err(err).Msg("Failed to create heartbeat request")
-			continue
+				continue
-		}
+			}
 
-		req.Header.Add("Content-Type", "application/json")
+			req.Header.Add("Content-Type", "application/json")
 
-		res, err := client.Do(req)
+			res, err := client.Do(req)
 
-		if err != nil {
+			if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to send heartbeat")
+				app.log.App.Error().Err(err).Msg("Failed to send heartbeat")
-			continue
+				continue
-		}
+			}
 
-		res.Body.Close()
+			res.Body.Close()
 
-		if res.StatusCode != 200 && res.StatusCode != 201 {
+			if res.StatusCode != 200 && res.StatusCode != 201 {
-			tlog.App.Debug().Str("status", res.Status).Msg("Heartbeat returned non-200/201 status")
+				app.log.App.Debug().Str("status", res.Status).Msg("Heartbeat returned non-200/201 status")
+			}
+		case <-app.ctx.Done():
+			app.log.App.Debug().Msg("Stopping heartbeat routine")
+			ticker.Stop()
+			return
 		}
 	}
 }
 
-func (app *BootstrapApp) dbCleanupRoutine(queries *repository.Queries) {
+func (app *BootstrapApp) dbCleanupRoutine() {
 	ticker := time.NewTicker(time.Duration(30) * time.Minute)
 	defer ticker.Stop()
-	ctx := context.Background()
 
-	for range ticker.C {
+	for {
-		tlog.App.Debug().Msg("Cleaning up old database sessions")
+		select {
-		err := queries.DeleteExpiredSessions(ctx, time.Now().Unix())
+		case <-ticker.C:
-		if err != nil {
+			app.log.App.Debug().Msg("Running database cleanup")
-			tlog.App.Error().Err(err).Msg("Failed to clean up old database sessions")
+
+			err := app.queries.DeleteExpiredSessions(app.ctx, time.Now().Unix())
+
+			if err != nil {
+				app.log.App.Error().Err(err).Msg("Failed to delete expired sessions")
+			}
+
+			app.log.App.Debug().Msg("Database cleanup completed")
+		case <-app.ctx.Done():
+			app.log.App.Debug().Msg("Stopping database cleanup routine")
+			ticker.Stop()
+			return
 		}
 	}
 }

internal/bootstrap/db_bootstrap.go

@@ -14,17 +14,17 @@ import (
 	_ "modernc.org/sqlite"
 )
 
-func (app *BootstrapApp) SetupDatabase(databasePath string) (*sql.DB, error) {
+func (app *BootstrapApp) SetupDatabase() error {
-	dir := filepath.Dir(databasePath)
+	dir := filepath.Dir(app.config.Database.Path)
 
 	if err := os.MkdirAll(dir, 0750); err != nil {
-		return nil, fmt.Errorf("failed to create database directory %s: %w", dir, err)
+		return fmt.Errorf("failed to create database directory %s: %w", dir, err)
 	}
 
-	db, err := sql.Open("sqlite", databasePath)
+	db, err := sql.Open("sqlite", app.config.Database.Path)
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to open database: %w", err)
+		return fmt.Errorf("failed to open database: %w", err)
 	}
 
 	// Limit to 1 connection to sequence writes, this may need to be revisited in the future
@@ -34,24 +34,25 @@ func (app *BootstrapApp) SetupDatabase(databasePath string) (*sql.DB, error) {
 	migrations, err := iofs.New(assets.Migrations, "migrations")
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to create migrations: %w", err)
+		return fmt.Errorf("failed to create migrations: %w", err)
 	}
 
 	target, err := sqlite3.WithInstance(db, &sqlite3.Config{})
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to create sqlite3 instance: %w", err)
+		return fmt.Errorf("failed to create sqlite3 instance: %w", err)
 	}
 
 	migrator, err := migrate.NewWithInstance("iofs", migrations, "sqlite3", target)
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to create migrator: %w", err)
+		return fmt.Errorf("failed to create migrator: %w", err)
 	}
 
 	if err := migrator.Up(); err != nil && err != migrate.ErrNoChange {
-		return nil, fmt.Errorf("failed to migrate database: %w", err)
+		return fmt.Errorf("failed to migrate database: %w", err)
 	}
 
-	return db, nil
+	app.db = db
+	return nil
 }

internal/bootstrap/router_bootstrap.go

@@ -2,21 +2,16 @@ package bootstrap
 
 import (
 	"fmt"
-	"slices"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
 	"github.com/tinyauthapp/tinyauth/internal/middleware"
 
 	"github.com/gin-gonic/gin"
 )
 
-var DEV_MODES = []string{"main", "test", "development"}
+func (app *BootstrapApp) setupRouter() error {
-
+	// we don't want gin debug mode
-func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
+	gin.SetMode(gin.ReleaseMode)
-	if !slices.Contains(DEV_MODES, config.Version) {
-		gin.SetMode(gin.ReleaseMode)
-	}
 
 	engine := gin.New()
 	engine.Use(gin.Recovery())
@@ -25,18 +20,16 @@ func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
 		err := engine.SetTrustedProxies(app.config.Auth.TrustedProxies)
 
 		if err != nil {
-			return nil, fmt.Errorf("failed to set trusted proxies: %w", err)
+			return fmt.Errorf("failed to set trusted proxies: %w", err)
 		}
 	}
 
-	contextMiddleware := middleware.NewContextMiddleware(middleware.ContextMiddlewareConfig{
+	contextMiddleware := middleware.NewContextMiddleware(app.log, app.runtime, app.services.authService, app.services.oauthBrokerService)
-		CookieDomain: app.context.cookieDomain,
-	}, app.services.authService, app.services.oauthBrokerService)
 
 	err := contextMiddleware.Init()
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to initialize context middleware: %w", err)
+		return fmt.Errorf("failed to initialize context middleware: %w", err)
 	}
 
 	engine.Use(contextMiddleware.Middleware())
@@ -46,67 +39,44 @@ func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
 	err = uiMiddleware.Init()
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to initialize UI middleware: %w", err)
+		return fmt.Errorf("failed to initialize UI middleware: %w", err)
 	}
 
 	engine.Use(uiMiddleware.Middleware())
 
-	zerologMiddleware := middleware.NewZerologMiddleware()
+	zerologMiddleware := middleware.NewZerologMiddleware(app.log)
 
 	err = zerologMiddleware.Init()
 
 	if err != nil {
-		return nil, fmt.Errorf("failed to initialize zerolog middleware: %w", err)
+		return fmt.Errorf("failed to initialize zerolog middleware: %w", err)
 	}
 
 	engine.Use(zerologMiddleware.Middleware())
 
 	apiRouter := engine.Group("/api")
 
-	contextController := controller.NewContextController(controller.ContextControllerConfig{
+	contextController := controller.NewContextController(app.log, app.config, app.runtime, apiRouter)
-		Providers:             app.context.configuredProviders,
-		Title:                 app.config.UI.Title,
-		AppURL:                app.config.AppURL,
-		CookieDomain:          app.context.cookieDomain,
-		ForgotPasswordMessage: app.config.UI.ForgotPasswordMessage,
-		BackgroundImage:       app.config.UI.BackgroundImage,
-		OAuthAutoRedirect:     app.config.OAuth.AutoRedirect,
-		WarningsEnabled:       app.config.UI.WarningsEnabled,
-	}, apiRouter)
 
 	contextController.SetupRoutes()
 
-	oauthController := controller.NewOAuthController(controller.OAuthControllerConfig{
+	oauthController := controller.NewOAuthController(app.log, app.config, app.runtime, apiRouter, app.services.authService)
-		AppURL:                 app.config.AppURL,
-		SecureCookie:           app.config.Auth.SecureCookie,
-		CSRFCookieName:         app.context.csrfCookieName,
-		RedirectCookieName:     app.context.redirectCookieName,
-		CookieDomain:           app.context.cookieDomain,
-		OAuthSessionCookieName: app.context.oauthSessionCookieName,
-	}, apiRouter, app.services.authService)
 
 	oauthController.SetupRoutes()
 
-	oidcController := controller.NewOIDCController(controller.OIDCControllerConfig{}, app.services.oidcService, apiRouter)
+	oidcController := controller.NewOIDCController(app.log, app.services.oidcService, apiRouter)
 
 	oidcController.SetupRoutes()
 
-	proxyController := controller.NewProxyController(controller.ProxyControllerConfig{
+	proxyController := controller.NewProxyController(app.log, app.runtime, apiRouter, app.services.accessControlService, app.services.authService)
-		AppURL: app.config.AppURL,
-	}, apiRouter, app.services.accessControlService, app.services.authService)
 
 	proxyController.SetupRoutes()
 
-	userController := controller.NewUserController(controller.UserControllerConfig{
+	userController := controller.NewUserController(app.log, app.runtime, apiRouter, app.services.authService)
-		CookieDomain: app.context.cookieDomain,
-	}, apiRouter, app.services.authService)
 
 	userController.SetupRoutes()
 
-	resourcesController := controller.NewResourcesController(controller.ResourcesControllerConfig{
+	resourcesController := controller.NewResourcesController(app.config, &engine.RouterGroup)
-		Path:    app.config.Resources.Path,
-		Enabled: app.config.Resources.Enabled,
-	}, &engine.RouterGroup)
 
 	resourcesController.SetupRoutes()
 
@@ -114,9 +84,10 @@ func (app *BootstrapApp) setupRouter() (*gin.Engine, error) {
 
 	healthController.SetupRoutes()
 
-	wellknownController := controller.NewWellKnownController(controller.WellKnownControllerConfig{}, app.services.oidcService, engine)
+	wellknownController := controller.NewWellKnownController(app.services.oidcService, &engine.RouterGroup)
 
 	wellknownController.SetupRoutes()
 
-	return engine, nil
+	app.router = engine
+	return nil
 }

internal/bootstrap/service_bootstrap.go

@@ -1,110 +1,96 @@
 package bootstrap
 
 import (
-	"github.com/tinyauthapp/tinyauth/internal/repository"
+	"fmt"
+	"os"
+
 	"github.com/tinyauthapp/tinyauth/internal/service"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
 )
 
-type Services struct {
+func (app *BootstrapApp) setupServices() error {
-	accessControlService *service.AccessControlsService
+	ldapService := service.NewLdapService(app.log, app.config, app.ctx, &app.wg)
-	authService          *service.AuthService
-	dockerService        *service.DockerService
-	ldapService          *service.LdapService
-	oauthBrokerService   *service.OAuthBrokerService
-	oidcService          *service.OIDCService
-}
-
-func (app *BootstrapApp) initServices(queries *repository.Queries) (Services, error) {
-	services := Services{}
-
-	ldapService := service.NewLdapService(service.LdapServiceConfig{
-		Address:      app.config.Ldap.Address,
-		BindDN:       app.config.Ldap.BindDN,
-		BindPassword: app.config.Ldap.BindPassword,
-		BaseDN:       app.config.Ldap.BaseDN,
-		Insecure:     app.config.Ldap.Insecure,
-		SearchFilter: app.config.Ldap.SearchFilter,
-		AuthCert:     app.config.Ldap.AuthCert,
-		AuthKey:      app.config.Ldap.AuthKey,
-	})
 
 	err := ldapService.Init()
 
 	if err != nil {
-		tlog.App.Warn().Err(err).Msg("Failed to setup LDAP service, starting without it")
+		app.log.App.Warn().Err(err).Msg("Failed to initialize LDAP connection, will continue without it")
 		ldapService.Unconfigure()
 	}
 
-	services.ldapService = ldapService
+	app.services.ldapService = ldapService
 
-	dockerService := service.NewDockerService()
+	useKubernetes := app.config.LabelProvider == "kubernetes" ||
+		(app.config.LabelProvider == "auto" && os.Getenv("KUBERNETES_SERVICE_HOST") != "")
 
-	err = dockerService.Init()
+	var labelProvider service.LabelProviderImpl
 
-	if err != nil {
+	if useKubernetes {
-		return Services{}, err
+		app.log.App.Debug().Msg("Using Kubernetes label provider")
+
+		kubernetesService := service.NewKubernetesService(app.log, app.ctx, &app.wg)
+
+		err = kubernetesService.Init()
+
+		if err != nil {
+			return fmt.Errorf("failed to initialize kubernetes service: %w", err)
+		}
+
+		app.services.kubernetesService = kubernetesService
+		labelProvider = kubernetesService
+	} else {
+		app.log.App.Debug().Msg("Using Docker label provider")
+
+		dockerService := service.NewDockerService(app.log, app.ctx, &app.wg)
+
+		err = dockerService.Init()
+
+		if err != nil {
+			return fmt.Errorf("failed to initialize docker service: %w", err)
+		}
+
+		app.services.dockerService = dockerService
+		labelProvider = dockerService
 	}
 
-	services.dockerService = dockerService
+	accessControlsService := service.NewAccessControlsService(app.log, labelProvider, app.config.Apps)
-
-	accessControlsService := service.NewAccessControlsService(dockerService, app.config.Apps)
 
 	err = accessControlsService.Init()
 
 	if err != nil {
-		return Services{}, err
+		return fmt.Errorf("failed to initialize access controls service: %w", err)
 	}
 
-	services.accessControlService = accessControlsService
+	app.services.accessControlService = accessControlsService
 
-	oauthBrokerService := service.NewOAuthBrokerService(app.context.oauthProviders)
+	oauthBrokerService := service.NewOAuthBrokerService(app.log, app.runtime.OAuthProviders)
 
 	err = oauthBrokerService.Init()
 
 	if err != nil {
-		return Services{}, err
+		return fmt.Errorf("failed to initialize oauth broker service: %w", err)
 	}
 
-	services.oauthBrokerService = oauthBrokerService
+	app.services.oauthBrokerService = oauthBrokerService
 
-	authService := service.NewAuthService(service.AuthServiceConfig{
+	authService := service.NewAuthService(app.log, app.config, app.runtime, app.ctx, &app.wg, app.services.ldapService, app.queries, app.services.oauthBrokerService)
-		Users:              app.context.users,
-		OauthWhitelist:     app.config.OAuth.Whitelist,
-		SessionExpiry:      app.config.Auth.SessionExpiry,
-		SessionMaxLifetime: app.config.Auth.SessionMaxLifetime,
-		SecureCookie:       app.config.Auth.SecureCookie,
-		CookieDomain:       app.context.cookieDomain,
-		LoginTimeout:       app.config.Auth.LoginTimeout,
-		LoginMaxRetries:    app.config.Auth.LoginMaxRetries,
-		SessionCookieName:  app.context.sessionCookieName,
-		IP:                 app.config.Auth.IP,
-		LDAPGroupsCacheTTL: app.config.Ldap.GroupCacheTTL,
-	}, dockerService, services.ldapService, queries, services.oauthBrokerService)
 
 	err = authService.Init()
 
 	if err != nil {
-		return Services{}, err
+		return fmt.Errorf("failed to initialize auth service: %w", err)
 	}
 
-	services.authService = authService
+	app.services.authService = authService
 
-	oidcService := service.NewOIDCService(service.OIDCServiceConfig{
+	oidcService := service.NewOIDCService(app.log, app.config, app.runtime, app.queries, app.ctx, &app.wg)
-		Clients:        app.config.OIDC.Clients,
-		PrivateKeyPath: app.config.OIDC.PrivateKeyPath,
-		PublicKeyPath:  app.config.OIDC.PublicKeyPath,
-		Issuer:         app.config.AppURL,
-		SessionExpiry:  app.config.Auth.SessionExpiry,
-	}, queries)
 
 	err = oidcService.Init()
 
 	if err != nil {
-		return Services{}, err
+		return fmt.Errorf("failed to initialize oidc service: %w", err)
 	}
 
-	services.oidcService = oidcService
+	app.services.oidcService = oidcService
 
-	return services, nil
+	return nil
 }

internal/controller/context_controller.go

@@ -4,8 +4,8 @@ import (
 	"fmt"
 	"net/url"
 
-	"github.com/tinyauthapp/tinyauth/internal/utils"
+	"github.com/tinyauthapp/tinyauth/internal/model"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"github.com/gin-gonic/gin"
 )
@@ -19,53 +19,45 @@ type UserContextResponse struct {
 	Email       string `json:"email"`
 	Provider    string `json:"provider"`
 	OAuth       bool   `json:"oauth"`
-	TotpPending bool   `json:"totpPending"`
+	TOTPPending bool   `json:"totpPending"`
 	OAuthName   string `json:"oauthName"`
 }
 
 type AppContextResponse struct {
-	Status                int        `json:"status"`
+	Status                int              `json:"status"`
-	Message               string     `json:"message"`
+	Message               string           `json:"message"`
-	Providers             []Provider `json:"providers"`
+	Providers             []model.Provider `json:"providers"`
-	Title                 string     `json:"title"`
+	Title                 string           `json:"title"`
-	AppURL                string     `json:"appUrl"`
+	AppURL                string           `json:"appUrl"`
-	CookieDomain          string     `json:"cookieDomain"`
+	CookieDomain          string           `json:"cookieDomain"`
-	ForgotPasswordMessage string     `json:"forgotPasswordMessage"`
+	ForgotPasswordMessage string           `json:"forgotPasswordMessage"`
-	BackgroundImage       string     `json:"backgroundImage"`
+	BackgroundImage       string           `json:"backgroundImage"`
-	OAuthAutoRedirect     string     `json:"oauthAutoRedirect"`
+	OAuthAutoRedirect     string           `json:"oauthAutoRedirect"`
-	WarningsEnabled       bool       `json:"warningsEnabled"`
+	WarningsEnabled       bool             `json:"warningsEnabled"`
-}
-
-type Provider struct {
-	Name  string `json:"name"`
-	ID    string `json:"id"`
-	OAuth bool   `json:"oauth"`
-}
-
-type ContextControllerConfig struct {
-	Providers             []Provider
-	Title                 string
-	AppURL                string
-	CookieDomain          string
-	ForgotPasswordMessage string
-	BackgroundImage       string
-	OAuthAutoRedirect     string
-	WarningsEnabled       bool
 }
 
 type ContextController struct {
-	config ContextControllerConfig
+	log     *logger.Logger
-	router *gin.RouterGroup
+	config  model.Config
+	runtime model.RuntimeConfig
+	router  *gin.RouterGroup
 }
 
-func NewContextController(config ContextControllerConfig, router *gin.RouterGroup) *ContextController {
+func NewContextController(
-	if !config.WarningsEnabled {
+	log *logger.Logger,
-		tlog.App.Warn().Msg("UI warnings are disabled. This may expose users to security risks. Proceed with caution.")
+	config model.Config,
+	runtimeConfig model.RuntimeConfig,
+	router *gin.RouterGroup,
+) *ContextController {
+	if !config.UI.WarningsEnabled {
+		log.App.Warn().Msg("UI warnings are disabled. This may lead to security issues if you are not careful. Make sure to enable warnings in production environments.")
 	}
 
 	return &ContextController{
-		config: config,
+		log:     log,
-		router: router,
+		config:  config,
+		runtime: runtimeConfig,
+		router:  router,
 	}
 }
 
@@ -76,28 +68,29 @@ func (controller *ContextController) SetupRoutes() {
 }
 
 func (controller *ContextController) userContextHandler(c *gin.Context) {
-	context, err := utils.GetContext(c)
+	context, err := new(model.UserContext).NewFromGin(c)
+
+	if err != nil {
+		controller.log.App.Error().Err(err).Msg("Failed to create user context from request")
+		c.JSON(200, UserContextResponse{
+			Status:     401,
+			Message:    "Unauthorized",
+			IsLoggedIn: false,
+		})
+		return
+	}
 
 	userContext := UserContextResponse{
 		Status:      200,
 		Message:     "Success",
-		IsLoggedIn:  context.IsLoggedIn,
+		IsLoggedIn:  context.Authenticated,
-		Username:    context.Username,
+		Username:    context.GetUsername(),
-		Name:        context.Name,
+		Name:        context.GetName(),
-		Email:       context.Email,
+		Email:       context.GetEmail(),
-		Provider:    context.Provider,
+		Provider:    context.GetProviderID(),
-		OAuth:       context.OAuth,
+		OAuth:       context.IsOAuth(),
-		TotpPending: context.TotpPending,
+		TOTPPending: context.TOTPPending(),
-		OAuthName:   context.OAuthName,
+		OAuthName:   context.OAuthName(),
-	}
-
-	if err != nil {
-		tlog.App.Debug().Err(err).Msg("No user context found in request")
-		userContext.Status = 401
-		userContext.Message = "Unauthorized"
-		userContext.IsLoggedIn = false
-		c.JSON(200, userContext)
-		return
 	}
 
 	c.JSON(200, userContext)
@@ -105,8 +98,9 @@ func (controller *ContextController) userContextHandler(c *gin.Context) {
 
 func (controller *ContextController) appContextHandler(c *gin.Context) {
 	appUrl, err := url.Parse(controller.config.AppURL)
+
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to parse app URL")
+		controller.log.App.Error().Err(err).Msg("Failed to parse app URL")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -117,13 +111,13 @@ func (controller *ContextController) appContextHandler(c *gin.Context) {
 	c.JSON(200, AppContextResponse{
 		Status:                200,
 		Message:               "Success",
-		Providers:             controller.config.Providers,
+		Providers:             controller.runtime.ConfiguredProviders,
-		Title:                 controller.config.Title,
+		Title:                 controller.config.UI.Title,
 		AppURL:                fmt.Sprintf("%s://%s", appUrl.Scheme, appUrl.Host),
-		CookieDomain:          controller.config.CookieDomain,
+		CookieDomain:          controller.runtime.CookieDomain,
-		ForgotPasswordMessage: controller.config.ForgotPasswordMessage,
+		ForgotPasswordMessage: controller.config.UI.ForgotPasswordMessage,
-		BackgroundImage:       controller.config.BackgroundImage,
+		BackgroundImage:       controller.config.UI.BackgroundImage,
-		OAuthAutoRedirect:     controller.config.OAuthAutoRedirect,
+		OAuthAutoRedirect:     controller.config.OAuth.AutoRedirect,
-		WarningsEnabled:       controller.config.WarningsEnabled,
+		WarningsEnabled:       controller.config.UI.WarningsEnabled,
 	})
 }

internal/controller/context_controller_test.go

@@ -7,11 +7,11 @@ import (
 	"testing"
 
 	"github.com/gin-gonic/gin"
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/stretchr/testify/assert"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestContextController(t *testing.T) {
@@ -79,12 +79,16 @@ func TestContextController(t *testing.T) {
 			description: "Ensure user context returns when authorized",
 			middlewares: []gin.HandlerFunc{
 				func(c *gin.Context) {
-					c.Set("context", &config.UserContext{
+					c.Set("context", &model.UserContext{
-						Username:   "johndoe",
+						Authenticated: true,
-						Name:       "John Doe",
+						Provider:      model.ProviderLocal,
-						Email:      utils.CompileUserEmail("johndoe", controllerConfig.CookieDomain),
+						Local: &model.LocalContext{
-						Provider:   "local",
+							BaseContext: model.BaseContext{
-						IsLoggedIn: true,
+								Username: "johndoe",
+								Name:     "John Doe",
+								Email:    utils.CompileUserEmail("johndoe", controllerConfig.CookieDomain),
+							},
+						},
 					})
 				},
 			},

internal/controller/controller.go

@@ -0,0 +1,12 @@
+package controller
+
+type UnauthorizedQuery struct {
+	Username string `url:"username"`
+	Resource string `url:"resource"`
+	GroupErr bool   `url:"groupErr"`
+	IP       string `url:"ip"`
+}
+
+type RedirectQuery struct {
+	RedirectURI string `url:"redirect_uri"`
+}

internal/controller/oauth_controller.go

@@ -6,11 +6,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/go-querystring/query"
@@ -20,26 +20,27 @@ type OAuthRequest struct {
 	Provider string `uri:"provider" binding:"required"`
 }
 
-type OAuthControllerConfig struct {
-	CSRFCookieName         string
-	OAuthSessionCookieName string
-	RedirectCookieName     string
-	SecureCookie           bool
-	AppURL                 string
-	CookieDomain           string
-}
-
 type OAuthController struct {
-	config OAuthControllerConfig
+	log     *logger.Logger
-	router *gin.RouterGroup
+	config  model.Config
-	auth   *service.AuthService
+	runtime model.RuntimeConfig
+	router  *gin.RouterGroup
+	auth    *service.AuthService
 }
 
-func NewOAuthController(config OAuthControllerConfig, router *gin.RouterGroup, auth *service.AuthService) *OAuthController {
+func NewOAuthController(
+	log *logger.Logger,
+	config model.Config,
+	runtimeConfig model.RuntimeConfig,
+	router *gin.RouterGroup,
+	auth *service.AuthService,
+) *OAuthController {
 	return &OAuthController{
-		config: config,
+		log:     log,
-		router: router,
+		config:  config,
-		auth:   auth,
+		runtime: runtimeConfig,
+		router:  router,
+		auth:    auth,
 	}
 }
 
@@ -54,7 +55,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 
 	err := c.BindUri(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind URI")
+		controller.log.App.Error().Err(err).Msg("Failed to bind URI")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -67,7 +68,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	err = c.BindQuery(&reqParams)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind query parameters")
+		controller.log.App.Error().Err(err).Msg("Failed to bind query parameters")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -76,10 +77,10 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	}
 
 	if !controller.isOidcRequest(reqParams) {
-		isRedirectSafe := utils.IsRedirectSafe(reqParams.RedirectURI, controller.config.CookieDomain)
+		isRedirectSafe := utils.IsRedirectSafe(reqParams.RedirectURI, controller.runtime.CookieDomain)
 
 		if !isRedirectSafe {
-			tlog.App.Warn().Str("redirect_uri", reqParams.RedirectURI).Msg("Unsafe redirect URI detected, ignoring")
+			controller.log.App.Warn().Str("redirectUri", reqParams.RedirectURI).Msg("Unsafe redirect URI, ignoring")
 			reqParams.RedirectURI = ""
 		}
 	}
@@ -87,7 +88,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	sessionId, _, err := controller.auth.NewOAuthSession(req.Provider, reqParams)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to create OAuth session")
+		controller.log.App.Error().Err(err).Msg("Failed to create new OAuth session")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -98,7 +99,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 	authUrl, err := controller.auth.GetOAuthURL(sessionId)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get OAuth URL")
+		controller.log.App.Error().Err(err).Msg("Failed to get OAuth URL for session")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -106,7 +107,7 @@ func (controller *OAuthController) oauthURLHandler(c *gin.Context) {
 		return
 	}
 
-	c.SetCookie(controller.config.OAuthSessionCookieName, sessionId, int(time.Hour.Seconds()), "/", fmt.Sprintf(".%s", controller.config.CookieDomain), controller.config.SecureCookie, true)
+	c.SetCookie(controller.runtime.OAuthSessionCookieName, sessionId, int(time.Hour.Seconds()), "/", controller.getCookieDomain(), controller.config.Auth.SecureCookie, true)
 
 	c.JSON(200, gin.H{
 		"status":  200,
@@ -120,7 +121,7 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 
 	err := c.BindUri(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind URI")
+		controller.log.App.Error().Err(err).Msg("Failed to bind URI")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -128,20 +129,20 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 		return
 	}
 
-	sessionIdCookie, err := c.Cookie(controller.config.OAuthSessionCookieName)
+	sessionIdCookie, err := c.Cookie(controller.runtime.OAuthSessionCookieName)
 
 	if err != nil {
-		tlog.App.Warn().Err(err).Msg("OAuth session cookie missing")
+		controller.log.App.Error().Err(err).Msg("Failed to get OAuth session cookie")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
 
-	c.SetCookie(controller.config.OAuthSessionCookieName, "", -1, "/", fmt.Sprintf(".%s", controller.config.CookieDomain), controller.config.SecureCookie, true)
+	c.SetCookie(controller.runtime.OAuthSessionCookieName, "", -1, "/", controller.getCookieDomain(), controller.config.Auth.SecureCookie, true)
 
 	oauthPendingSession, err := controller.auth.GetOAuthPendingSession(sessionIdCookie)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get OAuth pending session")
+		controller.log.App.Error().Err(err).Msg("Failed to get pending OAuth session")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
@@ -150,7 +151,7 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 
 	state := c.Query("state")
 	if state != oauthPendingSession.State {
-		tlog.App.Warn().Err(err).Msg("CSRF token mismatch")
+		controller.log.App.Warn().Msg("OAuth state mismatch")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
@@ -159,7 +160,7 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 	_, err = controller.auth.GetOAuthToken(sessionIdCookie, code)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to exchange code for token")
+		controller.log.App.Error().Err(err).Msg("Failed to exchange code for token")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
@@ -167,21 +168,21 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 	user, err := controller.auth.GetOAuthUserinfo(sessionIdCookie)
 
 	if user.Email == "" {
-		tlog.App.Error().Msg("OAuth provider did not return an email")
+		controller.log.App.Warn().Msg("OAuth provider did not return an email")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
 
 	if !controller.auth.IsEmailWhitelisted(user.Email) {
-		tlog.App.Warn().Str("email", user.Email).Msg("Email not whitelisted")
+		controller.log.App.Warn().Str("email", user.Email).Msg("Email not whitelisted, denying access")
-		tlog.AuditLoginFailure(c, user.Email, req.Provider, "email not whitelisted")
+		controller.log.AuditLoginFailure(user.Email, req.Provider, c.ClientIP(), "email not whitelisted")
 
-		queries, err := query.Values(config.UnauthorizedQuery{
+		queries, err := query.Values(UnauthorizedQuery{
 			Username: user.Email,
 		})
 
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to encode unauthorized query")
+			controller.log.App.Error().Err(err).Msg("Failed to encode unauthorized query")
 			c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 			return
 		}
@@ -193,33 +194,33 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 	var name string
 
 	if strings.TrimSpace(user.Name) != "" {
-		tlog.App.Debug().Msg("Using name from OAuth provider")
+		controller.log.App.Debug().Msg("Using name from OAuth provider")
 		name = user.Name
 	} else {
-		tlog.App.Debug().Msg("No name from OAuth provider, using pseudo name")
+		controller.log.App.Debug().Msg("No name from OAuth provider, generating from email")
 		name = fmt.Sprintf("%s (%s)", utils.Capitalize(strings.Split(user.Email, "@")[0]), strings.Split(user.Email, "@")[1])
 	}
 
 	var username string
 
 	if strings.TrimSpace(user.PreferredUsername) != "" {
-		tlog.App.Debug().Msg("Using preferred username from OAuth provider")
+		controller.log.App.Debug().Msg("Using preferred username from OAuth provider")
 		username = user.PreferredUsername
 	} else {
-		tlog.App.Debug().Msg("No preferred username from OAuth provider, using pseudo username")
+		controller.log.App.Debug().Msg("No preferred username from OAuth provider, generating from email")
 		username = strings.Replace(user.Email, "@", "_", 1)
 	}
 
 	svc, err := controller.auth.GetOAuthService(sessionIdCookie)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get OAuth service for session")
+		controller.log.App.Error().Err(err).Msg("Failed to get OAuth service for session")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
 
 	if svc.ID() != req.Provider {
-		tlog.App.Error().Msgf("OAuth service ID mismatch: expected %s, got %s", svc.ID(), req.Provider)
+		controller.log.App.Warn().Msgf("OAuth provider mismatch: expected %s, got %s", req.Provider, svc.ID())
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
@@ -234,23 +235,25 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 		OAuthSub:    user.Sub,
 	}
 
-	tlog.App.Trace().Interface("session_cookie", sessionCookie).Msg("Creating session cookie")
+	controller.log.App.Debug().Msg("Creating session cookie for user")
 
-	err = controller.auth.CreateSessionCookie(c, &sessionCookie)
+	cookie, err := controller.auth.CreateSession(c, sessionCookie)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to create session cookie")
+		controller.log.App.Error().Err(err).Msg("Failed to create session cookie")
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 		return
 	}
 
-	tlog.AuditLoginSuccess(c, sessionCookie.Username, sessionCookie.Provider)
+	http.SetCookie(c.Writer, cookie)
+
+	controller.log.AuditLoginSuccess(sessionCookie.Username, sessionCookie.Provider, c.ClientIP())
 
 	if controller.isOidcRequest(oauthPendingSession.CallbackParams) {
-		tlog.App.Debug().Msg("OIDC request, redirecting to authorize page")
+		controller.log.App.Debug().Msg("OIDC request detected, redirecting to authorization endpoint with callback params")
 		queries, err := query.Values(oauthPendingSession.CallbackParams)
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to encode OIDC callback query")
+			controller.log.App.Error().Err(err).Msg("Failed to encode OIDC callback query")
 			c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 			return
 		}
@@ -259,12 +262,12 @@ func (controller *OAuthController) oauthCallbackHandler(c *gin.Context) {
 	}
 
 	if oauthPendingSession.CallbackParams.RedirectURI != "" {
-		queries, err := query.Values(config.RedirectQuery{
+		queries, err := query.Values(RedirectQuery{
 			RedirectURI: oauthPendingSession.CallbackParams.RedirectURI,
 		})
 
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to encode redirect URI query")
+			controller.log.App.Error().Err(err).Msg("Failed to encode redirect query")
 			c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/error", controller.config.AppURL))
 			return
 		}
@@ -282,3 +285,10 @@ func (controller *OAuthController) isOidcRequest(params service.OAuthURLParams)
 		params.ClientID != "" &&
 		params.RedirectURI != ""
 }
+
+func (controller *OAuthController) getCookieDomain() string {
+	if controller.config.Auth.SubdomainsEnabled {
+		return "." + controller.runtime.CookieDomain
+	}
+	return controller.runtime.CookieDomain
+}

internal/controller/oidc_controller.go

@@ -10,15 +10,14 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/google/go-querystring/query"
 
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
-type OIDCControllerConfig struct{}
-
 type OIDCController struct {
-	config OIDCControllerConfig
+	log    *logger.Logger
 	router *gin.RouterGroup
 	oidc   *service.OIDCService
 }
@@ -57,9 +56,12 @@ type ClientCredentials struct {
 	ClientSecret string
 }
 
-func NewOIDCController(config OIDCControllerConfig, oidcService *service.OIDCService, router *gin.RouterGroup) *OIDCController {
+func NewOIDCController(
+	log *logger.Logger,
+	oidcService *service.OIDCService,
+	router *gin.RouterGroup) *OIDCController {
 	return &OIDCController{
-		config: config,
+		log:    log,
 		oidc:   oidcService,
 		router: router,
 	}
@@ -79,7 +81,7 @@ func (controller *OIDCController) GetClientInfo(c *gin.Context) {
 
 	err := c.BindUri(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind URI")
+		controller.log.App.Error().Err(err).Msg("Failed to bind URI")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -90,7 +92,7 @@ func (controller *OIDCController) GetClientInfo(c *gin.Context) {
 	client, ok := controller.oidc.GetClient(req.ClientID)
 
 	if !ok {
-		tlog.App.Warn().Str("client_id", req.ClientID).Msg("Client not found")
+		controller.log.App.Warn().Str("clientId", req.ClientID).Msg("Client not found")
 		c.JSON(404, gin.H{
 			"status":  404,
 			"message": "Client not found",
@@ -111,14 +113,14 @@ func (controller *OIDCController) Authorize(c *gin.Context) {
 		return
 	}
 
-	userContext, err := utils.GetContext(c)
+	userContext, err := new(model.UserContext).NewFromGin(c)
 
 	if err != nil {
 		controller.authorizeError(c, err, "Failed to get user context", "User is not logged in or the session is invalid", "", "", "")
 		return
 	}
 
-	if !userContext.IsLoggedIn {
+	if !userContext.Authenticated {
 		controller.authorizeError(c, errors.New("err user not logged in"), "User not logged in", "The user is not logged in", "", "", "")
 		return
 	}
@@ -141,7 +143,7 @@ func (controller *OIDCController) Authorize(c *gin.Context) {
 	err = controller.oidc.ValidateAuthorizeParams(req)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to validate authorize params")
+		controller.log.App.Warn().Err(err).Msg("Failed to validate authorize params")
 		if err.Error() != "invalid_request_uri" {
 			controller.authorizeError(c, err, "Failed validate authorize params", "Invalid request parameters", req.RedirectURI, err.Error(), req.State)
 			return
@@ -151,7 +153,7 @@ func (controller *OIDCController) Authorize(c *gin.Context) {
 	}
 
