Breaking Changes with 5.1 deny-by-default?

[fbrinker]

I've upgraded to 5.1 and thought the deny by default could be breaking, but it wasn't declared like that.

Now all my services aren't accessible via TinyAuth and PocketId anymore.

The solution is declaring whitelists like

TINYAUTH_APPS_STATUS_OAUTH_WHITELIST=myemail@example.org

But I don't like that configruation overhead for each service.
I thought TINYAUTH_AUTH_ACLS_POLICY=allow could solve this, but it has no effect.

How do I disable deny-by-default again? I don't see why I would need that.

PS: Downgrading doesn't work either due to migrations?

[dosubot]

Hi @fbrinker! I'm Dosu and I'm helping the Tinyauth team.

This is a confirmed bug in v5.1.0 introduced by PR #852, and it's already been reported in issue #1009 [1].

The problem is not actually the auth.acls.policy setting — the global policy default is still allow [2]. The issue is that RuleUserAllowed returns EffectDeny when the per-app OAuth whitelist is empty/not configured, which blocks OAuth users (like PocketID) before any other rules (like group checks) can run [2]. This is inconsistent with how empty user allow lists are handled (those correctly return EffectAbstain).

Workaround: Instead of adding each email per service, you can set a wildcard pattern to match all users:

TINYAUTH_APPS_STATUS_OAUTH_WHITELIST=/.*/

This lets everyone through the whitelist check, effectively restoring pre-5.1 behavior. You'd need to set this for each app, but it avoids listing individual emails [1].

So to answer your question — TINYAUTH_AUTH_ACLS_POLICY=allow doesn't help here because the OAuth whitelist rule explicitly returns deny (rather than abstain), so the global policy fallback never comes into play [2].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[steveiliop56]

@fbrinker it's a bug, it's already fixed and a new version will be released later today. Sorry for the inconvenience.

Fixed in: 1165c91

[fbrinker]

Thanks, didn't find the report with my search :)

That was quick, thanks :)

[steveiliop56]

@fbrinker can you please test with v5.1.1-rc.1? The issue should no longer be there.

also thank you for the coffee :)

[fbrinker]

I can't find a branch or tag with that version? 🙈

(Also for my current setup I would need a docker container to test it)

[steveiliop56]

@fbrinker GitHub's API is down and while trying to debug it, I removed the RC one (mis-click), I know people are on the rc version right now and it will fail to pull next time they try to use it but my hands are tied. I can't do anything but wait for GitHub to come back up and release tomorrow morning.

[fbrinker]

no worries, since there was a work around.

5.1.1 works like a charm again, thanks :)