fix: redirect to frontend when no redirect uri is present in oauth callback

Change forwardauth endpoint in example compose

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Create a report to help improve Tinyauth
+title: "[BUG]"
+labels: bug
+assignees: steveiliop56
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Logs**
+Please include the Tinyauth logs below, make sure to not include sensitive info.
+
+**Device (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Tinyauth [e.g. v2.1.1]
+ - Docker [e.g. 27.3.1]
+
+**
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[FEATURE]"
+labels: enhancement
+assignees: steveiliop56
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: Tinyauth CI
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "^1.23.2"
+
+      - name: Setup bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install frontend dependencies
+        run: |
+          cd site
+          bun install
+
+      - name: Build frontend
+        run: |
+          cd site
+          bun run build
+
+      - name: Copy frontend
+        run: |
+          cp -r site/dist internal/assets/dist
+
+      - name: Run tests
+        run: go test -v ./...

.gitignore

@@ -5,7 +5,7 @@ internal/assets/dist
 tinyauth
 
 # test docker compose
-docker-compose.test.yml
+docker-compose.test*
 
 # users file
 users.txt

CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -0,0 +1,81 @@
+# Contributing
+
+Contributing is relatively easy.
+
+## Requirements
+
+- Bun
+- Golang v1.23.2 and above
+- Git
+- Docker
+
+## Cloning the repository
+
+You firstly need to clone the repository with:
+
+```sh
+git clone https://github.com/steveiliop56/tinyauth
+cd tinyauth
+```
+
+## Install requirements
+
+Now it's time to install the requirements, firstly the Go ones:
+
+```sh
+go mod download
+```
+
+And now the site ones:
+
+```sh
+cd site
+bun i
+```
+
+## Developing locally
+
+In order to develop the app locally you need to build the frontend and copy it to the assets folder in order for Go to embed it and host it. In order to build the frontend run:
+
+```sh
+cd site
+bun run build
+cd ..
+```
+
+Copy it to the assets folder:
+
+```sh
+rm -rf internal/assets/dist
+cp -r site/dist internal/assets/dist
+```
+
+Finally either run the app with:
+
+```sh
+go run main.go
+```
+
+Or build it with:
+
+```sh
+go build
+```
+
+> [!WARNING]
+> Make sure you have set the environment variables when running outside of docker else the app will fail.
+
+## Developing in docker
+
+My recommended development method is docker so I can test that both my image works and that the app responds correctly to traefik. In my setup I have set these two DNS records in my DNS server:
+
+```
+*.dev.local -> 127.0.0.1
+dev.local -> 127.0.0.1
+```
+
+Then I can just make sure the domains are correct in the example docker compose file and do:
+
+```sh
+docker compose -f docker-compose.dev.yml up --build
+```

README.md

@@ -8,8 +8,8 @@
     <img alt="License" src="https://img.shields.io/github/license/steveiliop56/tinyauth">
     <img alt="Release" src="https://img.shields.io/github/v/release/steveiliop56/tinyauth">
     <img alt="Commit activity" src="https://img.shields.io/github/commit-activity/w/steveiliop56/tinyauth">
-    <img alt="Actions Workflow Status" src="https://img.shields.io/github/actions/workflow/status/steveiliop56/tinyauth/release.yml">
     <img alt="Issues" src="https://img.shields.io/github/issues/steveiliop56/tinyauth">
+    <img alt="Tinyauth CI" src="https://github.com/steveiliop56/tinyauth/actions/workflows/ci.yml/badge.svg">
 </div>
 
 <br />
@@ -22,9 +22,13 @@ Tinyauth is a simple authentication middleware that adds simple username/passwor
 > [!NOTE]
 > Tinyauth is intended for homelab use and it is not made for production use cases. If you are looking for something production ready please use [authentik](https://goauthentik.io).
 
+## Discord
+
+I just made a Discord server for Tinyauth! It is not only for Tinyauth but general self-hosting because I just like chatting with people! The link is [here](https://discord.gg/eHzVaCzRRd), see you there!
+
 ## Getting Started
 
-You can easily get started with tinyauth by following the guide on the documentation [here](https://tinyauth.doesmycode.work/docs/getting-started.html). There is also an available docker compose file [here](./docker-compose.example.yml) that has traefik, nginx and tinyauth to demonstrate its capabilities.
+You can easily get started with tinyauth by following the guide on the [documentation](https://tinyauth.doesmycode.work/docs/getting-started.html). There is also an available [docker compose file](./docker-compose.example.yml) that has traefik, nginx and tinyauth to demonstrate its capabilities.
 
 ## Documentation
 

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+## Supported Versions
+
+Please always use the latest available Tinyauth version which can be found [here](https://github.com/steveiliop56/tinyauth/releases/latest). Older versions (especially major) may contain security issues which I cannot go back and fix.
+
+## Reporting a Vulnerability
+
+Due to the nature of this app, it needs to be secure. If you find any security issues in the OAuth or login flow of the app please contact me at <steve@doesmycode.work> and include a concise description of the issue. Please do not use the issues section for reporting major security issues.

assets/discohook.json

@@ -0,0 +1,22 @@
+{
+  "content": null,
+  "embeds": [
+    {
+      "title": "Welcome to Tinyauth Discord!",
+      "description": "Tinyauth is a simple authentication middleware that adds simple username/password login or OAuth with Google, Github and any generic OAuth provider to all of your docker apps.\n\n**Information**\n\n• Github: <https://github.com/steveiliop56/tinyauth>\n• Website: <https://tinyauth.doesmycode.work>",
+      "url": "https://tinyauth.doesmycode.work",
+      "color": 7002085,
+      "author": {
+        "name": "Tinyauth"
+      },
+      "footer": {
+        "text": "Updated at"
+      },
+      "timestamp": "2025-02-06T22:00:00.000Z",
+      "thumbnail": {
+        "url": "https://github.com/steveiliop56/tinyauth/blob/main/site/public/logo.png?raw=true"
+      }
+    }
+  ],
+  "attachments": []
+}

cmd/root.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"errors"
 	"os"
 	"strings"
 	"time"
@@ -54,12 +55,16 @@ var rootCmd = &cobra.Command{
 		log.Info().Msg("Parsing users")
 		users, usersErr := utils.GetUsers(config.Users, config.UsersFile)
 
-		if (len(users) == 0 || usersErr != nil) && !utils.OAuthConfigured(config) {
-			log.Fatal().Err(usersErr).Msg("Failed to parse users")
+		HandleError(usersErr, "Failed to parse users")
+
+		if len(users) == 0 && !utils.OAuthConfigured(config) {
+			HandleError(errors.New("no users or OAuth configured"), "No users or OAuth configured")
 		}
 
 		// Create oauth whitelist
-		oauthWhitelist := strings.Split(config.OAuthWhitelist, ",")
+		oauthWhitelist := utils.Filter(strings.Split(config.OAuthWhitelist, ","), func(val string) bool {
+			return val != ""
+		})
 		log.Debug().Msg("Parsed OAuth whitelist")
 
 		// Create OAuth config
@@ -89,7 +94,7 @@ var rootCmd = &cobra.Command{
 		HandleError(dockerErr, "Failed to initialize docker")
 
 		// Create auth service
-		auth := auth.NewAuth(docker, users, oauthWhitelist)
+		auth := auth.NewAuth(docker, users, oauthWhitelist, config.SessionExpiry)
 
 		// Create OAuth providers service
 		providers := providers.NewProviders(oauthConfig)
@@ -108,7 +113,7 @@ var rootCmd = &cobra.Command{
 			AppURL:          config.AppURL,
 			CookieSecure:    config.CookieSecure,
 			DisableContinue: config.DisableContinue,
-			CookieExpiry:    config.CookieExpiry,
+			CookieExpiry:    config.SessionExpiry,
 		}, hooks, auth, providers)
 
 		// Setup routes
@@ -122,20 +127,24 @@ var rootCmd = &cobra.Command{
 
 func Execute() {
 	err := rootCmd.Execute()
-	if err != nil {
-		log.Fatal().Err(err).Msg("Failed to execute command")
-	}
+	HandleError(err, "Failed to execute root command")
 }
 
 func HandleError(err error, msg string) {
+	// If error log it and exit
 	if err != nil {
 		log.Fatal().Err(err).Msg(msg)
 	}
 }
 
 func init() {
+	// Add user command
 	rootCmd.AddCommand(cmd.UserCmd())
+
+	// Read environment variables
 	viper.AutomaticEnv()
+
+	// Flags
 	rootCmd.Flags().Int("port", 3000, "Port to run the server on.")
 	rootCmd.Flags().String("address", "0.0.0.0", "Address to bind the server to.")
 	rootCmd.Flags().String("secret", "", "Secret to use for the cookie.")
@@ -162,8 +171,10 @@ func init() {
 	rootCmd.Flags().String("generic-user-url", "", "Generic OAuth user info URL.")
 	rootCmd.Flags().Bool("disable-continue", false, "Disable continue screen and redirect to app directly.")
 	rootCmd.Flags().String("oauth-whitelist", "", "Comma separated list of email addresses to whitelist when using OAuth.")
-	rootCmd.Flags().Int("cookie-expiry", 86400, "Cookie expiration time in seconds.")
+	rootCmd.Flags().Int("session-expiry", 86400, "Session (cookie) expiration time in seconds.")
 	rootCmd.Flags().Int("log-level", 1, "Log level.")
+
+	// Bind flags to environment
 	viper.BindEnv("port", "PORT")
 	viper.BindEnv("address", "ADDRESS")
 	viper.BindEnv("secret", "SECRET")
@@ -190,7 +201,9 @@ func init() {
 	viper.BindEnv("generic-user-url", "GENERIC_USER_URL")
 	viper.BindEnv("disable-continue", "DISABLE_CONTINUE")
 	viper.BindEnv("oauth-whitelist", "OAUTH_WHITELIST")
-	viper.BindEnv("cookie-expiry", "COOKIE_EXPIRY")
+	viper.BindEnv("session-expiry", "SESSION_EXPIRY")
 	viper.BindEnv("log-level", "LOG_LEVEL")
+
+	// Bind flags to viper
 	viper.BindPFlags(rootCmd.Flags())
 }

cmd/user/create/create.go

@@ -13,27 +13,32 @@ import (
 )
 
 var interactive bool
-var username string
-var password string
 var docker bool
 
+// i stands for input
+var iUsername string
+var iPassword string
+
 var CreateCmd = &cobra.Command{
 	Use:   "create",
 	Short: "Create a user",
 	Long:  `Create a user either interactively or by passing flags.`,
 	Run: func(cmd *cobra.Command, args []string) {
+		// Setup logger
 		log.Logger = log.Level(zerolog.InfoLevel)
 