 	// WARNING: Since Tinyauth is stateless, we cannot have a sub that never changes. We will just create a uuid out of the username and client name which remains stable, but if username or client name changes then sub changes too.
-	sub := utils.GenerateUUID(fmt.Sprintf("%s:%s", userContext.Username, client.ID))
+	sub := utils.GenerateUUID(fmt.Sprintf("%s:%s", userContext.GetUsername(), client.ID))
 	code := utils.GenerateString(32)
 
 	// Before storing the code, delete old session
@@ -170,10 +172,10 @@ func (controller *OIDCController) Authorize(c *gin.Context) {
 
 	// We also need a snapshot of the user that authorized this (skip if no openid scope)
 	if slices.Contains(strings.Fields(req.Scope), "openid") {
-		err = controller.oidc.StoreUserinfo(c, sub, userContext, req)
+		err = controller.oidc.StoreUserinfo(c, sub, *userContext, req)
 
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to insert user info into database")
+			controller.log.App.Error().Err(err).Msg("Failed to store user info")
 			controller.authorizeError(c, err, "Failed to store user info", "Failed to store user info", req.RedirectURI, "server_error", req.State)
 			return
 		}
@@ -197,7 +199,7 @@ func (controller *OIDCController) Authorize(c *gin.Context) {
 
 func (controller *OIDCController) Token(c *gin.Context) {
 	if !controller.oidc.IsConfigured() {
-		tlog.App.Warn().Msg("OIDC not configured")
+		controller.log.App.Warn().Msg("Received OIDC request but OIDC server is not configured")
 		c.JSON(404, gin.H{
 			"error": "not_found",
 		})
@@ -208,7 +210,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 
 	err := c.Bind(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind token request")
+		controller.log.App.Warn().Err(err).Msg("Failed to bind token request")
 		c.JSON(400, gin.H{
 			"error": "invalid_request",
 		})
@@ -217,7 +219,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 
 	err = controller.oidc.ValidateGrantType(req.GrantType)
 	if err != nil {
-		tlog.App.Warn().Str("grant_type", req.GrantType).Msg("Unsupported grant type")
+		controller.log.App.Warn().Err(err).Msg("Invalid grant type")
 		c.JSON(400, gin.H{
 			"error": err.Error(),
 		})
@@ -232,12 +234,12 @@ func (controller *OIDCController) Token(c *gin.Context) {
 
 	// If it fails, we try basic auth
 	if creds.ClientID == "" || creds.ClientSecret == "" {
-		tlog.App.Debug().Msg("Tried form values and they are empty, trying basic auth")
+		controller.log.App.Debug().Msg("Client credentials not found in form, trying basic auth")
 
 		clientId, clientSecret, ok := c.Request.BasicAuth()
 
 		if !ok {
-			tlog.App.Error().Msg("Missing authorization header")
+			controller.log.App.Warn().Msg("Client credentials not found in basic auth")
 			c.Header("www-authenticate", `Basic realm="Tinyauth OIDC Token Endpoint"`)
 			c.JSON(400, gin.H{
 				"error": "invalid_client",
@@ -254,7 +256,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 	client, ok := controller.oidc.GetClient(creds.ClientID)
 
 	if !ok {
-		tlog.App.Warn().Str("client_id", creds.ClientID).Msg("Client not found")
+		controller.log.App.Warn().Str("clientId", creds.ClientID).Msg("Client not found")
 		c.JSON(400, gin.H{
 			"error": "invalid_client",
 		})
@@ -262,7 +264,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 	}
 
 	if client.ClientSecret != creds.ClientSecret {
-		tlog.App.Warn().Str("client_id", creds.ClientID).Msg("Invalid client secret")
+		controller.log.App.Warn().Str("clientId", creds.ClientID).Msg("Invalid client secret")
 		c.JSON(400, gin.H{
 			"error": "invalid_client",
 		})
@@ -276,30 +278,30 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		entry, err := controller.oidc.GetCodeEntry(c, controller.oidc.Hash(req.Code), client.ClientID)
 		if err != nil {
 			if err := controller.oidc.DeleteTokenByCodeHash(c, controller.oidc.Hash(req.Code)); err != nil {
-				tlog.App.Error().Err(err).Msg("Failed to delete access token by code hash")
+				controller.log.App.Error().Err(err).Msg("Failed to delete code")
 			}
 			if errors.Is(err, service.ErrCodeNotFound) {
-				tlog.App.Warn().Msg("Code not found")
+				controller.log.App.Warn().Msg("Code not found")
 				c.JSON(400, gin.H{
 					"error": "invalid_grant",
 				})
 				return
 			}
 			if errors.Is(err, service.ErrCodeExpired) {
-				tlog.App.Warn().Msg("Code expired")
+				controller.log.App.Warn().Msg("Code expired")
 				c.JSON(400, gin.H{
 					"error": "invalid_grant",
 				})
 				return
 			}
 			if errors.Is(err, service.ErrInvalidClient) {
-				tlog.App.Warn().Msg("Invalid client ID")
+				controller.log.App.Warn().Msg("Code does not belong to client")
 				c.JSON(400, gin.H{
 					"error": "invalid_client",
 				})
 				return
 			}
-			tlog.App.Warn().Err(err).Msg("Failed to get OIDC code entry")
+			controller.log.App.Error().Err(err).Msg("Failed to get code entry")
 			c.JSON(400, gin.H{
 				"error": "server_error",
 			})
@@ -307,7 +309,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		}
 
 		if entry.RedirectURI != req.RedirectURI {
-			tlog.App.Warn().Str("redirect_uri", req.RedirectURI).Msg("Redirect URI mismatch")
+			controller.log.App.Warn().Msg("Redirect URI does not match")
 			c.JSON(400, gin.H{
 				"error": "invalid_grant",
 			})
@@ -317,7 +319,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		ok := controller.oidc.ValidatePKCE(entry.CodeChallenge, req.CodeVerifier)
 
 		if !ok {
-			tlog.App.Warn().Msg("PKCE validation failed")
+			controller.log.App.Warn().Msg("PKCE validation failed")
 			c.JSON(400, gin.H{
 				"error": "invalid_grant",
 			})
@@ -327,7 +329,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 		tokenRes, err := controller.oidc.GenerateAccessToken(c, client, entry)
 
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to generate access token")
+			controller.log.App.Error().Err(err).Msg("Failed to generate access token")
 			c.JSON(400, gin.H{
 				"error": "server_error",
 			})
@@ -340,7 +342,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 
 		if err != nil {
 			if errors.Is(err, service.ErrTokenExpired) {
-				tlog.App.Error().Err(err).Msg("Refresh token expired")
+				controller.log.App.Warn().Msg("Refresh token expired")
 				c.JSON(400, gin.H{
 					"error": "invalid_grant",
 				})
@@ -348,14 +350,14 @@ func (controller *OIDCController) Token(c *gin.Context) {
 			}
 
 			if errors.Is(err, service.ErrInvalidClient) {
-				tlog.App.Error().Err(err).Msg("Invalid client")
+				controller.log.App.Warn().Msg("Refresh token does not belong to client")
 				c.JSON(400, gin.H{
 					"error": "invalid_grant",
 				})
 				return
 			}
 
-			tlog.App.Error().Err(err).Msg("Failed to refresh access token")
+			controller.log.App.Error().Err(err).Msg("Failed to refresh access token")
 			c.JSON(400, gin.H{
 				"error": "server_error",
 			})
@@ -373,7 +375,7 @@ func (controller *OIDCController) Token(c *gin.Context) {
 
 func (controller *OIDCController) Userinfo(c *gin.Context) {
 	if !controller.oidc.IsConfigured() {
-		tlog.App.Warn().Msg("OIDC not configured")
+		controller.log.App.Warn().Msg("Received OIDC userinfo request but OIDC server is not configured")
 		c.JSON(404, gin.H{
 			"error": "not_found",
 		})
@@ -386,7 +388,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 	if authorization != "" {
 		tokenType, bearerToken, ok := strings.Cut(authorization, " ")
 		if !ok {
-			tlog.App.Warn().Msg("OIDC userinfo accessed with malformed authorization header")
+			controller.log.App.Warn().Msg("OIDC userinfo accessed with invalid authorization header")
 			c.JSON(401, gin.H{
 				"error": "invalid_request",
 			})
@@ -394,7 +396,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 		}
 
 		if strings.ToLower(tokenType) != "bearer" {
-			tlog.App.Warn().Msg("OIDC userinfo accessed with invalid token type")
+			controller.log.App.Warn().Msg("OIDC userinfo accessed with non-bearer token")
 			c.JSON(401, gin.H{
 				"error": "invalid_request",
 			})
@@ -404,7 +406,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 		token = bearerToken
 	} else if c.Request.Method == http.MethodPost {
 		if c.ContentType() != "application/x-www-form-urlencoded" {
-			tlog.App.Warn().Msg("OIDC userinfo POST accessed with invalid content type")
+			controller.log.App.Warn().Msg("OIDC userinfo POST accessed with invalid content type")
 			c.JSON(400, gin.H{
 				"error": "invalid_request",
 			})
@@ -412,14 +414,14 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 		}
 		token = c.PostForm("access_token")
 		if token == "" {
-			tlog.App.Warn().Msg("OIDC userinfo POST accessed without access_token in body")
+			controller.log.App.Warn().Msg("OIDC userinfo POST accessed without access_token")
 			c.JSON(401, gin.H{
 				"error": "invalid_request",
 			})
 			return
 		}
 	} else {
-		tlog.App.Warn().Msg("OIDC userinfo accessed without authorization header")
+		controller.log.App.Warn().Msg("OIDC userinfo accessed without authorization header or POST body")
 		c.JSON(401, gin.H{
 			"error": "invalid_request",
 		})
@@ -429,15 +431,15 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 	entry, err := controller.oidc.GetAccessToken(c, controller.oidc.Hash(token))
 
 	if err != nil {
-		if err == service.ErrTokenNotFound {
+		if errors.Is(err, service.ErrTokenNotFound) {
-			tlog.App.Warn().Msg("OIDC userinfo accessed with invalid token")
+			controller.log.App.Warn().Msg("OIDC userinfo accessed with invalid token")
 			c.JSON(401, gin.H{
 				"error": "invalid_grant",
 			})
 			return
 		}
 
-		tlog.App.Err(err).Msg("Failed to get token entry")
+		controller.log.App.Error().Err(err).Msg("Failed to get access token")
 		c.JSON(401, gin.H{
 			"error": "server_error",
 		})
@@ -446,7 +448,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 
 	// If we don't have the openid scope, return an error
 	if !slices.Contains(strings.Split(entry.Scope, ","), "openid") {
-		tlog.App.Warn().Msg("OIDC userinfo accessed without openid scope")
+		controller.log.App.Warn().Msg("OIDC userinfo accessed with token missing openid scope")
 		c.JSON(401, gin.H{
 			"error": "invalid_scope",
 		})
@@ -456,7 +458,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 	user, err := controller.oidc.GetUserinfo(c, entry.Sub)
 
 	if err != nil {
-		tlog.App.Err(err).Msg("Failed to get user entry")
+		controller.log.App.Error().Err(err).Msg("Failed to get user info")
 		c.JSON(401, gin.H{
 			"error": "server_error",
 		})
@@ -467,7 +469,7 @@ func (controller *OIDCController) Userinfo(c *gin.Context) {
 }
 
 func (controller *OIDCController) authorizeError(c *gin.Context, err error, reason string, reasonUser string, callback string, callbackError string, state string) {
-	tlog.App.Error().Err(err).Msg(reason)
+	controller.log.App.Warn().Err(err).Str("reason", reason).Msg("Authorization error")
 
 	if callback != "" {
 		errorQueries := CallbackError{

internal/controller/oidc_controller_test.go

@@ -12,14 +12,14 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/go-querystring/query"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
-	"github.com/tinyauthapp/tinyauth/internal/config"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestOIDCController(t *testing.T) {
@@ -27,7 +27,7 @@ func TestOIDCController(t *testing.T) {
 	tempDir := t.TempDir()
 
 	oidcServiceCfg := service.OIDCServiceConfig{
-		Clients: map[string]config.OIDCClientConfig{
+		Clients: map[string]model.OIDCClientConfig{
 			"test": {
 				ClientID:            "some-client-id",
 				ClientSecret:        "some-client-secret",
@@ -44,12 +44,16 @@ func TestOIDCController(t *testing.T) {
 	controllerCfg := controller.OIDCControllerConfig{}
 
 	simpleCtx := func(c *gin.Context) {
-		c.Set("context", &config.UserContext{
+		c.Set("context", &model.UserContext{
-			Username:   "test",
+			Authenticated: true,
-			Name:       "Test User",
+			Provider:      model.ProviderLocal,
-			Email:      "test@example.com",
+			Local: &model.LocalContext{
-			IsLoggedIn: true,
+				BaseContext: model.BaseContext{
-			Provider:   "local",
+					Username: "test",
+					Name:     "Test User",
+					Email:    "test@example.com",
+				},
+			},
 		})
 		c.Next()
 	}
@@ -848,7 +852,7 @@ func TestOIDCController(t *testing.T) {
 		},
 	}
 
-	app := bootstrap.NewBootstrapApp(config.Config{})
+	app := bootstrap.NewBootstrapApp(model.Config{})
 
 	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
 	require.NoError(t, err)

internal/controller/proxy_controller.go

@@ -8,10 +8,10 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/go-querystring/query"
@@ -50,23 +50,27 @@ type ProxyContext struct {
 	ProxyType ProxyType
 }
 
-type ProxyControllerConfig struct {
-	AppURL string
-}
-
 type ProxyController struct {
-	config ProxyControllerConfig
+	log     *logger.Logger
-	router *gin.RouterGroup
+	runtime model.RuntimeConfig
-	acls   *service.AccessControlsService
+	router  *gin.RouterGroup
-	auth   *service.AuthService
+	acls    *service.AccessControlsService
+	auth    *service.AuthService
 }
 
-func NewProxyController(config ProxyControllerConfig, router *gin.RouterGroup, acls *service.AccessControlsService, auth *service.AuthService) *ProxyController {
+func NewProxyController(
+	log *logger.Logger,
+	runtime model.RuntimeConfig,
+	router *gin.RouterGroup,
+	acls *service.AccessControlsService,
+	auth *service.AuthService,
+) *ProxyController {
 	return &ProxyController{
-		config: config,
+		log:     log,
-		router: router,
+		runtime: runtime,
-		acls:   acls,
+		router:  router,
-		auth:   auth,
+		acls:    acls,
+		auth:    auth,
 	}
 }
 
@@ -80,7 +84,7 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 	proxyCtx, err := controller.getProxyContext(c)
 
 	if err != nil {
-		tlog.App.Warn().Err(err).Msg("Failed to get proxy context")
+		controller.log.App.Error().Err(err).Msg("Failed to get proxy context from request")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad request",
@@ -88,22 +92,18 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		return
 	}
 
-	tlog.App.Trace().Interface("ctx", proxyCtx).Msg("Got proxy context")
-
 	// Get acls
 	acls, err := controller.acls.GetAccessControls(proxyCtx.Host)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get access controls for resource")
+		controller.log.App.Error().Err(err).Msg("Failed to get ACLs for resource")
 		controller.handleError(c, proxyCtx)
 		return
 	}
 
-	tlog.App.Trace().Interface("acls", acls).Msg("ACLs for resource")
-
 	clientIP := c.ClientIP()
 
-	if controller.auth.IsBypassedIP(acls.IP, clientIP) {
+	if controller.auth.IsBypassedIP(clientIP, acls) {
 		controller.setHeaders(c, acls)
 		c.JSON(200, gin.H{
 			"status":  200,
@@ -112,16 +112,16 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		return
 	}
 
-	authEnabled, err := controller.auth.IsAuthEnabled(proxyCtx.Path, acls.Path)
+	authEnabled, err := controller.auth.IsAuthEnabled(proxyCtx.Path, acls)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to check if auth is enabled for resource")
+		controller.log.App.Error().Err(err).Msg("Failed to determine if authentication is enabled for resource")
 		controller.handleError(c, proxyCtx)
 		return
 	}
 
 	if !authEnabled {
-		tlog.App.Debug().Msg("Authentication disabled for resource, allowing access")
+		controller.log.App.Debug().Msg("Authentication is disabled for this resource, allowing access without authentication")
 		controller.setHeaders(c, acls)
 		c.JSON(200, gin.H{
 			"status":  200,
@@ -130,19 +130,19 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		return
 	}
 
-	if !controller.auth.CheckIP(acls.IP, clientIP) {
+	if !controller.auth.CheckIP(clientIP, acls) {
-		queries, err := query.Values(config.UnauthorizedQuery{
+		queries, err := query.Values(UnauthorizedQuery{
 			Resource: strings.Split(proxyCtx.Host, ".")[0],
 			IP:       clientIP,
 		})
 
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to encode unauthorized query")
+			controller.log.App.Error().Err(err).Msg("Failed to encode unauthorized query")
 			controller.handleError(c, proxyCtx)
 			return
 		}
 
-		redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.config.AppURL, queries.Encode())
+		redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.runtime.AppURL, queries.Encode())
 
 		if !controller.useBrowserResponse(proxyCtx) {
 			c.Header("x-tinyauth-location", redirectURL)
@@ -157,44 +157,38 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		return
 	}
 
-	var userContext config.UserContext
+	userContext, err := new(model.UserContext).NewFromGin(c)
-
-	context, err := utils.GetContext(c)
 
 	if err != nil {
-		tlog.App.Debug().Msg("No user context found in request, treating as not logged in")
+		controller.log.App.Error().Err(err).Msg("Failed to create user context from request, treating as unauthenticated")
-		userContext = config.UserContext{
+		userContext = &model.UserContext{
-			IsLoggedIn: false,
+			Authenticated: false,
 		}
-	} else {
-		userContext = context
 	}
 
-	tlog.App.Trace().Interface("context", userContext).Msg("User context from request")
+	if userContext.Authenticated {
-
+		userAllowed := controller.auth.IsUserAllowed(c, *userContext, acls)
-	if userContext.IsLoggedIn {
-		userAllowed := controller.auth.IsUserAllowed(c, userContext, acls)
 
 		if !userAllowed {
-			tlog.App.Warn().Str("user", userContext.Username).Str("resource", strings.Split(proxyCtx.Host, ".")[0]).Msg("User not allowed to access resource")
+			controller.log.App.Warn().Str("user", userContext.GetUsername()).Str("resource", strings.Split(proxyCtx.Host, ".")[0]).Msg("User is not allowed to access resource")
 
-			queries, err := query.Values(config.UnauthorizedQuery{
+			queries, err := query.Values(UnauthorizedQuery{
 				Resource: strings.Split(proxyCtx.Host, ".")[0],
 			})
 
 			if err != nil {
-				tlog.App.Error().Err(err).Msg("Failed to encode unauthorized query")
+				controller.log.App.Error().Err(err).Msg("Failed to encode unauthorized query")
 				controller.handleError(c, proxyCtx)
 				return
 			}
 
-			if userContext.OAuth {
+			if userContext.IsOAuth() {
-				queries.Set("username", userContext.Email)
+				queries.Set("username", userContext.GetEmail())
 			} else {
-				queries.Set("username", userContext.Username)
+				queries.Set("username", userContext.GetUsername())
 			}
 
-			redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.config.AppURL, queries.Encode())
+			redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.runtime.AppURL, queries.Encode())
 
 			if !controller.useBrowserResponse(proxyCtx) {
 				c.Header("x-tinyauth-location", redirectURL)
@@ -209,36 +203,36 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 			return
 		}
 
-		if userContext.OAuth || userContext.Provider == "ldap" {
+		if userContext.IsOAuth() || userContext.IsLDAP() {
 			var groupOK bool
 
-			if userContext.OAuth {
+			if userContext.IsOAuth() {
-				groupOK = controller.auth.IsInOAuthGroup(c, userContext, acls.OAuth.Groups)
+				groupOK = controller.auth.IsInOAuthGroup(c, *userContext, acls)
 			} else {
-				groupOK = controller.auth.IsInLdapGroup(c, userContext, acls.LDAP.Groups)
+				groupOK = controller.auth.IsInLDAPGroup(c, *userContext, acls)
 			}
 
 			if !groupOK {
-				tlog.App.Warn().Str("user", userContext.Username).Str("resource", strings.Split(proxyCtx.Host, ".")[0]).Msg("User groups do not match resource requirements")
+				controller.log.App.Warn().Str("user", userContext.GetUsername()).Str("resource", strings.Split(proxyCtx.Host, ".")[0]).Msg("User is not in the required group to access resource")
 
-				queries, err := query.Values(config.UnauthorizedQuery{
+				queries, err := query.Values(UnauthorizedQuery{
 					Resource: strings.Split(proxyCtx.Host, ".")[0],
 					GroupErr: true,
 				})
 
 				if err != nil {
-					tlog.App.Error().Err(err).Msg("Failed to encode unauthorized query")
+					controller.log.App.Error().Err(err).Msg("Failed to encode unauthorized query")
 					controller.handleError(c, proxyCtx)
 					return
 				}
 
-				if userContext.OAuth {
+				if userContext.IsOAuth() {
-					queries.Set("username", userContext.Email)
+					queries.Set("username", userContext.GetEmail())
 				} else {
-					queries.Set("username", userContext.Username)
+					queries.Set("username", userContext.GetUsername())
 				}
 
-				redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.config.AppURL, queries.Encode())
+				redirectURL := fmt.Sprintf("%s/unauthorized?%s", controller.runtime.AppURL, queries.Encode())
 
 				if !controller.useBrowserResponse(proxyCtx) {
 					c.Header("x-tinyauth-location", redirectURL)
@@ -254,17 +248,18 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 			}
 		}
 
-		c.Header("Remote-User", utils.SanitizeHeader(userContext.Username))
+		c.Header("Remote-User", utils.SanitizeHeader(userContext.GetUsername()))
-		c.Header("Remote-Name", utils.SanitizeHeader(userContext.Name))
+		c.Header("Remote-Name", utils.SanitizeHeader(userContext.GetName()))
-		c.Header("Remote-Email", utils.SanitizeHeader(userContext.Email))
+		c.Header("Remote-Email", utils.SanitizeHeader(userContext.GetEmail()))
 
-		if userContext.Provider == "ldap" {
+		if userContext.IsLDAP() {
-			c.Header("Remote-Groups", utils.SanitizeHeader(userContext.LdapGroups))
+			c.Header("Remote-Groups", utils.SanitizeHeader(strings.Join(userContext.LDAP.Groups, ",")))
-		} else if userContext.Provider != "local" {
-			c.Header("Remote-Groups", utils.SanitizeHeader(userContext.OAuthGroups))
 		}
 
-		c.Header("Remote-Sub", utils.SanitizeHeader(userContext.OAuthSub))
+		if userContext.IsOAuth() {
+			c.Header("Remote-Groups", utils.SanitizeHeader(strings.Join(userContext.OAuth.Groups, ",")))
+			c.Header("Remote-Sub", utils.SanitizeHeader(userContext.OAuth.Sub))
+		}
 
 		controller.setHeaders(c, acls)
 
@@ -275,17 +270,17 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 		return
 	}
 
-	queries, err := query.Values(config.RedirectQuery{
+	queries, err := query.Values(RedirectQuery{
 		RedirectURI: fmt.Sprintf("%s://%s%s", proxyCtx.Proto, proxyCtx.Host, proxyCtx.Path),
 	})
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to encode redirect URI query")
+		controller.log.App.Error().Err(err).Msg("Failed to encode redirect query")
 		controller.handleError(c, proxyCtx)
 		return
 	}
 
-	redirectURL := fmt.Sprintf("%s/login?%s", controller.config.AppURL, queries.Encode())
+	redirectURL := fmt.Sprintf("%s/login?%s", controller.runtime.AppURL, queries.Encode())
 
 	if !controller.useBrowserResponse(proxyCtx) {
 		c.Header("x-tinyauth-location", redirectURL)
@@ -299,26 +294,29 @@ func (controller *ProxyController) proxyHandler(c *gin.Context) {
 	c.Redirect(http.StatusTemporaryRedirect, redirectURL)
 }
 
-func (controller *ProxyController) setHeaders(c *gin.Context, acls config.App) {
+func (controller *ProxyController) setHeaders(c *gin.Context, acls *model.App) {
 	c.Header("Authorization", c.Request.Header.Get("Authorization"))
 
+	if acls == nil {
+		return
+	}
+
 	headers := utils.ParseHeaders(acls.Response.Headers)
 
 	for key, value := range headers {
-		tlog.App.Debug().Str("header", key).Msg("Setting header")
 		c.Header(key, value)
 	}
 
 	basicPassword := utils.GetSecret(acls.Response.BasicAuth.Password, acls.Response.BasicAuth.PasswordFile)
 
 	if acls.Response.BasicAuth.Username != "" && basicPassword != "" {
-		tlog.App.Debug().Str("username", acls.Response.BasicAuth.Username).Msg("Setting basic auth header")
+		controller.log.App.Debug().Msg("Setting basic auth header for response")
-		c.Header("Authorization", fmt.Sprintf("Basic %s", utils.GetBasicAuth(acls.Response.BasicAuth.Username, basicPassword)))
+		c.Header("Authorization", fmt.Sprintf("Basic %s", utils.EncodeBasicAuth(acls.Response.BasicAuth.Username, basicPassword)))
 	}
 }
 
 func (controller *ProxyController) handleError(c *gin.Context, proxyCtx ProxyContext) {
-	redirectURL := fmt.Sprintf("%s/error", controller.config.AppURL)
+	redirectURL := fmt.Sprintf("%s/error", controller.runtime.AppURL)
 
 	if !controller.useBrowserResponse(proxyCtx) {
 		c.Header("x-tinyauth-location", redirectURL)
@@ -519,7 +517,7 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 		return ProxyContext{}, err
 	}
 
-	tlog.App.Debug().Msgf("Proxy: %v", req.Proxy)
+	controller.log.App.Debug().Msgf("Determined proxy type: %v", proxy)
 
 	authModules := controller.determineAuthModules(proxy)
 
@@ -530,13 +528,13 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 	var ctx ProxyContext
 
 	for _, module := range authModules {
-		tlog.App.Debug().Msgf("Trying auth module: %v", module)
+		controller.log.App.Debug().Msgf("Trying to get context from auth module %v", module)
 		ctx, err = controller.getContextFromAuthModule(c, module)
 		if err == nil {
-			tlog.App.Debug().Msgf("Auth module %v succeeded", module)
+			controller.log.App.Debug().Msgf("Successfully got context from auth module %v", module)
 			break
 		}
-		tlog.App.Debug().Err(err).Msgf("Auth module %v failed", module)
+		controller.log.App.Debug().Msgf("Failed to get context from auth module %v: %v", module, err)
 	}
 
 	if err != nil {
@@ -548,9 +546,9 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 	isBrowser := BrowserUserAgentRegex.MatchString(userAgent)
 
 	if isBrowser {
-		tlog.App.Debug().Msg("Request identified as coming from a browser")
+		controller.log.App.Debug().Msg("Request identified as coming from a browser client")
 	} else {
-		tlog.App.Debug().Msg("Request identified as coming from a non-browser client")
+		controller.log.App.Debug().Msg("Request identified as coming from a non-browser client")
 	}
 
 	ctx.IsBrowser = isBrowser

internal/controller/proxy_controller_test.go

@@ -6,14 +6,14 @@ import (
 	"testing"
 
 	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
-	"github.com/tinyauthapp/tinyauth/internal/config"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestProxyController(t *testing.T) {
@@ -21,7 +21,7 @@ func TestProxyController(t *testing.T) {
 	tempDir := t.TempDir()
 
 	authServiceCfg := service.AuthServiceConfig{
-		Users: []config.User{
+		LocalUsers: &[]model.LocalUser{
 			{
 				Username: "testuser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
@@ -29,7 +29,7 @@ func TestProxyController(t *testing.T) {
 			{
 				Username:   "totpuser",
 				Password:   "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
-				TotpSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
+				TOTPSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
 			},
 		},
 		SessionExpiry:     10, // 10 seconds, useful for testing
@@ -43,28 +43,28 @@ func TestProxyController(t *testing.T) {
 		AppURL: "https://tinyauth.example.com",
 	}
 
-	acls := map[string]config.App{
+	acls := map[string]model.App{
 		"app_path_allow": {
-			Config: config.AppConfig{
+			Config: model.AppConfig{
 				Domain: "path-allow.example.com",
 			},
-			Path: config.AppPath{
+			Path: model.AppPath{
 				Allow: "/allowed",
 			},
 		},
 		"app_user_allow": {
-			Config: config.AppConfig{
+			Config: model.AppConfig{
 				Domain: "user-allow.example.com",
 			},
-			Users: config.AppUsers{
+			Users: model.AppUsers{
 				Allow: "testuser",
 			},
 		},
 		"ip_bypass": {
-			Config: config.AppConfig{
+			Config: model.AppConfig{
 				Domain: "ip-bypass.example.com",
 			},
-			IP: config.AppIP{
+			IP: model.AppIP{
 				Bypass: []string{"10.10.10.10"},
 			},
 		},
@@ -74,24 +74,31 @@ func TestProxyController(t *testing.T) {
 	Mozilla/5.0 (Linux; Android 8.0.0; SM-G955U Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Mobile Safari/537.36`
 
 	simpleCtx := func(c *gin.Context) {
-		c.Set("context", &config.UserContext{
+		c.Set("context", &model.UserContext{
-			Username:   "testuser",
+			Authenticated: true,
-			Name:       "Testuser",
+			Provider:      model.ProviderLocal,
-			Email:      "testuser@example.com",
+			Local: &model.LocalContext{
-			IsLoggedIn: true,
+				BaseContext: model.BaseContext{
-			Provider:   "local",
+					Username: "testuser",
+					Name:     "Testuser",
+					Email:    "testuser@example.com",
+				},
+			},
 		})
 		c.Next()
 	}
 
 	simpleCtxTotp := func(c *gin.Context) {
-		c.Set("context", &config.UserContext{
+		c.Set("context", &model.UserContext{
-			Username:    "totpuser",
+			Authenticated: true,
-			Name:        "Totpuser",
+			Provider:      model.ProviderLocal,
-			Email:       "totpuser@example.com",
+			Local: &model.LocalContext{
-			IsLoggedIn:  true,
+				BaseContext: model.BaseContext{
-			Provider:    "local",
+					Username: "totpuser",
-			TotpEnabled: true,
+					Name:     "Totpuser",
+					Email:    "totpuser@example.com",
+				},
+			},
 		})
 		c.Next()
 	}
@@ -391,9 +398,9 @@ func TestProxyController(t *testing.T) {
 		},
 	}
 
-	oauthBrokerCfgs := make(map[string]config.OAuthServiceConfig)
+	oauthBrokerCfgs := make(map[string]model.OAuthServiceConfig)
 
-	app := bootstrap.NewBootstrapApp(config.Config{})
+	app := bootstrap.NewBootstrapApp(model.Config{})
 
 	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
 	require.NoError(t, err)
@@ -412,7 +419,7 @@ func TestProxyController(t *testing.T) {
 	err = broker.Init()
 	require.NoError(t, err)
 
-	authService := service.NewAuthService(authServiceCfg, docker, ldap, queries, broker)
+	authService := service.NewAuthService(authServiceCfg, ldap, queries, broker)
 	err = authService.Init()
 	require.NoError(t, err)
 

internal/controller/resources_controller.go

@@ -4,21 +4,20 @@ import (
 	"net/http"
 
 	"github.com/gin-gonic/gin"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
-type ResourcesControllerConfig struct {
-	Path    string
-	Enabled bool
-}
-
 type ResourcesController struct {
-	config     ResourcesControllerConfig
+	config     model.Config
 	router     *gin.RouterGroup
 	fileServer http.Handler
 }
 
-func NewResourcesController(config ResourcesControllerConfig, router *gin.RouterGroup) *ResourcesController {
+func NewResourcesController(
-	fileServer := http.StripPrefix("/resources", http.FileServer(http.Dir(config.Path)))
+	config model.Config,
+	router *gin.RouterGroup,
+) *ResourcesController {
+	fileServer := http.StripPrefix("/resources", http.FileServer(http.Dir(config.Resources.Path)))
 
 	return &ResourcesController{
 		config:     config,
@@ -32,14 +31,14 @@ func (controller *ResourcesController) SetupRoutes() {
 }
 
 func (controller *ResourcesController) resourcesHandler(c *gin.Context) {
-	if controller.config.Path == "" {
+	if controller.config.Resources.Path == "" {
 		c.JSON(404, gin.H{
 			"status":  404,
 			"message": "Resources not found",
 		})
 		return
 	}
-	if !controller.config.Enabled {
+	if !controller.config.Resources.Enabled {
 		c.JSON(403, gin.H{
 			"status":  403,
 			"message": "Resources are disabled",

internal/controller/user_controller.go

@@ -1,14 +1,16 @@
 package controller
 
 import (
+	"errors"
 	"fmt"
+	"net/http"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"github.com/gin-gonic/gin"
 	"github.com/pquerna/otp/totp"
@@ -23,21 +25,24 @@ type TotpRequest struct {
 	Code string `json:"code"`
 }
 
-type UserControllerConfig struct {
-	CookieDomain string
-}
-
 type UserController struct {
-	config UserControllerConfig
+	log     *logger.Logger
-	router *gin.RouterGroup
+	runtime model.RuntimeConfig
-	auth   *service.AuthService
+	router  *gin.RouterGroup
+	auth    *service.AuthService
 }
 
-func NewUserController(config UserControllerConfig, router *gin.RouterGroup, auth *service.AuthService) *UserController {
+func NewUserController(
+	log *logger.Logger,
+	runtimeConfig model.RuntimeConfig,
+	router *gin.RouterGroup,
+	auth *service.AuthService,
+) *UserController {
 	return &UserController{
-		config: config,
+		log:     log,
-		router: router,
+		runtime: runtimeConfig,
-		auth:   auth,
+		router:  router,
+		auth:    auth,
 	}
 }
 
@@ -53,7 +58,7 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 
 	err := c.ShouldBindJSON(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind JSON")
+		controller.log.App.Error().Err(err).Msg("Failed to bind JSON")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -61,13 +66,13 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}
 
-	tlog.App.Debug().Str("username", req.Username).Msg("Login attempt")
+	controller.log.App.Debug().Str("username", req.Username).Msg("Login attempt")
 
 	isLocked, remaining := controller.auth.IsAccountLocked(req.Username)
 
 	if isLocked {
-		tlog.App.Warn().Str("username", req.Username).Msg("Account is locked due to too many failed login attempts")
+		controller.log.App.Warn().Str("username", req.Username).Msg("Account is locked due to too many failed login attempts")
-		tlog.AuditLoginFailure(c, req.Username, "username", "account locked")
+		controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "account locked")
 		c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
 		c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
 		c.JSON(429, gin.H{
@@ -77,12 +82,35 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}
 
-	userSearch := controller.auth.SearchUser(req.Username)
+	search, err := controller.auth.SearchUser(req.Username)
 
-	if userSearch.Type == "unknown" {
+	if err != nil {
-		tlog.App.Warn().Str("username", req.Username).Msg("User not found")
+		if errors.Is(err, service.ErrUserNotFound) {
+			controller.log.App.Warn().Str("username", req.Username).Msg("User not found during login attempt")
+			controller.auth.RecordLoginAttempt(req.Username, false)
+			controller.log.AuditLoginFailure(req.Username, "unkown", c.ClientIP(), "user not found")
+			c.JSON(401, gin.H{
+				"status":  401,
+				"message": "Unauthorized",
+			})
+			return
+		}
+		controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Error searching for user during login attempt")
+		c.JSON(500, gin.H{
+			"status":  500,
+			"message": "Internal Server Error",
+		})
+		return
+	}
+
+	if err := controller.auth.CheckUserPassword(*search, req.Password); err != nil {
+		controller.log.App.Warn().Str("username", req.Username).Msg("Invalid password during login attempt")
 		controller.auth.RecordLoginAttempt(req.Username, false)
-		tlog.AuditLoginFailure(c, req.Username, "username", "user not found")
+		if search.Type == model.UserLocal {
+			controller.log.AuditLoginFailure(req.Username, "local", c.ClientIP(), "invalid password")
+		} else {
+			controller.log.AuditLoginFailure(req.Username, "ldap", c.ClientIP(), "invalid password")
+		}
 		c.JSON(401, gin.H{
 			"status":  401,
 			"message": "Unauthorized",
@@ -90,46 +118,35 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}
 
