Repository navigation
[BUG] OAuth groups access control broken in v5.1.0 - empty app OAuth whitelist denies access #1009
Description
Describe the Bug
After upgrading to v5.1.0, OAuth groups-based access control stopped working. Debug logs show:
{"level":"warn","stream":"app","error":"filter is empty","item":"user@example.com","time":"2026-07-16T01:00:44Z","time":"2026-07-16T01:00:44Z","caller":"/tinyauth/internal/service/access_controls_rules.go:46","message":"Invalid entry in OAuth whitelist"}
This is with the env var TINYAUTH_APPS_[NAME]_OAUTH_GROUPS configured and the env var TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST not configured. Here [NAME] and user@example.com are placeholders for my actual app name and email. I confirmed in pocket-id that user@example.com is still in the right group.
It seems like the default OAuth whitelist of the empty string prevents a user from being granted access even if the user is in the configured group. My agent says it's from #852
When I set TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/, it works again.
How to Reproduce
No response
Expected Behavior
Setting TINYAUTH_APPS_[NAME]_OAUTH_GROUPS to use groups based access control does not require also setting the TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST env var to have users or a wildcard.
Additional Context
No response
Logs
No response
Operating System
Linux
Browser
No response
Tinyauth Version
v5.1.0
Docker Version (if applicable)
No response
Human Written Confirmation
- I confirm this issue was written by me and not generated by an LLM or AI assistant.
Activity
dosubot commentedon Jul 16, 2026
Hi @mitchgu! I'm Dosu and I'm helping the Tinyauth team.
This looks like a valid bug introduced in PR #852 [1]. The root cause is in
RuleUserAllowedinaccess_controls_rules.go— when the OAuth whitelist is not configured (empty),CheckFilterreturnsErrFilterEmpty, and the rule treats that as an invalid entry and returnsEffectDeny[2]. This short-circuits the policy engine beforeRuleOAuthGroupever gets a chance to evaluate group membership.The inconsistency is clear: when the user allow list is empty,
RuleUserAllowedcorrectly returnsEffectAbstain(letting subsequent rules like group checks decide), but when the OAuth whitelist is empty, it returnsEffectDenyinstead [3].The fix should make
RuleUserAllowedreturnEffectAbstain(notEffectDeny) when the OAuth whitelist is empty/not configured, matching how empty user allow lists are already handled. This would allow theRuleOAuthGrouprule to properly evaluate group membership afterward [4].Your workaround of setting
TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/is correct in the meantime — it makes the whitelist match everyone, soRuleUserAllowedallows the request through to the group check.To reply, just mention @dosu.
Docs are dead. Just use Dosu.
steveiliop56 commentedon Jul 16, 2026
@mitchgu can you please test with
v5.1.1-rc.1? The issue should no longer be there.mitchgu commentedon Jul 16, 2026
Just tried it - yes it works without the
TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/workaround. Thank you for the quick turnaround!