+		// Check if interactive
 		if interactive {
+			// Create huh form
 			form := huh.NewForm(
 				huh.NewGroup(
-					huh.NewInput().Title("Username").Value(&username).Validate((func(s string) error {
+					huh.NewInput().Title("Username").Value(&iUsername).Validate((func(s string) error {
 						if s == "" {
 							return errors.New("username cannot be empty")
 						}
 						return nil
 					})),
-					huh.NewInput().Title("Password").Value(&password).Validate((func(s string) error {
+					huh.NewInput().Title("Password").Value(&iPassword).Validate((func(s string) error {
 						if s == "" {
 							return errors.New("password cannot be empty")
 						}
@@ -43,6 +48,7 @@ var CreateCmd = &cobra.Command{
 				),
 			)
 
+			// Use simple theme
 			var baseTheme *huh.Theme = huh.ThemeBase()
 
 			formErr := form.WithTheme(baseTheme).Run()
@@ -52,31 +58,37 @@ var CreateCmd = &cobra.Command{
 			}
 		}
 
-		if username == "" || password == "" {
+		// Do we have username and password?
+		if iUsername == "" || iPassword == "" {
 			log.Error().Msg("Username and password cannot be empty")
 		}
 
-		log.Info().Str("username", username).Str("password", password).Bool("docker", docker).Msg("Creating user")
+		log.Info().Str("username", iUsername).Str("password", iPassword).Bool("docker", docker).Msg("Creating user")
 
-		passwordByte, passwordErr := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+		// Hash password
+		password, passwordErr := bcrypt.GenerateFromPassword([]byte(iPassword), bcrypt.DefaultCost)
 
 		if passwordErr != nil {
 			log.Fatal().Err(passwordErr).Msg("Failed to hash password")
 		}
 
-		passwordString := string(passwordByte)
+		// Convert password to string
+		passwordString := string(password)
 
+		// Escape $ for docker
 		if docker {
 			passwordString = strings.ReplaceAll(passwordString, "$", "$$")
 		}
 
-		log.Info().Str("user", fmt.Sprintf("%s:%s", username, passwordString)).Msg("User created")
+		// Log user created
+		log.Info().Str("user", fmt.Sprintf("%s:%s", iUsername, passwordString)).Msg("User created")
 	},
 }
 
 func init() {
-	CreateCmd.Flags().BoolVar(&interactive, "interactive", false, "Create a user interactively")
+	// Flags
+	CreateCmd.Flags().BoolVarP(&interactive, "interactive", "i", false, "Create a user interactively")
 	CreateCmd.Flags().BoolVar(&docker, "docker", false, "Format output for docker")
-	CreateCmd.Flags().StringVar(&username, "username", "", "Username")
-	CreateCmd.Flags().StringVar(&password, "password", "", "Password")
+	CreateCmd.Flags().StringVar(&iUsername, "username", "", "Username")
+	CreateCmd.Flags().StringVar(&iPassword, "password", "", "Password")
 }

cmd/user/verify/verify.go

@@ -12,34 +12,39 @@ import (
 )
 
 var interactive bool
-var username string
-var password string
 var docker bool
-var user string
+
+// i stands for input
+var iUsername string
+var iPassword string
+var iUser string
 
 var VerifyCmd = &cobra.Command{
 	Use:   "verify",
 	Short: "Verify a user is set up correctly",
 	Long:  `Verify a user is set up correctly meaning that it has a correct username and password.`,
 	Run: func(cmd *cobra.Command, args []string) {
+		// Setup logger
 		log.Logger = log.Level(zerolog.InfoLevel)
 
+		// Check if interactive
 		if interactive {
+			// Create huh form
 			form := huh.NewForm(
 				huh.NewGroup(
-					huh.NewInput().Title("User (username:hash)").Value(&user).Validate((func(s string) error {
+					huh.NewInput().Title("User (username:hash)").Value(&iUser).Validate((func(s string) error {
 						if s == "" {
 							return errors.New("user cannot be empty")
 						}
 						return nil
 					})),
-					huh.NewInput().Title("Username").Value(&username).Validate((func(s string) error {
+					huh.NewInput().Title("Username").Value(&iUsername).Validate((func(s string) error {
 						if s == "" {
 							return errors.New("username cannot be empty")
 						}
 						return nil
 					})),
-					huh.NewInput().Title("Password").Value(&password).Validate((func(s string) error {
+					huh.NewInput().Title("Password").Value(&iPassword).Validate((func(s string) error {
 						if s == "" {
 							return errors.New("password cannot be empty")
 						}
@@ -49,6 +54,7 @@ var VerifyCmd = &cobra.Command{
 				),
 			)
 
+			// Use simple theme
 			var baseTheme *huh.Theme = huh.ThemeBase()
 
 			formErr := form.WithTheme(baseTheme).Run()
@@ -58,25 +64,29 @@ var VerifyCmd = &cobra.Command{
 			}
 		}
 
-		if username == "" || password == "" || user == "" {
+		// Do we have username, password and user?
+		if iUsername == "" || iPassword == "" || iUser == "" {
 			log.Fatal().Msg("Username, password and user cannot be empty")
 		}
 
-		log.Info().Str("user", user).Str("username", username).Str("password", password).Bool("docker", docker).Msg("Verifying user")
+		log.Info().Str("user", iUser).Str("username", iUsername).Str("password", iPassword).Bool("docker", docker).Msg("Verifying user")
 
-		userSplit := strings.Split(user, ":")
+		// Split username and password hash
+		username, hash, ok := strings.Cut(iUser, ":")
 
-		if userSplit[1] == "" {
+		if !ok {
 			log.Fatal().Msg("User is not formatted correctly")
 		}
 
+		// Replace $$ with $ if formatted for docker
 		if docker {
-			userSplit[1] = strings.ReplaceAll(userSplit[1], "$$", "$")
+			hash = strings.ReplaceAll(hash, "$$", "$")
 		}
 
-		verifyErr := bcrypt.CompareHashAndPassword([]byte(userSplit[1]), []byte(password))
+		// Compare username and password
+		verifyErr := bcrypt.CompareHashAndPassword([]byte(hash), []byte(iPassword))
 
-		if verifyErr != nil || username != userSplit[0] {
+		if verifyErr != nil || username != iUsername {
 			log.Fatal().Msg("Username or password incorrect")
 		} else {
 			log.Info().Msg("Verification successful")
@@ -85,9 +95,10 @@ var VerifyCmd = &cobra.Command{
 }
 
 func init() {
+	// Flags
 	VerifyCmd.Flags().BoolVarP(&interactive, "interactive", "i", false, "Create a user interactively")
 	VerifyCmd.Flags().BoolVar(&docker, "docker", false, "Is the user formatted for docker?")
-	VerifyCmd.Flags().StringVar(&username, "username", "", "Username")
-	VerifyCmd.Flags().StringVar(&password, "password", "", "Password")
-	VerifyCmd.Flags().StringVar(&user, "user", "", "Hash (username:hash combination)")
+	VerifyCmd.Flags().StringVar(&iUsername, "username", "", "Username")
+	VerifyCmd.Flags().StringVar(&iPassword, "password", "", "Password")
+	VerifyCmd.Flags().StringVar(&iUser, "user", "", "Hash (username:hash combination)")
 }

docker-compose.dev.yml

@@ -7,8 +7,6 @@ services:
       - 80:80
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    labels:
-      traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth
 
   nginx:
     container_name: nginx
@@ -32,3 +30,4 @@ services:
       traefik.enable: true
       traefik.http.routers.tinyauth.rule: Host(`tinyauth.dev.local`)
       traefik.http.services.tinyauth.loadbalancer.server.port: 3000
+      traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth

docker-compose.example.yml

@@ -7,8 +7,6 @@ services:
       - 80:80
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-    labels:
-      traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth
 
   nginx:
     container_name: nginx
@@ -30,3 +28,4 @@ services:
       traefik.enable: true
       traefik.http.routers.tinyauth.rule: Host(`tinyauth.example.com`)
       traefik.http.services.tinyauth.loadbalancer.server.port: 3000
+      traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth

internal/api/api.go

@@ -41,11 +41,15 @@ type API struct {
 }
 
 func (api *API) Init() {
+	// Disable gin logs
 	gin.SetMode(gin.ReleaseMode)
 
+	// Create router and use zerolog for logs
 	log.Debug().Msg("Setting up router")
 	router := gin.New()
 	router.Use(zerolog())
+
+	// Read UI assets
 	log.Debug().Msg("Setting up assets")
 	dist, distErr := fs.Sub(assets.Assets, "dist")
 
@@ -53,11 +57,15 @@ func (api *API) Init() {
 		log.Fatal().Err(distErr).Msg("Failed to get UI assets")
 	}
 
+	// Create file server
 	log.Debug().Msg("Setting up file server")
 	fileServer := http.FileServer(http.FS(dist))
+
+	// Setup cookie store
 	log.Debug().Msg("Setting up cookie store")
 	store := cookie.NewStore([]byte(api.Config.Secret))
 
+	// Get domain to use for session cookies
 	log.Debug().Msg("Getting domain")
 	domain, domainErr := utils.GetRootURL(api.Config.AppURL)
 
@@ -70,6 +78,7 @@ func (api *API) Init() {
 
 	api.Domain = fmt.Sprintf(".%s", domain)
 
+	// Use session middleware
 	store.Options(sessions.Options{
 		Domain:   api.Domain,
 		Path:     "/",
@@ -80,82 +89,166 @@ func (api *API) Init() {
 
 	router.Use(sessions.Sessions("tinyauth", store))
 
+	// UI middleware
 	router.Use(func(c *gin.Context) {
+		// If not an API request, serve the UI
 		if !strings.HasPrefix(c.Request.URL.Path, "/api") {
 			_, err := fs.Stat(dist, strings.TrimPrefix(c.Request.URL.Path, "/"))
+
+			// If the file doesn't exist, serve the index.html
 			if os.IsNotExist(err) {
 				c.Request.URL.Path = "/"
 			}
+
+			// Serve the file
 			fileServer.ServeHTTP(c.Writer, c.Request)
+
+			// Stop further processing
 			c.Abort()
 		}
 	})
 
+	// Set router
 	api.Router = router
 }
 
 func (api *API) SetupRoutes() {
-	api.Router.GET("/api/auth", func(c *gin.Context) {
-		log.Debug().Msg("Checking auth")
+	api.Router.GET("/api/auth/:proxy", func(c *gin.Context) {
+		// Create struct for proxy
+		var proxy types.Proxy
+
+		// Bind URI
+		bindErr := c.BindUri(&proxy)
+
+		// Handle error
+		if bindErr != nil {
+			log.Error().Err(bindErr).Msg("Failed to bind URI")
+			c.JSON(400, gin.H{
+				"status":  400,
+				"message": "Bad Request",
+			})
+			return
+		}
+
+		log.Debug().Interface("proxy", proxy.Proxy).Msg("Got proxy")
+
+		// Get user context
 		userContext := api.Hooks.UseUserContext(c)
 
+		// Check if using basic auth
+		_, _, basicAuth := c.Request.BasicAuth()
+
+		// Get headers
 		uri := c.Request.Header.Get("X-Forwarded-Uri")
 		proto := c.Request.Header.Get("X-Forwarded-Proto")
 		host := c.Request.Header.Get("X-Forwarded-Host")
 
+		// Check if user is logged in
 		if userContext.IsLoggedIn {
 			log.Debug().Msg("Authenticated")
 
