release: 2.11.0

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Elias Schneider <login@eliasschneider.com>

.env.example

@@ -15,4 +15,4 @@ ENCRYPTION_KEY=
 TRUST_PROXY=false
 MAXMIND_LICENSE_KEY=
 PUID=1000
-PGID=1000
+PGID=1000

.github/ISSUE_TEMPLATE/feature.yml

@@ -1,7 +1,8 @@
 name: 🚀 Feature
 description: "Submit a proposal for a new feature"
 title: "🚀 Feature: "
-type: 'Feature'
+type: "Feature"
+labels: ["needs more upvotes"]
 body:
   - type: textarea
     id: feature-description

.github/dependabot.yml

@@ -1,12 +1,83 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for more information:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-# https://containers.dev/guide/dependabot
-
 version: 2
+
+multi-ecosystem-groups:
+  all-dependencies:
+    schedule:
+      interval: "weekly"
+      day: "friday"
+      time: "17:00"
+      timezone: "Europe/Zurich"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 2
+    pull-request-branch-name:
+      separator: "-"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
 updates:
- - package-ecosystem: "devcontainers"
-   directory: "/"
-   schedule:
-     interval: weekly
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "gomod"
+    directory: "/backend"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    versioning-strategy: "increase-if-necessary"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "docker"
+    directories:
+      - "/docker"
+      - "/tests/setup"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "docker-compose"
+    directories:
+      - "/"
+      - "/tests/setup"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "devcontainers"
+    directory: "/"
+    patterns: ["*"]
+    multi-ecosystem-group: "all-dependencies"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    cooldown:
+      default-days: 7

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+## What does this PR do?
+
+## Screenshots
+
+## AI Usage
+
+## Contributing Guidelines
+
+Have you read the [Contributing Guidelines](https://github.com/pocket-id/pocket-id/blob/main/CONTRIBUTING.md)?
+
+- [ ] If I'm implementing a new feature, I have opened an issue first, or commented on an existing one, to discuss the implementation details.
+- [ ] I have read the [AI Usage Guidelines](https://github.com/pocket-id/pocket-id/blob/main/CONTRIBUTING.md#ai-usage-policy).

.github/workflows/backend-linter.yml

@@ -17,14 +17,15 @@ permissions:
   pull-requests: read
   # Optional: allow write access to checks to allow the action to annotate code in the PR.
   checks: write
+  id-token: write
 
 jobs:
   golangci-lint:
     name: Run Golangci-lint
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -32,9 +33,9 @@ jobs:
           go-version-file: backend/go.mod
 
       - name: Run Golangci-lint
-        uses: golangci/golangci-lint-action@v9.0.0
+        uses: golangci/golangci-lint-action@v9.3.0
         with:
-          version: v2.11.4
-          args: --build-tags=exclude_frontend
+          version: v2.12.2
+          args: --config=.golangci.yml
           working-directory: backend
           only-new-issues: ${{ github.event_name == 'pull_request' }}

.github/workflows/build-next.yml

@@ -4,93 +4,89 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 concurrency:
   group: build-next-image
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
 jobs:
   build-next:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
+    runs-on: depot-ubuntu-latest
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
+        with:
+          run_install: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 24
+          cache: pnpm
 
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
-          go-version-file: "backend/go.mod"
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Set DOCKER_IMAGE_NAME
-        run: |
-          # Lowercase REPO_OWNER which is required for containers
-          REPO_OWNER=${{ github.repository_owner }}
-          DOCKER_IMAGE_NAME="ghcr.io/${REPO_OWNER,,}/pocket-id"
-          echo "DOCKER_IMAGE_NAME=${DOCKER_IMAGE_NAME}" >>${GITHUB_ENV}
+      - name: Setup depot buildx driver
+        run: depot configure-docker
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install frontend dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build frontend
-        working-directory: frontend
-        run: pnpm run build
-
-      - name: Build binaries
-        run: sh scripts/development/build-binaries.sh --docker-only
-
-      - name: Build and push container image
-        id: build-push-image
-        uses: docker/build-push-action@v6
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4.4.0
         with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ env.DOCKER_IMAGE_NAME }}:next
-          file: docker/Dockerfile-prebuilt
-      - name: Build and push container image (distroless)
-        uses: docker/build-push-action@v6
-        id: container-build-push-distroless
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7.2.3
         with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ env.DOCKER_IMAGE_NAME }}:next-distroless
-          file: docker/Dockerfile-distroless
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --clean --skip=announce,validate --parallelism=4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUILD_NEXT: "true"
+          SKIP_RELEASE: "true"
+          SKIP_CHANGELOG: "true"
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+
+      - name: Binary attestation
+        uses: actions/attest@v4
+        with:
+          subject-checksums: ./dist/checksums.txt
+
       - name: Container image attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest@v4
         with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
-          subject-digest: ${{ steps.build-push-image.outputs.digest }}
-          push-to-registry: true
-      - name: Container image attestation (distroless)
-        uses: actions/attest-build-provenance@v2
-        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
-          subject-digest: ${{ steps.container-build-push-distroless.outputs.digest }}
-          push-to-registry: true
+          subject-checksums: ./dist/digests.txt

.github/workflows/e2e-tests.yml

@@ -1,59 +1,27 @@
 name: E2E Tests
 on:
   push:
-    branches: [main]
+    branches: [ main ]
     paths-ignore:
       - "docs/**"
       - "**.md"
       - ".github/**"
   pull_request:
-    branches: [main, breaking/**]
+    branches: [ main, breaking/** ]
     paths-ignore:
       - "docs/**"
       - "**.md"
       - ".github/**"
 
+permissions:
+  contents: read
+  actions: write
+  id-token: write
+
 jobs:
-  build:
-    if: github.event.pull_request.head.ref != 'i18n_crowdin'
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and export
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile
-          push: false
-          load: false
-          tags: pocket-id:test
-          outputs: type=docker,dest=/tmp/docker-image.tar
-          build-args: BUILD_TAGS=e2etest
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Upload Docker image artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp/docker-image.tar
-          retention-days: 1
-
   test:
     if: github.event.pull_request.head.ref != 'i18n_crowdin'
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
-    needs: build
+    runs-on: depot-ubuntu-24.04-32
     strategy:
       fail-fast: false
       matrix:
@@ -70,25 +38,33 @@ jobs:
             storage: database
 
     steps:
-      - uses: actions/checkout@v5
+      - name: Checkout code
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 24
+          cache: "pnpm"
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
+      - name: Set up Depot Docker builder
+        run: depot configure-docker
 
       - name: Cache Playwright Browsers
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
 
       - name: Cache PostgreSQL Docker image
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: postgres-cache
         with:
           path: /tmp/postgres-image.tar
@@ -102,23 +78,8 @@ jobs:
         if: matrix.db == 'postgres' && steps.postgres-cache.outputs.cache-hit == 'true'
         run: docker load < /tmp/postgres-image.tar
 
-      - name: Cache LLDAP Docker image
-        uses: actions/cache@v4
-        id: lldap-cache
-        with:
-          path: /tmp/lldap-image.tar
-          key: lldap-stable-${{ runner.os }}
-      - name: Pull and save LLDAP image
-        if: steps.lldap-cache.outputs.cache-hit != 'true'
-        run: |
-          docker pull lldap/lldap:2025-05-19
-          docker save lldap/lldap:2025-05-19 > /tmp/lldap-image.tar
-      - name: Load LLDAP image
-        if: steps.lldap-cache.outputs.cache-hit == 'true'
-        run: docker load < /tmp/lldap-image.tar
-
       - name: Cache SCIM Test Server Docker image
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: scim-cache
         with:
           path: /tmp/scim-test-server-image.tar
@@ -134,45 +95,20 @@ jobs:
 
       - name: Cache Localstack S3 Docker image
         if: matrix.storage == 's3'
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         id: s3-cache
         with:
           path: /tmp/localstack-s3-image.tar
-          key: localstack-s3-latest-${{ runner.os }}
+          key: localstack-4.14.0-${{ runner.os }}
       - name: Pull and save Localstack S3 image
         if: matrix.storage == 's3' && steps.s3-cache.outputs.cache-hit != 'true'
         run: |
-          docker pull localstack/localstack:s3-latest
-          docker save localstack/localstack:s3-latest > /tmp/localstack-s3-image.tar
+          docker pull localstack/localstack:4.14.0
+          docker save localstack/localstack:4.14.0 > /tmp/localstack-s3-image.tar
       - name: Load Localstack S3 image
         if: matrix.storage == 's3' && steps.s3-cache.outputs.cache-hit == 'true'
         run: docker load < /tmp/localstack-s3-image.tar
 
-      - name: Cache AWS CLI Docker image
-        if: matrix.storage == 's3'
-        uses: actions/cache@v4
-        id: aws-cli-cache
-        with:
-          path: /tmp/aws-cli-image.tar
-          key: aws-cli-latest-${{ runner.os }}
-      - name: Pull and save AWS CLI image
-        if: matrix.storage == 's3' && steps.aws-cli-cache.outputs.cache-hit != 'true'
-        run: |
-          docker pull amazon/aws-cli:latest
-          docker save amazon/aws-cli:latest > /tmp/aws-cli-image.tar
-      - name: Load AWS CLI image
-        if: matrix.storage == 's3' && steps.aws-cli-cache.outputs.cache-hit == 'true'
-        run: docker load < /tmp/aws-cli-image.tar
-
-      - name: Download Docker image artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: docker-image
-          path: /tmp
-
-      - name: Load Docker image
-        run: docker load -i /tmp/docker-image.tar
-
       - name: Install test dependencies
         run: pnpm --filter pocket-id-tests install --frozen-lockfile
 
@@ -198,7 +134,7 @@ jobs:
             DOCKER_COMPOSE_FILE=docker-compose-s3.yml
           fi
 
-          docker compose -f "$DOCKER_COMPOSE_FILE" up -d
+          docker compose -f "$DOCKER_COMPOSE_FILE" up -d --build
 
           {
             LOG_FILE="/tmp/backend.log"
@@ -219,7 +155,7 @@ jobs:
         run: pnpm exec playwright test
 
       - name: Upload Test Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always() && github.event.pull_request.head.ref != 'i18n_crowdin'
         with:
           name: playwright-report-${{ matrix.db }}-${{ matrix.storage }}
@@ -228,7 +164,7 @@ jobs:
           retention-days: 15
 
       - name: Upload Backend Test Report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always() && github.event.pull_request.head.ref != 'i18n_crowdin'
         with:
           name: backend-${{ matrix.db }}-${{ matrix.storage }}

.github/workflows/pr-quality.yml

@@ -42,7 +42,7 @@ jobs:
 