-	if !controller.auth.VerifyUser(userSearch, req.Password) {
+	var localUser *model.LocalUser
-		tlog.App.Warn().Str("username", req.Username).Msg("Invalid password")
-		controller.auth.RecordLoginAttempt(req.Username, false)
-		tlog.AuditLoginFailure(c, req.Username, "username", "invalid password")
-		c.JSON(401, gin.H{
-			"status":  401,
-			"message": "Unauthorized",
-		})
-		return
-	}
 
-	tlog.App.Info().Str("username", req.Username).Msg("Login successful")
+	if search.Type == model.UserLocal {
-	tlog.AuditLoginSuccess(c, req.Username, "username")
+		localUser = controller.auth.GetLocalUser(req.Username)
 
-	controller.auth.RecordLoginAttempt(req.Username, true)
+		if localUser == nil {
+			controller.log.App.Error().Str("username", req.Username).Msg("Local user not found after successful password verification")
+			c.JSON(401, gin.H{
+				"status":  401,
+				"message": "Unauthorized",
+			})
+			return
+		}
 
-	var localUser *config.User
+		if localUser.TOTPSecret != "" {
-	if userSearch.Type == "local" {
+			controller.log.App.Debug().Str("username", req.Username).Msg("TOTP required for user, creating pending TOTP session")
-		user := controller.auth.GetLocalUser(userSearch.Username)
-		localUser = &user
-	}
 
-	if userSearch.Type == "local" && localUser != nil {
+			name := localUser.Attributes.Name
-		user := *localUser
-
-		if user.TotpSecret != "" {
-			tlog.App.Debug().Str("username", req.Username).Msg("User has TOTP enabled, requiring TOTP verification")
-
-			name := user.Attributes.Name
 			if name == "" {
-				name = utils.Capitalize(user.Username)
+				name = utils.Capitalize(localUser.Username)
 			}
 
-			email := user.Attributes.Email
+			email := localUser.Attributes.Email
 			if email == "" {
-				email = utils.CompileUserEmail(user.Username, controller.config.CookieDomain)
+				email = utils.CompileUserEmail(localUser.Username, controller.runtime.CookieDomain)
 			}
 
-			err := controller.auth.CreateSessionCookie(c, &repository.Session{
+			cookie, err := controller.auth.CreateSession(c, repository.Session{
-				Username:    user.Username,
+				Username:    localUser.Username,
 				Name:        name,
 				Email:       email,
 				Provider:    "local",
@@ -137,7 +154,7 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 			})
 
 			if err != nil {
-				tlog.App.Error().Err(err).Msg("Failed to create session cookie")
+				controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Failed to create pending TOTP session")
 				c.JSON(500, gin.H{
 					"status":  500,
 					"message": "Internal Server Error",
@@ -145,6 +162,8 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 				return
 			}
 
+			http.SetCookie(c.Writer, cookie)
+
 			c.JSON(200, gin.H{
 				"status":      200,
 				"message":     "TOTP required",
@@ -157,11 +176,11 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 	sessionCookie := repository.Session{
 		Username: req.Username,
 		Name:     utils.Capitalize(req.Username),
-		Email:    utils.CompileUserEmail(req.Username, controller.config.CookieDomain),
+		Email:    utils.CompileUserEmail(req.Username, controller.runtime.CookieDomain),
 		Provider: "local",
 	}
 
-	if userSearch.Type == "local" && localUser != nil {
+	if search.Type == model.UserLocal {
 		if localUser.Attributes.Name != "" {
 			sessionCookie.Name = localUser.Attributes.Name
 		}
@@ -170,16 +189,14 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		}
 	}
 
-	if userSearch.Type == "ldap" {
+	if search.Type == model.UserLDAP {
 		sessionCookie.Provider = "ldap"
 	}
 
-	tlog.App.Trace().Interface("session_cookie", sessionCookie).Msg("Creating session cookie")
+	cookie, err := controller.auth.CreateSession(c, sessionCookie)
-
-	err = controller.auth.CreateSessionCookie(c, &sessionCookie)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to create session cookie")
+		controller.log.App.Error().Err(err).Str("username", req.Username).Msg("Failed to create session cookie after successful login")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -187,6 +204,18 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 		return
 	}
 
+	http.SetCookie(c.Writer, cookie)
+
+	controller.log.App.Info().Str("username", req.Username).Msg("Login successful")
+
+	if search.Type == model.UserLocal {
+		controller.log.AuditLoginSuccess(req.Username, "local", c.ClientIP())
+	} else {
+		controller.log.AuditLoginSuccess(req.Username, "ldap", c.ClientIP())
+	}
+
+	controller.auth.RecordLoginAttempt(req.Username, true)
+
 	c.JSON(200, gin.H{
 		"status":  200,
 		"message": "Login successful",
@@ -194,15 +223,49 @@ func (controller *UserController) loginHandler(c *gin.Context) {
 }
 
 func (controller *UserController) logoutHandler(c *gin.Context) {
-	tlog.App.Debug().Msg("Logout request received")
+	controller.log.App.Debug().Msg("Logout attempt")
 
-	controller.auth.DeleteSessionCookie(c)
+	uuid, err := c.Cookie(controller.runtime.SessionCookieName)
 
-	context, err := utils.GetContext(c)
+	if err != nil {
-	if err == nil && context.IsLoggedIn {
+		if errors.Is(err, http.ErrNoCookie) {
-		tlog.AuditLogout(c, context.Username, context.Provider)
+			controller.log.App.Warn().Msg("Logout attempt without session cookie, treating as successful logout")
+			c.JSON(200, gin.H{
+				"status":  200,
+				"message": "Logout successful",
+			})
+			return
+		}
+		controller.log.App.Error().Err(err).Msg("Error retrieving session cookie on logout")
+		c.JSON(500, gin.H{
+			"status":  500,
+			"message": "Internal Server Error",
+		})
+		return
 	}
 
+	cookie, err := controller.auth.DeleteSession(c, uuid)
+
+	if err != nil {
+		controller.log.App.Error().Err(err).Msg("Error deleting session on logout")
+		c.JSON(500, gin.H{
+			"status":  500,
+			"message": "Internal Server Error",
+		})
+		return
+	}
+
+	context, err := new(model.UserContext).NewFromGin(c)
+
+	if err == nil {
+		controller.log.AuditLogout(context.GetUsername(), context.GetProviderID(), c.ClientIP())
+	} else {
+		controller.log.App.Warn().Err(err).Msg("Failed to get user context during logout, logging audit with unknown user")
+		controller.log.AuditLogout("unknown", "unknown", c.ClientIP())
+	}
+
+	http.SetCookie(c.Writer, cookie)
+
 	c.JSON(200, gin.H{
 		"status":  200,
 		"message": "Logout successful",
@@ -214,7 +277,7 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 
 	err := c.ShouldBindJSON(&req)
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to bind JSON")
+		controller.log.App.Error().Err(err).Msg("Failed to bind JSON for TOTP verification")
 		c.JSON(400, gin.H{
 			"status":  400,
 			"message": "Bad Request",
@@ -222,10 +285,10 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
-	context, err := utils.GetContext(c)
+	context, err := new(model.UserContext).NewFromGin(c)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to get user context")
+		controller.log.App.Error().Err(err).Msg("Failed to create user context from request for TOTP verification")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -233,8 +296,8 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
-	if !context.TotpPending {
+	if !context.TOTPPending() {
-		tlog.App.Warn().Msg("TOTP attempt without a pending TOTP session")
+		controller.log.App.Warn().Str("username", context.GetUsername()).Msg("TOTP verification attempt without pending TOTP session")
 		c.JSON(401, gin.H{
 			"status":  401,
 			"message": "Unauthorized",
@@ -242,12 +305,13 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
-	tlog.App.Debug().Str("username", context.Username).Msg("TOTP verification attempt")
+	controller.log.App.Debug().Str("username", context.GetUsername()).Msg("TOTP verification attempt")
 
-	isLocked, remaining := controller.auth.IsAccountLocked(context.Username)
+	isLocked, remaining := controller.auth.IsAccountLocked(context.GetUsername())
 
 	if isLocked {
-		tlog.App.Warn().Str("username", context.Username).Msg("Account is locked due to too many failed TOTP attempts")
+		controller.log.App.Warn().Str("username", context.GetUsername()).Msg("Account is locked due to too many failed TOTP attempts")
+		controller.log.AuditLoginFailure(context.GetUsername(), "local", c.ClientIP(), "account locked")
 		c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
 		c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
 		c.JSON(429, gin.H{
@@ -257,14 +321,10 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
-	user := controller.auth.GetLocalUser(context.Username)
+	user := controller.auth.GetLocalUser(context.GetUsername())
 
-	ok := totp.Validate(req.Code, user.TotpSecret)
+	if user == nil {
-
+		controller.log.App.Error().Str("username", context.GetUsername()).Msg("Local user not found during TOTP verification")
-	if !ok {
-		tlog.App.Warn().Str("username", context.Username).Msg("Invalid TOTP code")
-		controller.auth.RecordLoginAttempt(context.Username, false)
-		tlog.AuditLoginFailure(c, context.Username, "totp", "invalid totp code")
 		c.JSON(401, gin.H{
 			"status":  401,
 			"message": "Unauthorized",
@@ -272,15 +332,36 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
-	tlog.App.Info().Str("username", context.Username).Msg("TOTP verification successful")
+	ok := totp.Validate(req.Code, user.TOTPSecret)
-	tlog.AuditLoginSuccess(c, context.Username, "totp")
 
-	controller.auth.RecordLoginAttempt(context.Username, true)
+	if !ok {
+		controller.log.App.Warn().Str("username", context.GetUsername()).Msg("Invalid TOTP code during verification attempt")
+		controller.auth.RecordLoginAttempt(context.GetUsername(), false)
+		controller.log.AuditLoginFailure(context.GetUsername(), "local", c.ClientIP(), "invalid TOTP code")
+		c.JSON(401, gin.H{
+			"status":  401,
+			"message": "Unauthorized",
+		})
+		return
+	}
+
+	uuid, err := c.Cookie(controller.runtime.SessionCookieName)
+
+	if err == nil {
+		_, err = controller.auth.DeleteSession(c, uuid)
+		if err != nil {
+			controller.log.App.Error().Err(err).Msg("Failed to delete pending TOTP session after successful verification")
+		}
+	} else {
+		controller.log.App.Warn().Err(err).Msg("Failed to retrieve session cookie for pending TOTP session, cannot delete it")
+	}
+
+	controller.auth.RecordLoginAttempt(context.GetUsername(), true)
 
 	sessionCookie := repository.Session{
 		Username: user.Username,
 		Name:     utils.Capitalize(user.Username),
-		Email:    utils.CompileUserEmail(user.Username, controller.config.CookieDomain),
+		Email:    utils.CompileUserEmail(user.Username, controller.runtime.CookieDomain),
 		Provider: "local",
 	}
 
@@ -291,12 +372,10 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		sessionCookie.Email = user.Attributes.Email
 	}
 
-	tlog.App.Trace().Interface("session_cookie", sessionCookie).Msg("Creating session cookie")
+	cookie, err := controller.auth.CreateSession(c, sessionCookie)
-
-	err = controller.auth.CreateSessionCookie(c, &sessionCookie)
 
 	if err != nil {
-		tlog.App.Error().Err(err).Msg("Failed to create session cookie")
+		controller.log.App.Error().Err(err).Str("username", context.GetUsername()).Msg("Failed to create session cookie after successful TOTP verification")
 		c.JSON(500, gin.H{
 			"status":  500,
 			"message": "Internal Server Error",
@@ -304,6 +383,11 @@ func (controller *UserController) totpHandler(c *gin.Context) {
 		return
 	}
 
+	http.SetCookie(c.Writer, cookie)
+
+	controller.log.App.Info().Str("username", context.GetUsername()).Msg("TOTP verification successful, login complete")
+	controller.log.AuditLoginSuccess(context.GetUsername(), "local", c.ClientIP())
+
 	c.JSON(200, gin.H{
 		"status":  200,
 		"message": "Login successful",

internal/controller/user_controller_test.go

@@ -1,7 +1,9 @@
 package controller_test
 
 import (
+	"context"
 	"encoding/json"
+	"net/http"
 	"net/http/httptest"
 	"path"
 	"strings"
@@ -10,14 +12,14 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/pquerna/otp/totp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
-	"github.com/tinyauthapp/tinyauth/internal/config"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestUserController(t *testing.T) {
@@ -25,7 +27,7 @@ func TestUserController(t *testing.T) {
 	tempDir := t.TempDir()
 
 	authServiceCfg := service.AuthServiceConfig{
-		Users: []config.User{
+		LocalUsers: &[]model.LocalUser{
 			{
 				Username: "testuser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
@@ -33,12 +35,12 @@ func TestUserController(t *testing.T) {
 			{
 				Username:   "totpuser",
 				Password:   "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
-				TotpSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
+				TOTPSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
 			},
 			{
 				Username: "attruser",
 				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
-				Attributes: config.UserAttributes{
+				Attributes: model.UserAttributes{
 					Name:  "Alice Smith",
 					Email: "alice@example.com",
 				},
@@ -46,8 +48,8 @@ func TestUserController(t *testing.T) {
 			{
 				Username:   "attrtotpuser",
 				Password:   "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
-				TotpSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
+				TOTPSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
-				Attributes: config.UserAttributes{
+				Attributes: model.UserAttributes{
 					Name:  "Bob Jones",
 					Email: "bob@example.com",
 				},
@@ -61,9 +63,63 @@ func TestUserController(t *testing.T) {
 	}
 
 	userControllerCfg := controller.UserControllerConfig{
-		CookieDomain: "example.com",
+		CookieDomain:      "example.com",
+		SessionCookieName: "tinyauth-session",
 	}
 
+	totpCtx := func(c *gin.Context) {
+		c.Set("context", &model.UserContext{
+			Authenticated: false,
+			Provider:      model.ProviderLocal,
+			Local: &model.LocalContext{
+				BaseContext: model.BaseContext{
+					Username: "totpuser",
+					Name:     "Totpuser",
+					Email:    "totpuser@example.com",
+				},
+				TOTPPending: true,
+			},
+		})
+	}
+
+	totpAttrCtx := func(c *gin.Context) {
+		c.Set("context", &model.UserContext{
+			Authenticated: false,
+			Provider:      model.ProviderLocal,
+			Local: &model.LocalContext{
+				BaseContext: model.BaseContext{
+					Username: "attrtotpuser",
+					Name:     "Bob Jones",
+					Email:    "bob@example.com",
+				},
+				TOTPPending: true,
+			},
+		})
+	}
+
+	simpleCtx := func(c *gin.Context) {
+		c.Set("context", &model.UserContext{
+			Authenticated: true,
+			Provider:      model.ProviderLocal,
+			Local: &model.LocalContext{
+				BaseContext: model.BaseContext{
+					Username: "testuser",
+					Name:     "Test User",
+					Email:    "testuser@example.com",
+				},
+			},
+		})
+	}
+
+	oauthBrokerCfgs := make(map[string]model.OAuthServiceConfig)
+
+	app := bootstrap.NewBootstrapApp(model.Config{})
+
+	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
+	require.NoError(t, err)
+
+	queries := repository.New(db)
+
 	type testCase struct {
 		description string
 		middlewares []gin.HandlerFunc
@@ -94,7 +150,9 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", cookie.Name)
 				assert.True(t, cookie.HttpOnly)
 				assert.Equal(t, "example.com", cookie.Domain)
-				assert.Equal(t, 10, cookie.MaxAge)
+				// 3 seconds should be more than enough for even slow test environments
+				assert.GreaterOrEqual(t, cookie.MaxAge, 7)
+				assert.LessOrEqual(t, cookie.MaxAge, 10)
 			},
 		},
 		{
@@ -183,12 +241,15 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", cookie.Name)
 				assert.True(t, cookie.HttpOnly)
 				assert.Equal(t, "example.com", cookie.Domain)
-				assert.Equal(t, 3600, cookie.MaxAge) // 1 hour, default for totp pending sessions
+				assert.GreaterOrEqual(t, cookie.MaxAge, 3597)
+				assert.LessOrEqual(t, cookie.MaxAge, 3600)
 			},
 		},
 		{
 			description: "Should be able to logout",
-			middlewares: []gin.HandlerFunc{},
+			middlewares: []gin.HandlerFunc{
+				simpleCtx,
+			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				// First login to get a session cookie
 				loginReq := controller.LoginRequest{
@@ -204,9 +265,10 @@ func TestUserController(t *testing.T) {
 				router.ServeHTTP(recorder, req)
 
 				assert.Equal(t, 200, recorder.Code)
-				assert.Len(t, recorder.Result().Cookies(), 1)
+				cookies := recorder.Result().Cookies()
+				assert.Len(t, cookies, 1)
 
-				cookie := recorder.Result().Cookies()[0]
+				cookie := cookies[0]
 				assert.Equal(t, "tinyauth-session", cookie.Name)
 
 				// Now logout using the session cookie
@@ -217,18 +279,33 @@ func TestUserController(t *testing.T) {
 				router.ServeHTTP(recorder, req)
 
 				assert.Equal(t, 200, recorder.Code)
-				assert.Len(t, recorder.Result().Cookies(), 1)
+				cookies = recorder.Result().Cookies()
+				assert.Len(t, cookies, 1)
 
-				logoutCookie := recorder.Result().Cookies()[0]
+				cookie = cookies[0]
-				assert.Equal(t, "tinyauth-session", logoutCookie.Name)
+				assert.Equal(t, "tinyauth-session", cookie.Name)
-				assert.Equal(t, "", logoutCookie.Value)
+				assert.Equal(t, "", cookie.Value)
-				assert.Equal(t, -1, logoutCookie.MaxAge) // MaxAge -1 means delete cookie
+				assert.Equal(t, -1, cookie.MaxAge) // MaxAge -1 means delete cookie
 			},
 		},
 		{
 			description: "Should be able to login with totp",
-			middlewares: []gin.HandlerFunc{},
+			middlewares: []gin.HandlerFunc{
+				totpCtx,
+			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := queries.CreateSession(context.TODO(), repository.CreateSessionParams{
+					UUID:        "test-totp-login-uuid",
+					Username:    "test",
+					Email:       "test@example.com",
+					Name:        "Test",
+					Provider:    "local",
+					TotpPending: true,
+					Expiry:      time.Now().Add(1 * time.Hour).Unix(),
+					CreatedAt:   time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
 				code, err := totp.GenerateCode("JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK", time.Now())
 				assert.NoError(t, err)
 
@@ -242,7 +319,13 @@ func TestUserController(t *testing.T) {
 				recorder = httptest.NewRecorder()
 				req := httptest.NewRequest("POST", "/api/user/totp", strings.NewReader(string(totpReqBody)))
 				req.Header.Set("Content-Type", "application/json")
-
+				req.AddCookie(&http.Cookie{
+					Name:     "tinyauth-session",
+					Value:    "test-totp-login-uuid",
+					HttpOnly: true,
+					MaxAge:   3600,
+					Expires:  time.Now().Add(1 * time.Hour),
+				})
 				router.ServeHTTP(recorder, req)
 
 				assert.Equal(t, 200, recorder.Code)
@@ -253,12 +336,15 @@ func TestUserController(t *testing.T) {
 				assert.Equal(t, "tinyauth-session", totpCookie.Name)
 				assert.True(t, totpCookie.HttpOnly)
 				assert.Equal(t, "example.com", totpCookie.Domain)
-				assert.Equal(t, 10, totpCookie.MaxAge) // should use the regular session expiry time
+				assert.GreaterOrEqual(t, totpCookie.MaxAge, 7)
+				assert.LessOrEqual(t, totpCookie.MaxAge, 10)
 			},
 		},
 		{
 			description: "Totp should rate limit on multiple invalid attempts",
-			middlewares: []gin.HandlerFunc{},
+			middlewares: []gin.HandlerFunc{
+				totpCtx,
+			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
 				for range 3 {
 					totpReq := controller.TotpRequest{
@@ -328,8 +414,22 @@ func TestUserController(t *testing.T) {
 		},
 		{
 			description: "TOTP completion uses name and email from user attributes",
-			middlewares: []gin.HandlerFunc{},
+			middlewares: []gin.HandlerFunc{
+				totpAttrCtx,
+			},
 			run: func(t *testing.T, router *gin.Engine, recorder *httptest.ResponseRecorder) {
+				_, err := queries.CreateSession(context.TODO(), repository.CreateSessionParams{
+					UUID:        "test-totp-login-attributes-uuid",
+					Username:    "test",
+					Email:       "test@example.com",
+					Name:        "Test",
+					Provider:    "local",
+					TotpPending: true,
+					Expiry:      time.Now().Add(1 * time.Hour).Unix(),
+					CreatedAt:   time.Now().Unix(),
+				})
+				require.NoError(t, err)
+
 				code, err := totp.GenerateCode("JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK", time.Now())
 				require.NoError(t, err)
 
@@ -339,6 +439,13 @@ func TestUserController(t *testing.T) {
 
 				req := httptest.NewRequest("POST", "/api/user/totp", strings.NewReader(string(body)))
 				req.Header.Set("Content-Type", "application/json")
+				req.AddCookie(&http.Cookie{
+					Name:     "tinyauth-session",
+					Value:    "test-totp-login-attributes-uuid",
+					HttpOnly: true,
+					MaxAge:   3600,
+					Expires:  time.Now().Add(1 * time.Hour),
+				})
 				router.ServeHTTP(recorder, req)
 
 				require.Equal(t, 200, recorder.Code)
@@ -349,15 +456,6 @@ func TestUserController(t *testing.T) {
 		},
 	}
 
-	oauthBrokerCfgs := make(map[string]config.OAuthServiceConfig)
-
-	app := bootstrap.NewBootstrapApp(config.Config{})
-
-	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
-	require.NoError(t, err)
-
-	queries := repository.New(db)
-
 	docker := service.NewDockerService()
 	err = docker.Init()
 	require.NoError(t, err)
@@ -370,7 +468,7 @@ func TestUserController(t *testing.T) {
 	err = broker.Init()
 	require.NoError(t, err)
 
-	authService := service.NewAuthService(authServiceCfg, docker, ldap, queries, broker)
+	authService := service.NewAuthService(authServiceCfg, ldap, queries, broker)
 	err = authService.Init()
 	require.NoError(t, err)
 
@@ -379,33 +477,6 @@ func TestUserController(t *testing.T) {
 		authService.ClearRateLimitsTestingOnly()
 	}
 
-	setTotpMiddlewareOverrides := map[string]config.UserContext{
-		"Should be able to login with totp": {
-			Username:    "totpuser",
-			Name:        "Totpuser",
-			Email:       "totpuser@example.com",
-			Provider:    "local",
-			TotpPending: true,
-			TotpEnabled: true,
-		},
-		"Totp should rate limit on multiple invalid attempts": {
-			Username:    "totpuser",
-			Name:        "Totpuser",
-			Email:       "totpuser@example.com",
-			Provider:    "local",
-			TotpPending: true,
-			TotpEnabled: true,
-		},
-		"TOTP completion uses name and email from user attributes": {
-			Username:    "attrtotpuser",
-			Name:        "Bob Jones",
-			Email:       "bob@example.com",
-			Provider:    "local",
-			TotpPending: true,
-			TotpEnabled: true,
-		},
-	}
-
 	for _, test := range tests {
 		beforeEach()
 		t.Run(test.description, func(t *testing.T) {
@@ -415,15 +486,6 @@ func TestUserController(t *testing.T) {
 				router.Use(middleware)
 			}
 
-			// Gin is stupid and doesn't allow setting a middleware after the groups
-			// so we need to do some stupid overrides here
-			if ctx, ok := setTotpMiddlewareOverrides[test.description]; ok {
-				ctx := ctx
-				router.Use(func(c *gin.Context) {
-					c.Set("context", &ctx)
-				})
-			}
-
 			group := router.Group("/api")
 			gin.SetMode(gin.TestMode)
 

internal/controller/well_known_controller.go

@@ -26,25 +26,21 @@ type OpenIDConnectConfiguration struct {
 	RequestObjectSigningAlgValuesSupported []string `json:"request_object_signing_alg_values_supported"`
 }
 
-type WellKnownControllerConfig struct{}
-
 type WellKnownController struct {
-	config WellKnownControllerConfig
+	router *gin.RouterGroup
-	engine *gin.Engine
 	oidc   *service.OIDCService
 }
 
-func NewWellKnownController(config WellKnownControllerConfig, oidc *service.OIDCService, engine *gin.Engine) *WellKnownController {
+func NewWellKnownController(oidc *service.OIDCService, router *gin.RouterGroup) *WellKnownController {
 	return &WellKnownController{
-		config: config,
 		oidc:   oidc,
-		engine: engine,
+		router: router,
 	}
 }
 
 func (controller *WellKnownController) SetupRoutes() {
-	controller.engine.GET("/.well-known/openid-configuration", controller.OpenIDConnectConfiguration)
+	controller.router.GET("/.well-known/openid-configuration", controller.OpenIDConnectConfiguration)
-	controller.engine.GET("/.well-known/jwks.json", controller.JWKS)
+	controller.router.GET("/.well-known/jwks.json", controller.JWKS)
 }
 
 func (controller *WellKnownController) OpenIDConnectConfiguration(c *gin.Context) {

internal/controller/well_known_controller_test.go

@@ -8,14 +8,14 @@ import (
 	"testing"
 
 	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
-	"github.com/tinyauthapp/tinyauth/internal/config"
 	"github.com/tinyauthapp/tinyauth/internal/controller"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestWellKnownController(t *testing.T) {
@@ -23,7 +23,7 @@ func TestWellKnownController(t *testing.T) {
 	tempDir := t.TempDir()
 
 	oidcServiceCfg := service.OIDCServiceConfig{
-		Clients: map[string]config.OIDCClientConfig{
+		Clients: map[string]model.OIDCClientConfig{
 			"test": {
 				ClientID:            "some-client-id",
 				ClientSecret:        "some-client-secret",
@@ -101,7 +101,7 @@ func TestWellKnownController(t *testing.T) {
 		},
 	}
 
-	app := bootstrap.NewBootstrapApp(config.Config{})
+	app := bootstrap.NewBootstrapApp(model.Config{})
 
 	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
 	require.NoError(t, err)

internal/middleware/context_middleware.go

@@ -1,13 +1,16 @@
 package middleware
 
 import (
+	"context"
+	"fmt"
+	"net/http"
 	"strings"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	"github.com/gin-gonic/gin"
 )
@@ -32,21 +35,24 @@ var (
 	}
 )
 
-type ContextMiddlewareConfig struct {
-	CookieDomain string
-}
-
 type ContextMiddleware struct {
-	config ContextMiddlewareConfig
+	log     *logger.Logger
-	auth   *service.AuthService
+	runtime model.RuntimeConfig
-	broker *service.OAuthBrokerService
+	auth    *service.AuthService
+	broker  *service.OAuthBrokerService
 }
 
-func NewContextMiddleware(config ContextMiddlewareConfig, auth *service.AuthService, broker *service.OAuthBrokerService) *ContextMiddleware {
+func NewContextMiddleware(
+	log *logger.Logger,
+	runtime model.RuntimeConfig,
+	auth *service.AuthService,
+	broker *service.OAuthBrokerService,
+) *ContextMiddleware {
 	return &ContextMiddleware{
-		config: config,
+		log:     log,
-		auth:   auth,
+		runtime: runtime,
-		broker: broker,
+		auth:    auth,
+		broker:  broker,
 	}
 }
 
@@ -61,194 +67,41 @@ func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 			return
 		}
 
-		cookie, err := m.auth.GetSessionCookie(c)
+		uuid, err := c.Cookie(m.runtime.SessionCookieName)
 
-		if err != nil {
+		if err == nil {
-			tlog.App.Debug().Err(err).Msg("No valid session cookie found")
+			userContext, cookie, err := m.cookieAuth(c.Request.Context(), uuid)
-			goto basic
-		}
 
-		if cookie.TotpPending {
+			if err == nil {
-			c.Set("context", &config.UserContext{
+				if cookie != nil {
-				Username:    cookie.Username,
+					http.SetCookie(c.Writer, cookie)
-				Name:        cookie.Name,
-				Email:       cookie.Email,
-				Provider:    "local",
-				TotpPending: true,
-				TotpEnabled: true,
-			})
-			c.Next()
-			return
-		}
-
-		switch cookie.Provider {
-		case "local", "ldap":
-			userSearch := m.auth.SearchUser(cookie.Username)
-
-			if userSearch.Type == "unknown" {
-				tlog.App.Debug().Msg("User from session cookie not found")
-				m.auth.DeleteSessionCookie(c)
-				goto basic
-			}
-
-			if userSearch.Type != cookie.Provider {
-				tlog.App.Warn().Msg("User type from session cookie does not match user search type")
-				m.auth.DeleteSessionCookie(c)
-				c.Next()
-				return
-			}
-
-			var ldapGroups []string
-			var localAttributes config.UserAttributes
-
-			if cookie.Provider == "ldap" {
-				ldapUser, err := m.auth.GetLdapUser(userSearch.Username)
-
-				if err != nil {
-					tlog.App.Error().Err(err).Msg("Error retrieving LDAP user details")
-					c.Next()
-					return
 				}
 
-				ldapGroups = ldapUser.Groups
+				m.log.App.Debug().Msgf("Authenticated user %s via session cookie", userContext.GetUsername())
-			}
+				c.Set("context", userContext)
-
+				c.Next()
-			if cookie.Provider == "local" {
-				localUser := m.auth.GetLocalUser(cookie.Username)
-				localAttributes = localUser.Attributes
-			}
-
-			m.auth.RefreshSessionCookie(c)
-			c.Set("context", &config.UserContext{
-				Username:   cookie.Username,
-				Name:       cookie.Name,
-				Email:      cookie.Email,
-				Provider:   cookie.Provider,
-				IsLoggedIn: true,
-				LdapGroups: strings.Join(ldapGroups, ","),
-				Attributes: localAttributes,
-			})
-			c.Next()
-			return
-		default:
-			_, exists := m.broker.GetService(cookie.Provider)
-
-			if !exists {
-				tlog.App.Debug().Msg("OAuth provider from session cookie not found")
-				m.auth.DeleteSessionCookie(c)
-				goto basic
-			}
-
-			if !m.auth.IsEmailWhitelisted(cookie.Email) {
-				tlog.App.Debug().Msg("Email from session cookie not whitelisted")
-				m.auth.DeleteSessionCookie(c)
-				goto basic
-			}
-
-			m.auth.RefreshSessionCookie(c)
-			c.Set("context", &config.UserContext{
-				Username:    cookie.Username,
-				Name:        cookie.Name,
-				Email:       cookie.Email,
-				Provider:    cookie.Provider,
-				OAuthGroups: cookie.OAuthGroups,
-				OAuthName:   cookie.OAuthName,
-				OAuthSub:    cookie.OAuthSub,
-				IsLoggedIn:  true,
-				OAuth:       true,
-			})
-			c.Next()
-			return
-		}
-
-	basic:
-		basic := m.auth.GetBasicAuth(c)
-
-		if basic == nil {
-			tlog.App.Debug().Msg("No basic auth provided")
-			c.Next()
-			return
-		}
-
-		locked, remaining := m.auth.IsAccountLocked(basic.Username)
-
-		if locked {
-			tlog.App.Debug().Msgf("Account for user %s is locked for %d seconds, denying auth", basic.Username, remaining)
-			c.Writer.Header().Add("x-tinyauth-lock-locked", "true")
-			c.Writer.Header().Add("x-tinyauth-lock-reset", time.Now().Add(time.Duration(remaining)*time.Second).Format(time.RFC3339))
-			c.Next()
-			return
-		}
-
-		userSearch := m.auth.SearchUser(basic.Username)
-
-		if userSearch.Type == "unknown" || userSearch.Type == "error" {
-			m.auth.RecordLoginAttempt(basic.Username, false)
-			tlog.App.Debug().Msg("User from basic auth not found")
-			c.Next()
-			return
-		}
-
-		if !m.auth.VerifyUser(userSearch, basic.Password) {
-			m.auth.RecordLoginAttempt(basic.Username, false)
-			tlog.App.Debug().Msg("Invalid password for basic auth user")
-			c.Next()
-			return
-		}
-
-		m.auth.RecordLoginAttempt(basic.Username, true)
-
-		switch userSearch.Type {
-		case "local":
-			tlog.App.Debug().Msg("Basic auth user is local")
-
-			user := m.auth.GetLocalUser(basic.Username)
-
-			if user.TotpSecret != "" {
-				tlog.App.Debug().Msg("User with TOTP not allowed to login via basic auth")
 				return
+			} else {
+				m.log.App.Error().Msgf("Error authenticating session cookie: %v", err)
 			}
+		}
 
-			name := utils.Capitalize(user.Username)
+		username, password, ok := c.Request.BasicAuth()
-			if user.Attributes.Name != "" {
-				name = user.Attributes.Name
-			}
-			email := utils.CompileUserEmail(user.Username, m.config.CookieDomain)
-			if user.Attributes.Email != "" {
-				email = user.Attributes.Email
-			}
 
-			c.Set("context", &config.UserContext{
+		if ok {
-				Username:    user.Username,
+			userContext, headers, err := m.basicAuth(username, password)
-				Name:        name,
-				Email:       email,
-				Provider:    "local",
-				IsLoggedIn:  true,
-				IsBasicAuth: true,
-				Attributes:  user.Attributes,
-			})
-			c.Next()
-			return
-		case "ldap":
-			tlog.App.Debug().Msg("Basic auth user is LDAP")
-
-			ldapUser, err := m.auth.GetLdapUser(basic.Username)
 
 			if err != nil {
-				tlog.App.Debug().Err(err).Msg("Error retrieving LDAP user details")
+				m.log.App.Error().Msgf("Error authenticating basic auth: %v", err)
 				c.Next()
 				return
 			}
 
-			c.Set("context", &config.UserContext{
+			for k, v := range headers {
-				Username:    basic.Username,
+				c.Header(k, v)
-				Name:        utils.Capitalize(basic.Username),
+			}
-				Email:       utils.CompileUserEmail(basic.Username, m.config.CookieDomain),
+
-				Provider:    "ldap",
+			c.Set("context", userContext)
-				IsLoggedIn:  true,
-				LdapGroups:  strings.Join(ldapUser.Groups, ","),
-				IsBasicAuth: true,
-			})
 			c.Next()
 			return
 		}
@@ -257,6 +110,149 @@ func (m *ContextMiddleware) Middleware() gin.HandlerFunc {
 	}
 }
 
