[pull] main from tinyauthapp:main

cmd/tinyauth/generate_totp.go

@@ -116,11 +116,11 @@ func generateTotpCmd() *cli.Command {
 		userStr := fmt.Sprintf("%s:%s:%s", user.Username, user.Password, user.TOTPSecret)
 
 		fmt.Print("\nOr add the following TOTP secret to your authenticator app: ")
-		fmt.Print(colors.green.Render(secret))
+		fmt.Print(colors.blue.Render(secret))
 		fmt.Print("\n\n")
 
 		fmt.Printf("Finally, add your user '%s' back to your configuration: ", user.Username)
-		fmt.Print(colors.green.Render(userStr))
+		fmt.Print(colors.blue.Render(userStr))
 		fmt.Print("\n")
 
 		return nil

cmd/tinyauth/tinyauth.go

@@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"os"
-	"reflect"
 	"strings"
 
 	"charm.land/huh/v2"
@@ -32,10 +31,11 @@ func main() {
 		Configuration: tConfig,
 		Resources:     loaders,
 		Run: func(_ []string) error {
-			if !reflect.DeepEqual(model.NewDefaultConfiguration(env).Experimental, tConfig.Experimental) {
-				colors := getColors()
-				fmt.Println(colors.yellow.Render("⚠") + " Experimental features are enabled, use with caution. Experimental features may change with each release.")
-			}
+			// enable this on experimental features
+			//if !reflect.DeepEqual(model.NewDefaultConfiguration(env).Experimental, tConfig.Experimental) {
+			//	colors := getColors()
+			//	fmt.Println(colors.yellow.Render("⚠") + " Experimental features are enabled, use with caution. Experimental features may change with each release.")
+			//}
 			return runCmd(*tConfig)
 		},
 	}

internal/bootstrap/service_bootstrap.go

@@ -85,7 +85,8 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 			err := app.dig.Provide(service.NewKubernetesService)
 
 			if err != nil {
-				return nil, fmt.Errorf("failed to provide kubernetes service: %w", err)
+				app.log.App.Warn().Err(err).Msg("Failed to provide kubernetes service")
+				return nil, nil
 			}
 
 			err = app.dig.Invoke(func(k *service.KubernetesService) error {
@@ -94,7 +95,8 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 			})
 
 			if err != nil {
-				return nil, fmt.Errorf("failed to invoke kubernetes service: %w", err)
+				app.log.App.Warn().Err(err).Msg("Failed to invoke kubernetes service")
+				return nil, nil
 			}
 
 			// Kubernetes will fail to initialize with an error if it cannot connect to the cluster
@@ -114,7 +116,8 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 		err := app.dig.Provide(service.NewDockerService)
 
 		if err != nil {
-			return nil, fmt.Errorf("failed to provide docker service: %w", err)
+			app.log.App.Warn().Err(err).Msg("Failed to provide docker service")
+			return nil, nil
 		}
 
 		err = app.dig.Invoke(func(d *service.DockerService) error {
@@ -123,7 +126,8 @@ func (app *BootstrapApp) getLabelProvider() (service.LabelProvider, error) {
 		})
 
 		if err != nil {
-			return nil, fmt.Errorf("failed to invoke docker service: %w", err)
+			app.log.App.Warn().Err(err).Msg("Failed to invoke docker service")
+			return nil, nil
 		}
 
 		if app.services.dockerService == nil {

internal/model/config.go

@@ -101,22 +101,23 @@ func NewDefaultConfiguration(runtimeEnv RuntimeEnv) *Config {
 }
 