                   # PR Template Checks
                   require-pr-template: true
-                  strict-pr-template-sections: ""
+                  strict-pr-template-sections: "Contributing Guidelines"
                   optional-pr-template-sections: "Issues"
                   max-additional-pr-template-sections: 3
 
@@ -80,7 +80,7 @@ jobs:
                       dependabot[bot]
                       renovate[bot]
                       github-actions[bot]
-                  exempt-users: ""
+                  exempt-users: "James18232"
                   exempt-author-association: "OWNER,MEMBER,COLLABORATOR"
                   exempt-label: "quality/exempt"
                   exempt-pr-label: ""

.github/workflows/release.yml

@@ -5,121 +5,87 @@ on:
     tags:
       - "v*.*.*"
 
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
+
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      packages: write
-      attestations: write
-      id-token: write
+  release:
+    runs-on: depot-ubuntu-24.04-16
+
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
+        with:
+          run_install: false
+
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 24
-      - uses: actions/setup-go@v6
+          cache: pnpm
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
         with:
-          go-version-file: "backend/go.mod"
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Set DOCKER_IMAGE_NAME
-        run: |
-          # Lowercase REPO_OWNER which is required for containers
-          REPO_OWNER=${{ github.repository_owner }}
-          DOCKER_IMAGE_NAME="ghcr.io/${REPO_OWNER,,}/pocket-id"
-          echo "DOCKER_IMAGE_NAME=${DOCKER_IMAGE_NAME}" >>${GITHUB_ENV}
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
+      - name: Setup depot buildx driver
+        run: depot configure-docker
+
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4.4.0
         with:
           registry: ghcr.io
-          username: ${{github.repository_owner}}
-          password: ${{secrets.GITHUB_TOKEN}}
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.DOCKER_IMAGE_NAME }}
-          tags: |
-            type=semver,pattern={{version}},prefix=v
-            type=semver,pattern={{major}}.{{minor}},prefix=v
-            type=semver,pattern={{major}},prefix=v
-      - name: Docker metadata (distroless)
-        id: meta-distroless
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.DOCKER_IMAGE_NAME }}
-          flavor: |
-            suffix=-distroless,onlatest=true
-          tags: |
-            type=semver,pattern={{version}},prefix=v
-            type=semver,pattern={{major}}.{{minor}},prefix=v
-            type=semver,pattern={{major}},prefix=v
-      - name: Install frontend dependencies
-        run: pnpm --filter pocket-id-frontend install --frozen-lockfile
-      - name: Build frontend
-        run: pnpm --filter pocket-id-frontend build
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build binaries
-        run: sh scripts/development/build-binaries.sh
-      - name: Build and push container image
-        uses: docker/build-push-action@v6
-        id: container-build-push
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4.4.0
         with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          file: docker/Dockerfile-prebuilt
-      - name: Build and push container image (distroless)
-        uses: docker/build-push-action@v6
-        id: container-build-push-distroless
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7.2.3
         with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta-distroless.outputs.tags }}
-          labels: ${{ steps.meta-distroless.outputs.labels }}
-          file: docker/Dockerfile-distroless
-      - name: Binary attestation
-        uses: actions/attest-build-provenance@v2
-        with:
-          subject-path: "backend/.bin/pocket-id-**"
-      - name: Container image attestation
-        uses: actions/attest-build-provenance@v2
-        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
-          subject-digest: ${{ steps.container-build-push.outputs.digest }}
-          push-to-registry: true
-      - name: Container image attestation (distroless)
-        uses: actions/attest-build-provenance@v2
-        with:
-          subject-name: "${{ env.DOCKER_IMAGE_NAME }}"
-          subject-digest: ${{ steps.container-build-push-distroless.outputs.digest }}
-          push-to-registry: true
-      - name: Upload binaries to release
+          distribution: goreleaser-pro
+          version: "~> v2"
+          args: release --clean --skip=validate --parallelism=4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload ${{ github.ref_name }} backend/.bin/*
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          MACOS_SIGN_P12: ${{ secrets.MACOS_SIGN_P12 }}
+          MACOS_SIGN_PASSWORD: ${{ secrets.MACOS_SIGN_PASSWORD }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          DISCORD_WEBHOOK_ID: ${{ secrets.DISCORD_WEBHOOK_ID }}
+          DISCORD_WEBHOOK_TOKEN: ${{ secrets.DISCORD_WEBHOOK_TOKEN }}
 
-  publish-release:
-    runs-on: ubuntu-latest
-    needs: [build]
-    permissions:
-      contents: write
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-      - name: Mark release as published
+      - name: Binary attestation
+        uses: actions/attest@v4
+        with:
+          subject-checksums: ./dist/checksums.txt
+
+      - name: Container image attestation
+        uses: actions/attest@v4
+        with:
+          subject-checksums: ./dist/digests.txt
+
+      - name: Publish release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release edit ${{ github.ref_name }} --draft=false

.github/workflows/svelte-check.yml

@@ -11,7 +11,7 @@ on:
       - "frontend/tsconfig.json"
       - "frontend/svelte.config.js"
   pull_request:
-    branches: [main]
+    branches: [main, breaking/**]
     paths:
       - "frontend/src/**"
       - ".github/svelte-check-matcher.json"
@@ -21,28 +21,31 @@ on:
       - "frontend/svelte.config.js"
   workflow_dispatch:
 
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+  id-token: write
+
 jobs:
   type-check:
     name: Run Svelte Check
     # Don't run on dependabot branches
     if: github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
+    runs-on: depot-ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v5
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 24
+          cache: "pnpm"
 
       - name: Install dependencies
         run: pnpm --filter pocket-id-frontend install --frozen-lockfile

.github/workflows/unit-tests.yml

@@ -5,18 +5,20 @@ on:
     paths:
       - "backend/**"
   pull_request:
-    branches: [main]
+    branches: [main, breaking/**]
     paths:
       - "backend/**"
 
+permissions:
+  contents: read
+  id-token: write
+  actions: write
+
 jobs:
   test-backend:
-    permissions:
-      contents: read
-      actions: write
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with:
           go-version-file: "backend/go.mod"
@@ -29,8 +31,8 @@ jobs:
         working-directory: backend
         run: |
           set -e -o pipefail
-          go test -tags=exclude_frontend -v ./... | tee /tmp/TestResults.log
-      - uses: actions/upload-artifact@v4
+          go test -tags=exclude_frontend,unit -v ./... | tee /tmp/TestResults.log
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: backend-unit-tests

.github/workflows/update-aaguids.yml

@@ -8,14 +8,15 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   update-aaguids:
-    runs-on: ubuntu-latest
+    runs-on: depot-ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Fetch JSON data
         run: |

