feat: experimental option to run tinyauth in oauth bridge mode

[steveiliop56]

Summary by CodeRabbit

• New Features
  • Added an experimental OAuth bridge option (disabled by default) to improve consistency of identity mapping across OAuth and Tailscale sign-ins.
• Bug Fixes
  • Improved handling of missing or malformed identity fields by applying deterministic fallback rules and logging when email parsing fails.
• Configuration
  • Updated the example environment/template and YAML config to include the new experimental setting.
  • Displays a runtime warning when experimental features are enabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2cf0dbac-81f1-4393-8d8c-c0e30132b118

📥 Commits

Reviewing files that changed from the base of the PR and between 00b57df and d10ff04.

📒 Files selected for processing (1)

• internal/controller/oauth_controller.go

🚧 Files skipped from review as they are similar to previous changes (1)

• internal/controller/oauth_controller.go

---

📝 Walkthrough

Walkthrough

Adds an experimental OAuth bridge configuration flag, startup warning, and conditional identity mapping for OAuth sessions and Tailscale contexts.

Changes

OAuth bridge identity flow

Layer / File(s)	Summary
Experimental configuration and startup warning .env.example, internal/model/config.go, cmd/tinyauth/tinyauth.go	Adds ExperimentalConfig.OAuthBridgeEnabled, documents its environment variable, and prints a warning when experimental configuration differs from defaults.
OAuth identity normalization internal/controller/oauth_controller.go	Normalizes OAuth username and name values through createOAuthUserInfo before populating the session.
Tailscale identity mapping internal/middleware/context_middleware.go	Passes static configuration into middleware and derives Tailscale usernames using bridge-specific or legacy formatting.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant OAuthProvider
  participant oauthCallbackHandler
  participant createOAuthUserInfo
  participant Session
  OAuthProvider->>oauthCallbackHandler: OAuth user fields
  oauthCallbackHandler->>createOAuthUserInfo: Normalize identity
  createOAuthUserInfo-->>oauthCallbackHandler: oauthUserInfo
  oauthCallbackHandler->>Session: Create session identity

Loading

Possibly related PRs

• tinyauthapp/tinyauth#897: Related changes to modeling and initializing the experimental configuration.
• tinyauthapp/tinyauth#964: Expands the shared experimental configuration namespace.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding an experimental OAuth bridge mode option.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/oauth-bridge-mode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 1.92308% with 51 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/controller/oauth_controller.go	0.00%	42 Missing ⚠️
internal/middleware/context_middleware.go	14.28%	6 Missing ⚠️
cmd/tinyauth/tinyauth.go	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/controller/oauth_controller.go`:
- Around line 367-374: In the OAuth name assignment block, reverse the condition
so a non-empty input.Name is preserved in info.Name, while only missing names
use the email-derived fallback. Before accessing the split email parts in this
fallback, validate that input.Email contains an @ and handle malformed addresses
without indexing a missing second element.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cd429326-6147-40ad-b760-73c25e487525

📥 Commits

Reviewing files that changed from the base of the PR and between 4db1b33 and 00b57df.

📒 Files selected for processing (5)

• .env.example
• cmd/tinyauth/tinyauth.go
• internal/controller/oauth_controller.go
• internal/middleware/context_middleware.go
• internal/model/config.go