+			// Check if user is allowed to access subdomain, if request is nginx.example.com the subdomain (resource) is nginx
 			appAllowed, appAllowedErr := api.Auth.ResourceAllowed(userContext, host)
 
-			log.Debug().Bool("appAllowed", appAllowed).Msg("Checking if user is allowed")
+			// Check if there was an error
+			if appAllowedErr != nil {
+				// Return 501 if nginx is the proxy or if the request is using basic auth
+				if proxy.Proxy == "nginx" || basicAuth {
+					log.Error().Err(appAllowedErr).Msg("Failed to check if app is allowed")
+					c.JSON(501, gin.H{
+						"status":  501,
+						"message": "Internal Server Error",
+					})
+					return
+				}
 
-			if api.handleError(c, "Failed to check if resource is allowed", appAllowedErr) {
-				return
+				// Return the internal server error page
+				if api.handleError(c, "Failed to check if app is allowed", appAllowedErr) {
+					return
+				}
 			}
 
+			log.Debug().Bool("appAllowed", appAllowed).Msg("Checking if app is allowed")
+
+			// The user is not allowed to access the app
 			if !appAllowed {
 				log.Warn().Str("username", userContext.Username).Str("host", host).Msg("User not allowed")
+
+				// Return 401 if nginx is the proxy or if the request is using an Authorization header
+				if proxy.Proxy == "nginx" || basicAuth {
+					c.Header("WWW-Authenticate", "Basic realm=\"tinyauth\"")
+					c.JSON(401, gin.H{
+						"status":  401,
+						"message": "Unauthorized",
+					})
+					return
+				}
+
+				// Build query
 				queries, queryErr := query.Values(types.UnauthorizedQuery{
 					Username: userContext.Username,
 					Resource: strings.Split(host, ".")[0],
 				})
+
+				// Handle error (no need to check for nginx/headers since we are sure we are using caddy/traefik)
 				if api.handleError(c, "Failed to build query", queryErr) {
 					return
 				}
+
+				// We are using caddy/traefik so redirect
 				c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/unauthorized?%s", api.Config.AppURL, queries.Encode()))
+
+				// Stop further processing
+				return
 			}
 
+			// The user is allowed to access the app
 			c.JSON(200, gin.H{
 				"status":  200,
 				"message": "Authenticated",
 			})
+
+			// Stop further processing
 			return
 		}
 
-		queries, queryErr := query.Values(types.LoginQuery{
-			RedirectURI: fmt.Sprintf("%s://%s%s", proto, host, uri),
-		})
+		// The user is not logged in
+		log.Debug().Msg("Unauthorized")
 
-		log.Debug().Interface("redirect_uri", fmt.Sprintf("%s://%s%s", proto, host, uri)).Msg("Redirecting to login")
-
-		if queryErr != nil {
-			log.Error().Err(queryErr).Msg("Failed to build query")
-			c.JSON(501, gin.H{
-				"status":  501,
-				"message": "Internal Server Error",
+		// Return 401 if nginx is the proxy or if the request is using an Authorization header
+		if proxy.Proxy == "nginx" || basicAuth {
+			c.Header("WWW-Authenticate", "Basic realm=\"tinyauth\"")
+			c.JSON(401, gin.H{
+				"status":  401,
+				"message": "Unauthorized",
 			})
 			return
 		}
 
+		// Build query
+		queries, queryErr := query.Values(types.LoginQuery{
+			RedirectURI: fmt.Sprintf("%s://%s%s", proto, host, uri),
+		})
+
+		// Handle error (no need to check for nginx/headers since we are sure we are using caddy/traefik)
+		if api.handleError(c, "Failed to build query", queryErr) {
+			return
+		}
+
+		log.Debug().Interface("redirect_uri", fmt.Sprintf("%s://%s%s", proto, host, uri)).Msg("Redirecting to login")
+
+		// Redirect to login
 		c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf("%s/?%s", api.Config.AppURL, queries.Encode()))
 	})
 
 	api.Router.POST("/api/login", func(c *gin.Context) {
+		// Create login struct
 		var login types.LoginRequest
 
+		// Bind JSON
 		err := c.BindJSON(&login)
 
+		// Handle error
 		if err != nil {
 			log.Error().Err(err).Msg("Failed to bind JSON")
 			c.JSON(400, gin.H{
@@ -167,8 +260,10 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Msg("Got login request")
 
+		// Get user based on username
 		user := api.Auth.GetUser(login.Username)
 
+		// User does not exist
 		if user == nil {
 			log.Debug().Str("username", login.Username).Msg("User not found")
 			c.JSON(401, gin.H{
@@ -178,6 +273,9 @@ func (api *API) SetupRoutes() {
 			return
 		}
 
+		log.Debug().Msg("Got user")
+
+		// Check if password is correct
 		if !api.Auth.CheckPassword(*user, login.Password) {
 			log.Debug().Str("username", login.Username).Msg("Password incorrect")
 			c.JSON(401, gin.H{
@@ -189,11 +287,13 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Msg("Password correct, logging in")
 
+		// Create session cookie with username as provider
 		api.Auth.CreateSessionCookie(c, &types.SessionCookie{
 			Username: login.Username,
 			Provider: "username",
 		})
 
+		// Return logged in
 		c.JSON(200, gin.H{
 			"status":  200,
 			"message": "Logged in",
@@ -201,12 +301,17 @@ func (api *API) SetupRoutes() {
 	})
 
 	api.Router.POST("/api/logout", func(c *gin.Context) {
+		log.Debug().Msg("Logging out")
+
+		// Delete session cookie
 		api.Auth.DeleteSessionCookie(c)
 
 		log.Debug().Msg("Cleaning up redirect cookie")
 
+		// Clean up redirect cookie if it exists
 		c.SetCookie("tinyauth_redirect_uri", "", -1, "/", api.Domain, api.Config.CookieSecure, true)
 
+		// Return logged out
 		c.JSON(200, gin.H{
 			"status":  200,
 			"message": "Logged out",
@@ -215,19 +320,25 @@ func (api *API) SetupRoutes() {
 
 	api.Router.GET("/api/status", func(c *gin.Context) {
 		log.Debug().Msg("Checking status")
+
+		// Get user context
 		userContext := api.Hooks.UseUserContext(c)
 
+		// Get configured providers
 		configuredProviders := api.Providers.GetConfiguredProviders()
 
+		// We have username/password configured so add it to our providers
 		if api.Auth.UserAuthConfigured() {
 			configuredProviders = append(configuredProviders, "username")
 		}
 
+		// We are not logged in so return unauthorized
 		if !userContext.IsLoggedIn {
-			log.Debug().Msg("Unauthenticated")
+			log.Debug().Msg("Unauthorized")
+			c.Header("WWW-Authenticate", "Basic realm=\"tinyauth\"")
 			c.JSON(200, gin.H{
 				"status":              200,
-				"message":             "Unauthenticated",
+				"message":             "Unauthorized",
 				"username":            "",
 				"isLoggedIn":          false,
 				"oauth":               false,
@@ -240,6 +351,7 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Interface("userContext", userContext).Strs("configuredProviders", configuredProviders).Bool("disableContinue", api.Config.DisableContinue).Msg("Authenticated")
 
+		// We are logged in so return our user context
 		c.JSON(200, gin.H{
 			"status":              200,
 			"message":             "Authenticated",
@@ -252,18 +364,14 @@ func (api *API) SetupRoutes() {
 		})
 	})
 
-	api.Router.GET("/api/healthcheck", func(c *gin.Context) {
-		c.JSON(200, gin.H{
-			"status":  200,
-			"message": "OK",
-		})
-	})
-
 	api.Router.GET("/api/oauth/url/:provider", func(c *gin.Context) {
+		// Create struct for OAuth request
 		var request types.OAuthRequest
 
+		// Bind URI
 		bindErr := c.BindUri(&request)
 
+		// Handle error
 		if bindErr != nil {
 			log.Error().Err(bindErr).Msg("Failed to bind URI")
 			c.JSON(400, gin.H{
@@ -275,8 +383,10 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Msg("Got OAuth request")
 
+		// Check if provider exists
 		provider := api.Providers.GetProvider(request.Provider)
 
+		// Provider does not exist
 		if provider == nil {
 			c.JSON(404, gin.H{
 				"status":  404,
@@ -287,24 +397,38 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Str("provider", request.Provider).Msg("Got provider")
 
+		// Get auth URL
 		authURL := provider.GetAuthURL()
 
 		log.Debug().Msg("Got auth URL")
 
+		// Get redirect URI
 		redirectURI := c.Query("redirect_uri")
 
+		// Set redirect cookie if redirect URI is provided
 		if redirectURI != "" {
 			log.Debug().Str("redirectURI", redirectURI).Msg("Setting redirect cookie")
 			c.SetCookie("tinyauth_redirect_uri", redirectURI, 3600, "/", api.Domain, api.Config.CookieSecure, true)
 		}
 
+		// Tailscale does not have an auth url so we create a random code (does not need to be secure) to avoid caching and send it
 		if request.Provider == "tailscale" {
+			// Build tailscale query
 			tailscaleQuery, tailscaleQueryErr := query.Values(types.TailscaleQuery{
-				Code: (1000 + rand.IntN(9000)), // doesn't need to be secure, just there to avoid caching
+				Code: (1000 + rand.IntN(9000)),
 			})
-			if api.handleError(c, "Failed to build query", tailscaleQueryErr) {
+
+			// Handle error
+			if tailscaleQueryErr != nil {
+				log.Error().Err(tailscaleQueryErr).Msg("Failed to build query")
+				c.JSON(500, gin.H{
+					"status":  500,
+					"message": "Internal Server Error",
+				})
 				return
 			}
+
+			// Return tailscale URL (immidiately redirects to the callback)
 			c.JSON(200, gin.H{
 				"status":  200,
 				"message": "Ok",
@@ -313,6 +437,7 @@ func (api *API) SetupRoutes() {
 			return
 		}
 
+		// Return auth URL
 		c.JSON(200, gin.H{
 			"status":  200,
 			"message": "Ok",
@@ -321,18 +446,23 @@ func (api *API) SetupRoutes() {
 	})
 
 	api.Router.GET("/api/oauth/callback/:provider", func(c *gin.Context) {
+		// Create struct for OAuth request
 		var providerName types.OAuthRequest
 
+		// Bind URI
 		bindErr := c.BindUri(&providerName)
 
+		// Handle error
 		if api.handleError(c, "Failed to bind URI", bindErr) {
 			return
 		}
 
 		log.Debug().Interface("provider", providerName.Provider).Msg("Got provider name")
 
+		// Get code
 		code := c.Query("code")
 
+		// Code empty so redirect to error
 		if code == "" {
 			log.Error().Msg("No code provided")
 			c.Redirect(http.StatusPermanentRedirect, "/error")
@@ -341,82 +471,111 @@ func (api *API) SetupRoutes() {
 
 		log.Debug().Msg("Got code")
 