.gitignore

@@ -60,3 +60,5 @@ yarn-error.log*
 
 #Debug
 backend/cmd/__debug_*
+# Added by goreleaser init:
+dist/

.goreleaser.yaml

@@ -0,0 +1,247 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
+# vim: set ts=2 sw=2 tw=0 fo=jcroql
+version: 2
+pro: true
+
+project_name: pocket-id
+
+before:
+  hooks:
+    - pnpm install --frozen-lockfile
+    - pnpm -C frontend build
+
+builds:
+  - id: pocket-id
+    main: ./cmd
+    dir: backend
+    binary: pocket-id
+    env:
+      - CGO_ENABLED=0
+      - GOMAXPROCS=2
+    goos:
+      - linux
+      - darwin
+      - windows
+      - freebsd
+      - openbsd
+    goarch:
+      - amd64
+      - arm64
+      - "386"
+      - arm
+    goarm:
+      - "7"
+    goamd64:
+      - v1
+    go386:
+      - sse2
+    ignore:
+      - goos: darwin
+        goarch: "386"
+      - goos: darwin
+        goarch: arm
+      - goos: windows
+        goarch: "386"
+      - goos: windows
+        goarch: arm
+      - goos: freebsd
+        goarch: "386"
+      - goos: freebsd
+        goarch: arm
+      - goos: openbsd
+        goarch: "386"
+      - goos: openbsd
+        goarch: arm
+    ldflags:
+      - -w -s
+      - -buildid={{ .Version }}
+      - -X github.com/pocket-id/pocket-id/backend/internal/common.Version={{ .Version }}
+    flags:
+      - -trimpath
+      - -p=2
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    skip: '{{ if index .Env "BUILD_NEXT" }}true{{ end }}'
+
+  - id: pocket-id-next
+    main: ./cmd
+    dir: backend
+    binary: pocket-id
+    env:
+      - CGO_ENABLED=0
+      - GOMAXPROCS=2
+    targets:
+      - linux_amd64_v1
+      - linux_arm64_v8.0
+    ldflags:
+      - -w -s
+      - -buildid={{ .Version }}
+      - -X github.com/pocket-id/pocket-id/backend/internal/common.Version={{ .Version }}
+    flags:
+      - -trimpath
+      - -p=2
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    skip: '{{ if not (index .Env "BUILD_NEXT") }}true{{ end }}'
+
+archives:
+  - id: default
+    formats:
+      - binary
+    name_template: "{{ .Binary }}_{{ .Os }}_{{ .Arch }}{{ with .Arm }}v{{ . }}{{ end }}"
+
+checksum:
+  name_template: checksums.txt
+
+docker_digest:
+  name_template: digests.txt
+
+dockers_v2:
+  - id: pocket-id
+    ids:
+      - pocket-id
+    dockerfile: docker/Dockerfile-prebuilt
+    images:
+      - "pocketid/pocket-id"
+      - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/pocket-id"
+    tags:
+      - "{{ .Tag }}"
+      - "v{{ .Major }}"
+      - "v{{ .Major }}.{{ .Minor }}"
+      - "latest"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      "org.opencontainers.image.authors": "Pocket ID"
+      "org.opencontainers.image.url": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.documentation": "https://github.com/pocket-id/pocket-id/blob/main/README.md"
+      "org.opencontainers.image.source": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.version": "{{ .Version }}"
+      "org.opencontainers.image.revision": "{{ .FullCommit }}"
+      "org.opencontainers.image.licenses": "BSD-2-Clause"
+      "org.opencontainers.image.ref.name": "pocket-id"
+      "org.opencontainers.image.title": "Pocket ID"
+    disable: '{{ if index .Env "BUILD_NEXT" }}true{{ end }}'
+    sbom: true
+    extra_files:
+      - scripts/docker
+
+  - id: pocket-id-distroless
+    ids:
+      - pocket-id
+    dockerfile: docker/Dockerfile-distroless
+    images:
+      - "pocketid/pocket-id"
+      - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/pocket-id"
+    tags:
+      - "{{ .Tag }}-distroless"
+      - "v{{ .Major }}-distroless"
+      - "v{{ .Major }}.{{ .Minor }}-distroless"
+      - "latest-distroless"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      "org.opencontainers.image.authors": "Pocket ID"
+      "org.opencontainers.image.url": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.documentation": "https://github.com/pocket-id/pocket-id/blob/main/README.md"
+      "org.opencontainers.image.source": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.version": "{{ .Version }}"
+      "org.opencontainers.image.revision": "{{ .FullCommit }}"
+      "org.opencontainers.image.licenses": "BSD-2-Clause"
+      "org.opencontainers.image.ref.name": "pocket-id"
+      "org.opencontainers.image.title": "Pocket ID"
+    disable: '{{ if index .Env "BUILD_NEXT" }}true{{ end }}'
+    sbom: true
+
+  - id: pocket-id-next
+    ids:
+      - pocket-id-next
+    dockerfile: docker/Dockerfile-prebuilt
+    images:
+      - "pocketid/pocket-id"
+      - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/pocket-id"
+    tags:
+      - "next"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      "org.opencontainers.image.authors": "Pocket ID"
+      "org.opencontainers.image.url": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.documentation": "https://github.com/pocket-id/pocket-id/blob/main/README.md"
+      "org.opencontainers.image.source": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.version": "{{ .Version }}"
+      "org.opencontainers.image.revision": "{{ .FullCommit }}"
+      "org.opencontainers.image.licenses": "BSD-2-Clause"
+      "org.opencontainers.image.ref.name": "pocket-id"
+      "org.opencontainers.image.title": "Pocket ID"
+    disable: '{{ if not (index .Env "BUILD_NEXT") }}true{{ end }}'
+    sbom: true
+    extra_files:
+      - scripts/docker
+
+  - id: pocket-id-next-distroless
+    ids:
+      - pocket-id-next
+    dockerfile: docker/Dockerfile-distroless
+    images:
+      - "pocketid/pocket-id"
+      - "ghcr.io/{{ .Env.GITHUB_REPOSITORY_OWNER }}/pocket-id"
+    tags:
+      - "next-distroless"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      "org.opencontainers.image.authors": "Pocket ID"
+      "org.opencontainers.image.url": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.documentation": "https://github.com/pocket-id/pocket-id/blob/main/README.md"
+      "org.opencontainers.image.source": "https://github.com/pocket-id/pocket-id"
+      "org.opencontainers.image.version": "{{ .Version }}"
+      "org.opencontainers.image.revision": "{{ .FullCommit }}"
+      "org.opencontainers.image.licenses": "BSD-2-Clause"
+      "org.opencontainers.image.ref.name": "pocket-id"
+      "org.opencontainers.image.title": "Pocket ID"
+    disable: '{{ if not (index .Env "BUILD_NEXT") }}true{{ end }}'
+    sbom: true
+
+notarize:
+  macos:
+    - enabled: '{{ if and (isEnvSet "MACOS_SIGN_P12") (not (index .Env "BUILD_NEXT")) }}true{{ end }}'
+      ids:
+        - pocket-id
+      sign:
+        certificate: "{{ .Env.MACOS_SIGN_P12 }}"
+        password: "{{ .Env.MACOS_SIGN_PASSWORD }}"
+      notarize:
+        issuer_id: "{{ .Env.MACOS_NOTARY_ISSUER_ID }}"
+        key_id: "{{ .Env.MACOS_NOTARY_KEY_ID }}"
+        key: "{{ .Env.MACOS_NOTARY_KEY }}"
+        wait: true
+        timeout: 20m
+
+changelog:
+  disable: true
+
+announce:
+  discord:
+    enabled: true
+    message_template: "Pocket ID version {{ .Tag }} has been released! Checkout the changelog at {{ .ReleaseURL }}"
+    author: "GitHub Actions"
+    # Color code of the embed. You have to use decimal numeral system, not hexadecimal.
+    # color: "9320959"
+    icon_url: "https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png"
+
+release:
+  github:
+    owner: pocket-id
+    name: pocket-id
+  disable: '{{ if index .Env "SKIP_RELEASE" }}true{{ end }}'
+  draft: true
+  replace_existing_draft: false
+  use_existing_draft: true
+  replace_existing_artifacts: true
+  prerelease: auto
+  make_latest: true
+  mode: keep-existing
+  name_template: "{{ .Tag }}"

.version

@@ -1 +1 @@
-2.6.1
+2.11.0

.vscode/settings.json

@@ -1,4 +1,4 @@
 {
-    "go.buildTags": "e2etest",
-    "prettier.documentSelectors": ["**/*.svelte"],
-}
+  "go.buildTags": "e2etest unit",
+  "prettier.documentSelectors": ["**/*.svelte"]
+}

AGENTS.md

@@ -0,0 +1,102 @@
+# AGENTS.md
+
+Pocket ID — a passkey-only OIDC provider. Go backend serves a SvelteKit SPA (embedded in
+the binary for production). This file lists what isn't obvious from reading the code.
+
+## Layout
+
+- `backend/` — Go module (gin, GORM, [ory/fosite fork](#backend-go)). Its own toolchain, not part of the repository.
+- `frontend/` — SvelteKit 5 SPA. Builds into `backend/frontend/dist` and is embedded via `go:embed`.
+- `tests/` — Playwright end-to-end tests (drives a Dockerized full stack).
+
+## Build / test / lint
+
+```sh
+# backend/   — the exclude_frontend and unit tags are mandatory locally; CI uses them too
+go test -tags=exclude_frontend,unit ./...                          # unit/integration tests
+go test -tags=exclude_frontend,unit -run TestName ./internal/...   # a single test
+golangci-lint run  # lint (config: backend/.golangci.yml - includes build tags)
+
+# frontend/  (or root)
+pnpm check        # svelte-check — the ONLY frontend type gate (no unit tests exist)
+pnpm lint         # prettier --check && eslint  (note: not enforced by CI)
+pnpm format       # prettier --write — REQUIRED before opening a PR
+```
+
+End-to-end (needs Docker; **stop any local backend on `:1411` first** — see gotchas):
+
+```sh
+cd tests/setup && docker compose up -d --build   # rebuild after ANY code change, or you test stale code
+cd ../.. && pnpm test                            # = playwright test in tests/
+```
+
+## Critical gotchas
+
+- **`exclude_frontend` and `unit` build tags.** Without them plain `go run`/`go test`/`golangci-lint` fail
+  to run. Always pass `-tags exclude_frontend,unit` for backend dev/test/lint.
+- **Never edit generated files:** `frontend/src/lib/paraglide/**` (Paraglide i18n output) and
+  `backend/frontend/dist/**`. For i18n, only edit `frontend/messages/en.json`; other locales come
+  from Crowdin.
+- **Migrations are split by DB.** Raw SQL via golang-migrate in
+  `backend/resources/migrations/{sqlite,postgres}/` — separate files _and_ separate version
+  timelines. Add a matching up/down pair to **both**. Not GORM AutoMigrate. SQLite migrations
+  are not auto-wrapped in a transaction (`NoTxWrap`); wrap multi-statement ones manually
+  (`PRAGMA foreign_keys=OFF; BEGIN; … COMMIT; PRAGMA foreign_keys=ON;`).
+
+## Backend (Go)
+
+- **Config:** global `common.EnvConfig` (caarlos0/env); any secret var supports a `*_FILE` variant.
+- **Logging:** stdlib `log/slog` only (bridged to OpenTelemetry). No zerolog/logrus in app code.
+- `go.mod` pins a **fork** of fosite (`replace github.com/ory/fosite => github.com/pocket-id/fosite`).
+
+## Frontend (SvelteKit)
+
+- **Svelte 5 runes only:** `$state`, `$derived`, `$props`, `$bindable`. No `export let`. Event
+  modifiers are gone — use `preventDefault` from `$lib/utils/event-util` (`onsubmit={preventDefault(fn)}`).
+- **Forms:** use the custom `createForm(schema, initial)` from `$lib/utils/form-util.ts` with
+  `form-input.svelte`. The vendored shadcn formsnap/superforms wrappers exist but app forms don't
+  use them — match the surrounding file. Import zod as `import { z } from 'zod/v4'`.
+
+## Coding Style Guidelines
+
+### Comments
+
+- Exactly one sentence per line
+- There is NO maximum line width: never wrap a single sentence across multiple comment lines, no matter how long that sentence is
+- A new line in a comment means a new sentence; a wrapped line does not exist
+- No trailing period on single-line comments
+- Prefer comments that explain intent, invariants, or why a branch exists
+- Avoid comments that simply restate the next line of code
+- For multi-step logic, use short section comments to separate the steps and explain why each step exists
+- Inside a function, put a one-sentence comment above each major action; the comments double as visual separators between sections and should say what the step does and why, not how
+- Favor a few well-placed section comments over a wall of code; a reader should be able to skim the comments and understand the method's flow
+
+```go
+// Wrong — one sentence wrapped across multiple lines
+// This function performs the main validation logic. It checks
+// the input against the schema and returns an error if the
+// input is invalid.
+
+// Wrong — trailing period on single-line comment
+// Validate the input.
+
+// Right — one sentence per line, each line as long as it needs to be
+// This function performs the main validation logic
+// It checks the input against the schema and returns an error if the input is invalid
+
+// Right
+// Validate the input
+
+// Right
+// Normalize the request host so callers can pass either Host or X-Forwarded-Host values
+
+// Right
+// Browsers do not accept a cookie Domain attribute set to an IP address
+// Returning an empty domain tells the caller to set a host-only cookie instead
+
+// Wrong — restates the code
+// Trim whitespace and lowercase the host
+host = strings.TrimSpace(strings.ToLower(host))
+```
+
+Section comments inside a function — one sentence per major action, describing what and why, acting as visual separators:

CHANGELOG.md

@@ -1,3 +1,229 @@
+## v2.11.0
+
+### Bug Fixes
+
+- postgres migration 20250822 remove public schema references ([#1582](https://github.com/pocket-id/pocket-id/pull/1582) by @MarcoScabbiolo)
+- allow insecure callback URLs by default until next major release ([d9ead47](https://github.com/pocket-id/pocket-id/commit/d9ead47d19451b256336b7d0eb46606a236928f3) by @stonith404)
+- sort signup tokens by creation date explicitly ([77398a5](https://github.com/pocket-id/pocket-id/commit/77398a558df45e1e332316afbb0f0c5e416350ea) by @stonith404)
+- login code mobile ux ([#1584](https://github.com/pocket-id/pocket-id/pull/1584) by @James18232)
+- `INTERNAL_APP_URL` not reflected in UI URLs ([316cf47](https://github.com/pocket-id/pocket-id/commit/316cf47cebdb7337cef13a533a8105ef4364b6f5) by @stonith404)
+- ignore tab URL hashes in navigation history ([a3f27ec](https://github.com/pocket-id/pocket-id/commit/a3f27ec2ec1ce784ca11e5fb41f92a0367715393) by @stonith404)
+- block link-local addresses in SSRF protection ([9714296](https://github.com/pocket-id/pocket-id/commit/9714296efb3768e4f29479f48628318565a3bed7) by @stonith404)
+
+### Documentation
+
+- update README ([ff5e565](https://github.com/pocket-id/pocket-id/commit/ff5e565eebbba0dba991cf06ad76249b7af26432) by @stonith404)
+
+### Features
+
+- add support for CIDR and IP address lists in `TRUST_PROXY` ([187cd8d](https://github.com/pocket-id/pocket-id/commit/187cd8ddcd4d6babec73bdf7e81eab2dee1ade04) by @stonith404)
+
+### Other
+
+- manage instance ID in the KV table ([#1579](https://github.com/pocket-id/pocket-id/pull/1579) by @ItalyPaleAle)
+- Bump the "all-dependencies" group with 3 updates across multiple ecosystems ([#1578](https://github.com/pocket-id/pocket-id/pull/1578) by @dependabot[bot])
+- remove low demand issue closer ([bb03660](https://github.com/pocket-id/pocket-id/commit/bb03660bd7d48dfd0b022936dabd2b2880c9b382) by @stonith404)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.10.0...v2.11.0
+
+## v2.10.0
+
+### Bug Fixes
+
+- login code null submission and login code length check ([#1512](https://github.com/pocket-id/pocket-id/pull/1512) by @James18232)
+- don't reject `offline_access`scope ([2ed7035](https://github.com/pocket-id/pocket-id/commit/2ed703540d901eaf58427d0cf54fb0a5e68bc6a0) by @stonith404)
+- CSP error with `response_mode=form_post` ([16b5c16](https://github.com/pocket-id/pocket-id/commit/16b5c16a664a2f1b20ad824d907294de9cb60c9e) by @stonith404)
+- various bugs in observability / OTel ([#1564](https://github.com/pocket-id/pocket-id/pull/1564) by @ItalyPaleAle)
+- restore behavior that unknown scopes get ignored ([34e9a6d](https://github.com/pocket-id/pocket-id/commit/34e9a6d1982a3d50bb3874aff3316c3154113725) by @stonith404)
+- re-check api permissions on access token refresh ([e8cb0c8](https://github.com/pocket-id/pocket-id/commit/e8cb0c831ca914522babce101cf8533acbf94136) by @stonith404)
+- merge requested scopes instead of replacing them ([5e2cc6f](https://github.com/pocket-id/pocket-id/commit/5e2cc6f40e5c7139b122d8a59ca121af1fdbdceb) by @stonith404)
+- device authorization resolve resource creating device_code ([2f55b7c](https://github.com/pocket-id/pocket-id/commit/2f55b7cbc3d601128061dbc70014e77f5b1ec211) by @stonith404)
+- add missing burst to rate limit ([f3b6ceb](https://github.com/pocket-id/pocket-id/commit/f3b6ceb8768616fb155455cceb7a539c13c3da9f) by @stonith404)
+- disable one time access token exchange for disabled users ([c85a4e6](https://github.com/pocket-id/pocket-id/commit/c85a4e63dabcb2c71bbf35e03482969cb07a6df8) by @stonith404)
+- /authorize endpoint crashes when list of scopes is empty ([#1575](https://github.com/pocket-id/pocket-id/pull/1575) by @ItalyPaleAle)
+- mobile layout improvements ([2910c51](https://github.com/pocket-id/pocket-id/commit/2910c517bb7545f932c34321907299064b08bb10) by @stonith404)
+
+### Documentation
+
+- add link to API docs ([968d072](https://github.com/pocket-id/pocket-id/commit/968d07229eeefa763fe981e5c7e4970d5640c783) by @stonith404)
+- fix wrong OpenAPI documentation ([da3677f](https://github.com/pocket-id/pocket-id/commit/da3677f33d50c96f06ee1d8f65d9f802f67af270) by @stonith404)
+
+### Features
+
+- upgrade shadcn components ([80509c8](https://github.com/pocket-id/pocket-id/commit/80509c83ee0ce92b416286217c11f116d5b9fe2a) by @stonith404)
+- improve error handling on authorize page ([8689ddd](https://github.com/pocket-id/pocket-id/commit/8689ddd72b143ceac29adb63d624cc18585f580e) by @stonith404)
+- add ability to skip consent for client ([d467855](https://github.com/pocket-id/pocket-id/commit/d4678558708542719c5d3cc48c48d3053f37800c) by @stonith404)
+- prompt admin with PKCE client support hint ([#1499](https://github.com/pocket-id/pocket-id/pull/1499) by @James18232)
+- login code input boxes ([#1545](https://github.com/pocket-id/pocket-id/pull/1545) by @James18232)
+- drop TOFU support for callback URL ([931a6c2](https://github.com/pocket-id/pocket-id/commit/931a6c2adb39fb8cdfe18487f4206f8848b3d026) by @stonith404)
+- add OAuth APIs with scoped permissions ([#1542](https://github.com/pocket-id/pocket-id/pull/1542) by @stonith404)
+- add support for unencrypted OIDC request parameter ([25dcad7](https://github.com/pocket-id/pocket-id/commit/25dcad757a7d7670bfd8d4d4ac209e26dc919596) by @stonith404)
+- add description field to oidc clients ([#1547](https://github.com/pocket-id/pocket-id/pull/1547) by @seanmckenzie428)
+- add tab bar navigation for crowded pages ([28a553f](https://github.com/pocket-id/pocket-id/commit/28a553f63b85ecccaa764279af5f65ea1bf2d013) by @stonith404)
+
+### Other
+
+- close low-demand feature requests ([35987b9](https://github.com/pocket-id/pocket-id/commit/35987b9c8d44efb08928d031ab9f1e84eda9882f) by @stonith404)
+- Bump the "all-dependencies" group with 2 updates across multiple ecosystems ([#1528](https://github.com/pocket-id/pocket-id/pull/1528) by @dependabot[bot])
+- fix locators after shadcn upgrade ([dbbe2a4](https://github.com/pocket-id/pocket-id/commit/dbbe2a403aa6afc39e14cf559bd074c6640e3b0c) by @stonith404)
+- use fosite for OAuth 2.0 logic ([#1520](https://github.com/pocket-id/pocket-id/pull/1520) by @stonith404)
+- wrap last two migrations into transaction ([cf9a319](https://github.com/pocket-id/pocket-id/commit/cf9a31986f521451bc9e1c2754a09ee2d141cd57) by @stonith404)
+- remove dead code ([519cda0](https://github.com/pocket-id/pocket-id/commit/519cda0eef1083274deed9bf6c501b815986241a) by @stonith404)
+- update vulnerable dependencies ([e538ea0](https://github.com/pocket-id/pocket-id/commit/e538ea0bf1ba4d5f70f977c7021bfa4f4543070e) by @stonith404)
+- fix flaky test ([7eaaea7](https://github.com/pocket-id/pocket-id/commit/7eaaea717b418c167b733723eeb000073c6915fe) by @stonith404)
+- add AGENTS.md ([d0243fe](https://github.com/pocket-id/pocket-id/commit/d0243fe396fb4ae2ec8d66ab95c80c8a283a631b) by @stonith404)
+- use goreleaser for binaries and static image builds ([#1478](https://github.com/pocket-id/pocket-id/pull/1478) by @kmendell)
+- add support for Docker Hub ([99ab38d](https://github.com/pocket-id/pocket-id/commit/99ab38dc799d07d4d91863199b1350fb7d06e03e) by @stonith404)
+- remove static next image tag ([49305ed](https://github.com/pocket-id/pocket-id/commit/49305ed1f98d838167703d3dc2f6e3e5786fb9fc) by @stonith404)
+- don't build unnecessary binaries for `next` image ([4b957a0](https://github.com/pocket-id/pocket-id/commit/4b957a0106899666b55420b61d2bb12d08d82022) by @stonith404)
+- change Depot project ([cdc2374](https://github.com/pocket-id/pocket-id/commit/cdc23744ae1cb731184828afe326fc2a1712c02f) by @stonith404)
+- don't tag `next` image with current version ([cf54786](https://github.com/pocket-id/pocket-id/commit/cf54786cc3bfe59bd01e8d5cbb4a3ccabb7d6466) by @stonith404)
+- add exempt user to PR quality checks ([254ae88](https://github.com/pocket-id/pocket-id/commit/254ae88cda67ecc1095b0b738630388c93d90c44) by @stonith404)
+- migrate API key functionality to single `apikey` module ([9fce987](https://github.com/pocket-id/pocket-id/commit/9fce98710679e522233c3b7af8d3b6cd2ce5594c) by @stonith404)
+- migrate Webauthn functionality to single `webauthn` module ([58fcf7c](https://github.com/pocket-id/pocket-id/commit/58fcf7cbe665be8d7670170097735fe8efe31c6f) by @stonith404)
+- migrate signup functionality to single `usersignup` module ([ecad31c](https://github.com/pocket-id/pocket-id/commit/ecad31cae2dbbc51d15a7007601829c57accff75) by @stonith404)
+- make API key renewal date picker navigation date-independent ([#1560](https://github.com/pocket-id/pocket-id/pull/1560) by @ItalyPaleAle)
+- integrate Francis actor framework for background jobs, cron scheduling, and rate limiting ([#1556](https://github.com/pocket-id/pocket-id/pull/1556) by @ItalyPaleAle)
+- Bump the "all-dependencies" group with 3 updates across multiple ecosystems ([#1563](https://github.com/pocket-id/pocket-id/pull/1563) by @dependabot[bot])
+- use go-kit for sending emails ([#1565](https://github.com/pocket-id/pocket-id/pull/1565) by @ItalyPaleAle)
+- update AAGUIDs ([#1567](https://github.com/pocket-id/pocket-id/pull/1567) by @github-actions[bot])
+- move Pocket ID specific logic from Fosite into Pocket ID repo ([9a94aa0](https://github.com/pocket-id/pocket-id/commit/9a94aa0694abda5bdd7c9380cbadc1f080a8027e) by @stonith404)
+- update Fosite version ([337fc6f](https://github.com/pocket-id/pocket-id/commit/337fc6fd1ec53aa65275f5ad964869462664a194) by @stonith404)
+- pass transaction to `resolveResource` ([7667377](https://github.com/pocket-id/pocket-id/commit/7667377c98c01f45dc5e959c999c60143efca1ef) by @stonith404)
+- remove redundant dtos ([fa2d08c](https://github.com/pocket-id/pocket-id/commit/fa2d08cb6d60bc3c9d8865c36c07ef8868e8ed9e) by @stonith404)
+- rename migrations ([c72da58](https://github.com/pocket-id/pocket-id/commit/c72da58eaf45eafff3232bcc050fd87e84ae050f) by @stonith404)
+- remove duplicate fosite config properties ([190914f](https://github.com/pocket-id/pocket-id/commit/190914fd72481c2da7372215f369a5b96feed3f0) by @stonith404)
+- fix migration version in `database.json` ([a5f2192](https://github.com/pocket-id/pocket-id/commit/a5f2192d67045cca63a4e0038e118986754d4184) by @stonith404)