+func (m *ContextMiddleware) cookieAuth(ctx context.Context, uuid string) (*model.UserContext, *http.Cookie, error) {
+	session, err := m.auth.GetSession(ctx, uuid)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("error retrieving session: %w", err)
+	}
+
+	userContext, err := new(model.UserContext).NewFromSession(session)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("error creating user context from session: %w", err)
+	}
+
+	if userContext.Provider == model.ProviderLocal &&
+		userContext.Local.TOTPPending {
+		return userContext, nil, nil
+	}
+
+	switch userContext.Provider {
+	case model.ProviderLocal:
+		user := m.auth.GetLocalUser(userContext.Local.Username)
+
+		if user == nil {
+			return nil, nil, fmt.Errorf("local user not found")
+		}
+
+		userContext.Local.Attributes = user.Attributes
+
+		if userContext.Local.Attributes.Name == "" {
+			userContext.Local.Attributes.Name = utils.Capitalize(user.Username)
+		}
+
+		if userContext.Local.Attributes.Email == "" {
+			userContext.Local.Attributes.Email = utils.CompileUserEmail(user.Username, m.runtime.CookieDomain)
+		}
+	case model.ProviderLDAP:
+		search, err := m.auth.SearchUser(userContext.LDAP.Username)
+
+		if err != nil {
+			return nil, nil, fmt.Errorf("error searching for ldap user: %w", err)
+		}
+
+		if search.Type != model.UserLDAP {
+			return nil, nil, fmt.Errorf("user from session cookie is not ldap")
+		}
+
+		user, err := m.auth.GetLDAPUser(search.Username)
+
+		if err != nil {
+			return nil, nil, fmt.Errorf("error retrieving ldap user details: %w", err)
+		}
+
+		userContext.LDAP.Groups = user.Groups
+		userContext.LDAP.Name = utils.Capitalize(userContext.LDAP.Username)
+		userContext.LDAP.Email = utils.CompileUserEmail(userContext.LDAP.Username, m.runtime.CookieDomain)
+	case model.ProviderOAuth:
+		_, exists := m.broker.GetService(userContext.OAuth.ID)
+
+		if !exists {
+			return nil, nil, fmt.Errorf("oauth provider from session cookie not found: %s", userContext.OAuth.ID)
+		}
+
+		if !m.auth.IsEmailWhitelisted(userContext.OAuth.Email) {
+			m.auth.DeleteSession(ctx, uuid)
+			return nil, nil, fmt.Errorf("email from session cookie not whitelisted: %s", userContext.OAuth.Email)
+		}
+	}
+
+	cookie, err := m.auth.RefreshSession(ctx, uuid)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("error refreshing session: %w", err)
+	}
+
+	return userContext, cookie, nil
+}
+
+func (m *ContextMiddleware) basicAuth(username string, password string) (*model.UserContext, map[string]string, error) {
+	headers := make(map[string]string)
+	userContext := new(model.UserContext)
+	locked, remaining := m.auth.IsAccountLocked(username)
+
+	if locked {
+		m.log.App.Debug().Msgf("Account for user %s is locked for %d seconds, denying auth", username, remaining)
+		headers["x-tinyauth-lock-locked"] = "true"
+		headers["x-tinyauth-lock-reset"] = time.Now().Add(time.Duration(remaining) * time.Second).Format(time.RFC3339)
+		return nil, headers, nil
+	}
+
+	search, err := m.auth.SearchUser(username)
+
+	if err != nil {
+		return nil, nil, fmt.Errorf("error searching for user: %w", err)
+	}
+
+	err = m.auth.CheckUserPassword(*search, password)
+
+	if err != nil {
+		m.auth.RecordLoginAttempt(username, false)
+		return nil, nil, fmt.Errorf("invalid password for basic auth user: %w", err)
+	}
+
+	m.auth.RecordLoginAttempt(username, true)
+
+	switch search.Type {
+	case model.UserLocal:
+		user := m.auth.GetLocalUser(username)
+
+		if user.TOTPSecret != "" {
+			return nil, nil, fmt.Errorf("user with totp not allowed to login via basic auth: %s", username)
+		}
+
+		userContext.Local = &model.LocalContext{
+			BaseContext: model.BaseContext{
+				Username: user.Username,
+				Name:     utils.Capitalize(user.Username),
+				Email:    utils.CompileUserEmail(user.Username, m.runtime.CookieDomain),
+			},
+			Attributes: user.Attributes,
+		}
+		userContext.Provider = model.ProviderLocal
+	case model.UserLDAP:
+		user, err := m.auth.GetLDAPUser(username)
+
+		if err != nil {
+			return nil, nil, fmt.Errorf("error retrieving ldap user details: %w", err)
+		}
+
+		userContext.LDAP = &model.LDAPContext{
+			BaseContext: model.BaseContext{
+				Username: username,
+				Name:     utils.Capitalize(username),
+				Email:    utils.CompileUserEmail(username, m.runtime.CookieDomain),
+			},
+			Groups: user.Groups,
+		}
+		userContext.Provider = model.ProviderLDAP
+	}
+
+	userContext.Authenticated = true
+	return userContext, nil, nil
+}
+
 func (m *ContextMiddleware) isIgnorePath(path string) bool {
 	for _, prefix := range contextSkipPathsPrefix {
 		if strings.HasPrefix(path, prefix) {

internal/middleware/context_middleware_test.go

@@ -0,0 +1,328 @@
+package middleware_test
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tinyauthapp/tinyauth/internal/bootstrap"
+	"github.com/tinyauthapp/tinyauth/internal/middleware"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/repository"
+	"github.com/tinyauthapp/tinyauth/internal/service"
+	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+)
+
+func TestContextMiddleware(t *testing.T) {
+	tlog.NewTestLogger().Init()
+	tempDir := t.TempDir()
+
+	authServiceCfg := service.AuthServiceConfig{
+		LocalUsers: &[]model.LocalUser{
+			{
+				Username: "testuser",
+				Password: "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
+			},
+			{
+				Username:   "totpuser",
+				Password:   "$2a$10$ZwVYQH07JX2zq7Fjkt3gU.BjwvvwPeli4OqOno04RQIv0P7usBrXa", // password
+				TOTPSecret: "JPIEBDKJH6UGWJMX66RR3S55UFP2SGKK",
+			},
+		},
+		SessionExpiry:     10, // 10 seconds, useful for testing
+		CookieDomain:      "example.com",
+		LoginTimeout:      10, // 10 seconds, useful for testing
+		LoginMaxRetries:   3,
+		SessionCookieName: "tinyauth-session",
+	}
+
+	middlewareCfg := middleware.ContextMiddlewareConfig{
+		CookieDomain:      "example.com",
+		SessionCookieName: "tinyauth-session",
+	}
+
+	basicAuthHeader := func(username, password string) string {
+		return "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"+password))
+	}
+
+	seedSession := func(t *testing.T, queries *repository.Queries, params repository.CreateSessionParams) {
+		t.Helper()
+		_, err := queries.CreateSession(context.Background(), params)
+		require.NoError(t, err)
+	}
+
+	type runArgs struct {
+		do      func(req *http.Request) (*model.UserContext, *httptest.ResponseRecorder)
+		queries *repository.Queries
+	}
+
+	type testCase struct {
+		description string
+		run         func(t *testing.T, args runArgs)
+	}
+
+	tests := []testCase{
+		{
+			description: "Skip path bypasses auth processing",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/healthz", nil)
+				req.Header.Set("Authorization", basicAuthHeader("testuser", "password"))
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "No credentials yields no context",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Valid session cookie sets authenticated local context",
+			run: func(t *testing.T, args runArgs) {
+				uuid := "session-valid-local"
+				seedSession(t, args.queries, repository.CreateSessionParams{
+					UUID:      uuid,
+					Username:  "testuser",
+					Provider:  "local",
+					Expiry:    time.Now().Add(10 * time.Second).Unix(),
+					CreatedAt: time.Now().Unix(),
+				})
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: uuid})
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, model.ProviderLocal, userCtx.Provider)
+				assert.Equal(t, "testuser", userCtx.GetUsername())
+				assert.True(t, userCtx.Authenticated)
+				require.NotNil(t, userCtx.Local)
+			},
+		},
+		{
+			description: "Session cookie with totp pending sets unauthenticated context with totp enabled",
+			run: func(t *testing.T, args runArgs) {
+				uuid := "session-totp-pending"
+				seedSession(t, args.queries, repository.CreateSessionParams{
+					UUID:        uuid,
+					Username:    "totpuser",
+					Provider:    "local",
+					TotpPending: true,
+					Expiry:      time.Now().Add(60 * time.Second).Unix(),
+					CreatedAt:   time.Now().Unix(),
+				})
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: uuid})
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, "totpuser", userCtx.GetUsername())
+				assert.False(t, userCtx.Authenticated)
+				require.NotNil(t, userCtx.Local)
+				assert.True(t, userCtx.Local.TOTPPending)
+			},
+		},
+		{
+			description: "Unknown session cookie yields no context",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: "does-not-exist"})
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Session for missing local user yields no context",
+			run: func(t *testing.T, args runArgs) {
+				uuid := "session-deleted-user"
+				seedSession(t, args.queries, repository.CreateSessionParams{
+					UUID:      uuid,
+					Username:  "ghostuser",
+					Provider:  "local",
+					Expiry:    time.Now().Add(10 * time.Second).Unix(),
+					CreatedAt: time.Now().Unix(),
+				})
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: uuid})
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Expired session cookie yields no context",
+			run: func(t *testing.T, args runArgs) {
+				uuid := "session-expired"
+				seedSession(t, args.queries, repository.CreateSessionParams{
+					UUID:      uuid,
+					Username:  "testuser",
+					Provider:  "local",
+					Expiry:    time.Now().Add(-1 * time.Second).Unix(),
+					CreatedAt: time.Now().Add(-10 * time.Second).Unix(),
+				})
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: uuid})
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Valid basic auth sets authenticated local context",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("Authorization", basicAuthHeader("testuser", "password"))
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, model.ProviderLocal, userCtx.Provider)
+				assert.Equal(t, "testuser", userCtx.GetUsername())
+				assert.True(t, userCtx.Authenticated)
+			},
+		},
+		{
+			description: "Invalid basic auth password yields no context",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("Authorization", basicAuthHeader("testuser", "wrongpassword"))
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Basic auth is rejected for users with totp",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("Authorization", basicAuthHeader("totpuser", "password"))
+				userCtx, _ := args.do(req)
+
+				assert.Nil(t, userCtx)
+			},
+		},
+		{
+			description: "Locked account on basic auth sets lock headers",
+			run: func(t *testing.T, args runArgs) {
+				for range 3 {
+					req := httptest.NewRequest("GET", "/api/test", nil)
+					req.Header.Set("Authorization", basicAuthHeader("testuser", "wrongpassword"))
+					args.do(req)
+				}
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("Authorization", basicAuthHeader("testuser", "password"))
+				userCtx, recorder := args.do(req)
+
+				assert.Nil(t, userCtx)
+				assert.Equal(t, "true", recorder.Header().Get("x-tinyauth-lock-locked"))
+				assert.NotEmpty(t, recorder.Header().Get("x-tinyauth-lock-reset"))
+			},
+		},
+		{
+			description: "Cookie auth takes precedence over basic auth",
+			run: func(t *testing.T, args runArgs) {
+				uuid := "session-precedence"
+				seedSession(t, args.queries, repository.CreateSessionParams{
+					UUID:      uuid,
+					Username:  "testuser",
+					Provider:  "local",
+					Expiry:    time.Now().Add(10 * time.Second).Unix(),
+					CreatedAt: time.Now().Unix(),
+				})
+
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.AddCookie(&http.Cookie{Name: "tinyauth-session", Value: uuid})
+				req.Header.Set("Authorization", basicAuthHeader("totpuser", "password"))
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, "testuser", userCtx.GetUsername())
+				assert.True(t, userCtx.Authenticated)
+			},
+		},
+		{
+			description: "Ensure fallback to basic auth when cookie is missing",
+			run: func(t *testing.T, args runArgs) {
+				req := httptest.NewRequest("GET", "/api/test", nil)
+				req.Header.Set("Authorization", basicAuthHeader("testuser", "password"))
+				userCtx, _ := args.do(req)
+
+				require.NotNil(t, userCtx)
+				assert.Equal(t, "testuser", userCtx.GetUsername())
+				assert.True(t, userCtx.Authenticated)
+			},
+		},
+	}
+
+	oauthBrokerCfgs := make(map[string]model.OAuthServiceConfig)
+
+	app := bootstrap.NewBootstrapApp(model.Config{})
+
+	db, err := app.SetupDatabase(path.Join(tempDir, "tinyauth.db"))
+	require.NoError(t, err)
+
+	queries := repository.New(db)
+
+	ldap := service.NewLdapService(service.LdapServiceConfig{})
+	err = ldap.Init()
+	require.NoError(t, err)
+
+	broker := service.NewOAuthBrokerService(oauthBrokerCfgs)
+	err = broker.Init()
+	require.NoError(t, err)
+
+	authService := service.NewAuthService(authServiceCfg, ldap, queries, broker)
+	err = authService.Init()
+	require.NoError(t, err)
+
+	contextMiddleware := middleware.NewContextMiddleware(middlewareCfg, authService, broker)
+	err = contextMiddleware.Init()
+	require.NoError(t, err)
+
+	for _, test := range tests {
+		authService.ClearRateLimitsTestingOnly()
+		t.Run(test.description, func(t *testing.T) {
+			gin.SetMode(gin.TestMode)
+
+			do := func(req *http.Request) (*model.UserContext, *httptest.ResponseRecorder) {
+				var captured *model.UserContext
+				router := gin.New()
+				router.Use(contextMiddleware.Middleware())
+				handler := func(c *gin.Context) {
+					if val, exists := c.Get("context"); exists {
+						captured, _ = val.(*model.UserContext)
+					}
+				}
+				router.GET("/api/test", handler)
+				router.GET("/api/healthz", handler)
+
+				recorder := httptest.NewRecorder()
+				router.ServeHTTP(recorder, req)
+				return captured, recorder
+			}
+
+			test.run(t, runArgs{do: do, queries: queries})
+		})
+	}
+
+	t.Cleanup(func() {
+		err = db.Close()
+		require.NoError(t, err)
+	})
+}

internal/middleware/ui_middleware.go

@@ -9,7 +9,6 @@ import (
 	"time"
 
 	"github.com/tinyauthapp/tinyauth/internal/assets"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
 
 	"github.com/gin-gonic/gin"
 )
@@ -40,8 +39,6 @@ func (m *UIMiddleware) Middleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		path := strings.TrimPrefix(c.Request.URL.Path, "/")
 
-		tlog.App.Debug().Str("path", path).Msg("path")
-
 		switch strings.SplitN(path, "/", 2)[0] {
 		case "api", "resources", ".well-known":
 			c.Next()

internal/middleware/zerolog_middleware.go

@@ -5,7 +5,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
 // See context middleware for explanation of why we have to do this
@@ -17,10 +17,14 @@ var (
 	}
 )
 
-type ZerologMiddleware struct{}
+type ZerologMiddleware struct {
+	log *logger.Logger
+}
 
-func NewZerologMiddleware() *ZerologMiddleware {
+func NewZerologMiddleware(log *logger.Logger) *ZerologMiddleware {
-	return &ZerologMiddleware{}
+	return &ZerologMiddleware{
+		log: log,
+	}
 }
 
 func (m *ZerologMiddleware) Init() error {
@@ -50,7 +54,7 @@ func (m *ZerologMiddleware) Middleware() gin.HandlerFunc {
 
 		latency := time.Since(tStart).String()
 
-		subLogger := tlog.HTTP.With().Str("method", method).
+		subLogger := m.log.HTTP.With().Str("method", method).
 			Str("path", path).
 			Str("address", address).
 			Str("client_ip", clientIP).

internal/model/config.go

@@ -1,4 +1,4 @@
-package config
+package model
 
 // Default configuration
 func NewDefaultConfiguration() *Config {
@@ -18,6 +18,7 @@ func NewDefaultConfiguration() *Config {
 			Address: "0.0.0.0",
 		},
 		Auth: AuthConfig{
+			SubdomainsEnabled:  true,
 			SessionExpiry:      86400, // 1 day
 			SessionMaxLifetime: 0,     // disabled
 			LoginTimeout:       300,   // 5 minutes
@@ -29,7 +30,7 @@ func NewDefaultConfiguration() *Config {
 			BackgroundImage:       "/background.jpg",
 			WarningsEnabled:       true,
 		},
-		Ldap: LdapConfig{
+		LDAP: LDAPConfig{
 			Insecure:      false,
 			SearchFilter:  "(uid=%s)",
 			GroupCacheTTL: 900, // 15 minutes
@@ -59,38 +60,25 @@ func NewDefaultConfiguration() *Config {
 		Experimental: ExperimentalConfig{
 			ConfigFile: "",
 		},
+		LabelProvider: "auto",
 	}
 }
 
-// Version information, set at build time
-
-var Version = "development"
-var CommitHash = "development"
-var BuildTimestamp = "0000-00-00T00:00:00Z"
-
-// Cookie name templates
-
-var SessionCookieName = "tinyauth-session"
-var CSRFCookieName = "tinyauth-csrf"
-var RedirectCookieName = "tinyauth-redirect"
-var OAuthSessionCookieName = "tinyauth-oauth"
-
-// Main app config
-
 type Config struct {
-	AppURL       string             `description:"The base URL where the app is hosted." yaml:"appUrl"`
+	AppURL        string             `description:"The base URL where the app is hosted." yaml:"appUrl"`
-	Database     DatabaseConfig     `description:"Database configuration." yaml:"database"`
+	Database      DatabaseConfig     `description:"Database configuration." yaml:"database"`
-	Analytics    AnalyticsConfig    `description:"Analytics configuration." yaml:"analytics"`
+	Analytics     AnalyticsConfig    `description:"Analytics configuration." yaml:"analytics"`
-	Resources    ResourcesConfig    `description:"Resources configuration." yaml:"resources"`
+	Resources     ResourcesConfig    `description:"Resources configuration." yaml:"resources"`
-	Server       ServerConfig       `description:"Server configuration." yaml:"server"`
+	Server        ServerConfig       `description:"Server configuration." yaml:"server"`
-	Auth         AuthConfig         `description:"Authentication configuration." yaml:"auth"`
+	Auth          AuthConfig         `description:"Authentication configuration." yaml:"auth"`
-	Apps         map[string]App     `description:"Application ACLs configuration." yaml:"apps"`
+	Apps          map[string]App     `description:"Application ACLs configuration." yaml:"apps"`
-	OAuth        OAuthConfig        `description:"OAuth configuration." yaml:"oauth"`
+	OAuth         OAuthConfig        `description:"OAuth configuration." yaml:"oauth"`
-	OIDC         OIDCConfig         `description:"OIDC configuration." yaml:"oidc"`
+	OIDC          OIDCConfig         `description:"OIDC configuration." yaml:"oidc"`
-	UI           UIConfig           `description:"UI customization." yaml:"ui"`
+	UI            UIConfig           `description:"UI customization." yaml:"ui"`
-	Ldap         LdapConfig         `description:"LDAP configuration." yaml:"ldap"`
+	LDAP          LDAPConfig         `description:"LDAP configuration." yaml:"ldap"`
-	Experimental ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental"`
+	Experimental  ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental"`
-	Log          LogConfig          `description:"Logging configuration." yaml:"log"`
+	LabelProvider string             `description:"Label provider to use for ACLs (auto, docker, or kubernetes). auto detects the environment." yaml:"labelProvider"`
+	Log           LogConfig          `description:"Logging configuration." yaml:"log"`
 }
 
 type DatabaseConfig struct {
@@ -115,6 +103,7 @@ type ServerConfig struct {
 type AuthConfig struct {
 	IP                 IPConfig                  `description:"IP whitelisting config options." yaml:"ip"`
 	Users              []string                  `description:"Comma-separated list of users (username:hashed_password)." yaml:"users"`
+	SubdomainsEnabled  bool                      `description:"Enable subdomains support." yaml:"subdomainsEnabled"`
 	UserAttributes     map[string]UserAttributes `description:"Map of per-user OIDC attributes (username -> attributes)." yaml:"userAttributes"`
 	UsersFile          string                    `description:"Path to the users file." yaml:"usersFile"`
 	SecureCookie       bool                      `description:"Enable secure cookies." yaml:"secureCookie"`
@@ -159,6 +148,7 @@ type IPConfig struct {
 
 type OAuthConfig struct {
 	Whitelist    []string                      `description:"Comma-separated list of allowed OAuth domains." yaml:"whitelist"`
+	WhitelistFile string                       `description:"Path to the OAuth whitelist file." yaml:"whitelistFile"`
 	AutoRedirect string                        `description:"The OAuth provider to use for automatic redirection." yaml:"autoRedirect"`
 	Providers    map[string]OAuthServiceConfig `description:"OAuth providers configuration." yaml:"providers"`
 }
@@ -176,7 +166,7 @@ type UIConfig struct {
 	WarningsEnabled       bool   `description:"Enable UI warnings." yaml:"warningsEnabled"`
 }
 
-type LdapConfig struct {
+type LDAPConfig struct {
 	Address       string `description:"LDAP server address." yaml:"address"`
 	BindDN        string `description:"Bind DN for LDAP authentication." yaml:"bindDn"`
 	BindPassword  string `description:"Bind password for LDAP authentication." yaml:"bindPassword"`
@@ -209,20 +199,6 @@ type ExperimentalConfig struct {
 	ConfigFile string `description:"Path to config file." yaml:"-"`
 }
 
-// Config loader options
-
-const DefaultNamePrefix = "TINYAUTH_"
-
-// OAuth/OIDC config
-
-type Claims struct {
-	Sub               string `json:"sub"`
-	Name              string `json:"name"`
-	Email             string `json:"email"`
-	PreferredUsername string `json:"preferred_username"`
-	Groups            any    `json:"groups"`
-}
-
 type OAuthServiceConfig struct {
 	ClientID         string   `description:"OAuth client ID." yaml:"clientId"`
 	ClientSecret     string   `description:"OAuth client secret." yaml:"clientSecret"`
@@ -245,60 +221,6 @@ type OIDCClientConfig struct {
 	Name                string   `description:"Client name in UI." yaml:"name"`
 }
 
-var OverrideProviders = map[string]string{
-	"google": "Google",
-	"github": "GitHub",
-}
-
-// User/session related stuff
-
-type User struct {
-	Username   string
-	Password   string
-	TotpSecret string
-	Attributes UserAttributes
-}
-
-type LdapUser struct {
-	DN     string
-	Groups []string
-}
-
-type UserSearch struct {
-	Username string
-	Type     string // local, ldap or unknown
-}
-
-type UserContext struct {
-	Username    string
-	Name        string
-	Email       string
-	IsLoggedIn  bool
-	IsBasicAuth bool
-	OAuth       bool
-	Provider    string
-	TotpPending bool
-	OAuthGroups string
-	TotpEnabled bool
-	OAuthName   string
-	OAuthSub    string
-	LdapGroups  string
-	Attributes  UserAttributes
-}
-
-// API responses and queries
-
-type UnauthorizedQuery struct {
-	Username string `url:"username"`
-	Resource string `url:"resource"`
-	GroupErr bool   `url:"groupErr"`
-	IP       string `url:"ip"`
-}
-
-type RedirectQuery struct {
-	RedirectURI string `url:"redirect_uri"`
-}
-
 // ACLs
 
 type Apps struct {
@@ -354,7 +276,3 @@ type AppPath struct {
 	Allow string `description:"Comma-separated list of allowed paths." yaml:"allow"`
 	Block string `description:"Comma-separated list of blocked paths." yaml:"block"`
 }
-
-// API server
-
-var ApiServer = "https://api.tinyauth.app"

internal/model/constants.go

@@ -0,0 +1,23 @@
+package model
+
+const DefaultNamePrefix = "TINYAUTH_"
+
+const APIServer = "https://api.tinyauth.app"
+
+type Claims struct {
+	Sub               string `json:"sub"`
+	Name              string `json:"name"`
+	Email             string `json:"email"`
+	PreferredUsername string `json:"preferred_username"`
+	Groups            any    `json:"groups"`
+}
+
+var OverrideProviders = map[string]string{
+	"google": "Google",
+	"github": "GitHub",
+}
+
+const SessionCookieName = "tinyauth-session"
+const CSRFCookieName = "tinyauth-csrf"
+const RedirectCookieName = "tinyauth-redirect"
+const OAuthSessionCookieName = "tinyauth-oauth"

internal/model/context.go

@@ -0,0 +1,250 @@
+package model
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/tinyauthapp/tinyauth/internal/repository"
+)
+
+type ProviderType int
+
+const (
+	ProviderLocal ProviderType = iota
+	ProviderBasicAuth
+	ProviderOAuth
+	ProviderLDAP
+)
+
+type UserContext struct {
+	Authenticated bool
+	Provider      ProviderType
+	Local         *LocalContext
+	OAuth         *OAuthContext
+	LDAP          *LDAPContext
+}
+
+type BaseContext struct {
+	Username string
+	Name     string
+	Email    string
+}
+
+type LocalContext struct {
+	BaseContext
+	TOTPPending bool
+	Attributes  UserAttributes
+}
+
+type OAuthContext struct {
+	BaseContext
+	Groups      []string
+	Sub         string
+	DisplayName string
+	ID          string
+}
+
+type LDAPContext struct {
+	BaseContext
+	Groups []string
+}
+
+func (c *UserContext) IsAuthenticated() bool {
+	return c.Authenticated
+}
+
+func (c *UserContext) IsLocal() bool {
+	return c.Provider == ProviderLocal && c.Local != nil
+}
+
+func (c *UserContext) IsOAuth() bool {
+	return c.Provider == ProviderOAuth && c.OAuth != nil
+}
+
+func (c *UserContext) IsLDAP() bool {
+	return c.Provider == ProviderLDAP && c.LDAP != nil
+}
+
+func (c *UserContext) IsBasicAuth() bool {
+	return c.Provider == ProviderBasicAuth && c.Local != nil
+}
+
+func (c *UserContext) NewFromGin(ginctx *gin.Context) (*UserContext, error) {
+	userContextValue, exists := ginctx.Get("context")
+
+	if !exists {
+		return nil, errors.New("failed to get user context")
+	}
+
+	userContext, ok := userContextValue.(*UserContext)
+
+	if !ok || userContext == nil {
+		return nil, errors.New("invalid user context type")
+	}
+
+	if userContext.LDAP == nil && userContext.Local == nil && userContext.OAuth == nil {
+		return nil, errors.New("incomplete user context")
+	}
+
+	*c = *userContext
+	return c, nil
+}
+
+// Compatability layer until we get an excuse to drop in database migrations
+func (c *UserContext) NewFromSession(session *repository.Session) (*UserContext, error) {
+	*c = UserContext{
+		Authenticated: !session.TotpPending,
+	}
+
+	switch session.Provider {
+	case "local":
+		c.Provider = ProviderLocal
+		c.Local = &LocalContext{
+			BaseContext: BaseContext{
+				Username: session.Username,
+				Name:     session.Name,
+				Email:    session.Email,
+			},
+			TOTPPending: session.TotpPending,
+		}
+	case "ldap":
+		c.Provider = ProviderLDAP
+		c.LDAP = &LDAPContext{
+			BaseContext: BaseContext{
+				Username: session.Username,
+				Name:     session.Name,
+				Email:    session.Email,
+			},
+		}
+	// By default we assume an unkown name which is oauth
+	default:
+		c.Provider = ProviderOAuth
+		c.OAuth = &OAuthContext{
+			BaseContext: BaseContext{
+				Username: session.Username,
+				Name:     session.Name,
+				Email:    session.Email,
+			},
+			Groups: func() []string {
+				if session.OAuthGroups == "" {
+					return nil
+				}
+				return strings.Split(session.OAuthGroups, ",")
+			}(),
+			Sub:         session.OAuthSub,
+			DisplayName: session.OAuthName,
+			ID:          session.Provider,
+		}
+	}
+
+	return c, nil
+}
+
+func (c *UserContext) GetUsername() string {
+	switch c.Provider {
+	case ProviderLocal:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Username
+	case ProviderLDAP:
+		if c.LDAP == nil {
+			return ""
+		}
+		return c.LDAP.Username
+	case ProviderBasicAuth:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Username
+	case ProviderOAuth:
+		if c.OAuth == nil {
+			return ""
+		}
+		return c.OAuth.Username
+	default:
+		return ""
+	}
+}
+
+func (c *UserContext) GetEmail() string {
+	switch c.Provider {
+	case ProviderLocal:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Email
+	case ProviderLDAP:
+		if c.LDAP == nil {
+			return ""
+		}
+		return c.LDAP.Email
+	case ProviderBasicAuth:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Email
+	case ProviderOAuth:
+		if c.OAuth == nil {
+			return ""
+		}
+		return c.OAuth.Email
+	default:
+		return ""
+	}
+}
+
+func (c *UserContext) GetName() string {
+	switch c.Provider {
+	case ProviderLocal:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Name
+	case ProviderLDAP:
+		if c.LDAP == nil {
+			return ""
+		}
+		return c.LDAP.Name
+	case ProviderBasicAuth:
+		if c.Local == nil {
+			return ""
+		}
+		return c.Local.Name
+	case ProviderOAuth:
+		if c.OAuth == nil {
+			return ""
+		}
+		return c.OAuth.Name
+	default:
+		return ""
+	}
+}
+
+func (c *UserContext) GetProviderID() string {
+	switch c.Provider {
+	case ProviderBasicAuth, ProviderLocal:
+		return "local"
+	case ProviderLDAP:
+		return "ldap"
+	case ProviderOAuth:
+		return c.OAuth.ID
+	default:
+		return "unknown"
+	}
+}
+
+func (c *UserContext) TOTPPending() bool {
+	if c.Provider == ProviderLocal && c.Local != nil {
+		return c.Local.TOTPPending
+	}
+	return false
+}
+
+func (c *UserContext) OAuthName() string {
+	if c.Provider == ProviderOAuth && c.OAuth != nil {
+		return c.OAuth.DisplayName
+	}
+	return ""
+}

internal/model/context_test.go

@@ -0,0 +1,276 @@
+package model_test
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/repository"
+)
+
+func TestContext(t *testing.T) {
+	newGinCtx := func(value any, set bool) *gin.Context {
+		c, _ := gin.CreateTestContext(httptest.NewRecorder())
+		if set {
+			c.Set("context", value)
+		}
+		return c
+	}
+
+	tests := []struct {
+		description string
+		context     *model.UserContext
+		run         func(*testing.T, *model.UserContext) any
+		expected    any
+	}{
+		{
+			description: "IsAuthenticated reflects Authenticated field",
+			context:     &model.UserContext{Authenticated: true},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.IsAuthenticated() },
+			expected:    true,
+		},
+		{
+			description: "IsLocal returns true for ProviderLocal",
+			context:     &model.UserContext{Provider: model.ProviderLocal, Local: &model.LocalContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.IsLocal() },
+			expected:    true,
+		},
+		{
+			description: "IsOAuth returns true for ProviderOAuth",
+			context:     &model.UserContext{Provider: model.ProviderOAuth, OAuth: &model.OAuthContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.IsOAuth() },
+			expected:    true,
+		},
+		{
+			description: "IsLDAP returns true for ProviderLDAP",
+			context:     &model.UserContext{Provider: model.ProviderLDAP, LDAP: &model.LDAPContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.IsLDAP() },
+			expected:    true,
+		},
+		{
+			description: "IsBasicAuth returns true for ProviderBasicAuth",
+			context:     &model.UserContext{Provider: model.ProviderBasicAuth, Local: &model.LocalContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.IsBasicAuth() },
+			expected:    true,
+		},
+		{
+			description: "NewFromSession local session is authenticated and ProviderLocal",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				got, err := c.NewFromSession(&repository.Session{
+					Username: "alice", Email: "alice@example.com", Name: "Alice",
+					Provider: "local",
+				})
+				require.NoError(t, err)
+				return [2]any{got.Provider, got.Authenticated}
+			},
+			expected: [2]any{model.ProviderLocal, true},
+		},
+		{
+			description: "NewFromSession local session with TotpPending is not authenticated",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				got, err := c.NewFromSession(&repository.Session{
+					Username: "bob", Provider: "local", TotpPending: true,
+				})
+				require.NoError(t, err)
+				return got.Authenticated
+			},
+			expected: false,
+		},
+		{
+			description: "NewFromSession ldap session is ProviderLDAP",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				got, err := c.NewFromSession(&repository.Session{
+					Username: "carol", Provider: "ldap",
+				})
+				require.NoError(t, err)
+				return got.Provider
+			},
+			expected: model.ProviderLDAP,
+		},
+		{
+			description: "NewFromSession unknown provider defaults to OAuth and populates oauth fields",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				got, err := c.NewFromSession(&repository.Session{
+					Username: "dave", Provider: "github",
+					OAuthGroups: "devs,admins", OAuthSub: "sub-123", OAuthName: "GitHub",
+				})
+				require.NoError(t, err)
+				return [5]any{got.Provider, got.OAuth.ID, got.OAuth.Sub, got.OAuth.DisplayName, got.OAuth.Groups}
+			},
+			expected: [5]any{model.ProviderOAuth, "github", "sub-123", "GitHub", []string{"devs", "admins"}},
+		},
+		{
+			description: "Local getters return BaseContext fields",
+			context: &model.UserContext{
+				Provider: model.ProviderLocal,
+				Local:    &model.LocalContext{BaseContext: model.BaseContext{Username: "alice", Email: "alice@example.com", Name: "Alice"}},
+			},
+			run: func(t *testing.T, c *model.UserContext) any {
+				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
+			},
+			expected: [3]string{"alice", "alice@example.com", "Alice"},
+		},
+		{
+			description: "BasicAuth getters fall back to local fields",
+			context: &model.UserContext{
+				Provider: model.ProviderBasicAuth,
+				Local:    &model.LocalContext{BaseContext: model.BaseContext{Username: "bob", Email: "bob@example.com", Name: "Bob"}},
+			},
+			run: func(t *testing.T, c *model.UserContext) any {
+				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
+			},
+			expected: [3]string{"bob", "bob@example.com", "Bob"},
+		},
+		{
+			description: "LDAP getters return LDAP fields",
+			context: &model.UserContext{
+				Provider: model.ProviderLDAP,
+				LDAP:     &model.LDAPContext{BaseContext: model.BaseContext{Username: "carol", Email: "carol@example.com", Name: "Carol"}},
+			},
+			run: func(t *testing.T, c *model.UserContext) any {
+				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
+			},
+			expected: [3]string{"carol", "carol@example.com", "Carol"},
+		},
+		{
+			description: "OAuth getters return OAuth fields",
+			context: &model.UserContext{
+				Provider: model.ProviderOAuth,
+				OAuth:    &model.OAuthContext{BaseContext: model.BaseContext{Username: "dave", Email: "dave@example.com", Name: "Dave"}},
+			},
+			run: func(t *testing.T, c *model.UserContext) any {
+				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
+			},
+			expected: [3]string{"dave", "dave@example.com", "Dave"},
+		},
+		{
+			description: "ProviderName returns 'local' for ProviderLocal",
+			context:     &model.UserContext{Provider: model.ProviderLocal},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			expected:    "local",
+		},
+		{
+			description: "ProviderName returns 'local' for ProviderBasicAuth",
+			context:     &model.UserContext{Provider: model.ProviderBasicAuth},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			expected:    "local",
+		},
+		{
+			description: "ProviderName returns 'ldap' for ProviderLDAP",
+			context:     &model.UserContext{Provider: model.ProviderLDAP},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			expected:    "ldap",
+		},
+		{
+			description: "ProviderName returns OAuth provider ID for ProviderOAuth",
+			context: &model.UserContext{
+				Provider: model.ProviderOAuth,
+				OAuth:    &model.OAuthContext{ID: "github"},
+			},
+			run:      func(t *testing.T, c *model.UserContext) any { return c.GetProviderID() },
+			expected: "github",
+		},
+		{
+			description: "TOTPPending returns true when local context is pending",
+			context: &model.UserContext{
+				Provider: model.ProviderLocal,
+				Local:    &model.LocalContext{TOTPPending: true},
+			},
+			run:      func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			expected: true,
+		},
+		{
+			description: "TOTPPending returns false when local context is not pending",
+			context: &model.UserContext{
+				Provider: model.ProviderLocal,
+				Local:    &model.LocalContext{TOTPPending: false},
+			},
+			run:      func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			expected: false,
+		},
+		{
+			description: "TOTPPending returns false for non-local providers",
+			context:     &model.UserContext{Provider: model.ProviderOAuth, OAuth: &model.OAuthContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.TOTPPending() },
+			expected:    false,
+		},
+		{
+			description: "OAuthName returns DisplayName for ProviderOAuth",
+			context: &model.UserContext{
+				Provider: model.ProviderOAuth,
+				OAuth:    &model.OAuthContext{DisplayName: "Google"},
+			},
+			run:      func(t *testing.T, c *model.UserContext) any { return c.OAuthName() },
+			expected: "Google",
+		},
+		{
+			description: "OAuthName returns empty string for non-oauth providers",
+			context:     &model.UserContext{Provider: model.ProviderLocal, Local: &model.LocalContext{}},
+			run:         func(t *testing.T, c *model.UserContext) any { return c.OAuthName() },
+			expected:    "",
+		},
+		{
+			description: "NewFromGin populates context from gin value",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				stored := &model.UserContext{
+					Authenticated: true,
+					Provider:      model.ProviderLocal,
+					Local:         &model.LocalContext{BaseContext: model.BaseContext{Username: "alice"}},
+				}
+				got, err := c.NewFromGin(newGinCtx(stored, true))
+				require.NoError(t, err)
+				return [2]any{got.Authenticated, got.GetUsername()}
+			},
+			expected: [2]any{true, "alice"},
+		},
+		{
+			description: "NewFromGin returns error when context value is missing",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				_, err := c.NewFromGin(newGinCtx(nil, false))
+				return err.Error()
+			},
+			expected: "failed to get user context",
+		},
+		{
+			description: "NewFromGin returns error when context value has wrong type",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				_, err := c.NewFromGin(newGinCtx("not a user context", true))
+				return err.Error()
+			},
+			expected: "invalid user context type",
+		},
+		{
+			description: "NewFromGin returns an error when context doesn't include user information",
+			context:     &model.UserContext{},
+			run: func(t *testing.T, c *model.UserContext) any {
+				_, err := c.NewFromGin(newGinCtx(&model.UserContext{Provider: model.ProviderLocal}, true))
+				return err.Error()
+			},
+			expected: "incomplete user context",
+		},
+		{
+			description: "Getters should not panic if provider context is empty",
+			context:     &model.UserContext{Provider: model.ProviderLocal},
+			run: func(t *testing.T, c *model.UserContext) any {
+				return [3]string{c.GetUsername(), c.GetEmail(), c.GetName()}
+			},
+			expected: [3]string{"", "", ""},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			assert.Equal(t, test.expected, test.run(t, test.context))
+		})
+	}
+}

internal/model/runtime.go

@@ -0,0 +1,22 @@
+package model
+
+type RuntimeConfig struct {
+	AppURL                 string
+	UUID                   string
+	CookieDomain           string
+	SessionCookieName      string
+	CSRFCookieName         string
+	RedirectCookieName     string
+	OAuthSessionCookieName string
+	LocalUsers             []LocalUser
+	OAuthProviders         map[string]OAuthServiceConfig
+	OAuthWhitelist         []string
+	ConfiguredProviders    []Provider
+	OIDCClients            []OIDCClientConfig
+}
+
+type Provider struct {
+	Name  string `json:"name"`
+	ID    string `json:"id"`
+	OAuth bool   `json:"oauth"`
+}

internal/model/users.go

@@ -0,0 +1,25 @@
+package model
+
+type UserSearchType int
+
+const (
+	UserLocal UserSearchType = iota
+	UserLDAP
+)
+
+type LDAPUser struct {
+	DN     string
+	Groups []string
+}
+
+type LocalUser struct {
+	Username   string
+	Password   string
+	TOTPSecret string
+	Attributes UserAttributes
+}
+
+type UserSearch struct {
+	Username string
+	Type     UserSearchType
+}

internal/model/version.go

@@ -0,0 +1,5 @@
+package model
+
+var Version = "development"
+var CommitHash = "development"
+var BuildTimestamp = "0000-00-00T00:00:00Z"

internal/service/access_controls_service.go

@@ -1,22 +1,30 @@
 package service
 
 import (
-	"errors"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
-type AccessControlsService struct {
+type LabelProviderImpl interface {
-	docker *DockerService
+	GetLabels(appDomain string) (*model.App, error)
-	static map[string]config.App
 }
 