+		// Get provider
 		provider := api.Providers.GetProvider(providerName.Provider)
 
 		log.Debug().Str("provider", providerName.Provider).Msg("Got provider")
 
+		// Provider does not exist
 		if provider == nil {
 			c.Redirect(http.StatusPermanentRedirect, "/not-found")
 			return
 		}
 
+		// Exchange token (authenticates user)
 		_, tokenErr := provider.ExchangeToken(code)
 
 		log.Debug().Msg("Got token")
 
+		// Handle error
 		if api.handleError(c, "Failed to exchange token", tokenErr) {
 			return
 		}
 
+		// Get email
 		email, emailErr := api.Providers.GetUser(providerName.Provider)
 
 		log.Debug().Str("email", email).Msg("Got email")
 
+		// Handle error
 		if api.handleError(c, "Failed to get user", emailErr) {
 			return
 		}
 
+		// Email is not whitelisted
 		if !api.Auth.EmailWhitelisted(email) {
 			log.Warn().Str("email", email).Msg("Email not whitelisted")
+
+			// Build query
 			unauthorizedQuery, unauthorizedQueryErr := query.Values(types.UnauthorizedQuery{
 				Username: email,
 			})
+
+			// Handle error
 			if api.handleError(c, "Failed to build query", unauthorizedQueryErr) {
 				return
 			}
+
+			// Redirect to unauthorized
 			c.Redirect(http.StatusPermanentRedirect, fmt.Sprintf("%s/unauthorized?%s", api.Config.AppURL, unauthorizedQuery.Encode()))
 		}
 
 		log.Debug().Msg("Email whitelisted")
 
+		// Create session cookie
 		api.Auth.CreateSessionCookie(c, &types.SessionCookie{
 			Username: email,
 			Provider: providerName.Provider,
 		})
 
+		// Get redirect URI
 		redirectURI, redirectURIErr := c.Cookie("tinyauth_redirect_uri")
 
+		// If it is empty it means that no redirect_uri was provided to the login screen so we just log in
 		if redirectURIErr != nil {
-			c.JSON(200, gin.H{
-				"status":  200,
-				"message": "Logged in",
-			})
+			c.Redirect(http.StatusPermanentRedirect, api.Config.AppURL)
 		}
 
 		log.Debug().Str("redirectURI", redirectURI).Msg("Got redirect URI")
 
+		// Clean up redirect cookie since we already have the value
 		c.SetCookie("tinyauth_redirect_uri", "", -1, "/", api.Domain, api.Config.CookieSecure, true)
 
+		// Build query
 		redirectQuery, redirectQueryErr := query.Values(types.LoginQuery{
 			RedirectURI: redirectURI,
 		})
 
 		log.Debug().Msg("Got redirect query")
 
+		// Handle error
 		if api.handleError(c, "Failed to build query", redirectQueryErr) {
 			return
 		}
 
+		// Redirect to continue with the redirect URI
 		c.Redirect(http.StatusPermanentRedirect, fmt.Sprintf("%s/continue?%s", api.Config.AppURL, redirectQuery.Encode()))
 	})
+
+	// Simple healthcheck
+	api.Router.GET("/api/healthcheck", func(c *gin.Context) {
+		c.JSON(200, gin.H{
+			"status":  200,
+			"message": "OK",
+		})
+	})
 }
 
 func (api *API) Run() {
 	log.Info().Str("address", api.Config.Address).Int("port", api.Config.Port).Msg("Starting server")
+
+	// Run server
 	api.Router.Run(fmt.Sprintf("%s:%d", api.Config.Address, api.Config.Port))
 }
 
+// handleError logs the error and redirects to the error page (only meant for stuff the user may access does not apply for login paths)
 func (api *API) handleError(c *gin.Context, msg string, err error) bool {
+	// If error is not nil log it and redirect to error page also return true so we can stop further processing
 	if err != nil {
 		log.Error().Err(err).Msg(msg)
 		c.Redirect(http.StatusPermanentRedirect, fmt.Sprintf("%s/error", api.Config.AppURL))
@@ -425,19 +584,25 @@ func (api *API) handleError(c *gin.Context, msg string, err error) bool {
 	return false
 }
 
+// zerolog is a middleware for gin that logs requests using zerolog
 func zerolog() gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// Get initial time
 		tStart := time.Now()
 
+		// Process request
 		c.Next()
 
+		// Get status code, address, method and path
 		code := c.Writer.Status()
 		address := c.Request.RemoteAddr
 		method := c.Request.Method
 		path := c.Request.URL.Path
 
+		// Get latency
 		latency := time.Since(tStart).String()
 
+		// Log request
 		switch {
 		case code >= 200 && code < 300:
 			log.Info().Str("method", method).Str("path", path).Str("address", address).Int("status", code).Str("latency", latency).Msg("Request")

internal/api/api_test.go

@@ -0,0 +1,199 @@
+package api_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"tinyauth/internal/api"
+	"tinyauth/internal/auth"
+	"tinyauth/internal/docker"
+	"tinyauth/internal/hooks"
+	"tinyauth/internal/providers"
+	"tinyauth/internal/types"
+
+	"github.com/magiconair/properties/assert"
+)
+
+// Simple API config for tests
+var apiConfig = types.APIConfig{
+	Port:            8080,
+	Address:         "0.0.0.0",
+	Secret:          "super-secret-api-thing-for-tests", // It is 32 chars long
+	AppURL:          "http://tinyauth.localhost",
+	CookieSecure:    false,
+	CookieExpiry:    3600,
+	DisableContinue: false,
+}
+
+// Cookie
+var cookie string
+
+// User
+var user = types.User{
+	Username: "user",
+	Password: "$2a$10$AvGHLTYv3xiRJ0xV9xs3XeVIlkGTygI9nqIamFYB5Xu.5.0UWF7B6", // pass
+}
+
+// We need all this to be able to test the API
+func getAPI(t *testing.T) *api.API {
+	// Create docker service
+	docker := docker.NewDocker()
+
+	// Initialize docker
+	dockerErr := docker.Init()
+
+	// Check if there was an error
+	if dockerErr != nil {
+		t.Fatalf("Failed to initialize docker: %v", dockerErr)
+	}
+
+	// Create auth service
+	auth := auth.NewAuth(docker, types.Users{
+		{
+			Username: user.Username,
+			Password: user.Password,
+		},
+	}, nil, apiConfig.CookieExpiry)
+
+	// Create providers service
+	providers := providers.NewProviders(types.OAuthConfig{})
+
+	// Initialize providers
+	providers.Init()
+
+	// Create hooks service
+	hooks := hooks.NewHooks(auth, providers)
+
+	// Create API
+	api := api.NewAPI(apiConfig, hooks, auth, providers)
+
+	// Setup routes
+	api.Init()
+	api.SetupRoutes()
+
+	return api
+}
+
+// Test login (we will need this for the other tests)
+func TestLogin(t *testing.T) {
+	t.Log("Testing login")
+
+	// Get API
+	api := getAPI(t)
+
+	// Create recorder
+	recorder := httptest.NewRecorder()
+
+	// Create request
+	user := types.LoginRequest{
+		Username: "user",
+		Password: "pass",
+	}
+
+	json, err := json.Marshal(user)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error marshalling json: %v", err)
+	}
+
+	// Create request
+	req, err := http.NewRequest("POST", "/api/login", strings.NewReader(string(json)))
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating request: %v", err)
+	}
+
+	// Serve the request
+	api.Router.ServeHTTP(recorder, req)
+
+	// Assert
+	assert.Equal(t, recorder.Code, http.StatusOK)
+
+	// Get the cookie
+	cookie = recorder.Result().Cookies()[0].Value
+
+	// Check if the cookie is set
+	if cookie == "" {
+		t.Fatalf("Cookie not set")
+	}
+}
+
+// Test status
+func TestStatus(t *testing.T) {
+	t.Log("Testing status")
+
+	// Get API
+	api := getAPI(t)
+
+	// Create recorder
+	recorder := httptest.NewRecorder()
+
+	// Create request
+	req, err := http.NewRequest("GET", "/api/status", nil)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating request: %v", err)
+	}
+
+	// Set the cookie
+	req.AddCookie(&http.Cookie{
+		Name:  "tinyauth",
+		Value: cookie,
+	})
+
+	// Serve the request
+	api.Router.ServeHTTP(recorder, req)
+
+	// Assert
+	assert.Equal(t, recorder.Code, http.StatusOK)
+
+	// Parse the body
+	body := recorder.Body.String()
+
+	if !strings.Contains(body, "user") {
+		t.Fatalf("Expected user in body")
+	}
+}
+
+// Test logout
+func TestLogout(t *testing.T) {
+	t.Log("Testing logout")
+
+	// Get API
+	api := getAPI(t)
+
+	// Create recorder
+	recorder := httptest.NewRecorder()
+
+	// Create request
+	req, err := http.NewRequest("POST", "/api/logout", nil)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating request: %v", err)
+	}
+
+	// Set the cookie
+	req.AddCookie(&http.Cookie{
+		Name:  "tinyauth",
+		Value: cookie,
+	})
+
+	// Serve the request
+	api.Router.ServeHTTP(recorder, req)
+
+	// Assert
+	assert.Equal(t, recorder.Code, http.StatusOK)
+
+	// Check if the cookie is different (means go sessions flushed it)
+	if recorder.Result().Cookies()[0].Value == cookie {
+		t.Fatalf("Cookie not flushed")
+	}
+}
+
+// TODO: Testing for the oauth stuff

internal/assets/assets.go

@@ -4,8 +4,12 @@ import (
 	"embed"
 )
 
+// UI assets
+//
 //go:embed dist
 var Assets embed.FS
 
+// Version file
+//
 //go:embed version
-var Version string
+var Version string

internal/assets/version

@@ -1 +1 @@
-v2.1.1
+v3.0.0

internal/auth/auth.go

@@ -3,6 +3,7 @@ package auth
 import (
 	"slices"
 	"strings"
+	"time"
 	"tinyauth/internal/docker"
 	"tinyauth/internal/types"
 	"tinyauth/internal/utils"
@@ -13,11 +14,12 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
-func NewAuth(docker *docker.Docker, userList types.Users, oauthWhitelist []string) *Auth {
+func NewAuth(docker *docker.Docker, userList types.Users, oauthWhitelist []string, sessionExpiry int) *Auth {
 	return &Auth{
 		Docker:         docker,
 		Users:          userList,
 		OAuthWhitelist: oauthWhitelist,
+		SessionExpiry:  sessionExpiry,
 	}
 }
 