+- fix wrong migration name ([ce7d3a7](https://github.com/pocket-id/pocket-id/commit/ce7d3a7e1d6ab08696a149fa8805fcb99337afa9) by @stonith404)
+- run formatter ([59a6868](https://github.com/pocket-id/pocket-id/commit/59a6868ecdb017354d4dfd8d70c4ba0710f02f08) by @stonith404)
+- upgrade go version ([f62d476](https://github.com/pocket-id/pocket-id/commit/f62d476c56d39f7f20c443eb430462e9141d31fa) by @stonith404)
+
+### Performance Improvements
+
+- include permissions in api list response ([8035a4c](https://github.com/pocket-id/pocket-id/commit/8035a4c8d589109e767a031dae3c473ea3e77d75) by @stonith404)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.9.0...v2.10.0
+
+## v2.9.0
+
+### Bug Fixes
+
+- issues with loading new font ([#1496](https://github.com/pocket-id/pocket-id/pull/1496) by @MelvinSnijders)
+- PAR parameters not respected by authorize page ([3d9d4de](https://github.com/pocket-id/pocket-id/commit/3d9d4de61940747c64f4a5a4ba24010be2a2fbb6) by @stonith404)
+- add responsive css for api/user/group/client page add buttons ([#1508](https://github.com/pocket-id/pocket-id/pull/1508) by @James18232)
+- load Gloock font from static path instead of inline ([89b4abb](https://github.com/pocket-id/pocket-id/commit/89b4abb8b5cc71b62f458f966f2778259b167838) by @stonith404)
+- update terminology from public key code exchange to proof key co… ([#1515](https://github.com/pocket-id/pocket-id/pull/1515) by @maxwassiljew)
+- callback URL validation not validated if prompt=none ([8a75774](https://github.com/pocket-id/pocket-id/commit/8a7577497131229badb35cb4b3a4227b1300afff) by @stonith404)
+- passkey card not rounded ([84678c3](https://github.com/pocket-id/pocket-id/commit/84678c3a7bfa1f601261943f03aa935626fe54a2) by @stonith404)
+
+### Documentation
+
+- add AI Usage Policy to CONTRIBUTING.md ([fea933b](https://github.com/pocket-id/pocket-id/commit/fea933b62d6a2899bf1e46fc75dab8b6bca81a0f) by @stonith404)
+- add PR template ([bf9f76b](https://github.com/pocket-id/pocket-id/commit/bf9f76bbd5b8d49dabda74f1c3de5120ea5db698) by @stonith404)
+- add "needs more upvotes" label as default ([fc42f62](https://github.com/pocket-id/pocket-id/commit/fc42f6211d410ea8db75018292df8f311078a7fe) by @stonith404)
+- fix link to watchtower repo ([#1500](https://github.com/pocket-id/pocket-id/pull/1500) by @wollew)
+
+### Features
+
+- add support for Pushed Authorization Requests (RFC9126) ([#1404](https://github.com/pocket-id/pocket-id/pull/1404) by @Zenithar)
+
+### Other
+
+- fix linter issues ([4f97cd4](https://github.com/pocket-id/pocket-id/commit/4f97cd4188b6028e955c8dc62e122ec409b32db3) by @stonith404)
+- update AAGUIDs ([#1511](https://github.com/pocket-id/pocket-id/pull/1511) by @github-actions[bot])
+- run svelte check and unit tests in breaking branches ([83b45f6](https://github.com/pocket-id/pocket-id/commit/83b45f682dc89b2019b1812157157f431dfd3ad7) by @stonith404)
+- run formatter ([2726ddd](https://github.com/pocket-id/pocket-id/commit/2726ddd0c23ab6ae22f307bf8d377fdfd73e1c14) by @stonith404)
+- bump vite from 8.0.13 to 8.0.16 ([#1521](https://github.com/pocket-id/pocket-id/pull/1521) by @dependabot[bot])
+- npm dependabot not run from root ([c0d96a0](https://github.com/pocket-id/pocket-id/commit/c0d96a0b1349d7dd0dec65c78dcdc2e043713ff8) by @stonith404)
+- fix wrong assertion ([effd2a1](https://github.com/pocket-id/pocket-id/commit/effd2a146f9b85d8bf1df203b4970aafc7ae24f8) by @stonith404)
+- Bump the "all-dependencies" group with 4 updates across multiple ecosystems ([#1523](https://github.com/pocket-id/pocket-id/pull/1523) by @dependabot[bot])
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.8.0...v2.9.0
+
+## v2.8.0
+
+### Bug Fixes
+
+- delete refresh tokens on end-session to prevent reuse after logout ([#1458](https://github.com/pocket-id/pocket-id/pull/1458) by @wucm667)
+- return 404 status code for `.well-known` routes if not found ([714b5b3](https://github.com/pocket-id/pocket-id/commit/714b5b3307bb012b94e66e8dcb1de93a2d62eceb) by @stonith404)
+- add `email_verified` to reserved claims list ([8b22fca](https://github.com/pocket-id/pocket-id/commit/8b22fcaaa475984bb4c42306487035073d7c47e3) by @stonith404)
+- reject unknown PKCE code challenge methods ([ce6bdb9](https://github.com/pocket-id/pocket-id/commit/ce6bdb9d7e6c0f1eaaa21ddb6d808e41088a38b8) by @stonith404)
+- make stream of downloaded logos seekable for S3 checksum calculation ([cc9163f](https://github.com/pocket-id/pocket-id/commit/cc9163f577280d7c278dc744e20d0505dbe83ede) by @stonith404)
+- scope confirmation wasn't shown if account selection was prompted ([272d147](https://github.com/pocket-id/pocket-id/commit/272d1479bd64b4a068bfe4dfa5ba4cd3c5e90505) by @stonith404)
+- add support for unix socket mode in healthcheck ([a712196](https://github.com/pocket-id/pocket-id/commit/a71219637af1746e9faba5274b6095da676ec555) by @stonith404)
+- restore cross-platform binary builds ([7027296](https://github.com/pocket-id/pocket-id/commit/7027296632ab82cd9930f2fbe60054c2421688c4) by @stonith404)
+
+### Documentation
+
+- update SECURITY.md ([bb5a111](https://github.com/pocket-id/pocket-id/commit/bb5a111e3d51ad56fc074df7083022e3d4e25369) by @stonith404)
+
+### Features
+
+- delete OAuth refresh token on RP initiated logout ([#1480](https://github.com/pocket-id/pocket-id/pull/1480) by @stonith404)
+- remove EXIF/XMP metadata from uploaded images ([#1477](https://github.com/pocket-id/pocket-id/pull/1477) by @stonith404)
+- add support for `response_mode=fragment` ([0c95b7c](https://github.com/pocket-id/pocket-id/commit/0c95b7c3cc171ed77b51f236009b5ff659da0bec) by @stonith404)
+- add support for systemd socket activation ([#1479](https://github.com/pocket-id/pocket-id/pull/1479) by @deviant)
+- improve design trough the whole application ([b3d40a4](https://github.com/pocket-id/pocket-id/commit/b3d40a476b35cfa2451749e9a3d307b7babaeb6b) by @stonith404)
+
+### Other
+
+- update AAGUIDs ([#1476](https://github.com/pocket-id/pocket-id/pull/1476) by @github-actions[bot])
+- upgrade dependencies ([91c2ea2](https://github.com/pocket-id/pocket-id/commit/91c2ea2a6616a500922365d1789f1fa1ba66c112) by @stonith404)
+- remove deprecated http2 package ([e56dc12](https://github.com/pocket-id/pocket-id/commit/e56dc124cee4d3c176c89e7d574ddfde089bcbd1) by @stonith404)
+- apply go 1.26.0 syntax updated ([8ad95b8](https://github.com/pocket-id/pocket-id/commit/8ad95b8af17ba8cbb62168ed0bb54c87e3df379c) by @stonith404)
+- delete refresh tokens on end-session to prevent reuse after logout ([b27a52a](https://github.com/pocket-id/pocket-id/commit/b27a52a5915228383dbdbf0a2c353452cd351d0f) by @stonith404)
+- use dependabot for automatic dependency upgrades ([b9fdd53](https://github.com/pocket-id/pocket-id/commit/b9fdd530c0f370f2fccb6251d700aa6f9bdf4124) by @stonith404)
+- fix invalid schema ([e8c398f](https://github.com/pocket-id/pocket-id/commit/e8c398ffbd6545f76c983f01556bb3b73d40a728) by @stonith404)
+- update AAGUIDs ([#1487](https://github.com/pocket-id/pocket-id/pull/1487) by @github-actions[bot])
+- use custom Playwright route for callback URL checks ([f134247](https://github.com/pocket-id/pocket-id/commit/f13424720b7f5da3978988f0f9169cf303971a13) by @stonith404)
+- fix linter issues ([bc4f75c](https://github.com/pocket-id/pocket-id/commit/bc4f75c44f12a71380042ad4c140d41f4dddc7dd) by @stonith404)
+- don't compare hashes of profile pictures ([9ad2bfc](https://github.com/pocket-id/pocket-id/commit/9ad2bfc7b30e0eb2d7ae1406874b8caba5a1f121) by @stonith404)
+- run formatter ([0616aba](https://github.com/pocket-id/pocket-id/commit/0616abaf7f079d0a35543258e13aa5b4acb4adc0) by @stonith404)
+- use fixed minor version of Go ([e046a03](https://github.com/pocket-id/pocket-id/commit/e046a03364f00001f8699aaa7e902b33c2661118) by @stonith404)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.7.0...v2.8.0
+
+## v2.7.0
+
+### Bug Fixes
+
+- add `_FILE` support for `S3_SECRET_ACCESS_KEY_FILE` env var ([#1452](https://github.com/pocket-id/pocket-id/pull/1452) by @ItalyPaleAle)
+- invalidate cache when changing image ([#1462](https://github.com/pocket-id/pocket-id/pull/1462) by @GameTec-live)
+- fall back to Basic auth when PKCE puts client_id in body ([#1466](https://github.com/pocket-id/pocket-id/pull/1466) by @mgabor3141)
+
+### Documentation
+
+- add missing /api prefix to app config swagger routes ([#1454](https://github.com/pocket-id/pocket-id/pull/1454) by @aclerici38)
+
+### Features
+
+- add support for response_mode=form_post ([#1360](https://github.com/pocket-id/pocket-id/pull/1360) by @Johnwulp)
+- add support for "select_account" prompt ([#1453](https://github.com/pocket-id/pocket-id/pull/1453) by @ItalyPaleAle)
+
+### Other
+
+- add script to update deps ([f9f93f0](https://github.com/pocket-id/pocket-id/commit/f9f93f0ef164426d4d4cfb58fcf59ce30b686130) by @stonith404)
+- upgrade dependencies ([20df033](https://github.com/pocket-id/pocket-id/commit/20df033c1fc3d737927447206b4f5e65d3ab4a40) by @stonith404)
+- post dependency upgrade fixes ([e33a9b8](https://github.com/pocket-id/pocket-id/commit/e33a9b8c888988f7b2e6c500e72d53b57db01f34) by @stonith404)
+- migrate github actions runners to depot  runners ([#1329](https://github.com/pocket-id/pocket-id/pull/1329) by @kmendell)
+- fix caching of ldap-cli e2e tests docker build ([#1457](https://github.com/pocket-id/pocket-id/pull/1457) by @kmendell)
+- fix incorrect container name variable ([5c7e5f6](https://github.com/pocket-id/pocket-id/commit/5c7e5f680bb70d3056b11f1a33669cc4bd9a1e17) by @kmendell)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.6.2...v2.7.0
+
+## v2.6.2
+
+### Bug Fixes
+
+- return correct byte count in HEAD request writer ([#1443](https://github.com/pocket-id/pocket-id/pull/1443) by @ahampal)
+- improve keyboard navigation and screen-reader labels ([#1445](https://github.com/pocket-id/pocket-id/pull/1445) by @bjoernch)
+
+### Other
+
+- upgrade to vite 8.0 and pnpm 10.33.0 ([#1446](https://github.com/pocket-id/pocket-id/pull/1446) by @kmendell)
+
+**Full Changelog**: https://github.com/pocket-id/pocket-id/compare/v2.6.1...v2.6.2
+
 ## v2.6.1
 