-func NewAccessControlsService(docker *DockerService, static map[string]config.App) *AccessControlsService {
+type AccessControlsService struct {
+	log           *logger.Logger
+	labelProvider LabelProviderImpl
+	static        map[string]model.App
+}
+
+func NewAccessControlsService(
+	log *logger.Logger,
+	labelProvider LabelProviderImpl,
+	static map[string]model.App) *AccessControlsService {
 	return &AccessControlsService{
-		docker: docker,
+		log:           log,
-		static: static,
+		labelProvider: labelProvider,
+		static:        static,
 	}
 }
 
@@ -24,31 +32,34 @@ func (acls *AccessControlsService) Init() error {
 	return nil // No initialization needed
 }
 
-func (acls *AccessControlsService) lookupStaticACLs(domain string) (config.App, error) {
+func (acls *AccessControlsService) lookupStaticACLs(domain string) *model.App {
+	var appAcls *model.App
 	for app, config := range acls.static {
 		if config.Config.Domain == domain {
-			tlog.App.Debug().Str("name", app).Msg("Found matching container by domain")
+			acls.log.App.Debug().Str("name", app).Msg("Found matching container by domain")
-			return config, nil
+			appAcls = &config
+			break // If we find a match by domain, we can stop searching
 		}
 
 		if strings.SplitN(domain, ".", 2)[0] == app {
-			tlog.App.Debug().Str("name", app).Msg("Found matching container by app name")
+			acls.log.App.Debug().Str("name", app).Msg("Found matching container by app name")
-			return config, nil
+			appAcls = &config
+			break // If we find a match by app name, we can stop searching
 		}
 	}
-	return config.App{}, errors.New("no results")
+	return appAcls
 }
 
-func (acls *AccessControlsService) GetAccessControls(domain string) (config.App, error) {
+func (acls *AccessControlsService) GetAccessControls(domain string) (*model.App, error) {
 	// First check in the static config
-	app, err := acls.lookupStaticACLs(domain)
+	app := acls.lookupStaticACLs(domain)
 
-	if err == nil {
+	if app != nil {
-		tlog.App.Debug().Msg("Using ACls from static configuration")
+		acls.log.App.Debug().Msg("Using static ACLs for app")
 		return app, nil
 	}
 
-	// Fallback to Docker labels
+	// Fallback to label provider
-	tlog.App.Debug().Msg("Falling back to Docker labels for ACLs")
+	acls.log.App.Debug().Msg("Using label provider for app")
-	return acls.docker.GetLabels(domain)
+	return acls.labelProvider.GetLabels(domain)
 }

internal/service/auth_service.go

@@ -5,20 +5,22 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"net/http"
 	"regexp"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+
+	"slices"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 	"golang.org/x/crypto/bcrypt"
-	"golang.org/x/exp/slices"
 	"golang.org/x/oauth2"
 )
 
@@ -28,6 +30,10 @@ const MaxOAuthPendingSessions = 256
 const OAuthCleanupCount = 16
 const MaxLoginAttemptRecords = 256
 
+var (
+	ErrUserNotFound = errors.New("user not found")
+)
+
 // slightly modified version of the AuthorizeRequest from the OIDC service to basically accept all
 // parameters and pass them to the authorize page if needed
 type OAuthURLParams struct {
@@ -66,41 +72,44 @@ type Lockdown struct {
 	ActiveUntil time.Time
 }
 
-type AuthServiceConfig struct {
-	Users              []config.User
-	OauthWhitelist     []string
-	SessionExpiry      int
-	SessionMaxLifetime int
-	SecureCookie       bool
-	CookieDomain       string
-	LoginTimeout       int
-	LoginMaxRetries    int
-	SessionCookieName  string
-	IP                 config.IPConfig
-	LDAPGroupsCacheTTL int
-}
-
 type AuthService struct {
-	config               AuthServiceConfig
+	log     *logger.Logger
-	docker               *DockerService
+	config  model.Config
+	runtime model.RuntimeConfig
+	context context.Context
+	wg      *sync.WaitGroup
+
+	ldap        *LdapService
+	queries     *repository.Queries
+	oauthBroker *OAuthBrokerService
+
 	loginAttempts        map[string]*LoginAttempt
 	ldapGroupsCache      map[string]*LdapGroupsCache
 	oauthPendingSessions map[string]*OAuthPendingSession
 	oauthMutex           sync.RWMutex
 	loginMutex           sync.RWMutex
 	ldapGroupsMutex      sync.RWMutex
-	ldap                 *LdapService
-	queries              *repository.Queries
-	oauthBroker          *OAuthBrokerService
 	lockdown             *Lockdown
 	lockdownCtx          context.Context
 	lockdownCancelFunc   context.CancelFunc
 }
 
-func NewAuthService(config AuthServiceConfig, docker *DockerService, ldap *LdapService, queries *repository.Queries, oauthBroker *OAuthBrokerService) *AuthService {
+func NewAuthService(
+	log *logger.Logger,
+	config model.Config,
+	runtime model.RuntimeConfig,
+	context context.Context,
+	wg *sync.WaitGroup,
+	ldap *LdapService,
+	queries *repository.Queries,
+	oauthBroker *OAuthBrokerService,
+) *AuthService {
 	return &AuthService{
+		log:                  log,
+		runtime:              runtime,
+		context:              context,
+		wg:                   wg,
 		config:               config,
-		docker:               docker,
 		loginAttempts:        make(map[string]*LoginAttempt),
 		ldapGroupsCache:      make(map[string]*LdapGroupsCache),
 		oauthPendingSessions: make(map[string]*OAuthPendingSession),
@@ -111,83 +120,77 @@ func NewAuthService(config AuthServiceConfig, docker *DockerService, ldap *LdapS
 }
 
 func (auth *AuthService) Init() error {
-	go auth.CleanupOAuthSessionsRoutine()
+	auth.wg.Go(auth.CleanupOAuthSessionsRoutine)
 	return nil
 }
 
-func (auth *AuthService) SearchUser(username string) config.UserSearch {
+func (auth *AuthService) SearchUser(username string) (*model.UserSearch, error) {
-	if auth.GetLocalUser(username).Username != "" {
+	if auth.GetLocalUser(username) != nil {
-		return config.UserSearch{
+		return &model.UserSearch{
 			Username: username,
-			Type:     "local",
+			Type:     model.UserLocal,
-		}
+		}, nil
 	}
 
 	if auth.ldap.IsConfigured() {
 		userDN, err := auth.ldap.GetUserDN(username)
 
 		if err != nil {
-			tlog.App.Warn().Err(err).Str("username", username).Msg("Failed to search for user in LDAP")
+			return nil, fmt.Errorf("failed to get ldap user: %w", err)
-			return config.UserSearch{
-				Type: "unknown",
-			}
 		}
 
-		return config.UserSearch{
+		return &model.UserSearch{
 			Username: userDN,
-			Type:     "ldap",
+			Type:     model.UserLDAP,
-		}
+		}, nil
 	}
 
-	return config.UserSearch{
+	return nil, ErrUserNotFound
-		Type: "unknown",
-	}
 }
 
-func (auth *AuthService) VerifyUser(search config.UserSearch, password string) bool {
+func (auth *AuthService) CheckUserPassword(search model.UserSearch, password string) error {
 	switch search.Type {
-	case "local":
+	case model.UserLocal:
 		user := auth.GetLocalUser(search.Username)
-		return auth.CheckPassword(user, password)
+		if user == nil {
-	case "ldap":
+			return ErrUserNotFound
+		}
+		return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
+	case model.UserLDAP:
 		if auth.ldap.IsConfigured() {
 			err := auth.ldap.Bind(search.Username, password)
 			if err != nil {
-				tlog.App.Warn().Err(err).Str("username", search.Username).Msg("Failed to bind to LDAP")
+				return fmt.Errorf("failed to bind to ldap user: %w", err)
-				return false
 			}
 
 			err = auth.ldap.BindService(true)
 			if err != nil {
-				tlog.App.Error().Err(err).Msg("Failed to rebind with service account after user authentication")
+				return fmt.Errorf("failed to bind to ldap service account: %w", err)
-				return false
 			}
 
-			return true
+			return nil
 		}
 	default:
-		tlog.App.Debug().Str("type", search.Type).Msg("Unknown user type for authentication")
+		return errors.New("unknown user search type")
-		return false
 	}
-
+	return errors.New("user authentication failed")
-	tlog.App.Warn().Str("username", search.Username).Msg("User authentication failed")
-	return false
 }
 
-func (auth *AuthService) GetLocalUser(username string) config.User {
+func (auth *AuthService) GetLocalUser(username string) *model.LocalUser {
-	for _, user := range auth.config.Users {
+	if auth.runtime.LocalUsers == nil {
+		return nil
+	}
+	for _, user := range auth.runtime.LocalUsers {
 		if user.Username == username {
-			return user
+			return &user
 		}
 	}
-
+	return nil
-	tlog.App.Warn().Str("username", username).Msg("Local user not found")
-	return config.User{}
 }
 
-func (auth *AuthService) GetLdapUser(userDN string) (config.LdapUser, error) {
+func (auth *AuthService) GetLDAPUser(userDN string) (*model.LDAPUser, error) {
 	if !auth.ldap.IsConfigured() {
-		return config.LdapUser{}, errors.New("LDAP service not initialized")
+		return nil, errors.New("ldap service not configured")
 	}
 
 	auth.ldapGroupsMutex.RLock()
@@ -195,7 +198,7 @@ func (auth *AuthService) GetLdapUser(userDN string) (config.LdapUser, error) {
 	auth.ldapGroupsMutex.RUnlock()
 
 	if exists && time.Now().Before(entry.Expires) {
-		return config.LdapUser{
+		return &model.LDAPUser{
 			DN:     userDN,
 			Groups: entry.Groups,
 		}, nil
@@ -204,26 +207,22 @@ func (auth *AuthService) GetLdapUser(userDN string) (config.LdapUser, error) {
 	groups, err := auth.ldap.GetUserGroups(userDN)
 
 	if err != nil {
-		return config.LdapUser{}, err
+		return nil, fmt.Errorf("failed to get ldap groups: %w", err)
 	}
 
 	auth.ldapGroupsMutex.Lock()
 	auth.ldapGroupsCache[userDN] = &LdapGroupsCache{
 		Groups:  groups,
-		Expires: time.Now().Add(time.Duration(auth.config.LDAPGroupsCacheTTL) * time.Second),
+		Expires: time.Now().Add(time.Duration(auth.config.LDAP.GroupCacheTTL) * time.Second),
 	}
 	auth.ldapGroupsMutex.Unlock()
 
-	return config.LdapUser{
+	return &model.LDAPUser{
 		DN:     userDN,
 		Groups: groups,
 	}, nil
 }
 
-func (auth *AuthService) CheckPassword(user config.User, password string) bool {
-	return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil
-}
-
 func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
 	auth.loginMutex.RLock()
 	defer auth.loginMutex.RUnlock()
@@ -233,7 +232,7 @@ func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
 		return true, remaining
 	}
 
-	if auth.config.LoginMaxRetries <= 0 || auth.config.LoginTimeout <= 0 {
+	if auth.config.Auth.LoginMaxRetries <= 0 || auth.config.Auth.LoginTimeout <= 0 {
 		return false, 0
 	}
 
@@ -251,7 +250,7 @@ func (auth *AuthService) IsAccountLocked(identifier string) (bool, int) {
 }
 
 func (auth *AuthService) RecordLoginAttempt(identifier string, success bool) {
-	if auth.config.LoginMaxRetries <= 0 || auth.config.LoginTimeout <= 0 {
+	if auth.config.Auth.LoginMaxRetries <= 0 || auth.config.Auth.LoginTimeout <= 0 {
 		return
 	}
 
@@ -282,21 +281,21 @@ func (auth *AuthService) RecordLoginAttempt(identifier string, success bool) {
 
 	attempt.FailedAttempts++
 
-	if attempt.FailedAttempts >= auth.config.LoginMaxRetries {
+	if attempt.FailedAttempts >= auth.config.Auth.LoginMaxRetries {
-		attempt.LockedUntil = time.Now().Add(time.Duration(auth.config.LoginTimeout) * time.Second)
+		attempt.LockedUntil = time.Now().Add(time.Duration(auth.config.Auth.LoginTimeout) * time.Second)
-		tlog.App.Warn().Str("identifier", identifier).Int("timeout", auth.config.LoginTimeout).Msg("Account locked due to too many failed login attempts")
+		auth.log.App.Warn().Str("identifier", identifier).Int("failedAttempts", attempt.FailedAttempts).Msg("Account locked due to too many failed login attempts")
 	}
 }
 
 func (auth *AuthService) IsEmailWhitelisted(email string) bool {
-	return utils.CheckFilter(strings.Join(auth.config.OauthWhitelist, ","), email)
+	return utils.CheckFilter(strings.Join(auth.runtime.OAuthWhitelist, ","), email)
 }
 
-func (auth *AuthService) CreateSessionCookie(c *gin.Context, data *repository.Session) error {
+func (auth *AuthService) CreateSession(ctx context.Context, data repository.Session) (*http.Cookie, error) {
 	uuid, err := uuid.NewRandom()
 
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("failed to generate session uuid: %w", err)
 	}
 
 	var expiry int
@@ -304,9 +303,11 @@ func (auth *AuthService) CreateSessionCookie(c *gin.Context, data *repository.Se
 	if data.TotpPending {
 		expiry = 3600
 	} else {
-		expiry = auth.config.SessionExpiry
+		expiry = auth.config.Auth.SessionExpiry
 	}
 
+	expiresAt := time.Now().Add(time.Duration(expiry) * time.Second)
+
 	session := repository.CreateSessionParams{
 		UUID:        uuid.String(),
 		Username:    data.Username,
@@ -315,53 +316,55 @@ func (auth *AuthService) CreateSessionCookie(c *gin.Context, data *repository.Se
 		Provider:    data.Provider,
 		TotpPending: data.TotpPending,
 		OAuthGroups: data.OAuthGroups,
-		Expiry:      time.Now().Add(time.Duration(expiry) * time.Second).Unix(),
+		Expiry:      expiresAt.Unix(),
 		CreatedAt:   time.Now().Unix(),
 		OAuthName:   data.OAuthName,
 		OAuthSub:    data.OAuthSub,
 	}
 
-	_, err = auth.queries.CreateSession(c, session)
+	_, err = auth.queries.CreateSession(ctx, session)
 
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("failed to create session entry: %w", err)
 	}
 
-	c.SetCookie(auth.config.SessionCookieName, session.UUID, expiry, "/", fmt.Sprintf(".%s", auth.config.CookieDomain), auth.config.SecureCookie, true)
+	return &http.Cookie{
-
+		Name:     auth.runtime.SessionCookieName,
-	return nil
+		Value:    session.UUID,
+		Path:     "/",
+		Domain:   fmt.Sprintf(".%s", auth.runtime.CookieDomain),
+		Expires:  expiresAt,
+		MaxAge:   int(time.Until(expiresAt).Seconds()),
+		Secure:   auth.config.Auth.SecureCookie,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	}, nil
 }
 
-func (auth *AuthService) RefreshSessionCookie(c *gin.Context) error {
+func (auth *AuthService) RefreshSession(ctx context.Context, uuid string) (*http.Cookie, error) {
-	cookie, err := c.Cookie(auth.config.SessionCookieName)
+	session, err := auth.queries.GetSession(ctx, uuid)
 
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("failed to retrieve session: %w", err)
-	}
-
-	session, err := auth.queries.GetSession(c, cookie)
-
-	if err != nil {
-		return err
 	}
 
 	currentTime := time.Now().Unix()
 
 	var refreshThreshold int64
 
-	if auth.config.SessionExpiry <= int(time.Hour.Seconds()) {
+	if auth.config.Auth.SessionExpiry <= int(time.Hour.Seconds()) {
-		refreshThreshold = int64(auth.config.SessionExpiry / 2)
+		refreshThreshold = int64(auth.config.Auth.SessionExpiry / 2)
 	} else {
 		refreshThreshold = int64(time.Hour.Seconds())
 	}
 
 	if session.Expiry-currentTime > refreshThreshold {
-		return nil
+		return nil, nil
 	}
 
 	newExpiry := session.Expiry + refreshThreshold
 
-	_, err = auth.queries.UpdateSession(c, repository.UpdateSessionParams{
+	_, err = auth.queries.UpdateSession(ctx, repository.UpdateSessionParams{
 		Username:    session.Username,
 		Email:       session.Email,
 		Name:        session.Name,
@@ -375,150 +378,166 @@ func (auth *AuthService) RefreshSessionCookie(c *gin.Context) error {
 	})
 
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("failed to update session expiry: %w", err)
 	}
 
-	c.SetCookie(auth.config.SessionCookieName, cookie, int(newExpiry-currentTime), "/", fmt.Sprintf(".%s", auth.config.CookieDomain), auth.config.SecureCookie, true)
+	return &http.Cookie{
-	tlog.App.Trace().Str("username", session.Username).Msg("Session cookie refreshed")
+		Name:     auth.runtime.SessionCookieName,
+		Value:    session.UUID,
+		Path:     "/",
+		Domain:   fmt.Sprintf(".%s", auth.runtime.CookieDomain),
+		Expires:  time.Now().Add(time.Duration(newExpiry-currentTime) * time.Second),
+		MaxAge:   int(newExpiry - currentTime),
+		Secure:   auth.config.Auth.SecureCookie,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	}, nil
 
-	return nil
 }
 
-func (auth *AuthService) DeleteSessionCookie(c *gin.Context) error {
+func (auth *AuthService) DeleteSession(ctx context.Context, uuid string) (*http.Cookie, error) {
-	cookie, err := c.Cookie(auth.config.SessionCookieName)
+	err := auth.queries.DeleteSession(ctx, uuid)
 
 	if err != nil {
-		return err
+		auth.log.App.Error().Err(err).Str("uuid", uuid).Msg("Failed to delete session from database")
 	}
 
-	err = auth.queries.DeleteSession(c, cookie)
+	err = auth.queries.DeleteSession(ctx, uuid)
 
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	c.SetCookie(auth.config.SessionCookieName, "", -1, "/", fmt.Sprintf(".%s", auth.config.CookieDomain), auth.config.SecureCookie, true)
+	return &http.Cookie{
-
+		Name:     auth.runtime.SessionCookieName,
-	return nil
+		Value:    "",
+		Path:     "/",
+		Domain:   fmt.Sprintf(".%s", auth.runtime.CookieDomain),
+		Expires:  time.Now(),
+		MaxAge:   -1,
+		Secure:   auth.config.Auth.SecureCookie,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	}, nil
 }
 
-func (auth *AuthService) GetSessionCookie(c *gin.Context) (repository.Session, error) {
+func (auth *AuthService) GetSession(ctx context.Context, uuid string) (*repository.Session, error) {
-	cookie, err := c.Cookie(auth.config.SessionCookieName)
+	session, err := auth.queries.GetSession(ctx, uuid)
-
-	if err != nil {
-		return repository.Session{}, err
-	}
-
-	session, err := auth.queries.GetSession(c, cookie)
 
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
-			return repository.Session{}, fmt.Errorf("session not found")
+			return nil, errors.New("session not found")
 		}
-		return repository.Session{}, err
+		return nil, err
 	}
 
 	currentTime := time.Now().Unix()
 
-	if auth.config.SessionMaxLifetime != 0 && session.CreatedAt != 0 {
+	if auth.config.Auth.SessionMaxLifetime != 0 && session.CreatedAt != 0 {
-		if currentTime-session.CreatedAt > int64(auth.config.SessionMaxLifetime) {
+		if currentTime-session.CreatedAt > int64(auth.config.Auth.SessionMaxLifetime) {
-			err = auth.queries.DeleteSession(c, cookie)
+			err = auth.queries.DeleteSession(ctx, uuid)
 			if err != nil {
-				tlog.App.Error().Err(err).Msg("Failed to delete session exceeding max lifetime")
+				return nil, fmt.Errorf("failed to delete expired session: %w", err)
 			}
-			return repository.Session{}, fmt.Errorf("session expired due to max lifetime exceeded")
+			return nil, fmt.Errorf("session max lifetime exceeded")
 		}
 	}
 
 	if currentTime > session.Expiry {
-		err = auth.queries.DeleteSession(c, cookie)
+		err = auth.queries.DeleteSession(ctx, uuid)
 		if err != nil {
-			tlog.App.Error().Err(err).Msg("Failed to delete expired session")
+			return nil, fmt.Errorf("failed to delete expired session: %w", err)
 		}
-		return repository.Session{}, fmt.Errorf("session expired")
+		return nil, fmt.Errorf("session expired")
 	}
 
-	return repository.Session{
+	return &session, nil
-		UUID:        session.UUID,
-		Username:    session.Username,
-		Email:       session.Email,
-		Name:        session.Name,
-		Provider:    session.Provider,
-		TotpPending: session.TotpPending,
-		OAuthGroups: session.OAuthGroups,
-		OAuthName:   session.OAuthName,
-		OAuthSub:    session.OAuthSub,
-	}, nil
 }
 
 func (auth *AuthService) LocalAuthConfigured() bool {
-	return len(auth.config.Users) > 0
+	return len(auth.runtime.LocalUsers) > 0
 }
 
-func (auth *AuthService) LdapAuthConfigured() bool {
+func (auth *AuthService) LDAPAuthConfigured() bool {
 	return auth.ldap.IsConfigured()
 }
 
-func (auth *AuthService) IsUserAllowed(c *gin.Context, context config.UserContext, acls config.App) bool {
+func (auth *AuthService) IsUserAllowed(c *gin.Context, context model.UserContext, acls *model.App) bool {
-	if context.OAuth {
+	if acls == nil {
-		tlog.App.Debug().Msg("Checking OAuth whitelist")
+		return true
-		return utils.CheckFilter(acls.OAuth.Whitelist, context.Email)
+	}
+
+	if context.Provider == model.ProviderOAuth {
+		auth.log.App.Debug().Msg("User is an OAuth user, checking OAuth whitelist")
+		return utils.CheckFilter(acls.OAuth.Whitelist, context.OAuth.Email)
 	}
 
 	if acls.Users.Block != "" {
-		tlog.App.Debug().Msg("Checking blocked users")
+		auth.log.App.Debug().Msg("Checking users block list")
-		if utils.CheckFilter(acls.Users.Block, context.Username) {
+		if utils.CheckFilter(acls.Users.Block, context.GetUsername()) {
 			return false
 		}
 	}
 
-	tlog.App.Debug().Msg("Checking users")
+	auth.log.App.Debug().Msg("Checking users allow list")
-	return utils.CheckFilter(acls.Users.Allow, context.Username)
+	return utils.CheckFilter(acls.Users.Allow, context.GetUsername())
 }
 
-func (auth *AuthService) IsInOAuthGroup(c *gin.Context, context config.UserContext, requiredGroups string) bool {
+func (auth *AuthService) IsInOAuthGroup(c *gin.Context, context model.UserContext, acls *model.App) bool {
-	if requiredGroups == "" {
+	if acls == nil {
 		return true
 	}
 
-	for id := range config.OverrideProviders {
+	if !context.IsOAuth() {
-		if context.Provider == id {
+		auth.log.App.Debug().Msg("User is not an OAuth user, skipping OAuth group check")
-			tlog.App.Info().Str("provider", id).Msg("OAuth groups not supported for this provider")
+		return false
-			return true
-		}
 	}
 
-	for userGroup := range strings.SplitSeq(context.OAuthGroups, ",") {
+	if _, ok := model.OverrideProviders[context.OAuth.ID]; ok {
-		if utils.CheckFilter(requiredGroups, strings.TrimSpace(userGroup)) {
+		auth.log.App.Debug().Str("provider", context.OAuth.ID).Msg("Provider override detected, skipping group check")
-			tlog.App.Trace().Str("group", userGroup).Str("required", requiredGroups).Msg("User group matched")
-			return true
-		}
-	}
-
-	tlog.App.Debug().Msg("No groups matched")
-	return false
-}
-
-func (auth *AuthService) IsInLdapGroup(c *gin.Context, context config.UserContext, requiredGroups string) bool {
-	if requiredGroups == "" {
 		return true
 	}
 
-	for userGroup := range strings.SplitSeq(context.LdapGroups, ",") {
+	for _, userGroup := range context.OAuth.Groups {
-		if utils.CheckFilter(requiredGroups, strings.TrimSpace(userGroup)) {
+		if utils.CheckFilter(acls.OAuth.Groups, strings.TrimSpace(userGroup)) {
-			tlog.App.Trace().Str("group", userGroup).Str("required", requiredGroups).Msg("User group matched")
+			auth.log.App.Trace().Str("group", userGroup).Str("required", acls.OAuth.Groups).Msg("User group matched")
 			return true
 		}
 	}
 
-	tlog.App.Debug().Msg("No groups matched")
+	auth.log.App.Debug().Msg("No groups matched")
 	return false
 }
 
-func (auth *AuthService) IsAuthEnabled(uri string, path config.AppPath) (bool, error) {
+func (auth *AuthService) IsInLDAPGroup(c *gin.Context, context model.UserContext, acls *model.App) bool {
+	if acls == nil {
+		return true
+	}
+
+	if !context.IsLDAP() {
+		auth.log.App.Debug().Msg("User is not an LDAP user, skipping LDAP group check")
+		return false
+	}
+
+	for _, userGroup := range context.LDAP.Groups {
+		if utils.CheckFilter(acls.LDAP.Groups, strings.TrimSpace(userGroup)) {
+			auth.log.App.Trace().Str("group", userGroup).Str("required", acls.LDAP.Groups).Msg("User group matched")
+			return true
+		}
+	}
+
+	auth.log.App.Debug().Msg("No groups matched")
+	return false
+}
+
+func (auth *AuthService) IsAuthEnabled(uri string, acls *model.App) (bool, error) {
+	if acls == nil {
+		return true, nil
+	}
+
 	// Check for block list
-	if path.Block != "" {
+	if acls.Path.Block != "" {
-		regex, err := regexp.Compile(path.Block)
+		regex, err := regexp.Compile(acls.Path.Block)
 
 		if err != nil {
 			return true, err
@@ -530,8 +549,8 @@ func (auth *AuthService) IsAuthEnabled(uri string, path config.AppPath) (bool, e
 	}
 
 	// Check for allow list
-	if path.Allow != "" {
+	if acls.Path.Allow != "" {
-		regex, err := regexp.Compile(path.Allow)
+		regex, err := regexp.Compile(acls.Path.Allow)
 
 		if err != nil {
 			return true, err
@@ -545,31 +564,23 @@ func (auth *AuthService) IsAuthEnabled(uri string, path config.AppPath) (bool, e
 	return true, nil
 }
 
-func (auth *AuthService) GetBasicAuth(c *gin.Context) *config.User {
+func (auth *AuthService) CheckIP(ip string, acls *model.App) bool {
-	username, password, ok := c.Request.BasicAuth()
+	if acls == nil {
-	if !ok {
+		return true
-		tlog.App.Debug().Msg("No basic auth provided")
-		return nil
 	}
-	return &config.User{
-		Username: username,
-		Password: password,
-	}
-}
 
-func (auth *AuthService) CheckIP(acls config.AppIP, ip string) bool {
 	// Merge the global and app IP filter
-	blockedIps := append(auth.config.IP.Block, acls.Block...)
+	blockedIps := append(auth.config.Auth.IP.Block, acls.IP.Block...)
-	allowedIPs := append(auth.config.IP.Allow, acls.Allow...)
+	allowedIPs := append(auth.config.Auth.IP.Allow, acls.IP.Allow...)
 
 	for _, blocked := range blockedIps {
 		res, err := utils.FilterIP(blocked, ip)
 		if err != nil {
-			tlog.App.Warn().Err(err).Str("item", blocked).Msg("Invalid IP/CIDR in block list")
+			auth.log.App.Warn().Err(err).Str("item", blocked).Msg("Invalid IP/CIDR in block list")
 			continue
 		}
 		if res {
-			tlog.App.Debug().Str("ip", ip).Str("item", blocked).Msg("IP is in blocked list, denying access")
+			auth.log.App.Debug().Str("ip", ip).Str("item", blocked).Msg("IP is in block list, denying access")
 			return false
 		}
 	}
@@ -577,38 +588,42 @@ func (auth *AuthService) CheckIP(acls config.AppIP, ip string) bool {
 	for _, allowed := range allowedIPs {
 		res, err := utils.FilterIP(allowed, ip)
 		if err != nil {
-			tlog.App.Warn().Err(err).Str("item", allowed).Msg("Invalid IP/CIDR in allow list")
+			auth.log.App.Warn().Err(err).Str("item", allowed).Msg("Invalid IP/CIDR in allow list")
 			continue
 		}
 		if res {
-			tlog.App.Debug().Str("ip", ip).Str("item", allowed).Msg("IP is in allowed list, allowing access")
+			auth.log.App.Debug().Str("ip", ip).Str("item", allowed).Msg("IP is in allow list, allowing access")
 			return true
 		}
 	}
 
 	if len(allowedIPs) > 0 {
-		tlog.App.Debug().Str("ip", ip).Msg("IP not in allow list, denying access")
+		auth.log.App.Debug().Str("ip", ip).Msg("IP not in allow list, denying access")
 		return false
 	}
 
-	tlog.App.Debug().Str("ip", ip).Msg("IP not in allow or block list, allowing by default")
+	auth.log.App.Debug().Str("ip", ip).Msg("IP not in any block or allow list, allowing access by default")
 	return true
 }
 
-func (auth *AuthService) IsBypassedIP(acls config.AppIP, ip string) bool {
+func (auth *AuthService) IsBypassedIP(ip string, acls *model.App) bool {
-	for _, bypassed := range acls.Bypass {
+	if acls == nil {
+		return false
+	}
+
+	for _, bypassed := range acls.IP.Bypass {
 		res, err := utils.FilterIP(bypassed, ip)
 		if err != nil {
-			tlog.App.Warn().Err(err).Str("item", bypassed).Msg("Invalid IP/CIDR in bypass list")
+			auth.log.App.Warn().Err(err).Str("item", bypassed).Msg("Invalid IP/CIDR in bypass list")
 			continue
 		}
 		if res {
-			tlog.App.Debug().Str("ip", ip).Str("item", bypassed).Msg("IP is in bypass list, allowing access")
+			auth.log.App.Debug().Str("ip", ip).Str("item", bypassed).Msg("IP is in bypass list, skipping authentication")
 			return true
 		}
 	}
 
-	tlog.App.Debug().Str("ip", ip).Msg("IP not in bypass list, continuing with authentication")
+	auth.log.App.Debug().Str("ip", ip).Msg("IP not in bypass list, proceeding with authentication")
 	return false
 }
 
@@ -675,21 +690,21 @@ func (auth *AuthService) GetOAuthToken(sessionId string, code string) (*oauth2.T
 	return token, nil
 }
 
-func (auth *AuthService) GetOAuthUserinfo(sessionId string) (config.Claims, error) {
+func (auth *AuthService) GetOAuthUserinfo(sessionId string) (*model.Claims, error) {
 	session, err := auth.GetOAuthPendingSession(sessionId)
 
 	if err != nil {
-		return config.Claims{}, err
+		return nil, err
 	}
 
 	if session.Token == nil {
-		return config.Claims{}, fmt.Errorf("oauth token not found for session: %s", sessionId)
+		return nil, fmt.Errorf("oauth token not found for session: %s", sessionId)
 	}
 
 	userinfo, err := (*session.Service).GetUserinfo(session.Token)
 
 	if err != nil {
-		return config.Claims{}, fmt.Errorf("failed to get userinfo: %w", err)
+		return nil, fmt.Errorf("failed to get userinfo: %w", err)
 	}
 
 	return userinfo, nil
@@ -712,21 +727,32 @@ func (auth *AuthService) EndOAuthSession(sessionId string) {
 }
 
 func (auth *AuthService) CleanupOAuthSessionsRoutine() {
+	auth.log.App.Debug().Msg("Starting OAuth session cleanup routine")
+
 	ticker := time.NewTicker(30 * time.Minute)
 	defer ticker.Stop()
 
-	for range ticker.C {
+	for {
-		auth.oauthMutex.Lock()
+		select {
+		case <-ticker.C:
+			auth.log.App.Debug().Msg("Running OAuth session cleanup")
 
-		now := time.Now()
+			auth.oauthMutex.Lock()
 
-		for sessionId, session := range auth.oauthPendingSessions {
+			now := time.Now()
-			if now.After(session.ExpiresAt) {
+
-				delete(auth.oauthPendingSessions, sessionId)
+			for sessionId, session := range auth.oauthPendingSessions {
+				if now.After(session.ExpiresAt) {
+					delete(auth.oauthPendingSessions, sessionId)
+				}
 			}
-		}
 
-		auth.oauthMutex.Unlock()
+			auth.oauthMutex.Unlock()
+			auth.log.App.Debug().Msg("OAuth session cleanup completed")
+		case <-auth.context.Done():
+			auth.log.App.Debug().Msg("Stopping OAuth session cleanup routine")
+			return
+		}
 	}
 }
 