@@ -25,9 +27,11 @@ type Auth struct {
 	Users          types.Users
 	Docker         *docker.Docker
 	OAuthWhitelist []string
+	SessionExpiry  int
 }
 
 func (auth *Auth) GetUser(username string) *types.User {
+	// Loop through users and return the user if the username matches
 	for _, user := range auth.Users {
 		if user.Username == username {
 			return &user
@@ -37,98 +41,150 @@ func (auth *Auth) GetUser(username string) *types.User {
 }
 
 func (auth *Auth) CheckPassword(user types.User, password string) bool {
-	hashedPasswordErr := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password))
-	return hashedPasswordErr == nil
+	// Compare the hashed password with the password provided
+	return bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)) == nil
 }
 
 func (auth *Auth) EmailWhitelisted(emailSrc string) bool {
+	// If the whitelist is empty, allow all emails
 	if len(auth.OAuthWhitelist) == 0 {
 		return true
 	}
+
+	// Loop through the whitelist and return true if the email matches
 	for _, email := range auth.OAuthWhitelist {
 		if email == emailSrc {
 			return true
 		}
 	}
+
+	// If no emails match, return false
 	return false
 }
 
 func (auth *Auth) CreateSessionCookie(c *gin.Context, data *types.SessionCookie) {
 	log.Debug().Msg("Creating session cookie")
+
+	// Get session
 	sessions := sessions.Default(c)
+
 	log.Debug().Msg("Setting session cookie")
+
+	// Set data
 	sessions.Set("username", data.Username)
 	sessions.Set("provider", data.Provider)
+	sessions.Set("expiry", time.Now().Add(time.Duration(auth.SessionExpiry)*time.Second).Unix())
+
+	// Save session
 	sessions.Save()
 }
 
 func (auth *Auth) DeleteSessionCookie(c *gin.Context) {
 	log.Debug().Msg("Deleting session cookie")
+
+	// Get session
 	sessions := sessions.Default(c)
+
+	// Clear session
 	sessions.Clear()
+
+	// Save session
 	sessions.Save()
 }
 
-func (auth *Auth) GetSessionCookie(c *gin.Context) (types.SessionCookie, error) {
+func (auth *Auth) GetSessionCookie(c *gin.Context) types.SessionCookie {
 	log.Debug().Msg("Getting session cookie")
+
+	// Get session
 	sessions := sessions.Default(c)
 
+	// Get data
 	cookieUsername := sessions.Get("username")
 	cookieProvider := sessions.Get("provider")
+	cookieExpiry := sessions.Get("expiry")
 
+	// Convert interfaces to correct types
 	username, usernameOk := cookieUsername.(string)
 	provider, providerOk := cookieProvider.(string)
+	expiry, expiryOk := cookieExpiry.(int64)
 
-	log.Debug().Str("username", username).Str("provider", provider).Msg("Parsed cookie")
-
-	if !usernameOk || !providerOk {
+	// Check if the cookie is invalid
+	if !usernameOk || !providerOk || !expiryOk {
 		log.Warn().Msg("Session cookie invalid")
-		return types.SessionCookie{}, nil
+		return types.SessionCookie{}
 	}
 
+	// Check if the cookie has expired
+	if time.Now().Unix() > expiry {
+		log.Warn().Msg("Session cookie expired")
+
+		// If it has, delete it
+		auth.DeleteSessionCookie(c)
+
+		// Return empty cookie
+		return types.SessionCookie{}
+	}
+
+	log.Debug().Str("username", username).Str("provider", provider).Int64("expiry", expiry).Msg("Parsed cookie")
+
+	// Return the cookie
 	return types.SessionCookie{
 		Username: username,
 		Provider: provider,
-	}, nil
+	}
 }
 
 func (auth *Auth) UserAuthConfigured() bool {
+	// If there are users, return true
 	return len(auth.Users) > 0
 }
 
 func (auth *Auth) ResourceAllowed(context types.UserContext, host string) (bool, error) {
+	// Check if we have access to the Docker API
 	isConnected := auth.Docker.DockerConnected()
 
+	// If we don't have access, it is assumed that the user has access
 	if !isConnected {
 		log.Debug().Msg("Docker not connected, allowing access")
 		return true, nil
 	}
 
+	// Get the app ID from the host
 	appId := strings.Split(host, ".")[0]
+
+	// Get the containers
 	containers, containersErr := auth.Docker.GetContainers()
 
+	// If there is an error, return false
 	if containersErr != nil {
 		return false, containersErr
 	}
 
 	log.Debug().Msg("Got containers")
 
+	// Loop through the containers
 	for _, container := range containers {
+		// Inspect the container
 		inspect, inspectErr := auth.Docker.InspectContainer(container.ID)
 
+		// If there is an error, return false
 		if inspectErr != nil {
 			return false, inspectErr
 		}
 
+		// Get the container name (for some reason it is /name)
 		containerName := strings.Split(inspect.Name, "/")[1]
 
+		// There is a container with the same name as the app ID
 		if containerName == appId {
 			log.Debug().Str("container", containerName).Msg("Found container")
 
+			// Get only the tinyauth labels in a struct
 			labels := utils.GetTinyauthLabels(inspect.Config.Labels)
 
 			log.Debug().Msg("Got labels")
 
+			// If the container has an oauth whitelist, check if the user is in it
 			if context.OAuth && len(labels.OAuthWhitelist) != 0 {
 				log.Debug().Msg("Checking OAuth whitelist")
 				if slices.Contains(labels.OAuthWhitelist, context.Username) {
@@ -137,6 +193,7 @@ func (auth *Auth) ResourceAllowed(context types.UserContext, host string) (bool,
 				return false, nil
 			}
 
+			// If the container has users, check if the user is in it
 			if len(labels.Users) != 0 {
 				log.Debug().Msg("Checking users")
 				if slices.Contains(labels.Users, context.Username) {
@@ -150,5 +207,22 @@ func (auth *Auth) ResourceAllowed(context types.UserContext, host string) (bool,
 
 	log.Debug().Msg("No matching container found, allowing access")
 
+	// If no matching container is found, allow access
 	return true, nil
 }
+
+func (auth *Auth) GetBasicAuth(c *gin.Context) *types.User {
+	// Get the Authorization header
+	username, password, ok := c.Request.BasicAuth()
+
+	// If not ok, return an empty user
+	if !ok {
+		return nil
+	}
+
+	// Return the user
+	return &types.User{
+		Username: username,
+		Password: password,
+	}
+}

internal/constants/constants.go

@@ -1,5 +1,6 @@
 package constants
 
+// TinyauthLabels is a list of labels that can be used in a tinyauth protected container
 var TinyauthLabels = []string{
 	"tinyauth.oauth.whitelist",
 	"tinyauth.users",

internal/docker/docker.go

@@ -18,39 +18,50 @@ type Docker struct {
 }
 
 func (docker *Docker) Init() error {
+	// Create a new docker client
 	apiClient, err := client.NewClientWithOpts(client.FromEnv)
 
+	// Check if there was an error
 	if err != nil {
 		return err
 	}
 
+	// Set the context and api client
 	docker.Context = context.Background()
 	docker.Client = apiClient
 
+	// Done
 	return nil
 }
 
 func (docker *Docker) GetContainers() ([]types.Container, error) {
+	// Get the list of containers
 	containers, err := docker.Client.ContainerList(docker.Context, container.ListOptions{})
 
+	// Check if there was an error
 	if err != nil {
 		return nil, err
 	}
 
+	// Return the containers
 	return containers, nil
 }
 
 func (docker *Docker) InspectContainer(containerId string) (types.ContainerJSON, error) {
+	// Inspect the container
 	inspect, err := docker.Client.ContainerInspect(docker.Context, containerId)
 
+	// Check if there was an error
 	if err != nil {
 		return types.ContainerJSON{}, err
 	}
 
+	// Return the inspect
 	return inspect, nil
 }
 
 func (docker *Docker) DockerConnected() bool {
+	// Ping the docker client if there is an error it is not connected
 	_, err := docker.Client.Ping(docker.Context)
 	return err == nil
 }

internal/hooks/hooks.go

@@ -22,39 +22,64 @@ type Hooks struct {
 }
 
 func (hooks *Hooks) UseUserContext(c *gin.Context) types.UserContext {
-	cookie, cookiErr := hooks.Auth.GetSessionCookie(c)
+	// Get session cookie and basic auth
+	cookie := hooks.Auth.GetSessionCookie(c)
+	basic := hooks.Auth.GetBasicAuth(c)
 
-	if cookiErr != nil {
-		log.Error().Err(cookiErr).Msg("Failed to get session cookie")
-		return types.UserContext{
-			Username:   "",
-			IsLoggedIn: false,
-			OAuth:      false,
-			Provider:   "",
+	// Check if basic auth is set
+	if basic != nil {
+		log.Debug().Msg("Got basic auth")
+
+		// Check if user exists and password is correct
+		user := hooks.Auth.GetUser(basic.Username)
+
+		if user != nil && hooks.Auth.CheckPassword(*user, basic.Password) {
+			// Return user context since we are logged in with basic auth
+			return types.UserContext{
+				Username:   basic.Username,
+				IsLoggedIn: true,
+				OAuth:      false,
+				Provider:   "basic",
+			}
 		}
+
 	}
 
+	// Check if session cookie is username/password auth
 	if cookie.Provider == "username" {
 		log.Debug().Msg("Provider is username")
+
+		// Check if user exists
 		if hooks.Auth.GetUser(cookie.Username) != nil {
 			log.Debug().Msg("User exists")
+
+			// It exists so we are logged in
 			return types.UserContext{
 				Username:   cookie.Username,
 				IsLoggedIn: true,
 				OAuth:      false,
-				Provider:   "",
+				Provider:   "username",
 			}
 		}
 	}
 
 	log.Debug().Msg("Provider is not username")
+
+	// The provider is not username so we need to check if it is an oauth provider
 	provider := hooks.Providers.GetProvider(cookie.Provider)
 
+	// If we have a provider with this name
 	if provider != nil {
 		log.Debug().Msg("Provider exists")
+
+		// Check if the oauth email is whitelisted
 		if !hooks.Auth.EmailWhitelisted(cookie.Username) {
 			log.Error().Str("email", cookie.Username).Msg("Email is not whitelisted")
+
+			// It isn't so we delete the cookie and return an empty context
 			hooks.Auth.DeleteSessionCookie(c)
+
+			// Return empty context
 			return types.UserContext{
 				Username:   "",
 				IsLoggedIn: false,
@@ -62,7 +87,10 @@ func (hooks *Hooks) UseUserContext(c *gin.Context) types.UserContext {
 				Provider:   "",
 			}
 		}
+
 		log.Debug().Msg("Email is whitelisted")
+
+		// Return user context since we are logged in with oauth
 		return types.UserContext{
 			Username:   cookie.Username,
 			IsLoggedIn: true,
@@ -71,6 +99,7 @@ func (hooks *Hooks) UseUserContext(c *gin.Context) types.UserContext {
 		}
 	}
 