 ### Bug Fixes

CONTRIBUTING.md

@@ -1,12 +1,35 @@
 # Contributing
 
-I am happy that you want to contribute to Pocket ID and help to make it better! All contributions are welcome, including issues, suggestions, pull requests and more.
+We are happy that you want to contribute to Pocket ID and help to make it better!
+
+## Before you start
+
+Before starting to work on a new feature, please open an issue first, or comment on an existing one, to discuss the implementation details. This saves you time and avoids the disappointment of having a PR closed later because the change doesn't fit the project's direction.
+
+### AI Usage Policy
+
+We have nothing against using AI tools to assist your development. But we've seen a growing number of pull requests that appear to be fully or largely AI-generated and submitted without genuine human review. These are difficult and time-consuming for maintainers to review, and they often waste everyone's time.
+
+To keep contributions reviewable and high-quality, please follow these guidelines when using AI tools.
+
+#### Guidelines for Using AI Tools
+
+1. **Understand every line.** You must be able to explain what your code does and why, in your own words. "The AI wrote it" is not an acceptable answer to a reviewer's question.
+2. **Test before submitting.** Review and test all code manually, as a human, before opening a PR. Don't trust the AI's claim that it works.
+3. **Write your own words.** Don't paste AI-generated text into issues, comments, or PR descriptions. Walls of generated text make discussions harder, not easier.
+4. **Disclose your usage.** Note in the PR description how you used AI (see below).
+
+PRs that appear to be low effort AI output may be closed without a detailed review.
+
+#### Example disclosure
+
+> Used GitHub Copilot for autocomplete, and asked an LLM to help draft the test cases in `parser_test.go`. I reviewed, edited, and tested everything myself and understand how it works.
+
+> Used an LLM to generate the initial implementation of the new API endpoint, but I manually reviewed and tested it before submitting.
 
 ## Getting started
 
-You've found a bug, have suggestion or something else, just create an issue on GitHub and we can get in touch.
-
-## Submit a Pull Request
+### Submit a Pull Request
 
 Before you submit the pull request for review please ensure that
 
@@ -29,15 +52,15 @@ Before you submit the pull request for review please ensure that
 - Your pull request has a detailed description
 - You run `pnpm format` to format the code
 
-## Development Environment
+### Development Environment
 
 Pocket ID consists of a frontend and backend. In production the frontend gets statically served by the backend, but in development they run as separate processes to enable hot reloading.
 
 There are two ways to get the development environment setup:
 
-### 1. Install required tools
+#### 1. Install required tools
 
-#### With Dev Containers
+##### With Dev Containers
 
 If you use [Dev Containers](https://code.visualstudio.com/docs/remote/containers) in VS Code, you don't need to install anything manually, just follow the steps below.
 
@@ -46,7 +69,7 @@ If you use [Dev Containers](https://code.visualstudio.com/docs/remote/containers
 3. VS Code will detect .devcontainer and will prompt you to open the folder in devcontainer
 4. If the auto prompt does not work, hit `F1` and select `Dev Containers: Open Folder in Container.`, then select the pocket-id repo root folder and it'll open in container.
 
-#### Without Dev Containers
+##### Without Dev Containers
 
 If you don't use Dev Containers, you need to install the following tools manually:
 
@@ -54,9 +77,9 @@ If you don't use Dev Containers, you need to install the following tools manuall
 - [Go](https://golang.org/doc/install) >= 1.26
 - [Git](https://git-scm.com/downloads)
 
-### 2. Setup
+#### 2. Setup
 
-#### Backend
+##### Backend
 
 The backend is built with [Gin](https://gin-gonic.com) and written in Go. To set it up, follow these steps:
 
@@ -64,7 +87,7 @@ The backend is built with [Gin](https://gin-gonic.com) and written in Go. To set
 2. Copy the `.env.development-example` file to `.env` and edit the variables as needed
 3. Start the backend with `go run -tags exclude_frontend ./cmd`
 
-### Frontend
+##### Frontend
 
 The frontend is built with [SvelteKit](https://kit.svelte.dev) and written in TypeScript. To set it up, follow these steps:
 
@@ -77,9 +100,13 @@ You're all set! The application is now listening on `localhost:3000`. The backen
 
 ### Testing
 
+If you are contributing to a new feature please ensure that you add tests for it.
+
+#### End-to-end tests
+
 We are using [Playwright](https://playwright.dev) for end-to-end testing.
 
-If you are contributing to a new feature please ensure that you add tests for it. The tests are located in the `tests` folder at the root of the project.
+The tests are located in the `tests` folder at the root of the project.
 
 The tests can be run like this:
 
@@ -93,3 +120,9 @@ The tests can be run like this:
 5. Run the tests with `pnpm dlx playwright test` or from the root project folder `pnpm test`
 
 If you make any changes to the application, you have to rebuild the test environment by running `docker compose up -d --build` again.
+
+#### Unit tests
+
+In the backend we are using unit tests with the built-in Go testing framework. The tests are located in the same folder as the code they are testing and have the `_test.go` suffix.
+
+To run the tests, simply run `go test -tags=exclude_frontend,unit ./...` from the root of the `backend` folder.

README.md

@@ -1,15 +1,19 @@
 # <div align="center"><img  src="https://github.com/user-attachments/assets/4ceb2708-9f29-4694-b797-be833efce17d" width="100"/> </br>Pocket ID</div>
 
-Pocket ID is a simple OIDC provider that allows users to authenticate with their passkeys to your services.
+Pocket ID is an easy-to-use OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.
 
 → Try out the [Demo](https://demo.pocket-id.org)
 
 <img src="https://github.com/user-attachments/assets/1e99ba44-76da-4b47-9b8a-dbe9b7f84512" width="1200"/>
 
-The goal of Pocket ID is to be a simple and easy-to-use. There are other self-hosted OIDC providers like [Keycloak](https://www.keycloak.org/) or [ORY Hydra](https://www.ory.sh/hydra/) but they are often too complex for simple use cases.
+The goal of Pocket ID is to be a simple and easy-to-use. There are other self-hosted OIDC and OAuth 2.0 providers like [Keycloak](https://www.keycloak.org/) or [ORY Hydra](https://www.ory.sh/hydra/) but they are often too complex for simple use cases.
 
 Additionally, what makes Pocket ID special is that it only supports [passkey](https://www.passkeys.io/) authentication, which means you don’t need a password. Some people might not like this idea at first, but I believe passkeys are the future, and once you try them, you’ll love them. For example, you can now use a physical Yubikey to sign in to all your self-hosted services easily and securely.
 
+<a href="https://openid.net/certification/certified-openid-providers-profiles">
+    <img src="https://github.com/user-attachments/assets/697a8b8f-61bc-412f-8222-5410da7292c7" height="80" alt="OpenID Connect Certified">
+</a>
+
 ## Setup
 
 Pocket ID can be set up in multiple ways. The easiest and recommended way is to use Docker.

SECURITY.md

@@ -2,8 +2,11 @@
 
 ## Supported Versions
 
-As Pocket ID is in its early stages, older versions don't get security updates. Please consider to update Pocket ID regularly. Updates can be automated with e.g [Watchtower](https://github.com/containrrr/watchtower).
+It's recommended to always use the latest version of Pocket ID. We will provide security updates for the latest version.
+
+> [!NOTE]  
+> Updates can be automated with e.g [Watchtower](https://github.com/nicholas-fedor/watchtower/). Upgrading between non major versions is safe but you shouldn't upgrade between major versions before checking the release notes.
 