@@ -795,11 +821,11 @@ func (auth *AuthService) lockdownMode() {
 
 	auth.loginMutex.Lock()
 
-	tlog.App.Warn().Msg("Multiple login attempts detected, possibly DDOS attack. Activating temporary lockdown.")
+	auth.log.App.Warn().Msg("Too many failed login attempts, entering lockdown mode")
 
 	auth.lockdown = &Lockdown{
 		Active:      true,
-		ActiveUntil: time.Now().Add(time.Duration(auth.config.LoginTimeout) * time.Second),
+		ActiveUntil: time.Now().Add(time.Duration(auth.config.Auth.LoginTimeout) * time.Second),
 	}
 
 	// At this point all login attemps will also expire so,
@@ -816,11 +842,14 @@ func (auth *AuthService) lockdownMode() {
 		// Timer expired, end lockdown
 	case <-ctx.Done():
 		// Context cancelled, end lockdown
+	case <-auth.context.Done():
+		// Service is shutting down, end lockdown
 	}
 
 	auth.loginMutex.Lock()
 
-	tlog.App.Info().Msg("Lockdown period ended, resuming normal operation")
+	auth.log.App.Info().Msg("Exiting lockdown mode")
+
 	auth.lockdown = nil
 	auth.loginMutex.Unlock()
 }

internal/service/docker_service.go

@@ -3,23 +3,35 @@ package service
 import (
 	"context"
 	"strings"
+	"sync"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/decoders"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 
 	container "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
 )
 
 type DockerService struct {
-	client      *client.Client
+	log     *logger.Logger
-	context     context.Context
+	client  *client.Client
+	context context.Context
+	wg      *sync.WaitGroup
+
 	isConnected bool
 }
 
-func NewDockerService() *DockerService {
+func NewDockerService(
-	return &DockerService{}
+	log *logger.Logger,
+	context context.Context,
+	wg *sync.WaitGroup,
+) *DockerService {
+	return &DockerService{
+		log:     log,
+		context: context,
+		wg:      wg,
+	}
 }
 
 func (docker *DockerService) Init() error {
@@ -28,16 +40,14 @@ func (docker *DockerService) Init() error {
 		return err
 	}
 
-	ctx := context.Background()
+	client.NegotiateAPIVersion(docker.context)
-	client.NegotiateAPIVersion(ctx)
 
 	docker.client = client
-	docker.context = ctx
 
 	_, err = docker.client.Ping(docker.context)
 
 	if err != nil {
-		tlog.App.Debug().Err(err).Msg("Docker not connected")
+		docker.log.App.Debug().Err(err).Msg("Docker not connected")
 		docker.isConnected = false
 		docker.client = nil
 		docker.context = nil
@@ -45,62 +55,67 @@ func (docker *DockerService) Init() error {
 	}
 
 	docker.isConnected = true
-	tlog.App.Debug().Msg("Docker connected")
+	docker.log.App.Debug().Msg("Docker connected successfully")
+
+	docker.wg.Go(docker.watchAndClose)
 
 	return nil
 }
 
 func (docker *DockerService) getContainers() ([]container.Summary, error) {
-	containers, err := docker.client.ContainerList(docker.context, container.ListOptions{})
+	return docker.client.ContainerList(docker.context, container.ListOptions{})
-	if err != nil {
-		return nil, err
-	}
-	return containers, nil
 }
 
 func (docker *DockerService) inspectContainer(containerId string) (container.InspectResponse, error) {
-	inspect, err := docker.client.ContainerInspect(docker.context, containerId)
+	return docker.client.ContainerInspect(docker.context, containerId)
-	if err != nil {
-		return container.InspectResponse{}, err
-	}
-	return inspect, nil
 }
 
-func (docker *DockerService) GetLabels(appDomain string) (config.App, error) {
+func (docker *DockerService) GetLabels(appDomain string) (*model.App, error) {
 	if !docker.isConnected {
-		tlog.App.Debug().Msg("Docker not connected, returning empty labels")
+		docker.log.App.Debug().Msg("Docker service not connected, returning empty labels")
-		return config.App{}, nil
+		return nil, nil
 	}
 
 	containers, err := docker.getContainers()
 	if err != nil {
-		return config.App{}, err
+		return nil, err
 	}
 
 	for _, ctr := range containers {
 		inspect, err := docker.inspectContainer(ctr.ID)
 		if err != nil {
-			return config.App{}, err
+			return nil, err
 		}
 
-		labels, err := decoders.DecodeLabels[config.Apps](inspect.Config.Labels, "apps")
+		labels, err := decoders.DecodeLabels[model.Apps](inspect.Config.Labels, "apps")
 		if err != nil {
-			return config.App{}, err
+			return nil, err
 		}
 
 		for appName, appLabels := range labels.Apps {
 			if appLabels.Config.Domain == appDomain {
-				tlog.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by domain")
+				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by domain")
-				return appLabels, nil
+				return &appLabels, nil
 			}
 
 			if strings.SplitN(appDomain, ".", 2)[0] == appName {
-				tlog.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by app name")
+				docker.log.App.Debug().Str("id", inspect.ID).Str("name", inspect.Name).Msg("Found matching container by app name")
-				return appLabels, nil
+				return &appLabels, nil
 			}
 		}
 	}
 
-	tlog.App.Debug().Msg("No matching container found, returning empty labels")
+	docker.log.App.Debug().Str("domain", appDomain).Msg("No matching container found for domain")
-	return config.App{}, nil
+	return nil, nil
+}
+
+func (docker *DockerService) watchAndClose() {
+	<-docker.context.Done()
+	docker.log.App.Debug().Msg("Closing Docker client")
+	if docker.client != nil {
+		err := docker.client.Close()
+		if err != nil {
+			docker.log.App.Error().Err(err).Msg("Error closing Docker client")
+		}
+	}
 }

internal/service/kubernetes_service.go

@@ -0,0 +1,316 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils/decoders"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
+)
+
+type ingressKey struct {
+	namespace string
+	name      string
+}
+
+type ingressAppKey struct {
+	ingressKey
+	appName string
+}
+
+type ingressApp struct {
+	domain  string
+	appName string
+	app     model.App
+}
+
+type KubernetesService struct {
+	log *logger.Logger
+	ctx context.Context
+	wg  *sync.WaitGroup
+
+	client       dynamic.Interface
+	started      bool
+	mu           sync.RWMutex
+	ingressApps  map[ingressKey][]ingressApp
+	domainIndex  map[string]ingressAppKey
+	appNameIndex map[string]ingressAppKey
+}
+
+func NewKubernetesService(
+	log *logger.Logger,
+	context context.Context,
+	wg *sync.WaitGroup,
+) *KubernetesService {
+	return &KubernetesService{
+		log:          log,
+		ctx:          context,
+		wg:           wg,
+		ingressApps:  make(map[ingressKey][]ingressApp),
+		domainIndex:  make(map[string]ingressAppKey),
+		appNameIndex: make(map[string]ingressAppKey),
+	}
+}
+
+func (k *KubernetesService) addIngressApps(namespace, name string, apps []ingressApp) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+
+	key := ingressKey{namespace, name}
+	// Remove existing entries for this ingress
+	if existing, ok := k.ingressApps[key]; ok {
+		for _, app := range existing {
+			delete(k.domainIndex, app.domain)
+			delete(k.appNameIndex, app.appName)
+		}
+	}
+	// Add new entries
+	k.ingressApps[key] = apps
+	for _, app := range apps {
+		appKey := ingressAppKey{key, app.appName}
+		k.domainIndex[app.domain] = appKey
+		k.appNameIndex[app.appName] = appKey
+	}
+}
+
+func (k *KubernetesService) removeIngress(namespace, name string) {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+
+	key := ingressKey{namespace, name}
+	if apps, ok := k.ingressApps[key]; ok {
+		for _, app := range apps {
+			delete(k.domainIndex, app.domain)
+			delete(k.appNameIndex, app.appName)
+		}
+		delete(k.ingressApps, key)
+	}
+}
+
+func (k *KubernetesService) getByDomain(domain string) *model.App {
+	k.mu.RLock()
+	defer k.mu.RUnlock()
+
+	if appKey, ok := k.domainIndex[domain]; ok {
+		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
+			for i := range apps {
+				app := &apps[i]
+				if app.domain == domain && app.appName == appKey.appName {
+					return &app.app
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (k *KubernetesService) getByAppName(appName string) *model.App {
+	k.mu.RLock()
+	defer k.mu.RUnlock()
+
+	if appKey, ok := k.appNameIndex[appName]; ok {
+		if apps, ok := k.ingressApps[appKey.ingressKey]; ok {
+			for i := range apps {
+				app := &apps[i]
+				if app.appName == appName {
+					return &app.app
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (k *KubernetesService) updateFromItem(item *unstructured.Unstructured) {
+	namespace := item.GetNamespace()
+	name := item.GetName()
+	annotations := item.GetAnnotations()
+	if annotations == nil {
+		k.removeIngress(namespace, name)
+		return
+	}
+	labels, err := decoders.DecodeLabels[model.Apps](annotations, "apps")
+	if err != nil {
+		k.log.App.Warn().Err(err).Str("namespace", namespace).Str("name", name).Msg("Failed to decode ingress labels, skipping")
+		k.removeIngress(namespace, name)
+		return
+	}
+	var apps []ingressApp
+	for appName, appLabels := range labels.Apps {
+		if appLabels.Config.Domain == "" {
+			continue
+		}
+		apps = append(apps, ingressApp{
+			domain:  appLabels.Config.Domain,
+			appName: appName,
+			app:     appLabels,
+		})
+	}
+	if len(apps) == 0 {
+		k.removeIngress(namespace, name)
+	} else {
+		k.addIngressApps(namespace, name, apps)
+	}
+}
+
+func (k *KubernetesService) resyncGVR(gvr schema.GroupVersionResource) error {
+	ctx, cancel := context.WithTimeout(k.ctx, 30*time.Second)
+	defer cancel()
+
+	list, err := k.client.Resource(gvr).List(ctx, metav1.ListOptions{})
+	if err != nil {
+		k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Failed to list resources for resync")
+		return err
+	}
+	for i := range list.Items {
+		k.updateFromItem(&list.Items[i])
+	}
+	k.log.App.Debug().Str("api", gvr.GroupVersion().String()).Int("count", len(list.Items)).Msg("Resync complete")
+	return nil
+}
+
+// runWatcher drains events from an active watcher until it closes or the context is done.
+// Returns true if the caller should restart the watcher, false if it should exit.
+func (k *KubernetesService) runWatcher(gvr schema.GroupVersionResource, w watch.Interface, resyncTicker *time.Ticker) bool {
+	for {
+		select {
+		case <-k.ctx.Done():
+			w.Stop()
+			return false
+		case event, ok := <-w.ResultChan():
+			if !ok {
+				k.log.App.Warn().Str("api", gvr.GroupVersion().String()).Msg("Watcher channel closed, restarting watcher")
+				w.Stop()
+				time.Sleep(5 * time.Second)
+				return true
+			}
+			item, ok := event.Object.(*unstructured.Unstructured)
+			if !ok {
+				k.log.App.Warn().Str("api", gvr.GroupVersion().String()).Msg("Received unexpected event object, skipping")
+				continue
+			}
+			switch event.Type {
+			case watch.Added, watch.Modified:
+				k.updateFromItem(item)
+			case watch.Deleted:
+				k.removeIngress(item.GetNamespace(), item.GetName())
+			}
+		case <-resyncTicker.C:
+			if err := k.resyncGVR(gvr); err != nil {
+				k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Periodic resync failed during watcher run")
+			}
+		}
+	}
+}
+
+func (k *KubernetesService) watchGVR(gvr schema.GroupVersionResource) {
+	resyncTicker := time.NewTicker(5 * time.Minute)
+	defer resyncTicker.Stop()
+
+	if err := k.resyncGVR(gvr); err != nil {
+		k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Initial resync failed, will retry")
+		time.Sleep(30 * time.Second)
+	}
+
+	for {
+		select {
+		case <-k.ctx.Done():
+			k.log.App.Debug().Str("api", gvr.GroupVersion().String()).Msg("Context cancelled, stopping watcher")
+			return
+		case <-resyncTicker.C:
+			if err := k.resyncGVR(gvr); err != nil {
+				k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Periodic resync failed, will retry")
+			}
+		default:
+			ctx, cancel := context.WithCancel(k.ctx)
+			watcher, err := k.client.Resource(gvr).Watch(ctx, metav1.ListOptions{})
+			if err != nil {
+				k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Failed to start watcher, will retry")
+				cancel()
+				time.Sleep(10 * time.Second)
+				continue
+			}
+			k.log.App.Debug().Str("api", gvr.GroupVersion().String()).Msg("Watcher started successfully")
+			if !k.runWatcher(gvr, watcher, resyncTicker) {
+				cancel()
+				return
+			}
+			cancel()
+		}
+	}
+}
+
+func (k *KubernetesService) Init() error {
+	var cfg *rest.Config
+	var err error
+
+	cfg, err = rest.InClusterConfig()
+	if err != nil {
+		return fmt.Errorf("failed to get in-cluster Kubernetes config: %w", err)
+	}
+
+	client, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to create Kubernetes client: %w", err)
+	}
+
+	k.client = client
+	gvr := schema.GroupVersionResource{
+		Group:    "networking.k8s.io",
+		Version:  "v1",
+		Resource: "ingresses",
+	}
+
+	accessCtx, accessCancel := context.WithTimeout(k.ctx, 5*time.Second)
+	defer accessCancel()
+
+	_, err = k.client.Resource(gvr).List(accessCtx, metav1.ListOptions{Limit: 1})
+	if err != nil {
+		k.log.App.Warn().Err(err).Str("api", gvr.GroupVersion().String()).Msg("Failed to access Ingress API, Kubernetes label provider will be disabled")
+		k.started = false
+		return nil
+	}
+
+	k.log.App.Debug().Str("api", gvr.GroupVersion().String()).Msg("Successfully accessed Ingress API, starting watcher")
+	k.wg.Go(func() {
+		k.watchGVR(gvr)
+	})
+
+	k.started = true
+	k.log.App.Debug().Msg("Kubernetes label provider started successfully")
+	return nil
+}
+
+func (k *KubernetesService) GetLabels(appDomain string) (*model.App, error) {
+	if !k.started {
+		k.log.App.Debug().Str("domain", appDomain).Msg("Kubernetes label provider not started, skipping")
+		return nil, nil
+	}
+
+	// First check cache
+	app := k.getByDomain(appDomain)
+	if app != nil {
+		k.log.App.Debug().Str("domain", appDomain).Msg("Found labels in cache by domain")
+		return app, nil
+	}
+	appName := strings.SplitN(appDomain, ".", 2)[0]
+	app = k.getByAppName(appName)
+	if app != nil {
+		k.log.App.Debug().Str("domain", appDomain).Str("appName", appName).Msg("Found labels in cache by app name")
+		return app, nil
+	}
+
+	k.log.App.Debug().Str("domain", appDomain).Msg("No labels found for domain")
+	return nil, nil
+}

internal/service/kubernetes_service_test.go

@@ -0,0 +1,186 @@
+package service
+
+import (
+	"testing"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+)
+
+func TestKubernetesService(t *testing.T) {
+	type testCase struct {
+		description string
+		run         func(t *testing.T, svc *KubernetesService)
+	}
+
+	tests := []testCase{
+		{
+			description: "Cache by domain returns app and misses unknown domain",
+			run: func(t *testing.T, svc *KubernetesService) {
+				app := model.App{Config: model.AppConfig{Domain: "foo.example.com"}}
+				svc.addIngressApps("default", "my-ingress", []ingressApp{
+					{domain: "foo.example.com", appName: "foo", app: app},
+				})
+
+				got := svc.getByDomain("foo.example.com")
+				require.NotNil(t, got)
+				assert.Equal(t, "foo.example.com", got.Config.Domain)
+
+				got = svc.getByDomain("notfound.example.com")
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "Cache by app name returns app and misses unknown name",
+			run: func(t *testing.T, svc *KubernetesService) {
+				app := model.App{Config: model.AppConfig{Domain: "bar.example.com"}}
+				svc.addIngressApps("default", "my-ingress", []ingressApp{
+					{domain: "bar.example.com", appName: "bar", app: app},
+				})
+
+				got := svc.getByAppName("bar")
+				require.NotNil(t, got)
+				assert.Equal(t, "bar.example.com", got.Config.Domain)
+
+				got = svc.getByAppName("notfound")
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "RemoveIngress clears domain and app name entries",
+			run: func(t *testing.T, svc *KubernetesService) {
+				app := model.App{Config: model.AppConfig{Domain: "baz.example.com"}}
+				svc.addIngressApps("default", "my-ingress", []ingressApp{
+					{domain: "baz.example.com", appName: "baz", app: app},
+				})
+
+				svc.removeIngress("default", "my-ingress")
+
+				got := svc.getByDomain("baz.example.com")
+				assert.Nil(t, got)
+				got = svc.getByAppName("baz")
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "AddIngressApps replaces stale entries for the same ingress",
+			run: func(t *testing.T, svc *KubernetesService) {
+				old := model.App{Config: model.AppConfig{Domain: "old.example.com"}}
+				svc.addIngressApps("default", "my-ingress", []ingressApp{
+					{domain: "old.example.com", appName: "old", app: old},
+				})
+
+				updated := model.App{Config: model.AppConfig{Domain: "new.example.com"}}
+				svc.addIngressApps("default", "my-ingress", []ingressApp{
+					{domain: "new.example.com", appName: "new", app: updated},
+				})
+
+				got := svc.getByDomain("old.example.com")
+				assert.Nil(t, got)
+
+				got = svc.getByDomain("new.example.com")
+				require.NotNil(t, got)
+				assert.Equal(t, "new.example.com", got.Config.Domain)
+			},
+		},
+		{
+			description: "GetLabels returns app from cache when started",
+			run: func(t *testing.T, svc *KubernetesService) {
+				svc.started = true
+
+				app := model.App{Config: model.AppConfig{Domain: "hit.example.com"}}
+				svc.addIngressApps("default", "ing", []ingressApp{
+					{domain: "hit.example.com", appName: "hit", app: app},
+				})
+
+				got, err := svc.GetLabels("hit.example.com")
+				require.NoError(t, err)
+				assert.Equal(t, "hit.example.com", got.Config.Domain)
+			},
+		},
+		{
+			description: "GetLabels returns empty app on cache miss when started",
+			run: func(t *testing.T, svc *KubernetesService) {
+				svc.started = true
+
+				got, err := svc.GetLabels("notfound.example.com")
+				require.NoError(t, err)
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "GetLabels resolves app by app name",
+			run: func(t *testing.T, svc *KubernetesService) {
+				svc.started = true
+
+				app := model.App{Config: model.AppConfig{Domain: "myapp.internal.example.com"}}
+				svc.addIngressApps("default", "ing", []ingressApp{
+					{domain: "myapp.internal.example.com", appName: "myapp", app: app},
+				})
+
+				got, err := svc.GetLabels("myapp.internal.example.com")
+				require.NoError(t, err)
+				assert.Equal(t, "myapp.internal.example.com", got.Config.Domain)
+			},
+		},
+		{
+			description: "GetLabels returns empty app when service not yet started",
+			run: func(t *testing.T, svc *KubernetesService) {
+				got, err := svc.GetLabels("anything.example.com")
+				require.NoError(t, err)
+				assert.Nil(t, got)
+			},
+		},
+		{
+			description: "UpdateFromItem parses annotations and populates cache",
+			run: func(t *testing.T, svc *KubernetesService) {
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+				item.SetAnnotations(map[string]string{
+					"tinyauth.apps.myapp.config.domain": "myapp.example.com",
+					"tinyauth.apps.myapp.users.allow":   "alice",
+				})
+
+				svc.updateFromItem(&item)
+
+				got := svc.getByDomain("myapp.example.com")
+				require.NotNil(t, got)
+				assert.Equal(t, "myapp.example.com", got.Config.Domain)
+				assert.Equal(t, "alice", got.Users.Allow)
+			},
+		},
+		{
+			description: "UpdateFromItem with no annotations removes existing cache entries",
+			run: func(t *testing.T, svc *KubernetesService) {
+				app := model.App{Config: model.AppConfig{Domain: "todelete.example.com"}}
+				svc.addIngressApps("default", "test-ingress", []ingressApp{
+					{domain: "todelete.example.com", appName: "todelete", app: app},
+				})
+
+				item := unstructured.Unstructured{}
+				item.SetNamespace("default")
+				item.SetName("test-ingress")
+
+				svc.updateFromItem(&item)
+
+				got := svc.getByDomain("todelete.example.com")
+				assert.Nil(t, got)
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			svc := &KubernetesService{
+				ingressApps:  make(map[ingressKey][]ingressApp),
+				domainIndex:  make(map[string]ingressAppKey),
+				appNameIndex: make(map[string]ingressAppKey),
+			}
+			test.run(t, svc)
+		})
+	}
+}

internal/service/ldap_service.go

@@ -9,31 +9,33 @@ import (
 
 	"github.com/cenkalti/backoff/v5"
 	ldapgo "github.com/go-ldap/ldap/v3"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
 )
 
-type LdapServiceConfig struct {
-	Address      string
-	BindDN       string
-	BindPassword string
-	BaseDN       string
-	Insecure     bool
-	SearchFilter string
-	AuthCert     string
-	AuthKey      string
-}
-
 type LdapService struct {
-	config       LdapServiceConfig
+	log     *logger.Logger
+	config  model.Config
+	context context.Context
+	wg      *sync.WaitGroup
+
 	conn         *ldapgo.Conn
 	mutex        sync.RWMutex
 	cert         *tls.Certificate
 	isConfigured bool
 }
 
-func NewLdapService(config LdapServiceConfig) *LdapService {
+func NewLdapService(
+	log *logger.Logger,
+	config model.Config,
+	context context.Context,
+	wg *sync.WaitGroup,
+) *LdapService {
 	return &LdapService{
-		config: config,
+		log:     log,
+		config:  config,
+		context: context,
+		wg:      wg,
 	}
 }
 
@@ -57,7 +59,7 @@ func (ldap *LdapService) Unconfigure() error {
 }
 
 func (ldap *LdapService) Init() error {
-	if ldap.config.Address == "" {
+	if ldap.config.LDAP.Address == "" {
 		ldap.isConfigured = false
 		return nil
 	}
@@ -65,13 +67,13 @@ func (ldap *LdapService) Init() error {
 	ldap.isConfigured = true
 
 	// Check whether authentication with client certificate is possible
-	if ldap.config.AuthCert != "" && ldap.config.AuthKey != "" {
+	if ldap.config.LDAP.AuthCert != "" && ldap.config.LDAP.AuthKey != "" {
-		cert, err := tls.LoadX509KeyPair(ldap.config.AuthCert, ldap.config.AuthKey)
+		cert, err := tls.LoadX509KeyPair(ldap.config.LDAP.AuthCert, ldap.config.LDAP.AuthKey)
 		if err != nil {
 			return fmt.Errorf("failed to initialize LDAP with mTLS authentication: %w", err)
 		}
 		ldap.cert = &cert
-		tlog.App.Info().Msg("Using LDAP with mTLS authentication")
+		ldap.log.App.Info().Msg("LDAP mTLS authentication configured successfully")
 
 		// TODO: Add optional extra CA certificates, instead of `InsecureSkipVerify`
 		/*
@@ -89,19 +91,30 @@ func (ldap *LdapService) Init() error {
 		return fmt.Errorf("failed to connect to LDAP server: %w", err)
 	}
 
-	go func() {
+	ldap.wg.Go(func() {
-		for range time.Tick(time.Duration(5) * time.Minute) {
+		ldap.log.App.Debug().Msg("Starting LDAP connection heartbeat routine")
-			err := ldap.heartbeat()
+
-			if err != nil {
+		ticker := time.NewTicker(5 * time.Minute)
-				tlog.App.Error().Err(err).Msg("LDAP connection heartbeat failed")
+		defer ticker.Stop()
-				if reconnectErr := ldap.reconnect(); reconnectErr != nil {
+
-					tlog.App.Error().Err(reconnectErr).Msg("Failed to reconnect to LDAP server")
+		for {
-					continue
+			select {
+			case <-ticker.C:
+				err := ldap.heartbeat()
+				if err != nil {
+					ldap.log.App.Warn().Err(err).Msg("LDAP connection heartbeat failed, attempting to reconnect")
+					if reconnectErr := ldap.reconnect(); reconnectErr != nil {
+						ldap.log.App.Error().Err(reconnectErr).Msg("Failed to reconnect to LDAP server")
+						continue
+					}
+					ldap.log.App.Info().Msg("Successfully reconnected to LDAP server")
 				}
-				tlog.App.Info().Msg("Successfully reconnected to LDAP server")
+			case <-ldap.context.Done():
+				ldap.log.App.Debug().Msg("LDAP service context cancelled, stopping heartbeat")
+				return
 			}
 		}
-	}()
+	})
 
 	return nil
 }
@@ -120,13 +133,13 @@ func (ldap *LdapService) connect() (*ldapgo.Conn, error) {
 	// 2. conn.StartTLS(tlsConfig)
 	// 3. conn.externalBind()
 	if ldap.cert != nil {
-		conn, err = ldapgo.DialURL(ldap.config.Address, ldapgo.DialWithTLSConfig(&tls.Config{
+		conn, err = ldapgo.DialURL(ldap.config.LDAP.Address, ldapgo.DialWithTLSConfig(&tls.Config{
 			MinVersion:   tls.VersionTLS12,
 			Certificates: []tls.Certificate{*ldap.cert},
 		}))
 	} else {
-		conn, err = ldapgo.DialURL(ldap.config.Address, ldapgo.DialWithTLSConfig(&tls.Config{
+		conn, err = ldapgo.DialURL(ldap.config.LDAP.Address, ldapgo.DialWithTLSConfig(&tls.Config{
-			InsecureSkipVerify: ldap.config.Insecure,
+			InsecureSkipVerify: ldap.config.LDAP.Insecure,
 			MinVersion:         tls.VersionTLS12,
 		}))
 	}
@@ -146,10 +159,10 @@ func (ldap *LdapService) connect() (*ldapgo.Conn, error) {
 func (ldap *LdapService) GetUserDN(username string) (string, error) {
 	// Escape the username to prevent LDAP injection
 	escapedUsername := ldapgo.EscapeFilter(username)
-	filter := fmt.Sprintf(ldap.config.SearchFilter, escapedUsername)
+	filter := fmt.Sprintf(ldap.config.LDAP.SearchFilter, escapedUsername)
 
 	searchRequest := ldapgo.NewSearchRequest(
-		ldap.config.BaseDN,
+		ldap.config.LDAP.BaseDN,
 		ldapgo.ScopeWholeSubtree, ldapgo.NeverDerefAliases, 0, 0, false,
 		filter,
 		[]string{"dn"},
@@ -176,7 +189,7 @@ func (ldap *LdapService) GetUserGroups(userDN string) ([]string, error) {
 	escapedUserDN := ldapgo.EscapeFilter(userDN)
 
 	searchRequest := ldapgo.NewSearchRequest(
-		ldap.config.BaseDN,
+		ldap.config.LDAP.BaseDN,
 		ldapgo.ScopeWholeSubtree, ldapgo.NeverDerefAliases, 0, 0, false,
 		fmt.Sprintf("(&(objectclass=groupOfUniqueNames)(uniquemember=%s))", escapedUserDN),
 		[]string{"dn"},
@@ -224,7 +237,7 @@ func (ldap *LdapService) BindService(rebind bool) error {
 	if ldap.cert != nil {
 		return ldap.conn.ExternalBind()
 	}
-	return ldap.conn.Bind(ldap.config.BindDN, ldap.config.BindPassword)
+	return ldap.conn.Bind(ldap.config.LDAP.BindDN, ldap.config.LDAP.BindPassword)
 }
 
 func (ldap *LdapService) Bind(userDN string, password string) error {
@@ -238,7 +251,7 @@ func (ldap *LdapService) Bind(userDN string, password string) error {
 }
 
 func (ldap *LdapService) heartbeat() error {
-	tlog.App.Debug().Msg("Performing LDAP connection heartbeat")
+	ldap.log.App.Debug().Msg("Performing LDAP connection heartbeat")
 
 	searchRequest := ldapgo.NewSearchRequest(
 		"",
@@ -260,7 +273,7 @@ func (ldap *LdapService) heartbeat() error {
 }
 
 func (ldap *LdapService) reconnect() error {
-	tlog.App.Info().Msg("Reconnecting to LDAP server")
+	ldap.log.App.Info().Msg("Attempting to reconnect to LDAP server")
 
 	exp := backoff.NewExponentialBackOff()
 	exp.InitialInterval = 500 * time.Millisecond

internal/service/oauth_broker_service.go

@@ -1,10 +1,11 @@
 package service
 
 import (
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+
+	"slices"
 
-	"golang.org/x/exp/slices"
 	"golang.org/x/oauth2"
 )
 
@@ -14,21 +15,27 @@ type OAuthServiceImpl interface {
 	NewRandom() string
 	GetAuthURL(state string, verifier string) string
 	GetToken(code string, verifier string) (*oauth2.Token, error)
-	GetUserinfo(token *oauth2.Token) (config.Claims, error)
+	GetUserinfo(token *oauth2.Token) (*model.Claims, error)
 }
 
 type OAuthBrokerService struct {
+	log *logger.Logger
+
 	services map[string]OAuthServiceImpl
-	configs  map[string]config.OAuthServiceConfig
+	configs  map[string]model.OAuthServiceConfig
 }
 
-var presets = map[string]func(config config.OAuthServiceConfig) *OAuthService{
+var presets = map[string]func(config model.OAuthServiceConfig) *OAuthService{
 	"github": newGitHubOAuthService,
 	"google": newGoogleOAuthService,
 }
 
-func NewOAuthBrokerService(configs map[string]config.OAuthServiceConfig) *OAuthBrokerService {
+func NewOAuthBrokerService(
+	log *logger.Logger,
+	configs map[string]model.OAuthServiceConfig,
+) *OAuthBrokerService {
 	return &OAuthBrokerService{
+		log:      log,
 		services: make(map[string]OAuthServiceImpl),
 		configs:  configs,
 	}
@@ -38,10 +45,10 @@ func (broker *OAuthBrokerService) Init() error {
 	for name, cfg := range broker.configs {
 		if presetFunc, exists := presets[name]; exists {
 			broker.services[name] = presetFunc(cfg)
-			tlog.App.Debug().Str("service", name).Msg("Loaded OAuth service from preset")
+			broker.log.App.Debug().Str("service", name).Msg("Loaded OAuth service from preset")
 		} else {
 			broker.services[name] = NewOAuthService(cfg, name)
-			tlog.App.Debug().Str("service", name).Msg("Loaded OAuth service from config")
+			broker.log.App.Debug().Str("service", name).Msg("Loaded OAuth service from custom config")
 		}
 	}
 	return nil

internal/service/oauth_extractors.go

@@ -8,12 +8,13 @@ import (
 	"net/http"
 	"strconv"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
 type GithubEmailResponse []struct {
-	Email   string `json:"email"`
+	Email    string `json:"email"`
-	Primary bool   `json:"primary"`
+	Primary  bool   `json:"primary"`
+	Verified bool   `json:"verified"`
 }
 
 type GithubUserInfoResponse struct {
@@ -22,33 +23,33 @@ type GithubUserInfoResponse struct {
 	ID    int    `json:"id"`
 }
 
-func defaultExtractor(client *http.Client, url string) (config.Claims, error) {
+func defaultExtractor(client *http.Client, url string) (*model.Claims, error) {
-	return simpleReq[config.Claims](client, url, nil)
+	return simpleReq[model.Claims](client, url, nil)
 }
 
-func githubExtractor(client *http.Client, url string) (config.Claims, error) {
+func githubExtractor(client *http.Client, _ string) (*model.Claims, error) {
-	var user config.Claims
+	var user model.Claims
 
 	userInfo, err := simpleReq[GithubUserInfoResponse](client, "https://api.github.com/user", map[string]string{
 		"accept": "application/vnd.github+json",
 	})
 	if err != nil {
-		return config.Claims{}, err
+		return nil, err
 	}
 
 	userEmails, err := simpleReq[GithubEmailResponse](client, "https://api.github.com/user/emails", map[string]string{
 		"accept": "application/vnd.github+json",
 	})
 	if err != nil {
-		return config.Claims{}, err
+		return nil, err
 	}
 
-	if len(userEmails) == 0 {
+	if len(*userEmails) == 0 {
-		return user, errors.New("no emails found")
+		return nil, errors.New("no emails found")
 	}
 
-	for _, email := range userEmails {
+	for _, email := range *userEmails {
-		if email.Primary {
+		if email.Primary && email.Verified {
 			user.Email = email.Email
 			break
 		}
@@ -56,22 +57,31 @@ func githubExtractor(client *http.Client, url string) (config.Claims, error) {
 
 	// Use first available email if no primary email was found
 	if user.Email == "" {
-		user.Email = userEmails[0].Email
+		for _, email := range *userEmails {
+			if email.Verified {
+				user.Email = email.Email
+				break
+			}
+		}
+	}
+
+	if user.Email == "" {
+		return nil, errors.New("no verified email found")
 	}
 
 	user.PreferredUsername = userInfo.Login
 	user.Name = userInfo.Name
 	user.Sub = strconv.Itoa(userInfo.ID)
 
-	return user, nil
+	return &user, nil
 }
 
-func simpleReq[T any](client *http.Client, url string, headers map[string]string) (T, error) {
+func simpleReq[T any](client *http.Client, url string, headers map[string]string) (*T, error) {
 	var decodedRes T
 
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {
-		return decodedRes, err
+		return nil, err
 	}
 
 	for key, value := range headers {
@@ -80,23 +90,23 @@ func simpleReq[T any](client *http.Client, url string, headers map[string]string
 
 	res, err := client.Do(req)
 	if err != nil {
-		return decodedRes, err
+		return nil, err
 	}
 	defer res.Body.Close()
 
 	if res.StatusCode < 200 || res.StatusCode >= 300 {
-		return decodedRes, fmt.Errorf("request failed with status: %s", res.Status)
+		return nil, fmt.Errorf("request failed with status: %s", res.Status)
 	}
 
 	body, err := io.ReadAll(res.Body)
 	if err != nil {
-		return decodedRes, err
+		return nil, err
 	}
 
 	err = json.Unmarshal(body, &decodedRes)
 	if err != nil {
-		return decodedRes, err
+		return nil, err
 	}
 
-	return decodedRes, nil
+	return &decodedRes, nil
 }

internal/service/oauth_presets.go

@@ -1,11 +1,11 @@
 package service
 
 import (
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"golang.org/x/oauth2/endpoints"
 )
 
-func newGoogleOAuthService(config config.OAuthServiceConfig) *OAuthService {
+func newGoogleOAuthService(config model.OAuthServiceConfig) *OAuthService {
 	scopes := []string{"openid", "email", "profile"}
 	config.Scopes = scopes
 	config.AuthURL = endpoints.Google.AuthURL
@@ -14,7 +14,7 @@ func newGoogleOAuthService(config config.OAuthServiceConfig) *OAuthService {
 	return NewOAuthService(config, "google")
 }
 
-func newGitHubOAuthService(config config.OAuthServiceConfig) *OAuthService {
+func newGitHubOAuthService(config model.OAuthServiceConfig) *OAuthService {
 	scopes := []string{"read:user", "user:email"}
 	config.Scopes = scopes
 	config.AuthURL = endpoints.GitHub.AuthURL

internal/service/oauth_service.go

@@ -6,21 +6,21 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"golang.org/x/oauth2"
 )
 
-type UserinfoExtractor func(client *http.Client, url string) (config.Claims, error)
+type UserinfoExtractor func(client *http.Client, url string) (*model.Claims, error)
 
 type OAuthService struct {
-	serviceCfg        config.OAuthServiceConfig
+	serviceCfg        model.OAuthServiceConfig
 	config            *oauth2.Config
 	ctx               context.Context
 	userinfoExtractor UserinfoExtractor
 	id                string
 }
 