 type Config struct {
-	AppURL        string             `description:"The base URL where the app is hosted." yaml:"appUrl,omitempty"`
-	ConfigFile    string             `description:"Path to config file." yaml:"-" gen:"include"`
-	LabelProvider string             `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider,omitempty"`
-	Database      DatabaseConfig     `description:"Database configuration." yaml:"database,omitempty"`
-	Analytics     AnalyticsConfig    `description:"Analytics configuration." yaml:"analytics,omitempty"`
-	Resources     ResourcesConfig    `description:"Resources configuration." yaml:"resources,omitempty"`
-	Server        ServerConfig       `description:"Server configuration." yaml:"server,omitempty"`
-	Auth          AuthConfig         `description:"Authentication configuration." yaml:"auth,omitempty"`
-	Apps          map[string]App     `description:"Application ACLs configuration." yaml:"apps,omitempty"`
-	OAuth         OAuthConfig        `description:"OAuth configuration." yaml:"oauth,omitempty"`
-	OIDC          OIDCConfig         `description:"OIDC configuration." yaml:"oidc,omitempty"`
-	UI            UIConfig           `description:"UI customization." yaml:"ui,omitempty"`
-	LDAP          LDAPConfig         `description:"LDAP configuration." yaml:"ldap,omitempty"`
-	Experimental  ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental,omitempty"`
-	Tailscale     TailscaleConfig    `description:"Tailscale configuration." yaml:"tailscale,omitempty"`
-	Log           LogConfig          `description:"Logging configuration." yaml:"log,omitempty"`
+	AppURL        string          `description:"The base URL where the app is hosted." yaml:"appUrl,omitempty"`
+	ConfigFile    string          `description:"Path to config file." yaml:"-" gen:"include"`
+	LabelProvider string          `description:"Label provider to use for ACLs (auto, docker, kubernetes or none to disable). auto detects the environment." yaml:"labelProvider,omitempty"`
+	Database      DatabaseConfig  `description:"Database configuration." yaml:"database,omitempty"`
+	Analytics     AnalyticsConfig `description:"Analytics configuration." yaml:"analytics,omitempty"`
+	Resources     ResourcesConfig `description:"Resources configuration." yaml:"resources,omitempty"`
+	Server        ServerConfig    `description:"Server configuration." yaml:"server,omitempty"`
+	Auth          AuthConfig      `description:"Authentication configuration." yaml:"auth,omitempty"`
+	Apps          map[string]App  `description:"Application ACLs configuration." yaml:"apps,omitempty"`
+	OAuth         OAuthConfig     `description:"OAuth configuration." yaml:"oauth,omitempty"`
+	OIDC          OIDCConfig      `description:"OIDC configuration." yaml:"oidc,omitempty"`
+	UI            UIConfig        `description:"UI customization." yaml:"ui,omitempty"`
+	LDAP          LDAPConfig      `description:"LDAP configuration." yaml:"ldap,omitempty"`
+	// enable the cli warning on experimental features
+	//Experimental  ExperimentalConfig `description:"Experimental features, use with caution." yaml:"experimental,omitempty"`
+	Tailscale TailscaleConfig `description:"Tailscale configuration." yaml:"tailscale,omitempty"`
+	Log       LogConfig       `description:"Logging configuration." yaml:"log,omitempty"`
 }
 
 type DatabaseConfig struct {
@@ -237,7 +238,7 @@ type LogStreamConfig struct {
 	Level   string `description:"Log level for this stream. Use global if empty." yaml:"level,omitempty"`
 }
 
-type ExperimentalConfig struct{}
+//type ExperimentalConfig struct{}
 
 type TailscaleConfig struct {
 	Enabled       bool   `description:"Enable Tailscale integration." yaml:"enabled,omitempty"`

internal/service/access_controls_rules.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"errors"
 	"regexp"
 	"strings"
 
@@ -43,6 +44,10 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 		rule.Log.App.Debug().Msg("User is an OAuth user, checking OAuth whitelist")
 		match, err := utils.CheckFilter(ctx.ACLs.OAuth.Whitelist, ctx.UserContext.OAuth.Email)
 		if err != nil {
+			if errors.Is(err, utils.ErrFilterEmpty) {
+				rule.Log.App.Debug().Msg("OAuth whitelist is empty, abstaining")
+				return EffectAbstain
+			}
 			rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.OAuth.Email).Msg("Invalid entry in OAuth whitelist")
 			return EffectDeny
 		}
@@ -72,7 +77,7 @@ func (rule *UserAllowedRule) Evaluate(ctx *ACLContext) Effect {
 	match, err := utils.CheckFilter(ctx.ACLs.Users.Allow, ctx.UserContext.GetUsername())
 
 	if err != nil {
-		if err == utils.ErrFilterEmpty {
+		if errors.Is(err, utils.ErrFilterEmpty) {
 			return EffectAbstain
 		}
 		rule.Log.App.Warn().Err(err).Str("item", ctx.UserContext.GetUsername()).Msg("Invalid entry in users allow list")

internal/service/access_controls_rules_test.go

@@ -44,6 +44,21 @@ func TestUserAllowedRule(t *testing.T) {
 			},
 			expected: EffectAbstain,
 		},
+		{
+			name: "abstains when filter is empty",
+			ctx: &ACLContext{
+				ACLs: &model.App{
+					OAuth: model.AppOAuth{Whitelist: ""},
+				},
+				UserContext: &model.UserContext{
+					Provider: model.ProviderOAuth,
+					OAuth: &model.OAuthContext{
+						BaseContext: model.BaseContext{Username: "alice"},
+					},
+				},
+			},
+			expected: EffectAbstain,
+		},
 		{
 			name: "allows OAuth user when email matches whitelist",
 			ctx: &ACLContext{