 ## Reporting a Vulnerability
 
-Thank you for taking the time to report a vulnerability. Please DO NOT create an issue on GitHub because the vulnerability could get exploited. Instead please write an email to [elias@eliasschneider.com](mailto:elias@eliasschneider.com).
+Thank you for taking the time to report a vulnerability. Please DO NOT create an issue on GitHub because the vulnerability could get exploited. Instead please create a Security Advisory [here](https://github.com/pocket-id/pocket-id/security/advisories/new). You can learn more about how to report a vulnerability in the [GitHub Security Advisories documentation](https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory).

backend/.env.development-example

@@ -6,4 +6,7 @@ APP_ENV=development
 # In the development environment the backend gets proxied by the frontend
 APP_URL=http://localhost:3000
 PORT=1411
-MAXMIND_LICENSE_KEY=your_license_key
+MAXMIND_LICENSE_KEY=your_license_key
+
+# Set the ENCRYPTION_KEY to a random sequence of characters, for example generated with `openssl rand -base64 32`
+ENCRYPTION_KEY=

backend/.golangci.yml

@@ -2,6 +2,9 @@ version: "2"
 run:
   tests: true
   timeout: 5m
+  build-tags:
+    - unit
+    - exclude_frontend
 linters:
   default: none
   enable:

backend/Makefile

@@ -0,0 +1,11 @@
+.PHONY: test
+test:
+	go test -tags exclude_frontend,unit ./...
+
+.PHONY: test-race
+test-race:
+	CGO_ENABLED=1 go test -race -tags exclude_frontend,unit ./...
+
+.PHONY: lint
+lint:
+	golangci-lint run -c .golangci.yml

backend/frontend/frontend_excluded.go

@@ -2,8 +2,10 @@
 
 package frontend
 
-import "github.com/gin-gonic/gin"
+import (
+	"github.com/gin-gonic/gin"
+)
 
-func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) error {
+func RegisterFrontend(router *gin.Engine) error {
 	return ErrFrontendNotIncluded
 }

backend/frontend/frontend_included.go

@@ -10,7 +10,6 @@ import (
 	"io/fs"
 	"mime"
 	"net/http"
-	"os"
 	"path"
 	"strings"
 	"time"
@@ -54,7 +53,7 @@ func init() {
 	}
 }
 
-func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) error {
+func RegisterFrontend(router *gin.Engine) error {
 	distFS, err := fs.Sub(frontendFS, "dist")
 	if err != nil {
 		return fmt.Errorf("failed to create sub FS: %w", err)
@@ -78,19 +77,12 @@ func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) e
 			return
 		}
 
-		if strings.HasPrefix(path, "api/") {
+		if strings.HasPrefix(path, "api/") || strings.HasPrefix(path, ".well-known/") {
 			c.JSON(http.StatusNotFound, gin.H{"error": "API endpoint not found"})
 			return
 		}
 
-		// If path is / or does not exist, serve index.html
-		if path == "" {
-			path = "index.html"
-		} else if _, err := fs.Stat(distFS, path); os.IsNotExist(err) {
-			path = "index.html"
-		}
-
-		if path == "index.html" {
+		if isSPARequest(path, distFS) {
 			nonce := middleware.GetCSPNonce(c)
 
 			// Do not cache the HTML shell, as it embeds a per-request nonce
@@ -108,11 +100,23 @@ func RegisterFrontend(router *gin.Engine, rateLimitMiddleware gin.HandlerFunc) e
 		fileServer.ServeHTTP(c.Writer, c.Request)
 	}
 
-	router.NoRoute(rateLimitMiddleware, handler)
+	router.NoRoute(handler)
 
 	return nil
 }
 
+func isSPARequest(path string, distFS fs.FS) bool {
+	if path == "" {
+		return true
+	}
+
+	if _, err := fs.Stat(distFS, path); err != nil {
+		return true
+	}
+
+	return false
+}
+
 // FileServerWithCaching wraps http.FileServer to add caching headers
 type FileServerWithCaching struct {
 	root                    http.FileSystem

backend/frontend/frontend_included_test.go

@@ -0,0 +1,28 @@
+//go:build !exclude_frontend
+
+package frontend
+
+import (
+	"testing"
+	"testing/fstest"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsSPARequest(t *testing.T) {
+	distFS := fstest.MapFS{
+		"assets/app.js": &fstest.MapFile{Data: []byte("console.log('test')")},
+	}
+
+	t.Run("root path is spa request", func(t *testing.T) {
+		assert.True(t, isSPARequest("", distFS))
+	})
+
+	t.Run("existing bundled asset is not spa request", func(t *testing.T) {
+		assert.False(t, isSPARequest("assets/app.js", distFS))
+	})
+
+	t.Run("unknown path is spa request", func(t *testing.T) {
+		assert.True(t, isSPARequest("authorize", distFS))
+	})
+}

backend/go.mod

@@ -1,118 +1,152 @@
 module github.com/pocket-id/pocket-id/backend
 
-go 1.26.0
+go 1.26.5
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.5
-	github.com/aws/aws-sdk-go-v2/config v1.32.14
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.14
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
-	github.com/aws/smithy-go v1.24.3
-	github.com/caarlos0/env/v11 v11.4.0
+	github.com/aws/aws-sdk-go-v2 v1.42.1
+	github.com/aws/aws-sdk-go-v2/config v1.32.27
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.26
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.104.2
+	github.com/aws/smithy-go v1.27.3
+	github.com/caarlos0/env/v11 v11.4.1
 	github.com/cenkalti/backoff/v5 v5.0.3
+	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/disintegration/imageorient v0.0.0-20180920195336-8147d86e83ec
 	github.com/disintegration/imaging v1.6.2
 	github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1
-	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
-	github.com/emersion/go-smtp v0.24.0
-	github.com/fsnotify/fsnotify v1.8.0
+	github.com/fsnotify/fsnotify v1.10.1
 	github.com/gin-contrib/slog v1.2.1
 	github.com/gin-gonic/gin v1.12.0
-	github.com/glebarez/go-sqlite v1.22.0
-	github.com/glebarez/sqlite v1.11.0
-	github.com/go-co-op/gocron/v2 v2.20.0
+	github.com/go-co-op/gocron/v2 v2.21.2
+	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/go-ldap/ldap/v3 v3.4.13
-	github.com/go-playground/validator/v10 v10.30.2
-	github.com/go-webauthn/webauthn v0.16.4
+	github.com/go-playground/validator/v10 v10.30.3
+	github.com/go-webauthn/webauthn v0.17.4
 	github.com/golang-migrate/migrate/v4 v4.19.1
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/go-uuid v1.0.3
+	github.com/italypaleale/francis v0.1.0-beta.10
+	github.com/italypaleale/go-kit v0.0.0-20260708054611-e276b65dd3be
+	github.com/italypaleale/go-sql-utils v0.2.4
+	github.com/jackc/pgx/v5 v5.10.0
 	github.com/jinzhu/copier v0.4.0
 	github.com/joho/godotenv v1.5.1
-	github.com/lestrrat-go/httprc/v3 v3.0.5
-	github.com/lestrrat-go/jwx/v3 v3.0.13
+	github.com/lestrrat-go/httprc/v3 v3.0.6
+	github.com/lestrrat-go/jwx/v3 v3.1.1
+	github.com/libtnb/sqlite v1.1.2
 	github.com/lmittmann/tint v1.1.3
-	github.com/mattn/go-isatty v0.0.21
+	github.com/mattn/go-isatty v0.0.22
 	github.com/mileusna/useragent v1.3.5
 	github.com/orandin/slog-gorm v1.4.0
-	github.com/oschwald/maxminddb-golang/v2 v2.1.1
+	github.com/ory/fosite v0.49.1-0.20250703093431-a5f0b09bf31c
+	github.com/oschwald/maxminddb-golang/v2 v2.4.1
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
-	go.opentelemetry.io/contrib/bridges/otelslog v0.18.0
-	go.opentelemetry.io/contrib/exporters/autoexport v0.68.0
-	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.68.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
-	go.opentelemetry.io/otel v1.43.0
-	go.opentelemetry.io/otel/log v0.19.0
-	go.opentelemetry.io/otel/metric v1.43.0
-	go.opentelemetry.io/otel/sdk v1.43.0
-	go.opentelemetry.io/otel/sdk/log v0.19.0
-	go.opentelemetry.io/otel/sdk/metric v1.43.0
-	go.opentelemetry.io/otel/trace v1.43.0
-	golang.org/x/crypto v0.50.0
-	golang.org/x/image v0.39.0
-	golang.org/x/net v0.53.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/text v0.36.0
-	golang.org/x/time v0.15.0
+	github.com/zitadel/exifremove v0.1.0
+	go.opentelemetry.io/contrib/bridges/otelslog v0.19.0
+	go.opentelemetry.io/contrib/exporters/autoexport v0.69.0
+	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.69.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0
+	go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel/log v0.20.0
+	go.opentelemetry.io/otel/sdk v1.44.0
+	go.opentelemetry.io/otel/sdk/log v0.20.0
+	go.opentelemetry.io/otel/sdk/metric v1.44.0
+	go.opentelemetry.io/otel/trace v1.44.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/image v0.43.0
+	golang.org/x/sync v0.22.0
+	golang.org/x/text v0.39.0
 	gorm.io/driver/postgres v1.6.0
-	gorm.io/gorm v1.31.1
+	gorm.io/gorm v1.31.2
+	gorm.io/plugin/opentelemetry v0.1.16
+	modernc.org/sqlite v1.53.0
 )
 
 require (
-	github.com/Azure/go-ntlmssp v0.1.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect
+	filippo.io/edwards25519 v1.2.0 // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/ClickHouse/ch-go v0.61.5 // indirect
+	github.com/ClickHouse/clickhouse-go/v2 v2.30.0 // indirect
+	github.com/alphadose/haxmap v1.4.1 // indirect
+	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.4.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
 	github.com/bytedance/gopkg v0.1.4 // indirect
-	github.com/bytedance/sonic v1.15.0 // indirect
+	github.com/bytedance/sonic v1.15.1 // indirect
 	github.com/bytedance/sonic/loader v0.5.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/cloudwego/base64x v0.1.7 // indirect
+	github.com/cristalhq/jwt/v5 v5.4.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
+	github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
 	github.com/disintegration/gift v1.2.1 // indirect
+	github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d // indirect
+	github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d // indirect
+	github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413 // indirect
+	github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102 // indirect
+	github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd // indirect
+	github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d // indirect
+	github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d // indirect
+	github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349 // indirect
+	github.com/dunglas/httpsfv v1.1.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/gin-contrib/sse v1.1.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-faster/city v1.0.1 // indirect
+	github.com/go-faster/errors v0.7.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-sql-driver/mysql v1.9.3 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/go-webauthn/x v0.2.3 // indirect
+	github.com/go-webauthn/x v0.2.6 // indirect
+	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7 // indirect
 	github.com/google/go-github/v39 v39.2.0 // indirect
 	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/google/go-tpm v0.9.8 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/h2non/filetype v1.1.3 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.9.1 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jaegertracing/jaeger-idl v0.9.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
@@ -122,57 +156,95 @@ require (
 	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/lib/pq v1.12.3 // indirect
 	github.com/mattn/go-sqlite3 v1.14.42 // indirect
+	github.com/mattn/goveralls v0.0.12 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/nlnwa/whatwg-url v0.6.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
+	github.com/openzipkin/zipkin-go v0.4.3 // indirect
+	github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe // indirect
+	github.com/ory/go-convenience v0.1.0 // indirect
+	github.com/ory/pop/v6 v6.4.1 // indirect
+	github.com/ory/x v0.0.729 // indirect
+	github.com/paulmach/orb v0.11.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/common v0.69.0 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/quic-go/quic-go v0.60.0 // indirect
+	github.com/quic-go/webtransport-go v0.11.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
+	github.com/sagikazarmark/locafero v0.12.0 // indirect
+	github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/tinylib/msgp v1.6.3 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/tinylib/msgp v1.6.4 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
 	github.com/valyala/fastjson v1.6.10 // indirect
+	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.6.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.65.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.69.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.44.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 // indirect
+	go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.1 // indirect
+	go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.66.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/zipkin v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	golang.org/x/arch v0.26.0 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	go.uber.org/mock v0.6.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/arch v0.27.0 // indirect
+	golang.org/x/exp v0.0.0-20260611194520-c48552f49976 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
-	google.golang.org/grpc v1.80.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/grpc v1.82.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.71.0 // indirect
+	gorm.io/driver/clickhouse v0.7.0 // indirect
+	gorm.io/driver/mysql v1.5.7 // indirect
+	k8s.io/utils v0.0.0-20260617174310-a95e086a2553 // indirect
+	modernc.org/libc v1.73.5 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.48.2 // indirect
 )
+
+replace github.com/ory/fosite => github.com/pocket-id/fosite v0.0.0-20260708083902-56a3c0f378d6