+	// Neither basic auth or oauth is set so we return an empty context
 	return types.UserContext{
 		Username:   "",
 		IsLoggedIn: false,

internal/oauth/oauth.go

@@ -21,23 +21,33 @@ type OAuth struct {
 }
 
 func (oauth *OAuth) Init() {
+	// Create a new context and verifier
 	oauth.Context = context.Background()
 	oauth.Verifier = oauth2.GenerateVerifier()
 }
 
 func (oauth *OAuth) GetAuthURL() string {
+	// Return the auth url
 	return oauth.Config.AuthCodeURL("state", oauth2.AccessTypeOffline, oauth2.S256ChallengeOption(oauth.Verifier))
 }
 
 func (oauth *OAuth) ExchangeToken(code string) (string, error) {
+	// Exchange the code for a token
 	token, err := oauth.Config.Exchange(oauth.Context, code, oauth2.VerifierOption(oauth.Verifier))
+
+	// Check if there was an error
 	if err != nil {
 		return "", err
 	}
+
+	// Set the token
 	oauth.Token = token
+
+	// Return the access token
 	return oauth.Token.AccessToken, nil
 }
 
 func (oauth *OAuth) GetClient() *http.Client {
+	// Return the http client with the token set
 	return oauth.Config.Client(oauth.Context, oauth.Token)
 }

internal/providers/generic.go

@@ -8,36 +8,45 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
+// We are assuming that the generic provider will return a JSON object with an email field
 type GenericUserInfoResponse struct {
 	Email string `json:"email"`
 }
 
 func GetGenericEmail(client *http.Client, url string) (string, error) {
+	// Using the oauth client get the user info url
 	res, resErr := client.Get(url)
 
+	// Check if there was an error
 	if resErr != nil {
 		return "", resErr
 	}
 
 	log.Debug().Msg("Got response from generic provider")
 
+	// Read the body of the response
 	body, bodyErr := io.ReadAll(res.Body)
 
+	// Check if there was an error
 	if bodyErr != nil {
 		return "", bodyErr
 	}
 
 	log.Debug().Msg("Read body from generic provider")
 
+	// Parse the body into a user struct
 	var user GenericUserInfoResponse
 
+	// Unmarshal the body into the user struct
 	jsonErr := json.Unmarshal(body, &user)
 
+	// Check if there was an error
 	if jsonErr != nil {
 		return "", jsonErr
 	}
 
 	log.Debug().Msg("Parsed user from generic provider")
 
+	// Return the email
 	return user.Email, nil
 }

internal/providers/github.go

@@ -9,47 +9,58 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
+// Github has a different response than the generic provider
 type GithubUserInfoResponse []struct {
 	Email   string `json:"email"`
 	Primary bool   `json:"primary"`
 }
 
+// The scopes required for the github provider
 func GithubScopes() []string {
 	return []string{"user:email"}
 }
 
 func GetGithubEmail(client *http.Client) (string, error) {
+	// Get the user emails from github using the oauth http client
 	res, resErr := client.Get("https://api.github.com/user/emails")
 
+	// Check if there was an error
 	if resErr != nil {
 		return "", resErr
 	}
 
 	log.Debug().Msg("Got response from github")
 
+	// Read the body of the response
 	body, bodyErr := io.ReadAll(res.Body)
 
+	// Check if there was an error
 	if bodyErr != nil {
 		return "", bodyErr
 	}
 
 	log.Debug().Msg("Read body from github")
 
+	// Parse the body into a user struct
 	var emails GithubUserInfoResponse
 
+	// Unmarshal the body into the user struct
 	jsonErr := json.Unmarshal(body, &emails)
 
+	// Check if there was an error
 	if jsonErr != nil {
 		return "", jsonErr
 	}
 
 	log.Debug().Msg("Parsed emails from github")
 
+	// Find and return the primary email
 	for _, email := range emails {
 		if email.Primary {
 			return email.Email, nil
 		}
 	}
 
+	// User does not have a primary email?
 	return "", errors.New("no primary email found")
 }

internal/providers/google.go

@@ -8,40 +8,50 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
+// Google works the same as the generic provider
 type GoogleUserInfoResponse struct {
 	Email string `json:"email"`
 }
 
+// The scopes required for the google provider
 func GoogleScopes() []string {
 	return []string{"https://www.googleapis.com/auth/userinfo.email"}
 }
 
 func GetGoogleEmail(client *http.Client) (string, error) {
+	// Get the user info from google using the oauth http client
 	res, resErr := client.Get("https://www.googleapis.com/userinfo/v2/me")
 
+	// Check if there was an error
 	if resErr != nil {
 		return "", resErr
 	}
 
 	log.Debug().Msg("Got response from google")
 
+	// Read the body of the response
 	body, bodyErr := io.ReadAll(res.Body)
 
+	// Check if there was an error
 	if bodyErr != nil {
 		return "", bodyErr
 	}
 
 	log.Debug().Msg("Read body from google")
 
+	// Parse the body into a user struct
 	var user GoogleUserInfoResponse
 
+	// Unmarshal the body into the user struct
 	jsonErr := json.Unmarshal(body, &user)
 
+	// Check if there was an error
 	if jsonErr != nil {
 		return "", jsonErr
 	}
 
 	log.Debug().Msg("Parsed user from google")
 
+	// Return the email
 	return user.Email, nil
 }

internal/providers/providers.go

@@ -25,8 +25,11 @@ type Providers struct {
 }
 
 func (providers *Providers) Init() {
+	// If we have a client id and secret for github, initialize the oauth provider
 	if providers.Config.GithubClientId != "" && providers.Config.GithubClientSecret != "" {
 		log.Info().Msg("Initializing Github OAuth")
+
+		// Create a new oauth provider with the github config
 		providers.Github = oauth.NewOAuth(oauth2.Config{
 			ClientID:     providers.Config.GithubClientId,
 			ClientSecret: providers.Config.GithubClientSecret,
@@ -34,10 +37,16 @@ func (providers *Providers) Init() {
 			Scopes:       GithubScopes(),
 			Endpoint:     endpoints.GitHub,
 		})
+
+		// Initialize the oauth provider
 		providers.Github.Init()
 	}
+
+	// If we have a client id and secret for google, initialize the oauth provider
 	if providers.Config.GoogleClientId != "" && providers.Config.GoogleClientSecret != "" {
 		log.Info().Msg("Initializing Google OAuth")
+
+		// Create a new oauth provider with the google config
 		providers.Google = oauth.NewOAuth(oauth2.Config{
 			ClientID:     providers.Config.GoogleClientId,
 			ClientSecret: providers.Config.GoogleClientSecret,
@@ -45,10 +54,15 @@ func (providers *Providers) Init() {
 			Scopes:       GoogleScopes(),
 			Endpoint:     endpoints.Google,
 		})
+
+		// Initialize the oauth provider
 		providers.Google.Init()
 	}
+
 	if providers.Config.TailscaleClientId != "" && providers.Config.TailscaleClientSecret != "" {
 		log.Info().Msg("Initializing Tailscale OAuth")
+
+		// Create a new oauth provider with the tailscale config
 		providers.Tailscale = oauth.NewOAuth(oauth2.Config{
 			ClientID:     providers.Config.TailscaleClientId,
 			ClientSecret: providers.Config.TailscaleClientSecret,
@@ -56,10 +70,16 @@ func (providers *Providers) Init() {
 			Scopes:       TailscaleScopes(),
 			Endpoint:     TailscaleEndpoint,
 		})
+
+		// Initialize the oauth provider
 		providers.Tailscale.Init()
 	}
+
+	// If we have a client id and secret for generic oauth, initialize the oauth provider
 	if providers.Config.GenericClientId != "" && providers.Config.GenericClientSecret != "" {
 		log.Info().Msg("Initializing Generic OAuth")
+
+		// Create a new oauth provider with the generic config
 		providers.Generic = oauth.NewOAuth(oauth2.Config{
 			ClientID:     providers.Config.GenericClientId,
 			ClientSecret: providers.Config.GenericClientSecret,
@@ -70,11 +90,14 @@ func (providers *Providers) Init() {
 				TokenURL: providers.Config.GenericTokenURL,
 			},
 		})
+
+		// Initialize the oauth provider
 		providers.Generic.Init()
 	}
 }
 
 func (providers *Providers) GetProvider(provider string) *oauth.OAuth {
+	// Return the provider based on the provider string
 	switch provider {
 	case "github":
 		return providers.Github
@@ -90,58 +113,103 @@ func (providers *Providers) GetProvider(provider string) *oauth.OAuth {
 }
 
 func (providers *Providers) GetUser(provider string) (string, error) {
+	// Get the email from the provider
 	switch provider {
 	case "github":
+		// If the github provider is not configured, return an error
 		if providers.Github == nil {
 			log.Debug().Msg("Github provider not configured")
 			return "", nil
 		}
+
+		// Get the client from the github provider
 		client := providers.Github.GetClient()
+
 		log.Debug().Msg("Got client from github")
+
+		// Get the email from the github provider
 		email, emailErr := GetGithubEmail(client)
+
+		// Check if there was an error
 		if emailErr != nil {
 			return "", emailErr
 		}
+
 		log.Debug().Msg("Got email from github")
+
+		// Return the email
 		return email, nil
 	case "google":
+		// If the google provider is not configured, return an error
 		if providers.Google == nil {
 			log.Debug().Msg("Google provider not configured")
 			return "", nil
 		}
+
+		// Get the client from the google provider
 		client := providers.Google.GetClient()
+
 		log.Debug().Msg("Got client from google")
+
+		// Get the email from the google provider
 		email, emailErr := GetGoogleEmail(client)
+
+		// Check if there was an error
 		if emailErr != nil {
 			return "", emailErr
 		}
+
 		log.Debug().Msg("Got email from google")
+
+		// Return the email
 		return email, nil
 	case "tailscale":
+		// If the tailscale provider is not configured, return an error
 		if providers.Tailscale == nil {
 			log.Debug().Msg("Tailscale provider not configured")
 			return "", nil
 		}
+
+		// Get the client from the tailscale provider
 		client := providers.Tailscale.GetClient()
+
 		log.Debug().Msg("Got client from tailscale")
+
+		// Get the email from the tailscale provider
 		email, emailErr := GetTailscaleEmail(client)
+
+		// Check if there was an error
 		if emailErr != nil {
 			return "", emailErr
 		}
+
 		log.Debug().Msg("Got email from tailscale")
+
+		// Return the email
 		return email, nil
 	case "generic":
+		// If the generic provider is not configured, return an error
 		if providers.Generic == nil {
 			log.Debug().Msg("Generic provider not configured")
 			return "", nil
 		}
+
+		// Get the client from the generic provider
 		client := providers.Generic.GetClient()
+
 		log.Debug().Msg("Got client from generic")
+
+		// Get the email from the generic provider
 		email, emailErr := GetGenericEmail(client, providers.Config.GenericUserURL)
+
+		// Check if there was an error
 		if emailErr != nil {
 			return "", emailErr
 		}
+
 		log.Debug().Msg("Got email from generic")
+
+		// Return the email
 		return email, nil
 	default:
 		return "", nil
@@ -149,6 +217,7 @@ func (providers *Providers) GetUser(provider string) (string, error) {
 }
 
 func (provider *Providers) GetConfiguredProviders() []string {
+	// Create a list of the configured providers
 	providers := []string{}
 	if provider.Github != nil {
 		providers = append(providers, "github")

internal/providers/tailscale.go

@@ -9,48 +9,60 @@ import (
 	"golang.org/x/oauth2"
 )
 
+// The tailscale email is the loginName
 type TailscaleUser struct {
 	LoginName string `json:"loginName"`
 }
 