-func NewOAuthService(config config.OAuthServiceConfig, id string) *OAuthService {
+func NewOAuthService(config model.OAuthServiceConfig, id string) *OAuthService {
 	httpClient := &http.Client{
 		Timeout: 30 * time.Second,
 		Transport: &http.Transport{
@@ -78,7 +78,7 @@ func (s *OAuthService) GetToken(code string, verifier string) (*oauth2.Token, er
 	return s.config.Exchange(s.ctx, code, oauth2.VerifierOption(verifier))
 }
 
-func (s *OAuthService) GetUserinfo(token *oauth2.Token) (config.Claims, error) {
+func (s *OAuthService) GetUserinfo(token *oauth2.Token) (*model.Claims, error) {
 	client := oauth2.NewClient(s.ctx, oauth2.StaticTokenSource(token))
 	return s.userinfoExtractor(client, s.serviceCfg.UserinfoURL)
 }

internal/service/oidc_service.go

@@ -16,15 +16,17 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"sync"
 	"time"
 
+	"slices"
+
 	"github.com/gin-gonic/gin"
 	"github.com/go-jose/go-jose/v4"
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
-	"golang.org/x/exp/slices"
 )
 
 var (
@@ -67,27 +69,27 @@ type ClaimSet struct {
 }
 
 type UserinfoResponse struct {
-	Sub                 string               `json:"sub"`
+	Sub                 string              `json:"sub"`
-	Name                string               `json:"name,omitempty"`
+	Name                string              `json:"name,omitempty"`
-	GivenName           string               `json:"given_name,omitempty"`
+	GivenName           string              `json:"given_name,omitempty"`
-	FamilyName          string               `json:"family_name,omitempty"`
+	FamilyName          string              `json:"family_name,omitempty"`
-	MiddleName          string               `json:"middle_name,omitempty"`
+	MiddleName          string              `json:"middle_name,omitempty"`
-	Nickname            string               `json:"nickname,omitempty"`
+	Nickname            string              `json:"nickname,omitempty"`
-	Profile             string               `json:"profile,omitempty"`
+	Profile             string              `json:"profile,omitempty"`
-	Picture             string               `json:"picture,omitempty"`
+	Picture             string              `json:"picture,omitempty"`
-	Website             string               `json:"website,omitempty"`
+	Website             string              `json:"website,omitempty"`
-	Gender              string               `json:"gender,omitempty"`
+	Gender              string              `json:"gender,omitempty"`
-	Birthdate           string               `json:"birthdate,omitempty"`
+	Birthdate           string              `json:"birthdate,omitempty"`
-	Zoneinfo            string               `json:"zoneinfo,omitempty"`
+	Zoneinfo            string              `json:"zoneinfo,omitempty"`
-	Locale              string               `json:"locale,omitempty"`
+	Locale              string              `json:"locale,omitempty"`
-	Email               string               `json:"email,omitempty"`
+	Email               string              `json:"email,omitempty"`
-	PreferredUsername   string               `json:"preferred_username,omitempty"`
+	PreferredUsername   string              `json:"preferred_username,omitempty"`
-	Groups              []string             `json:"groups,omitempty"`
+	Groups              []string            `json:"groups,omitempty"`
-	EmailVerified       bool                 `json:"email_verified,omitempty"`
+	EmailVerified       bool                `json:"email_verified,omitempty"`
-	PhoneNumber         string               `json:"phone_number,omitempty"`
+	PhoneNumber         string              `json:"phone_number,omitempty"`
-	PhoneNumberVerified *bool                `json:"phone_number_verified,omitempty"`
+	PhoneNumberVerified *bool               `json:"phone_number_verified,omitempty"`
-	Address             *config.AddressClaim `json:"address,omitempty"`
+	Address             *model.AddressClaim `json:"address,omitempty"`
-	UpdatedAt           int64                `json:"updated_at"`
+	UpdatedAt           int64               `json:"updated_at"`
 }
 
 type TokenResponse struct {
@@ -110,28 +112,35 @@ type AuthorizeRequest struct {
 	CodeChallengeMethod string `json:"code_challenge_method"`
 }
 
-type OIDCServiceConfig struct {
-	Clients        map[string]config.OIDCClientConfig
-	PrivateKeyPath string
-	PublicKeyPath  string
-	Issuer         string
-	SessionExpiry  int
-}
-
 type OIDCService struct {
-	config       OIDCServiceConfig
+	log     *logger.Logger
-	queries      *repository.Queries
+	config  model.Config
-	clients      map[string]config.OIDCClientConfig
+	runtime model.RuntimeConfig
+	queries *repository.Queries
+	context context.Context
+	wg      *sync.WaitGroup
+
+	clients      map[string]model.OIDCClientConfig
 	privateKey   *rsa.PrivateKey
 	publicKey    crypto.PublicKey
 	issuer       string
 	isConfigured bool
 }
 
-func NewOIDCService(config OIDCServiceConfig, queries *repository.Queries) *OIDCService {
+func NewOIDCService(
+	log *logger.Logger,
+	config model.Config,
+	runtime model.RuntimeConfig,
+	queries *repository.Queries,
+	context context.Context,
+	wg *sync.WaitGroup) *OIDCService {
 	return &OIDCService{
+		log:     log,
 		config:  config,
+		runtime: runtime,
 		queries: queries,
+		context: context,
+		wg:      wg,
 	}
 }
 
@@ -141,7 +150,7 @@ func (service *OIDCService) IsConfigured() bool {
 
 func (service *OIDCService) Init() error {
 	// If not configured, skip init
-	if len(service.config.Clients) == 0 {
+	if len(service.runtime.OIDCClients) == 0 {
 		service.isConfigured = false
 		return nil
 	}
@@ -149,7 +158,7 @@ func (service *OIDCService) Init() error {
 	service.isConfigured = true
 
 	// Ensure issuer is https
-	uissuer, err := url.Parse(service.config.Issuer)
+	uissuer, err := url.Parse(service.runtime.AppURL)
 
 	if err != nil {
 		return err
@@ -162,14 +171,14 @@ func (service *OIDCService) Init() error {
 	service.issuer = fmt.Sprintf("%s://%s", uissuer.Scheme, uissuer.Host)
 
 	// Create/load private and public keys
-	if strings.TrimSpace(service.config.PrivateKeyPath) == "" ||
+	if strings.TrimSpace(service.config.OIDC.PrivateKeyPath) == "" ||
-		strings.TrimSpace(service.config.PublicKeyPath) == "" {
+		strings.TrimSpace(service.config.OIDC.PublicKeyPath) == "" {
 		return errors.New("private key path and public key path are required")
 	}
 
 	var privateKey *rsa.PrivateKey
 
-	fprivateKey, err := os.ReadFile(service.config.PrivateKeyPath)
+	fprivateKey, err := os.ReadFile(service.config.OIDC.PrivateKeyPath)
 
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
@@ -188,8 +197,8 @@ func (service *OIDCService) Init() error {
 			Type:  "RSA PRIVATE KEY",
 			Bytes: der,
 		})
-		tlog.App.Trace().Str("type", "RSA PRIVATE KEY").Msg("Generated private RSA key")
+		service.log.App.Trace().Str("type", "RSA PRIVATE KEY").Msg("Generated private RSA key")
-		err = os.WriteFile(service.config.PrivateKeyPath, encoded, 0600)
+		err = os.WriteFile(service.config.OIDC.PrivateKeyPath, encoded, 0600)
 		if err != nil {
 			return err
 		}
@@ -199,7 +208,7 @@ func (service *OIDCService) Init() error {
 		if block == nil {
 			return errors.New("failed to decode private key")
 		}
-		tlog.App.Trace().Str("type", block.Type).Msg("Loaded private key")
+		service.log.App.Trace().Str("type", block.Type).Msg("Loaded private key")
 		privateKey, err = x509.ParsePKCS1PrivateKey(block.Bytes)
 		if err != nil {
 			return err
@@ -207,7 +216,7 @@ func (service *OIDCService) Init() error {
 		service.privateKey = privateKey
 	}
 
-	fpublicKey, err := os.ReadFile(service.config.PublicKeyPath)
+	fpublicKey, err := os.ReadFile(service.config.OIDC.PublicKeyPath)
 
 	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
@@ -223,8 +232,8 @@ func (service *OIDCService) Init() error {
 			Type:  "RSA PUBLIC KEY",
 			Bytes: der,
 		})
-		tlog.App.Trace().Str("type", "RSA PUBLIC KEY").Msg("Generated public RSA key")
+		service.log.App.Trace().Str("type", "RSA PUBLIC KEY").Msg("Generated public RSA key")
-		err = os.WriteFile(service.config.PublicKeyPath, encoded, 0644)
+		err = os.WriteFile(service.config.OIDC.PublicKeyPath, encoded, 0644)
 		if err != nil {
 			return err
 		}
@@ -234,7 +243,7 @@ func (service *OIDCService) Init() error {
 		if block == nil {
 			return errors.New("failed to decode public key")
 		}
-		tlog.App.Trace().Str("type", block.Type).Msg("Loaded public key")
+		service.log.App.Trace().Str("type", block.Type).Msg("Loaded public key")
 		switch block.Type {
 		case "RSA PUBLIC KEY":
 			publicKey, err := x509.ParsePKCS1PublicKey(block.Bytes)
@@ -254,9 +263,9 @@ func (service *OIDCService) Init() error {
 	}
 
 	// We will reorganize the client into a map with the client ID as the key
-	service.clients = make(map[string]config.OIDCClientConfig)
+	service.clients = make(map[string]model.OIDCClientConfig)
 
-	for id, client := range service.config.Clients {
+	for id, client := range service.config.OIDC.Clients {
 		client.ID = id
 		if client.Name == "" {
 			client.Name = utils.Capitalize(client.ID)
@@ -272,9 +281,12 @@ func (service *OIDCService) Init() error {
 		}
 		client.ClientSecretFile = ""
 		service.clients[id] = client
-		tlog.App.Info().Str("id", client.ID).Msg("Registered OIDC client")
+		service.log.App.Debug().Str("clientId", client.ClientID).Msg("Loaded OIDC client configuration")
 	}
 
+	// Start cleanup routine
+	service.wg.Go(service.cleanupRoutine)
+
 	return nil
 }
 
@@ -282,7 +294,7 @@ func (service *OIDCService) GetIssuer() string {
 	return service.issuer
 }
 
-func (service *OIDCService) GetClient(id string) (config.OIDCClientConfig, bool) {
+func (service *OIDCService) GetClient(id string) (model.OIDCClientConfig, bool) {
 	client, ok := service.clients[id]
 	return client, ok
 }
@@ -306,7 +318,7 @@ func (service *OIDCService) ValidateAuthorizeParams(req AuthorizeRequest) error
 			return errors.New("invalid_scope")
 		}
 		if !slices.Contains(SupportedScopes, scope) {
-			tlog.App.Warn().Str("scope", scope).Msg("Unsupported OIDC scope, will be ignored")
+			service.log.App.Warn().Str("scope", scope).Msg("Requested unsupported scope")
 		}
 	}
 
@@ -356,7 +368,7 @@ func (service *OIDCService) StoreCode(c *gin.Context, sub string, code string, r
 			entry.CodeChallenge = req.CodeChallenge
 		} else {
 			entry.CodeChallenge = service.hashAndEncodePKCE(req.CodeChallenge)
-			tlog.App.Warn().Msg("Received plain PKCE code challenge, it's recommended to use S256 for better security")
+			service.log.App.Warn().Msg("Using plain PKCE code challenge method is not recommended, consider switching to S256 for better security")
 		}
 	}
 
@@ -366,43 +378,45 @@ func (service *OIDCService) StoreCode(c *gin.Context, sub string, code string, r
 	return err
 }
 
-func (service *OIDCService) StoreUserinfo(c *gin.Context, sub string, userContext config.UserContext, req AuthorizeRequest) error {
+func (service *OIDCService) StoreUserinfo(c *gin.Context, sub string, userContext model.UserContext, req AuthorizeRequest) error {
-	addressJSON, err := json.Marshal(userContext.Attributes.Address)
-	if err != nil {
-		return err
-	}
-
 	userInfoParams := repository.CreateOidcUserInfoParams{
 		Sub:               sub,
-		Name:              userContext.Name,
+		Name:              userContext.GetName(),
-		Email:             userContext.Email,
+		Email:             userContext.GetEmail(),
-		PreferredUsername: userContext.Username,
+		PreferredUsername: userContext.GetUsername(),
 		UpdatedAt:         time.Now().Unix(),
-		GivenName:         userContext.Attributes.GivenName,
+	}
-		FamilyName:        userContext.Attributes.FamilyName,
+
-		MiddleName:        userContext.Attributes.MiddleName,
+	if userContext.IsLocal() {
-		Nickname:          userContext.Attributes.Nickname,
+		addressJSON, err := json.Marshal(userContext.Local.Attributes.Address)
-		Profile:           userContext.Attributes.Profile,
+		if err != nil {
-		Picture:           userContext.Attributes.Picture,
+			return err
-		Website:           userContext.Attributes.Website,
+		}
-		Gender:            userContext.Attributes.Gender,
+		userInfoParams.GivenName = userContext.Local.Attributes.GivenName
-		Birthdate:         userContext.Attributes.Birthdate,
+		userInfoParams.FamilyName = userContext.Local.Attributes.FamilyName
-		Zoneinfo:          userContext.Attributes.Zoneinfo,
+		userInfoParams.MiddleName = userContext.Local.Attributes.MiddleName
-		Locale:            userContext.Attributes.Locale,
+		userInfoParams.Nickname = userContext.Local.Attributes.Nickname
-		PhoneNumber:       userContext.Attributes.PhoneNumber,
+		userInfoParams.Profile = userContext.Local.Attributes.Profile
-		Address:           string(addressJSON),
+		userInfoParams.Picture = userContext.Local.Attributes.Picture
+		userInfoParams.Website = userContext.Local.Attributes.Website
+		userInfoParams.Gender = userContext.Local.Attributes.Gender
+		userInfoParams.Birthdate = userContext.Local.Attributes.Birthdate
+		userInfoParams.Zoneinfo = userContext.Local.Attributes.Zoneinfo
+		userInfoParams.Locale = userContext.Local.Attributes.Locale
+		userInfoParams.PhoneNumber = userContext.Local.Attributes.PhoneNumber
+		userInfoParams.Address = string(addressJSON)
 	}
 
 	// Tinyauth will pass through the groups it got from an LDAP or an OIDC server
-	if userContext.Provider == "ldap" {
+	if userContext.IsLDAP() {
-		userInfoParams.Groups = userContext.LdapGroups
+		userInfoParams.Groups = strings.Join(userContext.LDAP.Groups, ",")
 	}
 
-	if userContext.OAuth && len(userContext.OAuthGroups) > 0 {
+	if userContext.IsOAuth() {
-		userInfoParams.Groups = userContext.OAuthGroups
+		userInfoParams.Groups = strings.Join(userContext.OAuth.Groups, ",")
 	}
 
-	_, err = service.queries.CreateOidcUserInfo(c, userInfoParams)
+	_, err := service.queries.CreateOidcUserInfo(c, userInfoParams)
 
 	return err
 }
@@ -444,9 +458,9 @@ func (service *OIDCService) GetCodeEntry(c *gin.Context, codeHash string, client
 	return oidcCode, nil
 }
 
-func (service *OIDCService) generateIDToken(client config.OIDCClientConfig, user repository.OidcUserinfo, scope string, nonce string) (string, error) {
+func (service *OIDCService) generateIDToken(client model.OIDCClientConfig, user repository.OidcUserinfo, scope string, nonce string) (string, error) {
 	createdAt := time.Now().Unix()
-	expiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry) * time.Second).Unix()
+	expiresAt := time.Now().Add(time.Duration(service.config.Auth.SessionExpiry) * time.Second).Unix()
 
 	hasher := sha256.New()
 
@@ -510,7 +524,7 @@ func (service *OIDCService) generateIDToken(client config.OIDCClientConfig, user
 	return token, nil
 }
 
-func (service *OIDCService) GenerateAccessToken(c *gin.Context, client config.OIDCClientConfig, codeEntry repository.OidcCode) (TokenResponse, error) {
+func (service *OIDCService) GenerateAccessToken(c *gin.Context, client model.OIDCClientConfig, codeEntry repository.OidcCode) (TokenResponse, error) {
 	user, err := service.GetUserinfo(c, codeEntry.Sub)
 
 	if err != nil {
@@ -526,16 +540,16 @@ func (service *OIDCService) GenerateAccessToken(c *gin.Context, client config.OI
 	accessToken := utils.GenerateString(32)
 	refreshToken := utils.GenerateString(32)
 
-	tokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry) * time.Second).Unix()
+	tokenExpiresAt := time.Now().Add(time.Duration(service.config.Auth.SessionExpiry) * time.Second).Unix()
 
 	// Refresh token lives double the time of an access token but can't be used to access userinfo
-	refrshTokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry*2) * time.Second).Unix()
+	refreshTokenExpiresAt := time.Now().Add(time.Duration(service.config.Auth.SessionExpiry*2) * time.Second).Unix()
 
 	tokenResponse := TokenResponse{
 		AccessToken:  accessToken,
 		RefreshToken: refreshToken,
 		TokenType:    "Bearer",
-		ExpiresIn:    int64(service.config.SessionExpiry),
+		ExpiresIn:    int64(service.config.Auth.SessionExpiry),
 		IDToken:      idToken,
 		Scope:        strings.ReplaceAll(codeEntry.Scope, ",", " "),
 	}
@@ -547,7 +561,7 @@ func (service *OIDCService) GenerateAccessToken(c *gin.Context, client config.OI
 		ClientID:              client.ClientID,
 		Scope:                 codeEntry.Scope,
 		TokenExpiresAt:        tokenExpiresAt,
-		RefreshTokenExpiresAt: refrshTokenExpiresAt,
+		RefreshTokenExpiresAt: refreshTokenExpiresAt,
 		Nonce:                 codeEntry.Nonce,
 		CodeHash:              codeEntry.CodeHash,
 	})
@@ -563,7 +577,7 @@ func (service *OIDCService) RefreshAccessToken(c *gin.Context, refreshToken stri
 	entry, err := service.queries.GetOidcTokenByRefreshToken(c, service.Hash(refreshToken))
 
 	if err != nil {
-		if err == sql.ErrNoRows {
+		if errors.Is(err, sql.ErrNoRows) {
 			return TokenResponse{}, ErrTokenNotFound
 		}
 		return TokenResponse{}, err
@@ -584,7 +598,7 @@ func (service *OIDCService) RefreshAccessToken(c *gin.Context, refreshToken stri
 		return TokenResponse{}, err
 	}
 
-	idToken, err := service.generateIDToken(config.OIDCClientConfig{
+	idToken, err := service.generateIDToken(model.OIDCClientConfig{
 		ClientID: entry.ClientID,
 	}, user, entry.Scope, entry.Nonce)
 
@@ -595,14 +609,14 @@ func (service *OIDCService) RefreshAccessToken(c *gin.Context, refreshToken stri
 	accessToken := utils.GenerateString(32)
 	newRefreshToken := utils.GenerateString(32)
 
-	tokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry) * time.Second).Unix()
+	tokenExpiresAt := time.Now().Add(time.Duration(service.config.Auth.SessionExpiry) * time.Second).Unix()
-	refrshTokenExpiresAt := time.Now().Add(time.Duration(service.config.SessionExpiry*2) * time.Second).Unix()
+	refreshTokenExpiresAt := time.Now().Add(time.Duration(service.config.Auth.SessionExpiry*2) * time.Second).Unix()
 
 	tokenResponse := TokenResponse{
 		AccessToken:  accessToken,
 		RefreshToken: newRefreshToken,
 		TokenType:    "Bearer",
-		ExpiresIn:    int64(service.config.SessionExpiry),
+		ExpiresIn:    int64(service.config.Auth.SessionExpiry),
 		IDToken:      idToken,
 		Scope:        strings.ReplaceAll(entry.Scope, ",", " "),
 	}
@@ -611,7 +625,7 @@ func (service *OIDCService) RefreshAccessToken(c *gin.Context, refreshToken stri
 		AccessTokenHash:       service.Hash(accessToken),
 		RefreshTokenHash:      service.Hash(newRefreshToken),
 		TokenExpiresAt:        tokenExpiresAt,
-		RefreshTokenExpiresAt: refrshTokenExpiresAt,
+		RefreshTokenExpiresAt: refreshTokenExpiresAt,
 		RefreshTokenHash_2:    service.Hash(refreshToken), // that's the selector, it's not stored in the db
 	})
 
@@ -642,7 +656,7 @@ func (service *OIDCService) GetAccessToken(c *gin.Context, tokenHash string) (re
 	entry, err := service.queries.GetOidcToken(c, tokenHash)
 
 	if err != nil {
-		if err == sql.ErrNoRows {
+		if errors.Is(err, sql.ErrNoRows) {
 			return repository.OidcToken{}, ErrTokenNotFound
 		}
 		return repository.OidcToken{}, err
@@ -713,7 +727,7 @@ func (service *OIDCService) CompileUserinfo(user repository.OidcUserinfo, scope
 	}
 
 	if slices.Contains(scopes, "address") {
-		var addr config.AddressClaim
+		var addr model.AddressClaim
 		if err := json.Unmarshal([]byte(user.Address), &addr); err == nil {
 			userInfo.Address = &addr
 		}
@@ -745,56 +759,64 @@ func (service *OIDCService) DeleteOldSession(ctx context.Context, sub string) er
 }
 
 // Cleanup routine - Resource heavy due to the linked tables
-func (service *OIDCService) Cleanup() {
+func (service *OIDCService) cleanupRoutine() {
-	// We need a context for the routine
+	service.log.App.Debug().Msg("Starting OIDC cleanup routine")
-	ctx := context.Background()
-
 	ticker := time.NewTicker(time.Duration(30) * time.Minute)
 	defer ticker.Stop()
 
-	for range ticker.C {
+	for {
-		currentTime := time.Now().Unix()
+		select {
+		case <-ticker.C:
+			service.log.App.Debug().Msg("Performing OIDC cleanup routine")
 
-		// For the OIDC tokens, if they are expired we delete the userinfo and codes
+			currentTime := time.Now().Unix()
-		expiredTokens, err := service.queries.DeleteExpiredOidcTokens(ctx, repository.DeleteExpiredOidcTokensParams{
-			TokenExpiresAt:        currentTime,
-			RefreshTokenExpiresAt: currentTime,
-		})
 
-		if err != nil {
+			// For the OIDC tokens, if they are expired we delete the userinfo and codes
-			tlog.App.Warn().Err(err).Msg("Failed to delete expired tokens")
+			expiredTokens, err := service.queries.DeleteExpiredOidcTokens(service.context, repository.DeleteExpiredOidcTokensParams{
-		}
+				TokenExpiresAt:        currentTime,
-
+				RefreshTokenExpiresAt: currentTime,
-		for _, expiredToken := range expiredTokens {
+			})
-			err := service.DeleteOldSession(ctx, expiredToken.Sub)
-			if err != nil {
-				tlog.App.Warn().Err(err).Msg("Failed to delete old session")
-			}
-		}
-
-		// For expired codes, we need to get the sub, check if tokens are expired and if they are remove everything
-		expiredCodes, err := service.queries.DeleteExpiredOidcCodes(ctx, currentTime)
-
-		if err != nil {
-			tlog.App.Warn().Err(err).Msg("Failed to delete expired codes")
-		}
-
-		for _, expiredCode := range expiredCodes {
-			token, err := service.queries.GetOidcTokenBySub(ctx, expiredCode.Sub)
 
 			if err != nil {
-				if err == sql.ErrNoRows {
+				service.log.App.Warn().Err(err).Msg("Failed to delete expired tokens")
-					continue
-				}
-				tlog.App.Warn().Err(err).Msg("Failed to get OIDC token by sub")
 			}
 
-			if token.TokenExpiresAt < currentTime && token.RefreshTokenExpiresAt < currentTime {
+			for _, expiredToken := range expiredTokens {
-				err := service.DeleteOldSession(ctx, expiredCode.Sub)
+				err := service.DeleteOldSession(service.context, expiredToken.Sub)
 				if err != nil {
-					tlog.App.Warn().Err(err).Msg("Failed to delete session")
+					service.log.App.Warn().Err(err).Msg("Failed to delete session for expired token")
 				}
 			}
+
+			// For expired codes, we need to get the sub, check if tokens are expired and if they are remove everything
+			expiredCodes, err := service.queries.DeleteExpiredOidcCodes(service.context, currentTime)
+
+			if err != nil {
+				service.log.App.Warn().Err(err).Msg("Failed to delete expired codes")
+			}
+
+			for _, expiredCode := range expiredCodes {
+				token, err := service.queries.GetOidcTokenBySub(service.context, expiredCode.Sub)
+
+				if err != nil {
+					if errors.Is(err, sql.ErrNoRows) {
+						continue
+					}
+					service.log.App.Warn().Err(err).Msg("Failed to get token by sub for expired code")
+				}
+
+				if token.TokenExpiresAt < currentTime && token.RefreshTokenExpiresAt < currentTime {
+					err := service.DeleteOldSession(service.context, expiredCode.Sub)
+					if err != nil {
+						service.log.App.Warn().Err(err).Msg("Failed to delete session for expired code")
+					}
+				}
+			}
+
+			service.log.App.Debug().Msg("Finished OIDC cleanup routine")
+		case <-service.context.Done():
+			service.log.App.Debug().Msg("Stopping OIDC cleanup routine")
+			return
 		}
 	}
 }

internal/service/oidc_service_test.go

@@ -7,13 +7,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/repository"
 	"github.com/tinyauthapp/tinyauth/internal/service"
 )
 
 func newTestUser() repository.OidcUserinfo {
-	addr := config.AddressClaim{
+	addr := model.AddressClaim{
 		Formatted:     "123 Main St",
 		StreetAddress: "123 Main St",
 		Locality:      "Springfield",

internal/utils/app_utils.go

@@ -7,10 +7,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-
-	"github.com/gin-gonic/gin"
 	"github.com/weppos/publicsuffix-go/publicsuffix"
 )
 
@@ -24,13 +20,12 @@ func GetCookieDomain(u string) (string, error) {
 	host := parsed.Hostname()
 
 	if netIP := net.ParseIP(host); netIP != nil {
-		return "", errors.New("IP addresses not allowed")
+		return "", errors.New("ip addresses not allowed")
 	}
 
 	parts := strings.Split(host, ".")
 
 	if len(parts) == 2 {
-		tlog.App.Warn().Msgf("Running on the root domain, cookies will be set for .%v", host)
 		return host, nil
 	}
 
@@ -49,6 +44,27 @@ func GetCookieDomain(u string) (string, error) {
 	return domain, nil
 }
 
+func GetStandaloneCookieDomain(u string) (string, error) {
+	parsed, err := url.Parse(u)
+	if err != nil {
+		return "", err
+	}
+
+	host := parsed.Hostname()
+
+	if netIP := net.ParseIP(host); netIP != nil {
+		return "", errors.New("ip addresses not allowed")
+	}
+
+	parts := strings.Split(host, ".")
+
+	if len(parts) < 2 {
+		return "", errors.New("invalid app url")
+	}
+
+	return host, nil
+}
+
 func ParseFileToLine(content string) string {
 	lines := strings.Split(content, "\n")
 	users := make([]string, 0)
@@ -73,22 +89,6 @@ func Filter[T any](slice []T, test func(T) bool) (res []T) {
 	return res
 }
 
-func GetContext(c *gin.Context) (config.UserContext, error) {
-	userContextValue, exists := c.Get("context")
-
-	if !exists {
-		return config.UserContext{}, errors.New("no user context in request")
-	}
-
-	userContext, ok := userContextValue.(*config.UserContext)
-
-	if !ok {
-		return config.UserContext{}, errors.New("invalid user context in request")
-	}
-
-	return *userContext, nil
-}
-
 func IsRedirectSafe(redirectURL string, domain string) bool {
 	if redirectURL == "" {
 		return false

internal/utils/app_utils_test.go

@@ -3,11 +3,8 @@ package utils_test
 import (
 	"testing"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/stretchr/testify/assert"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-
-	"github.com/gin-gonic/gin"
-	"gotest.tools/v3/assert"
 )
 
 func TestGetRootDomain(t *testing.T) {
@@ -15,14 +12,14 @@ func TestGetRootDomain(t *testing.T) {
 	domain := "http://sub.tinyauth.app"
 	expected := "tinyauth.app"
 	result, err := utils.GetCookieDomain(domain)
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 
 	// Domain with multiple subdomains
 	domain = "http://b.c.tinyauth.app"
 	expected = "c.tinyauth.app"
 	result, err = utils.GetCookieDomain(domain)
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 
 	// Invalid domain (only TLD)
@@ -33,7 +30,7 @@ func TestGetRootDomain(t *testing.T) {
 	// IP address
 	domain = "http://10.10.10.10"
 	_, err = utils.GetCookieDomain(domain)
-	assert.ErrorContains(t, err, "IP addresses not allowed")
+	assert.ErrorContains(t, err, "ip addresses not allowed")
 
 	// Invalid URL
 	domain = "http://[::1]:namedport"
@@ -44,14 +41,14 @@ func TestGetRootDomain(t *testing.T) {
 	domain = "https://sub.tinyauth.app/path"
 	expected = "tinyauth.app"
 	result, err = utils.GetCookieDomain(domain)
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 
 	// URL with port
 	domain = "http://sub.tinyauth.app:8080"
 	expected = "tinyauth.app"
 	result, err = utils.GetCookieDomain(domain)
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, expected, result)
 
 	// Domain managed by ICANN
@@ -98,57 +95,35 @@ func TestFilter(t *testing.T) {
 	testFunc := func(n int) bool { return n%2 == 0 }
 	expected := []int{2, 4}
 	result := utils.Filter(slice, testFunc)
-	assert.DeepEqual(t, expected, result)
+	assert.Equal(t, expected, result)
 
 	// Case with no matches
 	slice = []int{1, 3, 5}
 	testFunc = func(n int) bool { return n%2 == 0 }
 	expected = []int{}
 	result = utils.Filter(slice, testFunc)
-	assert.DeepEqual(t, expected, result)
+	assert.Equal(t, expected, result)
 
 	// Case with all matches
 	slice = []int{2, 4, 6}
 	testFunc = func(n int) bool { return n%2 == 0 }
 	expected = []int{2, 4, 6}
 	result = utils.Filter(slice, testFunc)
-	assert.DeepEqual(t, expected, result)
+	assert.Equal(t, expected, result)
 
 	// Case with empty slice
 	slice = []int{}
 	testFunc = func(n int) bool { return n%2 == 0 }
 	expected = []int{}
 	result = utils.Filter(slice, testFunc)
-	assert.DeepEqual(t, expected, result)
+	assert.Equal(t, expected, result)
 
 	// Case with different type (string)
 	sliceStr := []string{"apple", "banana", "cherry"}
 	testFuncStr := func(s string) bool { return len(s) > 5 }
 	expectedStr := []string{"banana", "cherry"}
 	resultStr := utils.Filter(sliceStr, testFuncStr)
-	assert.DeepEqual(t, expectedStr, resultStr)
+	assert.Equal(t, expectedStr, resultStr)
-}
-
-func TestGetContext(t *testing.T) {
-	// Setup
-	gin.SetMode(gin.TestMode)
-	c, _ := gin.CreateTestContext(nil)
-
-	// Normal case
-	c.Set("context", &config.UserContext{Username: "testuser"})
-	result, err := utils.GetContext(c)
-	assert.NilError(t, err)
-	assert.Equal(t, "testuser", result.Username)
-
-	// Case with no context
-	c.Set("context", nil)
-	_, err = utils.GetContext(c)
-	assert.Error(t, err, "invalid user context in request")
-
-	// Case with invalid context type
-	c.Set("context", "invalid type")
-	_, err = utils.GetContext(c)
-	assert.Error(t, err, "invalid user context in request")
 }
 
 func TestIsRedirectSafe(t *testing.T) {
@@ -158,50 +133,95 @@ func TestIsRedirectSafe(t *testing.T) {
 	// Case with no subdomain
 	redirectURL := "http://example.com/welcome"
 	result := utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, true, result)
+	assert.True(t, result)
 
 	// Case with different domain
 	redirectURL = "http://malicious.com/phishing"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.False(t, result)
 
 	// Case with subdomain
 	redirectURL = "http://sub.example.com/page"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, true, result)
+	assert.True(t, result)
 
 	// Case with sub-subdomain
 	redirectURL = "http://a.b.example.com/home"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, true, result)
+	assert.True(t, result)
 
 	// Case with empty redirect URL
 	redirectURL = ""
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.False(t, result)
 
 	// Case with invalid URL
 	redirectURL = "http://[::1]:namedport"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.False(t, result)
 
 	// Case with URL having port
 	redirectURL = "http://sub.example.com:8080/page"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, true, result)
+	assert.True(t, result)
 
 	// Case with URL having different subdomain
 	redirectURL = "http://another.example.com/page"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, true, result)
+	assert.True(t, result)
 
 	// Case with URL having different TLD
 	redirectURL = "http://example.org/page"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.False(t, result)
 
 	// Case with malicious domain
 	redirectURL = "https://malicious-example.com/yoyo"
 	result = utils.IsRedirectSafe(redirectURL, domain)
-	assert.Equal(t, false, result)
+	assert.False(t, result)
+}
+
+func TestGetStandaloneCookieDomain(t *testing.T) {
+	// Normal case
+	domain := "http://tinyauth.app"
+	expected := "tinyauth.app"
+	result, err := utils.GetStandaloneCookieDomain(domain)
+	assert.NoError(t, err)
+	assert.Equal(t, expected, result)
+
+	// URL with subdomain (full hostname is returned, no subdomain stripping)
+	domain = "http://sub.tinyauth.app"
+	expected = "sub.tinyauth.app"
+	result, err = utils.GetStandaloneCookieDomain(domain)
+	assert.NoError(t, err)
+	assert.Equal(t, expected, result)
+
+	// URL with port (port should be stripped)
+	domain = "http://tinyauth.app:8080"
+	expected = "tinyauth.app"
+	result, err = utils.GetStandaloneCookieDomain(domain)
+	assert.NoError(t, err)
+	assert.Equal(t, expected, result)
+
+	// URL with path
+	domain = "https://tinyauth.app/some/path"
+	expected = "tinyauth.app"
+	result, err = utils.GetStandaloneCookieDomain(domain)
+	assert.NoError(t, err)
+	assert.Equal(t, expected, result)
+
+	// IP address
+	domain = "http://10.10.10.10"
+	_, err = utils.GetStandaloneCookieDomain(domain)
+	assert.ErrorContains(t, err, "ip addresses not allowed")
+
+	// Invalid domain (only TLD)
+	domain = "com"
+	_, err = utils.GetStandaloneCookieDomain(domain)
+	assert.ErrorContains(t, err, "invalid app url")
+
+	// Invalid URL
+	domain = "http://[::1]:namedport"
+	_, err = utils.GetStandaloneCookieDomain(domain)
+	assert.ErrorContains(t, err, "parse \"http://[::1]:namedport\": invalid port \":namedport\" after host")
 }

internal/utils/decoders/label_decoder_test.go

@@ -3,42 +3,41 @@ package decoders_test
 import (
 	"testing"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils/decoders"
-
-	"gotest.tools/v3/assert"
 )
 
 func TestDecodeLabels(t *testing.T) {
 	// Variables
-	expected := config.Apps{
+	expected := model.Apps{
-		Apps: map[string]config.App{
+		Apps: map[string]model.App{
 			"foo": {
-				Config: config.AppConfig{
+				Config: model.AppConfig{
 					Domain: "example.com",
 				},
-				Users: config.AppUsers{
+				Users: model.AppUsers{
 					Allow: "user1,user2",
 					Block: "user3",
 				},
-				OAuth: config.AppOAuth{
+				OAuth: model.AppOAuth{
 					Whitelist: "somebody@example.com",
 					Groups:    "group3",
 				},
-				IP: config.AppIP{
+				IP: model.AppIP{
 					Allow:  []string{"10.71.0.1/24", "10.71.0.2"},
 					Block:  []string{"10.10.10.10", "10.0.0.0/24"},
 					Bypass: []string{"192.168.1.1"},
 				},
-				Response: config.AppResponse{
+				Response: model.AppResponse{
 					Headers: []string{"X-Foo=Bar", "X-Baz=Qux"},
-					BasicAuth: config.AppBasicAuth{
+					BasicAuth: model.AppBasicAuth{
 						Username:     "admin",
 						Password:     "password",
 						PasswordFile: "/path/to/passwordfile",
 					},
 				},
-				Path: config.AppPath{
+				Path: model.AppPath{
 					Allow: "/public",
 					Block: "/private",
 				},
@@ -63,7 +62,7 @@ func TestDecodeLabels(t *testing.T) {
 	}
 
