[BUG] OAuth groups access control broken in v5.1.0 - empty app OAuth whitelist denies access

[mitchgu]

Describe the Bug

After upgrading to v5.1.0, OAuth groups-based access control stopped working. Debug logs show:

{"level":"warn","stream":"app","error":"filter is empty","item":"user@example.com","time":"2026-07-16T01:00:44Z","time":"2026-07-16T01:00:44Z","caller":"/tinyauth/internal/service/access_controls_rules.go:46","message":"Invalid entry in OAuth whitelist"}

This is with the env var TINYAUTH_APPS_[NAME]_OAUTH_GROUPS configured and the env var TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST not configured. Here [NAME] and user@example.com are placeholders for my actual app name and email. I confirmed in pocket-id that user@example.com is still in the right group.

It seems like the default OAuth whitelist of the empty string prevents a user from being granted access even if the user is in the configured group. My agent says it's from #852

When I set TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/, it works again.

How to Reproduce

No response

Expected Behavior

Setting TINYAUTH_APPS_[NAME]_OAUTH_GROUPS to use groups based access control does not require also setting the TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST env var to have users or a wildcard.

Additional Context

No response

Logs

No response

Operating System

Linux

Browser

No response

Tinyauth Version

v5.1.0

Docker Version (if applicable)

No response

Human Written Confirmation

• I confirm this issue was written by me and not generated by an LLM or AI assistant.

[dosubot]

Hi @mitchgu! I'm Dosu and I'm helping the Tinyauth team.

This looks like a valid bug introduced in PR #852 [1]. The root cause is in RuleUserAllowed in access_controls_rules.go — when the OAuth whitelist is not configured (empty), CheckFilter returns ErrFilterEmpty, and the rule treats that as an invalid entry and returns EffectDeny [2]. This short-circuits the policy engine before RuleOAuthGroup ever gets a chance to evaluate group membership.

The inconsistency is clear: when the user allow list is empty, RuleUserAllowed correctly returns EffectAbstain (letting subsequent rules like group checks decide), but when the OAuth whitelist is empty, it returns EffectDeny instead [3].

The fix should make RuleUserAllowed return EffectAbstain (not EffectDeny) when the OAuth whitelist is empty/not configured, matching how empty user allow lists are already handled. This would allow the RuleOAuthGroup rule to properly evaluate group membership afterward [4].

Your workaround of setting TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/ is correct in the meantime — it makes the whitelist match everyone, so RuleUserAllowed allows the request through to the group check.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[steveiliop56]

@mitchgu can you please test with v5.1.1-rc.1? The issue should no longer be there.

[mitchgu]

Just tried it - yes it works without the TINYAUTH_APPS_[NAME]_OAUTH_WHITELIST=/.*/ workaround. Thank you for the quick turnaround!