+// The response from the tailscale user info endpoint
 type TailscaleUserInfoResponse struct {
 	Users []TailscaleUser `json:"users"`
 }
 
+// The scopes required for the tailscale provider
 func TailscaleScopes() []string {
 	return []string{"users:read"}
 }
 
+// The tailscale endpoint
 var TailscaleEndpoint = oauth2.Endpoint{
 	TokenURL: "https://api.tailscale.com/api/v2/oauth/token",
 }
 
 func GetTailscaleEmail(client *http.Client) (string, error) {
+	// Get the user info from tailscale using the oauth http client
 	res, resErr := client.Get("https://api.tailscale.com/api/v2/tailnet/-/users")
 
+	// Check if there was an error
 	if resErr != nil {
 		return "", resErr
 	}
 
 	log.Debug().Msg("Got response from tailscale")
 
+	// Read the body of the response
 	body, bodyErr := io.ReadAll(res.Body)
 
+	// Check if there was an error
 	if bodyErr != nil {
 		return "", bodyErr
 	}
 
 	log.Debug().Msg("Read body from tailscale")
 
+	// Parse the body into a user struct
 	var users TailscaleUserInfoResponse
 
+	// Unmarshal the body into the user struct
 	jsonErr := json.Unmarshal(body, &users)
 
+	// Check if there was an error
 	if jsonErr != nil {
 		return "", jsonErr
 	}
 
 	log.Debug().Msg("Parsed users from tailscale")
 
+	// Return the email of the first user
 	return users.Users[0].LoginName, nil
 }

internal/types/types.go

@@ -2,22 +2,27 @@ package types
 
 import "tinyauth/internal/oauth"
 
+// LoginQuery is the query parameters for the login endpoint
 type LoginQuery struct {
 	RedirectURI string `url:"redirect_uri"`
 }
 
+// LoginRequest is the request body for the login endpoint
 type LoginRequest struct {
 	Username string `json:"username"`
 	Password string `json:"password"`
 }
 
+// User is the struct for a user
 type User struct {
 	Username string
 	Password string
 }
 
+// Users is a list of users
 type Users []User
 
+// Config is the configuration for the tinyauth server
 type Config struct {
 	Port                      int    `mapstructure:"port" validate:"required"`
 	Address                   string `validate:"required,ip4_addr" mapstructure:"address"`
@@ -45,10 +50,11 @@ type Config struct {
 	GenericUserURL            string `mapstructure:"generic-user-url"`
 	DisableContinue           bool   `mapstructure:"disable-continue"`
 	OAuthWhitelist            string `mapstructure:"oauth-whitelist"`
-	CookieExpiry              int    `mapstructure:"cookie-expiry"`
+	SessionExpiry             int    `mapstructure:"session-expiry"`
 	LogLevel                  int8   `mapstructure:"log-level" validate:"min=-1,max=5"`
 }
 
+// UserContext is the context for the user
 type UserContext struct {
 	Username   string
 	IsLoggedIn bool
@@ -56,6 +62,7 @@ type UserContext struct {
 	Provider   string
 }
 
+// APIConfig is the configuration for the API
 type APIConfig struct {
 	Port            int
 	Address         string
@@ -66,6 +73,7 @@ type APIConfig struct {
 	DisableContinue bool
 }
 
+// OAuthConfig is the configuration for the providers
 type OAuthConfig struct {
 	GithubClientId        string
 	GithubClientSecret    string
@@ -82,31 +90,42 @@ type OAuthConfig struct {
 	AppURL                string
 }
 
+// OAuthRequest is the request for the OAuth endpoint
 type OAuthRequest struct {
 	Provider string `uri:"provider" binding:"required"`
 }
 
+// OAuthProviders is the struct for the OAuth providers
 type OAuthProviders struct {
 	Github    *oauth.OAuth
 	Google    *oauth.OAuth
 	Microsoft *oauth.OAuth
 }
 
+// UnauthorizedQuery is the query parameters for the unauthorized endpoint
 type UnauthorizedQuery struct {
 	Username string `url:"username"`
 	Resource string `url:"resource"`
 }
 
+// SessionCookie is the cookie for the session (exculding the expiry)
 type SessionCookie struct {
 	Username string
 	Provider string
 }
 
+// TinyauthLabels is the labels for the tinyauth container
 type TinyauthLabels struct {
 	OAuthWhitelist []string
 	Users          []string
 }
 
+// TailscaleQuery is the query parameters for the tailscale endpoint
 type TailscaleQuery struct {
 	Code int `url:"code"`
 }
+
+// Proxy is the uri parameters for the proxy endpoint
+type Proxy struct {
+	Proxy string `uri:"proxy" binding:"required"`
+}

internal/utils/utils.go

@@ -12,20 +12,32 @@ import (
 	"github.com/rs/zerolog/log"
 )
 
+// Parses a list of comma separated users in a struct
 func ParseUsers(users string) (types.Users, error) {
 	log.Debug().Msg("Parsing users")
+
+	// Create a new users struct
 	var usersParsed types.Users
+
+	// Split the users by comma
 	userList := strings.Split(users, ",")
 
+	// Check if there are any users
 	if len(userList) == 0 {
 		return types.Users{}, errors.New("invalid user format")
 	}
 
+	// Loop through the users and split them by colon
 	for _, user := range userList {
+		// Split the user by colon
 		userSplit := strings.Split(user, ":")
+
+		// Check if the user is in the correct format
 		if len(userSplit) != 2 {
 			return types.Users{}, errors.New("invalid user format")
 		}
+
+		// Append the user to the users struct
 		usersParsed = append(usersParsed, types.User{
 			Username: userSplit[0],
 			Password: userSplit[1],
@@ -34,43 +46,61 @@ func ParseUsers(users string) (types.Users, error) {
 
 	log.Debug().Msg("Parsed users")
 
+	// Return the users struct
 	return usersParsed, nil
 }
 
+// Root url parses parses a hostname and returns the root domain (e.g. sub1.sub2.domain.com -> sub2.domain.com)
 func GetRootURL(urlSrc string) (string, error) {
+	// Make sure the url is valid
 	urlParsed, parseErr := url.Parse(urlSrc)
 
+	// Check if there was an error
 	if parseErr != nil {
 		return "", parseErr
 	}
 
+	// Split the hostname by period
 	urlSplitted := strings.Split(urlParsed.Hostname(), ".")
 
+	// Get the last part of the url
 	urlFinal := strings.Join(urlSplitted[1:], ".")
 
+	// Return the root domain
 	return urlFinal, nil
 }
 
+// Reads a file and returns the contents
 func ReadFile(file string) (string, error) {
+	// Check if the file exists
 	_, statErr := os.Stat(file)
 
+	// Check if there was an error
 	if statErr != nil {
 		return "", statErr
 	}
 
+	// Read the file
 	data, readErr := os.ReadFile(file)
 
+	// Check if there was an error
 	if readErr != nil {
 		return "", readErr
 	}
 
+	// Return the file contents
 	return string(data), nil
 }
 
+// Parses a file into a comma separated list of users
 func ParseFileToLine(content string) string {
+	// Split the content by newline
 	lines := strings.Split(content, "\n")
+
+	// Create a list of users
 	users := make([]string, 0)
 
+	// Loop through the lines, trimming the whitespace and appending to the users list
 	for _, line := range lines {
 		if strings.TrimSpace(line) == "" {
 			continue
@@ -79,63 +109,87 @@ func ParseFileToLine(content string) string {
 		users = append(users, strings.TrimSpace(line))
 	}
 
+	// Return the users as a comma separated string
 	return strings.Join(users, ",")
 }
 
+// Get the secret from the config or file
 func GetSecret(conf string, file string) string {
+	// If neither the config or file is set, return an empty string
 	if conf == "" && file == "" {
 		return ""
 	}
 
+	// If the config is set, return the config (environment variable)
 	if conf != "" {
 		return conf
 	}
 
+	// If the file is set, read the file
 	contents, err := ReadFile(file)
 
+	// Check if there was an error
 	if err != nil {
 		return ""
 	}
 
+	// Return the contents of the file
 	return contents
 }
 
+// Get the users from the config or file
 func GetUsers(conf string, file string) (types.Users, error) {
+	// Create a string to store the users
 	var users string
 
+	// If neither the config or file is set, return an empty users struct
 	if conf == "" && file == "" {
-		return types.Users{}, errors.New("no users provided")
+		return types.Users{}, nil
 	}
 
+	// If the config (environment) is set, append the users to the users string
 	if conf != "" {
 		log.Debug().Msg("Using users from config")
 		users += conf
 	}
 
+	// If the file is set, read the file and append the users to the users string
 	if file != "" {
+		// Read the file
 		fileContents, fileErr := ReadFile(file)
 
+		// If there isn't an error we can append the users to the users string
 		if fileErr == nil {
 			log.Debug().Msg("Using users from file")
+
+			// Append the users to the users string
 			if users != "" {
 				users += ","
 			}
+
+			// Parse the file contents into a comma separated list of users
 			users += ParseFileToLine(fileContents)
 		}
 	}
 
+	// Return the parsed users
 	return ParseUsers(users)
 }
 
-func OAuthConfigured(config types.Config) bool {
-	return (config.GithubClientId != "" && config.GithubClientSecret != "") || (config.GoogleClientId != "" && config.GoogleClientSecret != "") || (config.GenericClientId != "" && config.GenericClientSecret != "")
-}
-
+// Parse the docker labels to the tinyauth labels struct
 func GetTinyauthLabels(labels map[string]string) types.TinyauthLabels {
+	// Create a new tinyauth labels struct
 	var tinyauthLabels types.TinyauthLabels
+
+	// Loop through the labels
 	for label, value := range labels {
+
+		// Check if the label is in the tinyauth labels
 		if slices.Contains(constants.TinyauthLabels, label) {
+
 			log.Debug().Str("label", label).Msg("Found label")
+
+			// Add the label value to the tinyauth labels struct
 			switch label {
 			case "tinyauth.oauth.whitelist":
 				tinyauthLabels.OAuthWhitelist = strings.Split(value, ",")
@@ -144,5 +198,22 @@ func GetTinyauthLabels(labels map[string]string) types.TinyauthLabels {
 			}
 		}
 	}
+
+	// Return the tinyauth labels
 	return tinyauthLabels
 }
+
+// Check if any of the OAuth providers are configured based on the client id and secret
+func OAuthConfigured(config types.Config) bool {
+	return (config.GithubClientId != "" && config.GithubClientSecret != "") || (config.GoogleClientId != "" && config.GoogleClientSecret != "") || (config.GenericClientId != "" && config.GenericClientSecret != "") || (config.TailscaleClientId != "" && config.TailscaleClientSecret != "")
+}
+
+// Filter helper function
+func Filter[T any](slice []T, test func(T) bool) (res []T) {
+	for _, value := range slice {
+		if test(value) {
+			res = append(res, value)
+		}
+	}
+	return res
+}