 	// Test
-	result, err := decoders.DecodeLabels[config.Apps](test, "apps")
+	result, err := decoders.DecodeLabels[model.Apps](test, "apps")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
-	assert.DeepEqual(t, expected, result)
+	assert.Equal(t, expected, result)
 }

internal/utils/fs_utils_test.go

@@ -4,24 +4,25 @@ import (
 	"os"
 	"testing"
 
-	"gotest.tools/v3/assert"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestReadFile(t *testing.T) {
 	// Setup
 	file, err := os.Create("/tmp/tinyauth_test_file")
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	_, err = file.WriteString("file content\n")
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	err = file.Close()
-	assert.NilError(t, err)
+	require.NoError(t, err)
 	defer os.Remove("/tmp/tinyauth_test_file")
 
 	// Normal case
 	content, err := ReadFile("/tmp/tinyauth_test_file")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, "file content\n", content)
 
 	// Non-existing file

internal/utils/label_utils_test.go

@@ -3,9 +3,8 @@ package utils_test
 import (
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-
-	"gotest.tools/v3/assert"
 )
 
 func TestParseHeaders(t *testing.T) {
@@ -18,7 +17,7 @@ func TestParseHeaders(t *testing.T) {
 		"X-Custom-Header": "Value",
 		"Another-Header":  "AnotherValue",
 	}
-	assert.DeepEqual(t, expected, utils.ParseHeaders(headers))
+	assert.Equal(t, expected, utils.ParseHeaders(headers))
 
 	// Case insensitivity and trimming
 	headers = []string{
@@ -29,7 +28,7 @@ func TestParseHeaders(t *testing.T) {
 		"X-Custom-Header": "Value",
 		"Another-Header":  "AnotherValue",
 	}
-	assert.DeepEqual(t, expected, utils.ParseHeaders(headers))
+	assert.Equal(t, expected, utils.ParseHeaders(headers))
 
 	// Invalid headers (missing '=', empty key/value)
 	headers = []string{
@@ -39,7 +38,7 @@ func TestParseHeaders(t *testing.T) {
 		"   =   ",
 	}
 	expected = map[string]string{}
-	assert.DeepEqual(t, expected, utils.ParseHeaders(headers))
+	assert.Equal(t, expected, utils.ParseHeaders(headers))
 
 	// Headers with unsafe characters
 	headers = []string{
@@ -52,7 +51,7 @@ func TestParseHeaders(t *testing.T) {
 		"Another-Header":  "AnotherValue",
 		"Good-Header":     "GoodValue",
 	}
-	assert.DeepEqual(t, expected, utils.ParseHeaders(headers))
+	assert.Equal(t, expected, utils.ParseHeaders(headers))
 
 	// Header with spaces in key (should be ignored)
 	headers = []string{
@@ -62,7 +61,7 @@ func TestParseHeaders(t *testing.T) {
 	expected = map[string]string{
 		"Valid-Header": "ValidValue",
 	}
-	assert.DeepEqual(t, expected, utils.ParseHeaders(headers))
+	assert.Equal(t, expected, utils.ParseHeaders(headers))
 }
 
 func TestSanitizeHeader(t *testing.T) {

internal/utils/loaders/loader_env.go

@@ -4,21 +4,20 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
-
 	"github.com/tinyauthapp/paerser/cli"
 	"github.com/tinyauthapp/paerser/env"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
 type EnvLoader struct{}
 
 func (e *EnvLoader) Load(_ []string, cmd *cli.Command) (bool, error) {
-	vars := env.FindPrefixedEnvVars(os.Environ(), config.DefaultNamePrefix, cmd.Configuration)
+	vars := env.FindPrefixedEnvVars(os.Environ(), model.DefaultNamePrefix, cmd.Configuration)
 	if len(vars) == 0 {
 		return false, nil
 	}
 
-	if err := env.Decode(vars, config.DefaultNamePrefix, cmd.Configuration); err != nil {
+	if err := env.Decode(vars, model.DefaultNamePrefix, cmd.Configuration); err != nil {
 		return false, fmt.Errorf("failed to decode configuration from environment variables: %w", err)
 	}
 

internal/utils/logger/logger.go

@@ -0,0 +1,160 @@
+package logger
+
+import (
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+)
+
+type Logger struct {
+	HTTP   zerolog.Logger
+	App    zerolog.Logger
+	config model.LogConfig
+	base   zerolog.Logger
+	audit  zerolog.Logger
+	writer io.Writer
+}
+
+func NewLogger() *Logger {
+	return &Logger{
+		writer: os.Stderr,
+		config: model.LogConfig{
+			Level: "error",
+			Json:  true,
+			Streams: model.LogStreams{
+				HTTP: model.LogStreamConfig{
+					Enabled: true,
+				},
+				App: model.LogStreamConfig{
+					Enabled: true,
+				},
+				// No reason to enabled audit by default since it will be surpressed by the log level
+			},
+		},
+	}
+}
+
+func (l *Logger) WithConfig(cfg model.LogConfig) *Logger {
+	l.config = cfg
+	return l
+}
+
+func (l *Logger) WithSimpleConfig() *Logger {
+	l.config = model.LogConfig{
+		Level: "info",
+		Json:  false,
+		Streams: model.LogStreams{
+			HTTP:  model.LogStreamConfig{Enabled: true},
+			App:   model.LogStreamConfig{Enabled: true},
+			Audit: model.LogStreamConfig{Enabled: false},
+		},
+	}
+	return l
+}
+
+func (l *Logger) WithTestConfig() *Logger {
+	l.config = model.LogConfig{
+		Level: "trace",
+		Streams: model.LogStreams{
+			HTTP:  model.LogStreamConfig{Enabled: true},
+			App:   model.LogStreamConfig{Enabled: true},
+			Audit: model.LogStreamConfig{Enabled: true},
+		},
+	}
+	return l
+}
+
+func (l *Logger) WithWriter(writer io.Writer) *Logger {
+	l.writer = writer
+	return l
+}
+
+func (l *Logger) Init() {
+	base := log.With().
+		Timestamp().
+		Logger().
+		Level(l.parseLogLevel(l.config.Level)).Output(l.writer)
+
+	if !l.config.Json {
+		base = base.Output(zerolog.ConsoleWriter{
+			Out:        l.writer,
+			TimeFormat: time.RFC3339,
+		})
+	}
+
+	if base.GetLevel() == zerolog.TraceLevel || base.GetLevel() == zerolog.DebugLevel {
+		base = base.With().Caller().Logger()
+	}
+
+	l.base = base
+	l.audit = l.createLogger("audit", l.config.Streams.Audit)
+	l.HTTP = l.createLogger("http", l.config.Streams.HTTP)
+	l.App = l.createLogger("app", l.config.Streams.App)
+}
+
+func (l *Logger) parseLogLevel(level string) zerolog.Level {
+	if level == "" {
+		return zerolog.InfoLevel
+	}
+	parsed, err := zerolog.ParseLevel(strings.ToLower(level))
+	if err != nil {
+		log.Warn().Err(err).Str("level", level).Msg("Invalid log level, defaulting to error")
+		parsed = zerolog.ErrorLevel
+	}
+	return parsed
+}
+
+func (l *Logger) createLogger(component string, cfg model.LogStreamConfig) zerolog.Logger {
+	if !cfg.Enabled {
+		return zerolog.Nop()
+	}
+	sub := l.base.With().Str("stream", component).Logger()
+	if cfg.Level != "" {
+		sub = sub.Level(l.parseLogLevel(cfg.Level))
+	}
+	return sub
+}
+
+func (l *Logger) AuditLoginSuccess(username, provider, ip string) {
+	l.audit.Info().
+		CallerSkipFrame(1).
+		Str("event", "login").
+		Str("result", "success").
+		Str("username", username).
+		Str("provider", provider).
+		Str("ip", ip).
+		Send()
+}
+
+func (l *Logger) AuditLoginFailure(username, provider, ip, reason string) {
+	l.audit.Warn().
+		CallerSkipFrame(1).
+		Str("event", "login").
+		Str("result", "failure").
+		Str("username", username).
+		Str("provider", provider).
+		Str("ip", ip).
+		Str("reason", reason).
+		Send()
+}
+
+func (l *Logger) AuditLogout(username, provider, ip string) {
+	l.audit.Info().
+		CallerSkipFrame(1).
+		Str("event", "logout").
+		Str("result", "success").
+		Str("username", username).
+		Str("provider", provider).
+		Str("ip", ip).
+		Send()
+}
+
+// Used for testing
+func (l *Logger) GetConfig() model.LogConfig {
+	return l.config
+}

internal/utils/logger/logger_test.go

@@ -0,0 +1,173 @@
+package logger_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tinyauthapp/tinyauth/internal/model"
+	"github.com/tinyauthapp/tinyauth/internal/utils/logger"
+)
+
+func TestLogger(t *testing.T) {
+	type testCase struct {
+		description string
+		run         func(t *testing.T)
+	}
+
+	tests := []testCase{
+		{
+			description: "Should create a simple logger with the expected config",
+			run: func(t *testing.T) {
+				l := logger.NewLogger().WithSimpleConfig()
+				l.Init()
+
+				cfg := l.GetConfig()
+
+				assert.Equal(t, cfg, model.LogConfig{
+					Level: "info",
+					Json:  false,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: true},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: false},
+					},
+				})
+			},
+		},
+		{
+			description: "Should create a test logger with the expected config",
+			run: func(t *testing.T) {
+				l := logger.NewLogger().WithTestConfig()
+				l.Init()
+
+				cfg := l.GetConfig()
+
+				assert.Equal(t, cfg, model.LogConfig{
+					Level: "trace",
+					Json:  false,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: true},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: true},
+					},
+				})
+			},
+		},
+		{
+			description: "Should create a logger with a custom config",
+			run: func(t *testing.T) {
+				customCfg := model.LogConfig{
+					Level: "debug",
+					Json:  true,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: false},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: false},
+					},
+				}
+
+				l := logger.NewLogger().WithConfig(customCfg)
+				l.Init()
+
+				cfg := l.GetConfig()
+
+				assert.Equal(t, cfg, customCfg)
+			},
+		},
+		{
+			description: "Default logger should use error type and log json",
+			run: func(t *testing.T) {
+				buf := bytes.Buffer{}
+
+				l := logger.NewLogger().WithWriter(&buf)
+				l.Init()
+
+				cfg := l.GetConfig()
+
+				assert.Equal(t, cfg, model.LogConfig{
+					Level: "error",
+					Json:  true,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: true},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: false},
+					},
+				})
+
+				l.App.Error().Msg("test")
+
+				var entry map[string]any
+				err := json.Unmarshal(buf.Bytes(), &entry)
+				require.NoError(t, err)
+
+				assert.Equal(t, "test", entry["message"])
+				assert.Equal(t, "app", entry["stream"])
+				assert.Equal(t, "error", entry["level"])
+				assert.NotEmpty(t, entry["time"])
+			},
+		},
+		{
+			description: "Should default to error level if an invalid level is provided",
+			run: func(t *testing.T) {
+				buf := bytes.Buffer{}
+
+				customCfg := model.LogConfig{
+					Level: "invalid",
+					Json:  false,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: true},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: false},
+					},
+				}
+
+				l := logger.NewLogger().WithConfig(customCfg).WithWriter(&buf)
+				l.Init()
+
+				assert.Equal(t, zerolog.ErrorLevel, l.App.GetLevel())
+				assert.Equal(t, zerolog.ErrorLevel, l.HTTP.GetLevel())
+
+				// should not get logged
+				l.AuditLoginFailure("test", "test", "test", "test")
+
+				assert.Empty(t, buf.String())
+			},
+		},
+		{
+			description: "Should use nop logger for disabled streams",
+			run: func(t *testing.T) {
+				buf := bytes.Buffer{}
+
+				customCfg := model.LogConfig{
+					Level: "info",
+					Json:  false,
+					Streams: model.LogStreams{
+						HTTP:  model.LogStreamConfig{Enabled: false},
+						App:   model.LogStreamConfig{Enabled: true},
+						Audit: model.LogStreamConfig{Enabled: false},
+					},
+				}
+
+				l := logger.NewLogger().WithConfig(customCfg).WithWriter(&buf)
+				l.Init()
+
+				assert.Equal(t, zerolog.Disabled, l.HTTP.GetLevel())
+
+				l.App.Info().Msg("test")
+
+				l.AuditLoginFailure("test", "test", "test", "test")
+
+				assert.NotEmpty(t, buf.String())
+				assert.Equal(t, 81, buf.Len()) // it's the length of the test log entry
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, test.run)
+	}
+}

internal/utils/security_utils.go

@@ -41,7 +41,7 @@ func ParseSecretFile(contents string) string {
 	return ""
 }
 
-func GetBasicAuth(username string, password string) string {
+func EncodeBasicAuth(username string, password string) string {
 	auth := username + ":" + password
 	return base64.StdEncoding.EncodeToString([]byte(auth))
 }

internal/utils/security_utils_test.go

@@ -4,21 +4,21 @@ import (
 	"os"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-
-	"gotest.tools/v3/assert"
 )
 
 func TestGetSecret(t *testing.T) {
 	// Setup
 	file, err := os.Create("/tmp/tinyauth_test_secret")
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	_, err = file.WriteString("       secret       \n")
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	err = file.Close()
-	assert.NilError(t, err)
+	require.NoError(t, err)
 	defer os.Remove("/tmp/tinyauth_test_secret")
 
 	// Get from config
@@ -55,50 +55,50 @@ func TestParseSecretFile(t *testing.T) {
 	assert.Equal(t, "", utils.ParseSecretFile(content))
 }
 
-func TestGetBasicAuth(t *testing.T) {
+func TestEncodeBasicAuth(t *testing.T) {
 	// Normal case
 	username := "user"
 	password := "pass"
 	expected := "dXNlcjpwYXNz" // base64 of "user:pass"
-	assert.Equal(t, expected, utils.GetBasicAuth(username, password))
+	assert.Equal(t, expected, utils.EncodeBasicAuth(username, password))
 
 	// Empty username
 	username = ""
 	password = "pass"
 	expected = "OnBhc3M=" // base64 of ":pass"
-	assert.Equal(t, expected, utils.GetBasicAuth(username, password))
+	assert.Equal(t, expected, utils.EncodeBasicAuth(username, password))
 
 	// Empty password
 	username = "user"
 	password = ""
 	expected = "dXNlcjo=" // base64 of "user:"
-	assert.Equal(t, expected, utils.GetBasicAuth(username, password))
+	assert.Equal(t, expected, utils.EncodeBasicAuth(username, password))
 }
 
 func TestFilterIP(t *testing.T) {
 	// Exact match IPv4
 	ok, err := utils.FilterIP("10.10.0.1", "10.10.0.1")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, true, ok)
 
 	// Non-match IPv4
 	ok, err = utils.FilterIP("10.10.0.1", "10.10.0.2")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, false, ok)
 
 	// CIDR match IPv4
 	ok, err = utils.FilterIP("10.10.0.0/24", "10.10.0.2")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, true, ok)
 
 	// CIDR match IPv4 with '-' instead of '/'
 	ok, err = utils.FilterIP("10.10.10.0-24", "10.10.10.5")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, true, ok)
 
 	// CIDR non-match IPv4
 	ok, err = utils.FilterIP("10.10.0.0/24", "10.5.0.1")
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 	assert.Equal(t, false, ok)
 
 	// Invalid CIDR
@@ -145,5 +145,5 @@ func TestGenerateUUID(t *testing.T) {
 
 	// Different output for different input
 	id3 := utils.GenerateUUID("differentstring")
-	assert.Assert(t, id1 != id3)
+	assert.NotEqual(t, id2, id3)
 }

internal/utils/string_utils.go

@@ -28,3 +28,41 @@ func CoalesceToString(value any) string {
 		return ""
 	}
 }
+
+func ParseNonEmptyLines(contents string) []string {
+	lines := make([]string, 0)
+
+	for line := range strings.SplitSeq(contents, "\n") {
+		lineTrimmed := strings.TrimSpace(line)
+		if lineTrimmed == "" {
+			continue
+		}
+		lines = append(lines, lineTrimmed)
+	}
+
+	return lines
+}
+
+func GetStringList(valuesCfg []string, valuesPath string) ([]string, error) {
+	values := make([]string, 0, len(valuesCfg))
+
+	for _, value := range valuesCfg {
+		valueTrimmed := strings.TrimSpace(value)
+		if valueTrimmed == "" {
+			continue
+		}
+		values = append(values, valueTrimmed)
+	}
+
+	if valuesPath == "" {
+		return values, nil
+	}
+
+	contents, err := ReadFile(valuesPath)
+	if err != nil {
+		return []string{}, err
+	}
+
+	values = append(values, ParseNonEmptyLines(contents)...)
+	return values, nil
+}

internal/utils/string_utils_test.go

@@ -1,11 +1,11 @@
 package utils_test
 
 import (
+	"os"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-
-	"gotest.tools/v3/assert"
 )
 
 func TestCapitalize(t *testing.T) {
@@ -57,3 +57,33 @@ func TestCompileUserEmail(t *testing.T) {
 	// Test with invalid email
 	assert.Equal(t, "user@example.com", utils.CompileUserEmail("user", "example.com"))
 }
+
+func TestParseNonEmptyLines(t *testing.T) {
+	lines := utils.ParseNonEmptyLines(" first@example.com \n\n second@example.com \n   \n")
+
+	assert.Equal(t, []string{"first@example.com", "second@example.com"}, lines)
+}
+
+func TestGetStringList(t *testing.T) {
+	file, err := os.Create("/tmp/tinyauth_list_test_file")
+	assert.NoError(t, err)
+
+	_, err = file.WriteString(" third@example.com \n\n fourth@example.com \n")
+	assert.NoError(t, err)
+
+	err = file.Close()
+	assert.NoError(t, err)
+	defer os.Remove("/tmp/tinyauth_list_test_file")
+
+	values, err := utils.GetStringList([]string{" first@example.com ", "", "second@example.com"}, "/tmp/tinyauth_list_test_file")
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"first@example.com", "second@example.com", "third@example.com", "fourth@example.com"}, values)
+
+	values, err = utils.GetStringList(nil, "")
+	assert.NoError(t, err)
+	assert.Equal(t, []string{}, values)
+
+	values, err = utils.GetStringList(nil, "/tmp/non_existing_list_file")
+	assert.ErrorContains(t, err, "no such file or directory")
+	assert.Equal(t, []string{}, values)
+}

internal/utils/tlog/log_audit.go

@@ -1,39 +0,0 @@
-package tlog
-
-import "github.com/gin-gonic/gin"
-
-// functions here use CallerSkipFrame to ensure correct caller info is logged
-
-func AuditLoginSuccess(c *gin.Context, username, provider string) {
-	Audit.Info().
-		CallerSkipFrame(1).
-		Str("event", "login").
-		Str("result", "success").
-		Str("username", username).
-		Str("provider", provider).
-		Str("ip", c.ClientIP()).
-		Send()
-}
-
-func AuditLoginFailure(c *gin.Context, username, provider string, reason string) {
-	Audit.Warn().
-		CallerSkipFrame(1).
-		Str("event", "login").
-		Str("result", "failure").
-		Str("username", username).
-		Str("provider", provider).
-		Str("ip", c.ClientIP()).
-		Str("reason", reason).
-		Send()
-}
-
-func AuditLogout(c *gin.Context, username, provider string) {
-	Audit.Info().
-		CallerSkipFrame(1).
-		Str("event", "logout").
-		Str("result", "success").
-		Str("username", username).
-		Str("provider", provider).
-		Str("ip", c.ClientIP()).
-		Send()
-}

internal/utils/tlog/log_wrapper.go

@@ -1,97 +0,0 @@
-package tlog
-
-import (
-	"os"
-	"strings"
-	"time"
-
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"github.com/tinyauthapp/tinyauth/internal/config"
-)
-
-type Logger struct {
-	Audit zerolog.Logger
-	HTTP  zerolog.Logger
-	App   zerolog.Logger
-}
-
-var (
-	Audit zerolog.Logger
-	HTTP  zerolog.Logger
-	App   zerolog.Logger
-)
-
-func NewLogger(cfg config.LogConfig) *Logger {
-	baseLogger := log.With().
-		Timestamp().
-		Caller().
-		Logger().
-		Level(parseLogLevel(cfg.Level))
-
-	if !cfg.Json {
-		baseLogger = baseLogger.Output(zerolog.ConsoleWriter{
-			Out:        os.Stderr,
-			TimeFormat: time.RFC3339,
-		})
-	}
-
-	return &Logger{
-		Audit: createLogger("audit", cfg.Streams.Audit, baseLogger),
-		HTTP:  createLogger("http", cfg.Streams.HTTP, baseLogger),
-		App:   createLogger("app", cfg.Streams.App, baseLogger),
-	}
-}
-
-func NewSimpleLogger() *Logger {
-	return NewLogger(config.LogConfig{
-		Level: "info",
-		Json:  false,
-		Streams: config.LogStreams{
-			HTTP:  config.LogStreamConfig{Enabled: true},
-			App:   config.LogStreamConfig{Enabled: true},
-			Audit: config.LogStreamConfig{Enabled: false},
-		},
-	})
-}
-
-func NewTestLogger() *Logger {
-	return NewLogger(config.LogConfig{
-		Level: "trace",
-		Streams: config.LogStreams{
-			HTTP:  config.LogStreamConfig{Enabled: true},
-			App:   config.LogStreamConfig{Enabled: true},
-			Audit: config.LogStreamConfig{Enabled: true},
-		},
-	})
-}
-
-func (l *Logger) Init() {
-	Audit = l.Audit
-	HTTP = l.HTTP
-	App = l.App
-}
-
-func createLogger(component string, streamCfg config.LogStreamConfig, baseLogger zerolog.Logger) zerolog.Logger {
-	if !streamCfg.Enabled {
-		return zerolog.Nop()
-	}
-	subLogger := baseLogger.With().Str("log_stream", component).Logger()
-	// override level if specified, otherwise use base level
-	if streamCfg.Level != "" {
-		subLogger = subLogger.Level(parseLogLevel(streamCfg.Level))
-	}
-	return subLogger
-}
-
-func parseLogLevel(level string) zerolog.Level {
-	if level == "" {
-		return zerolog.InfoLevel
-	}
-	parsedLevel, err := zerolog.ParseLevel(strings.ToLower(level))
-	if err != nil {
-		log.Warn().Err(err).Str("level", level).Msg("Invalid log level, defaulting to info")
-		parsedLevel = zerolog.InfoLevel
-	}
-	return parsedLevel
-}

internal/utils/tlog/log_wrapper_test.go

@@ -1,93 +0,0 @@
-package tlog_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"testing"
-
-	"github.com/tinyauthapp/tinyauth/internal/config"
-	"github.com/tinyauthapp/tinyauth/internal/utils/tlog"
-
-	"github.com/rs/zerolog"
-	"gotest.tools/v3/assert"
-)
-
-func TestNewLogger(t *testing.T) {
-	cfg := config.LogConfig{
-		Level: "debug",
-		Json:  true,
-		Streams: config.LogStreams{
-			HTTP:  config.LogStreamConfig{Enabled: true, Level: "info"},
-			App:   config.LogStreamConfig{Enabled: true, Level: ""},
-			Audit: config.LogStreamConfig{Enabled: false, Level: ""},
-		},
-	}
-
-	logger := tlog.NewLogger(cfg)
-
-	assert.Assert(t, logger != nil)
-	assert.Assert(t, logger.HTTP.GetLevel() == zerolog.InfoLevel)
-	assert.Assert(t, logger.App.GetLevel() == zerolog.DebugLevel)
-	assert.Assert(t, logger.Audit.GetLevel() == zerolog.Disabled)
-}
-
-func TestNewSimpleLogger(t *testing.T) {
-	logger := tlog.NewSimpleLogger()
-	assert.Assert(t, logger != nil)
-	assert.Assert(t, logger.HTTP.GetLevel() == zerolog.InfoLevel)
-	assert.Assert(t, logger.App.GetLevel() == zerolog.InfoLevel)
-	assert.Assert(t, logger.Audit.GetLevel() == zerolog.Disabled)
-}
-
-func TestLoggerInit(t *testing.T) {
-	logger := tlog.NewSimpleLogger()
-	logger.Init()
-
-	assert.Assert(t, tlog.App.GetLevel() != zerolog.Disabled)
-}
-
-func TestLoggerWithDisabledStreams(t *testing.T) {
-	cfg := config.LogConfig{
-		Level: "info",
-		Json:  false,
-		Streams: config.LogStreams{
-			HTTP:  config.LogStreamConfig{Enabled: false},
-			App:   config.LogStreamConfig{Enabled: false},
-			Audit: config.LogStreamConfig{Enabled: false},
-		},
-	}
-
-	logger := tlog.NewLogger(cfg)
-
-	assert.Assert(t, logger.HTTP.GetLevel() == zerolog.Disabled)
-	assert.Assert(t, logger.App.GetLevel() == zerolog.Disabled)
-	assert.Assert(t, logger.Audit.GetLevel() == zerolog.Disabled)
-}
-
-func TestLogStreamField(t *testing.T) {
-	var buf bytes.Buffer
-
-	cfg := config.LogConfig{
-		Level: "info",
-		Json:  true,
-		Streams: config.LogStreams{
-			HTTP:  config.LogStreamConfig{Enabled: true},
-			App:   config.LogStreamConfig{Enabled: true},
-			Audit: config.LogStreamConfig{Enabled: true},
-		},
-	}
-
-	logger := tlog.NewLogger(cfg)
-
-	// Override output for HTTP logger to capture output
-	logger.HTTP = logger.HTTP.Output(&buf)
-
-	logger.HTTP.Info().Msg("test message")
-
-	var logEntry map[string]interface{}
-	err := json.Unmarshal(buf.Bytes(), &logEntry)
-	assert.NilError(t, err)
-
-	assert.Equal(t, "http", logEntry["log_stream"])
-	assert.Equal(t, "test message", logEntry["message"])
-}

internal/utils/user_utils.go

@@ -6,14 +6,14 @@ import (
 	"net/mail"
 	"strings"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 )
 
-func ParseUsers(usersStr []string, userAttributes map[string]config.UserAttributes) ([]config.User, error) {
+func ParseUsers(usersStr []string, userAttributes map[string]model.UserAttributes) (*[]model.LocalUser, error) {
-	var users []config.User
+	var users []model.LocalUser
 
 	if len(usersStr) == 0 {
-		return []config.User{}, nil
+		return nil, nil
 	}
 
 	for _, user := range usersStr {
@@ -22,50 +22,27 @@ func ParseUsers(usersStr []string, userAttributes map[string]config.UserAttribut
 		}
 		parsed, err := ParseUser(strings.TrimSpace(user))
 		if err != nil {
-			return []config.User{}, err
+			return nil, err
 		}
 		if attrs, ok := userAttributes[parsed.Username]; ok {
 			parsed.Attributes = attrs
 		}
-		users = append(users, parsed)
+		users = append(users, *parsed)
 	}
 
-	return users, nil
+	return &users, nil
 }
 
-func GetUsers(usersCfg []string, usersPath string, userAttributes map[string]config.UserAttributes) ([]config.User, error) {
+func GetUsers(usersCfg []string, usersPath string, userAttributes map[string]model.UserAttributes) (*[]model.LocalUser, error) {
-	var usersStr []string
+	usersStr, err := GetStringList(usersCfg, usersPath)
-
+	if err != nil {
-	if len(usersCfg) == 0 && usersPath == "" {
+		return nil, err
-		return []config.User{}, nil
-	}
-
-	if len(usersCfg) > 0 {
-		usersStr = append(usersStr, usersCfg...)
-	}
-
-	if usersPath != "" {
-		contents, err := ReadFile(usersPath)
-
-		if err != nil {
-			return []config.User{}, err
-		}
-
-		lines := strings.SplitSeq(contents, "\n")
-
-		for line := range lines {
-			lineTrimmed := strings.TrimSpace(line)
-			if lineTrimmed == "" {
-				continue
-			}
-			usersStr = append(usersStr, lineTrimmed)
-		}
 	}
 
 	return ParseUsers(usersStr, userAttributes)
 }
 
-func ParseUser(userStr string) (config.User, error) {
+func ParseUser(userStr string) (*model.LocalUser, error) {
 	if strings.Contains(userStr, "$$") {
 		userStr = strings.ReplaceAll(userStr, "$$", "$")
 	}
@@ -73,27 +50,27 @@ func ParseUser(userStr string) (config.User, error) {
 	parts := strings.SplitN(userStr, ":", 4)
 
 	if len(parts) < 2 || len(parts) > 3 {
-		return config.User{}, errors.New("invalid user format")
+		return nil, errors.New("invalid user format")
 	}
 
 	for i, part := range parts {
 		trimmed := strings.TrimSpace(part)
 		if trimmed == "" {
-			return config.User{}, errors.New("invalid user format")
+			return nil, errors.New("invalid user format")
 		}
 		parts[i] = trimmed
 	}
 
-	user := config.User{
+	user := model.LocalUser{
 		Username: parts[0],
 		Password: parts[1],
 	}
 
 	if len(parts) == 3 {
-		user.TotpSecret = parts[2]
+		user.TOTPSecret = parts[2]
 	}
 
-	return user, nil
+	return &user, nil
 }
 
 func CompileUserEmail(username string, domain string) string {

internal/utils/user_utils_test.go

@@ -4,74 +4,76 @@ import (
 	"os"
 	"testing"
 
-	"github.com/tinyauthapp/tinyauth/internal/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tinyauthapp/tinyauth/internal/model"
 	"github.com/tinyauthapp/tinyauth/internal/utils"
-
-	"gotest.tools/v3/assert"
 )
 
 func TestGetUsers(t *testing.T) {
+	tmpDir := t.TempDir()
+
 	hash := "$2a$10$Mz5xhkfSJUtPWkzCd/TdaePh9CaXc5QcGII5wIMPLSR46eTwma30G"
 
 	// Setup
-	file, err := os.Create("/tmp/tinyauth_users_test.txt")
+	file, err := os.Create(tmpDir + "/tinyauth_users_test.txt")
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	_, err = file.WriteString("      user1:" + hash + "        \n         user2:" + hash + "                    ") // Spacing is on purpose
-	assert.NilError(t, err)
+	require.NoError(t, err)
 
 	err = file.Close()
-	assert.NilError(t, err)
+	require.NoError(t, err)
-	defer os.Remove("/tmp/tinyauth_users_test.txt")
+	defer os.Remove(tmpDir + "/tinyauth_users_test.txt")
 
-	noAttrs := map[string]config.UserAttributes{}
+	noAttrs := map[string]model.UserAttributes{}
 
 	// Test file only
-	users, err := utils.GetUsers([]string{}, "/tmp/tinyauth_users_test.txt", noAttrs)
+	users, err := utils.GetUsers([]string{}, tmpDir+"/tinyauth_users_test.txt", noAttrs)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
+	assert.NotNil(t, users)
+	assert.Len(t, *users, 2)
 
-	assert.Equal(t, 2, len(users))
+	assert.Equal(t, "user1", (*users)[0].Username)
-
+	assert.Equal(t, hash, (*users)[0].Password)
-	assert.Equal(t, "user1", users[0].Username)
+	assert.Equal(t, "user2", (*users)[1].Username)
-	assert.Equal(t, hash, users[0].Password)
+	assert.Equal(t, hash, (*users)[1].Password)
-	assert.Equal(t, "user2", users[1].Username)
-	assert.Equal(t, hash, users[1].Password)
 
 	// Test inline config only
 	users, err = utils.GetUsers([]string{"user3:" + hash, "user4:" + hash}, "", noAttrs)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
-	assert.Equal(t, 2, len(users))
+	assert.Len(t, *users, 2)
-	assert.Equal(t, "user3", users[0].Username)
+	assert.Equal(t, "user3", (*users)[0].Username)
-	assert.Equal(t, "user4", users[1].Username)
+	assert.Equal(t, "user4", (*users)[1].Username)
 
 	// Test both
-	users, err = utils.GetUsers([]string{"user5:" + hash}, "/tmp/tinyauth_users_test.txt", noAttrs)
+	users, err = utils.GetUsers([]string{"user5:" + hash}, tmpDir+"/tinyauth_users_test.txt", noAttrs)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
-	assert.Equal(t, 3, len(users))
+	assert.Len(t, *users, 3)
 
 	usernames := map[string]bool{}
-	for _, u := range users {
+	for _, u := range *users {
 		usernames[u.Username] = true
 	}
-	assert.Assert(t, usernames["user1"])
+	assert.True(t, usernames["user1"])
-	assert.Assert(t, usernames["user2"])
+	assert.True(t, usernames["user2"])
-	assert.Assert(t, usernames["user5"])
+	assert.True(t, usernames["user5"])
 
 	// Test attributes applied from userAttributes map
-	attrs := map[string]config.UserAttributes{
+	attrs := map[string]model.UserAttributes{
 		"user1": {Name: "User One", Email: "user1@example.com"},
 	}
-	users, err = utils.GetUsers([]string{}, "/tmp/tinyauth_users_test.txt", attrs)
+	users, err = utils.GetUsers([]string{}, tmpDir+"/tinyauth_users_test.txt", attrs)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
-	assert.Equal(t, 2, len(users))
+	assert.Len(t, *users, 2)
 
-	for _, u := range users {
+	for _, u := range *users {
 		if u.Username == "user1" {
 			assert.Equal(t, "User One", u.Attributes.Name)
 			assert.Equal(t, "user1@example.com", u.Attributes.Email)
@@ -84,16 +86,14 @@ func TestGetUsers(t *testing.T) {
 	// Test empty
 	users, err = utils.GetUsers([]string{}, "", noAttrs)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
-
+	assert.Nil(t, users)
-	assert.Equal(t, 0, len(users))
 
 	// Test non-existent file
-	users, err = utils.GetUsers([]string{}, "/tmp/non_existent_file.txt", noAttrs)
+	users, err = utils.GetUsers([]string{}, tmpDir+"/non_existent_file.txt", noAttrs)
 
 	assert.ErrorContains(t, err, "no such file or directory")
-
+	assert.Nil(t, users)
-	assert.Equal(t, 0, len(users))
 }
 
 func TestParseUser(t *testing.T) {
@@ -102,38 +102,38 @@ func TestParseUser(t *testing.T) {
 	// Valid user without TOTP
 	user, err := utils.ParseUser("user1:" + hash)
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
 	assert.Equal(t, "user1", user.Username)
 	assert.Equal(t, hash, user.Password)
-	assert.Equal(t, "", user.TotpSecret)
+	assert.Equal(t, "", user.TOTPSecret)
 
 	// Valid user with TOTP
 	user, err = utils.ParseUser("user2:" + hash + ":ABCDEF")
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
 	assert.Equal(t, "user2", user.Username)
 	assert.Equal(t, hash, user.Password)
-	assert.Equal(t, "ABCDEF", user.TotpSecret)
+	assert.Equal(t, "ABCDEF", user.TOTPSecret)
 
 	// Valid user with $$ in password
 	user, err = utils.ParseUser("user3:pa$$word123")
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
 	assert.Equal(t, "user3", user.Username)
 	assert.Equal(t, "pa$word123", user.Password)
-	assert.Equal(t, "", user.TotpSecret)
+	assert.Equal(t, "", user.TOTPSecret)
 
 	// User with spaces
 	user, err = utils.ParseUser("   user4   :   password123   :   TOTPSECRET   ")
 
-	assert.NilError(t, err)
+	assert.NoError(t, err)
 
 	assert.Equal(t, "user4", user.Username)
 	assert.Equal(t, "password123", user.Password)
-	assert.Equal(t, "TOTPSECRET", user.TotpSecret)
+	assert.Equal(t, "TOTPSECRET", user.TOTPSecret)
 
 	// Invalid users
 	_, err = utils.ParseUser("user1") // Missing password