internal/utils/utils_test.go

@@ -0,0 +1,334 @@
+package utils_test
+
+import (
+	"os"
+	"reflect"
+	"testing"
+	"tinyauth/internal/types"
+	"tinyauth/internal/utils"
+)
+
+// Test the parse users function
+func TestParseUsers(t *testing.T) {
+	t.Log("Testing parse users with a valid string")
+
+	// Test the parse users function with a valid string
+	users := "user1:pass1,user2:pass2"
+	expected := types.Users{
+		{
+			Username: "user1",
+			Password: "pass1",
+		},
+		{
+			Username: "user2",
+			Password: "pass2",
+		},
+	}
+
+	result, err := utils.ParseUsers(users)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error parsing users: %v", err)
+	}
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	t.Log("Testing parse users with an invalid string")
+
+	// Test the parse users function with an invalid string
+	users = "user1:pass1,user2"
+
+	_, err = utils.ParseUsers(users)
+
+	// There should be an error
+	if err == nil {
+		t.Fatalf("Expected error parsing users")
+	}
+}
+
+// Test the get root url function
+func TestGetRootURL(t *testing.T) {
+	t.Log("Testing get root url with a valid url")
+
+	// Test the get root url function with a valid url
+	url := "https://sub1.sub2.domain.com:8080"
+	expected := "sub2.domain.com"
+
+	result, err := utils.GetRootURL(url)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error getting root url: %v", err)
+	}
+
+	// Check if the result is equal to the expected
+	if expected != result {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+}
+
+// Test the read file function
+func TestReadFile(t *testing.T) {
+	t.Log("Creating a test file")
+
+	// Create a test file
+	err := os.WriteFile("/tmp/test.txt", []byte("test"), 0644)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating test file: %v", err)
+	}
+
+	// Test the read file function
+	t.Log("Testing read file with a valid file")
+
+	data, err := utils.ReadFile("/tmp/test.txt")
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error reading file: %v", err)
+	}
+
+	// Check if the data is equal to the expected
+	if data != "test" {
+		t.Fatalf("Expected test, got %v", data)
+	}
+
+	// Cleanup the test file
+	t.Log("Cleaning up test file")
+
+	err = os.Remove("/tmp/test.txt")
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error cleaning up test file: %v", err)
+	}
+}
+
+// Test the parse file to line function
+func TestParseFileToLine(t *testing.T) {
+	t.Log("Testing parse file to line with a valid string")
+
+	// Test the parse file to line function with a valid string
+	content := "user1:pass1\nuser2:pass2"
+	expected := "user1:pass1,user2:pass2"
+
+	result := utils.ParseFileToLine(content)
+
+	// Check if the result is equal to the expected
+	if expected != result {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+}
+
+// Test the get secret function
+func TestGetSecret(t *testing.T) {
+	t.Log("Testing get secret with an empty config and file")
+
+	// Test the get secret function with an empty config and file
+	conf := ""
+	file := "/tmp/test.txt"
+	expected := "test"
+
+	// Create file
+	err := os.WriteFile(file, []byte(expected), 0644)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating test file: %v", err)
+	}
+
+	// Test
+	result := utils.GetSecret(conf, file)
+
+	// Check if the result is equal to the expected
+	if result != expected {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	t.Log("Testing get secret with an empty file and a valid config")
+
+	// Test the get secret function with an empty file and a valid config
+	result = utils.GetSecret(expected, "")
+
+	// Check if the result is equal to the expected
+	if result != expected {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	t.Log("Testing get secret with both a valid config and file")
+
+	// Test the get secret function with both a valid config and file
+	result = utils.GetSecret(expected, file)
+
+	// Check if the result is equal to the expected
+	if result != expected {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	// Cleanup the test file
+	t.Log("Cleaning up test file")
+
+	err = os.Remove(file)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error cleaning up test file: %v", err)
+	}
+}
+
+// Test the get users function
+func TestGetUsers(t *testing.T) {
+	t.Log("Testing get users with a config and no file")
+
+	// Test the get users function with a config and no file
+	conf := "user1:pass1,user2:pass2"
+	file := ""
+	expected := types.Users{
+		{
+			Username: "user1",
+			Password: "pass1",
+		},
+		{
+			Username: "user2",
+			Password: "pass2",
+		},
+	}
+
+	result, err := utils.GetUsers(conf, file)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error getting users: %v", err)
+	}
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	t.Log("Testing get users with a file and no config")
+
+	// Test the get users function with a file and no config
+	conf = ""
+	file = "/tmp/test.txt"
+	expected = types.Users{
+		{
+			Username: "user1",
+			Password: "pass1",
+		},
+		{
+			Username: "user2",
+			Password: "pass2",
+		},
+	}
+
+	// Create file
+	err = os.WriteFile(file, []byte("user1:pass1\nuser2:pass2"), 0644)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error creating test file: %v", err)
+	}
+
+	// Test
+	result, err = utils.GetUsers(conf, file)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error getting users: %v", err)
+	}
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	// Test the get users function with both a config and file
+	t.Log("Testing get users with both a config and file")
+
+	conf = "user3:pass3"
+	expected = types.Users{
+		{
+			Username: "user3",
+			Password: "pass3",
+		},
+		{
+			Username: "user1",
+			Password: "pass1",
+		},
+		{
+			Username: "user2",
+			Password: "pass2",
+		},
+	}
+
+	result, err = utils.GetUsers(conf, file)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error getting users: %v", err)
+	}
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+
+	// Cleanup the test file
+	t.Log("Cleaning up test file")
+
+	err = os.Remove(file)
+
+	// Check if there was an error
+	if err != nil {
+		t.Fatalf("Error cleaning up test file: %v", err)
+	}
+}
+
+// Test the tinyauth labels function
+func TestGetTinyauthLabels(t *testing.T) {
+	t.Log("Testing get tinyauth labels with a valid map")
+
+	// Test the get tinyauth labels function with a valid map
+	labels := map[string]string{
+		"tinyauth.users":           "user1,user2",
+		"tinyauth.oauth.whitelist": "user1,user2",
+		"random":                   "random",
+	}
+
+	expected := types.TinyauthLabels{
+		Users:          []string{"user1", "user2"},
+		OAuthWhitelist: []string{"user1", "user2"},
+	}
+
+	result := utils.GetTinyauthLabels(labels)
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+}
+
+// Test the filter function
+func TestFilter(t *testing.T) {
+	t.Log("Testing filter helper")
+
+	// Create variables
+	data := []string{"", "val1", "", "val2", "", "val3", ""}
+	expected := []string{"val1", "val2", "val3"}
+
+	// Test the filter function
+	result := utils.Filter(data, func(val string) bool {
+		return val != ""
+	})
+
+	// Check if the result is equal to the expected
+	if !reflect.DeepEqual(expected, result) {
+		t.Fatalf("Expected %v, got %v", expected, result)
+	}
+}

site/src/pages/continue-page.tsx

@@ -4,11 +4,12 @@ import { Navigate } from "react-router";
 import { useUserContext } from "../context/user-context";
 import { Layout } from "../components/layouts/layout";
 import { ReactNode } from "react";
+import { isQueryValid } from "../utils/utils";
 
 export const ContinuePage = () => {
   const queryString = window.location.search;
   const params = new URLSearchParams(queryString);
-  const redirectUri = params.get("redirect_uri");
+  const redirectUri = params.get("redirect_uri") ?? "";
 
   const { isLoggedIn, disableContinue } = useUserContext();
 
@@ -16,7 +17,7 @@ export const ContinuePage = () => {
     return <Navigate to={`/login?redirect_uri=${redirectUri}`} />;
   }
 
-  if (redirectUri === "null") {
+  if (!isQueryValid(redirectUri)) {
     return <Navigate to="/" />;
   }
 
@@ -27,15 +28,31 @@ export const ContinuePage = () => {
       color: "blue",
     });
     setTimeout(() => {
-      window.location.href = redirectUri!;
+      window.location.href = redirectUri;
     }, 500);
   };
 
-  const urlParsed = URL.parse(redirectUri!);
+  let uri;
+
+  try {
+    uri = new URL(redirectUri);
+  } catch {
+    return (
+      <ContinuePageLayout>
+        <Text size="xl" fw={700}>
+          Invalid Redirect
+        </Text>
+        <Text>
+          The redirect URL is invalid, please contact the app owner to fix the
+          issue.
+        </Text>
+      </ContinuePageLayout>
+    );
+  }
 
   if (
     window.location.protocol === "https:" &&
-    urlParsed!.protocol === "http:"
+    uri.protocol === "http:"
   ) {
     return (
       <ContinuePageLayout>
@@ -54,7 +71,7 @@ export const ContinuePage = () => {
   }
 
   if (disableContinue) {
-    window.location.href = redirectUri!;
+    window.location.href = redirectUri;
     return (
       <ContinuePageLayout>
         <Text size="xl" fw={700}>

site/src/pages/login-page.tsx

@@ -20,13 +20,15 @@ import { GoogleIcon } from "../icons/google";
 import { GithubIcon } from "../icons/github";
 import { OAuthIcon } from "../icons/oauth";
 import { TailscaleIcon } from "../icons/tailscale";
+import { isQueryValid } from "../utils/utils";
 
 export const LoginPage = () => {
   const queryString = window.location.search;
   const params = new URLSearchParams(queryString);
-  const redirectUri = params.get("redirect_uri");
+  const redirectUri = params.get("redirect_uri") ?? "";
 
   const { isLoggedIn, configuredProviders } = useUserContext();
+
   const oauthProviders = configuredProviders.filter(
     (value) => value !== "username",
   );
@@ -69,7 +71,7 @@ export const LoginPage = () => {
         color: "green",
       });
       setTimeout(() => {
-        if (redirectUri === "null") {
+        if (isQueryValid(redirectUri)) {
           window.location.replace("/");
         } else {
           window.location.replace(`/continue?redirect_uri=${redirectUri}`);

site/src/pages/unauthorized-page.tsx

@@ -1,14 +1,15 @@
 import { Button, Code, Paper, Text } from "@mantine/core";
 import { Layout } from "../components/layouts/layout";
 import { Navigate } from "react-router";
+import { isQueryValid } from "../utils/utils";
 
 export const UnauthorizedPage = () => {
   const queryString = window.location.search;
   const params = new URLSearchParams(queryString);
-  const username = params.get("username");
-  const resource = params.get("resource");
+  const username = params.get("username") ?? "";
+  const resource = params.get("resource") ?? "";
 
-  if (username === "null") {
+  if (!isQueryValid(username)) {
     return <Navigate to="/" />;
   }
 
@@ -20,7 +21,7 @@ export const UnauthorizedPage = () => {
         </Text>
         <Text>
           The user with username <Code>{username}</Code> is not authorized to{" "}
-          {resource !== "null" ? (
+          {isQueryValid(resource) ? (
             <span>
               access the <Code>{resource}</Code> resource.
             </span>

site/src/utils/utils.ts

@@ -1 +1,2 @@
-export const capitalize = (s: string) => s.charAt(0).toUpperCase() + s.slice(1);
+export const capitalize = (s: string) => s.charAt(0).toUpperCase() + s.slice(1);
+export const isQueryValid = (value: string) => value.trim() !== "" && value !== "null";