backend/go.sum

@@ -1,49 +1,59 @@
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
-github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
+filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/ClickHouse/ch-go v0.61.5 h1:zwR8QbYI0tsMiEcze/uIMK+Tz1D3XZXLdNrlaOpeEI4=
+github.com/ClickHouse/ch-go v0.61.5/go.mod h1:s1LJW/F/LcFs5HJnuogFMta50kKDO0lf9zzfrbl0RQg=
+github.com/ClickHouse/clickhouse-go/v2 v2.30.0 h1:AG4D/hW39qa58+JHQIFOSnxyL46H6h2lrmGGk17dhFo=
+github.com/ClickHouse/clickhouse-go/v2 v2.30.0/go.mod h1:i9ZQAojcayW3RsdCb3YR+n+wC2h65eJsZCscZ1Z1wyo=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14 h1:opVIRo/ZbbI8OIqSOKmpFaY7IwfFUOCCXBsUpJOwDdI=
-github.com/aws/aws-sdk-go-v2/config v1.32.14/go.mod h1:U4/V0uKxh0Tl5sxmCBZ3AecYny4UNlVmObYjKuuaiOo=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14 h1:n+UcGWAIZHkXzYt87uMFBv/l8THYELoX6gVcUvgl6fI=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.14/go.mod h1:cJKuyWB59Mqi0jM3nFYQRmnHVQIcgoxjEMAbLkpr62w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 h1:NUS3K4BTDArQqNu2ih7yeDLaS3bmHD0YndtA6UP884g=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21/go.mod h1:YWNWJQNjKigKY1RHVJCuupeWDrrHjRqHm0N9rdrWzYI=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP1VyQpy15qWh1Pk=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 h1:QKZH0S178gCmFEgst8hN0mCX1KxLgHBKKY/CLqwP8lg=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.9/go.mod h1:7yuQJoT+OoH8aqIxw9vwF+8KpvLZ8AWmvmUWHsGQZvI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 h1:lFd1+ZSEYJZYvv9d6kXzhkZu07si3f+GQ1AaYwa2LUM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.15/go.mod h1:WSvS1NLr7JaPunCXqpJnWk1Bjo7IxzZXrZi1QQCkuqM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 h1:dzztQ1YmfPrxdrOiuZRMF6fuOwWlWpD2StNLTceKpys=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19/go.mod h1:YO8TrYtFdl5w/4vmjL8zaBSsiNp3w0L1FfKVKenZT7w=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 h1:p8ogvvLugcR/zLBXTXrTkj0RYBUdErbMnAFFp12Lm/U=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.10/go.mod h1:60dv0eZJfeVXfbT1tFJinbHrDfSJ2GZl4Q//OSSNAVw=
-github.com/aws/smithy-go v1.24.3 h1:XgOAaUgx+HhVBoP4v8n6HCQoTRDhoMghKqw4LNHsDNg=
-github.com/aws/smithy-go v1.24.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/alphadose/haxmap v1.4.1 h1:VtD6VCxUkjNIfJk/aWdYFfOzrRddDFjmvmRmILg7x8Q=
+github.com/alphadose/haxmap v1.4.1/go.mod h1:rjHw1IAqbxm0S3U5tD16GoKsiAd8FWx5BJ2IYqXwgmM=
+github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
+github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/aws/aws-sdk-go-v2 v1.42.1 h1:9eOTgu1z/dVtYpNZ3/8/XbbaX0x/BqE3HUzAzs6K0ek=
+github.com/aws/aws-sdk-go-v2 v1.42.1/go.mod h1:5pKeft2eJj+gElQ38Jqg4ibCqh+/AK33/0X3hip7IjM=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 h1:3IZY0XAJquT3aHzbkHfPzy4ACPcEjVG0x87KOwtpqGY=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14/go.mod h1:zwM6veDkhGgQFqkBy+uT28AAYpLu+uFMlPl+rCg/73E=
+github.com/aws/aws-sdk-go-v2/config v1.32.27 h1:SJwJ9Q4kM7v5QVSYYyXj3znRr6lNyZEhSgAXmXXcVbI=
+github.com/aws/aws-sdk-go-v2/config v1.32.27/go.mod h1:uBfrzTRedDmB2u+b6+UlaKJy2O6VSH5un2jP24t/KvQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.26 h1:Si8kk1kyJnuJWCEgiwpBtTdtgSdR7i611596NnC0YIQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.26/go.mod h1:lBckz+W9SAdNtSDw3pYgQUJDJFcBBWry0GSzw+bK0TY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30 h1:/hi1JADLEW9YYryEz1w4GQu0EtP23pP553Cf9KgsDV4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.30/go.mod h1:/3AOgy4K17Dm4ucMZVC/MJkzy5kmfKUcINRHZyo0koQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30 h1:xM/Is9cKMHa8Jj8zkvWhvrFkZsXJV9E+BB4g0HW0duQ=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.30/go.mod h1:WueJeNDZvK1fMYEWJIkcivBfEzUkTpBhzlrUKKY8EuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30 h1:jn46zC9LdsVR/ZpMIJqMqb8hHv31BlLx3ulVqNspUOk=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.30/go.mod h1:1hTMsAgbdS/AtUi4bw8+gUuh1pceo+eXRLfpSuSQj3M=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31 h1:3GUprIsfmGcC5SACIyB0e7E0BM1O1b3Erl5CePYIAeQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.31/go.mod h1:7PuV1yl5e2xnUbm+RqvVg5i2iBM8EyijZNoI9wsOoOc=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 h1:mbRIur/BiHK6SKPjoBIXSE/hJ6g6JGRLuxQy1jGjlN4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13/go.mod h1:ITg9em2KbJx1s0y4aqRX5OYWG6HBZ5TVR//OdpEZ2CQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 h1:9Fjh6fi/U5JEStVZijmaMpUwE/gvBJj7x2B/PjbO9To=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23/go.mod h1:iMoT2f1tClxrWAAnKCXjZQ6LOmfLrMG14wmnWpM+F14=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30 h1:/Z5jmNrKsSD7EmDjzAPsm/3L9IuOkzaynklJZ1qX7S4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.30/go.mod h1:lEzEZnOosE7zi8Z6royW1cFJTD9fpab4Ul1SBrllewk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 h1:uao4A3QZ5UmB326V6KF+qRpv9Tjz7IlnlnTbbANntlU=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31/go.mod h1:I/1+z0VwL1GhQyLgkoHDlygpUZ+iTAwOQ/NsftiUL2I=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.104.2 h1:bAY6O/TDv1HQnvylh9E247IyIKsUWUt2G965S7qX110=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.104.2/go.mod h1:zdmCoFO/dSI7GlrwsPqFJI+WlFnSU4Tc8TJnlXrM1Do=
+github.com/aws/aws-sdk-go-v2/service/signin v1.4.0 h1:sLzmJGCMv+C8KqiJgEqDLB6vxaJGmobRh4rr//ZpA3w=
+github.com/aws/aws-sdk-go-v2/service/signin v1.4.0/go.mod h1:mxC0nT/C8wMMS97DemZPzvUZxvIt+2Iq+eS3JdFZGgg=
+github.com/aws/aws-sdk-go-v2/service/sso v1.32.0 h1:qjMmry/cBDee1E/2gyvel0uRYCi3mwRZ2hf6N+GAodo=
+github.com/aws/aws-sdk-go-v2/service/sso v1.32.0/go.mod h1:u8af9Nqkmqnr96f7v9nHqzZT9XBwbXEkTiqT4ROuJSE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0 h1:fpOlDPI55HdszaxapEGk6HsGosOUaM2YPWJpjMgp8UI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.37.0/go.mod h1:DMPWJBjYs6+3+f/qhBFEFPPlQ6NlhWjai3dJNvipJ84=
+github.com/aws/aws-sdk-go-v2/service/sts v1.44.0 h1:bLZ0PolJ8J+HkJHztcXORUpHXBye2U8298lCEMi6ZCU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.44.0/go.mod h1:9gdl4RrflIdpDb2TlXshWgR1F9TeCkvqDx77Vpr4Z/Q=
+github.com/aws/smithy-go v1.27.3 h1:F3Zb497UhhskkfpJmfkXswyo+t0sh9OTBnIHjogWbVY=
+github.com/aws/smithy-go v1.27.3/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bits-and-blooms/bitset v1.20.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
@@ -51,29 +61,37 @@ github.com/bits-and-blooms/bitset v1.24.4 h1:95H15Og1clikBrKr/DuzMXkQzECs1M6hhoG
 github.com/bits-and-blooms/bitset v1.24.4/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bytedance/gopkg v0.1.4 h1:oZnQwnX82KAIWb7033bEwtxvTqXcYMxDBaQxo5JJHWM=
 github.com/bytedance/gopkg v0.1.4/go.mod h1:v1zWfPm21Fb+OsyXN2VAHdL6TBb2L88anLQgdyje6R4=
-github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
-github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
+github.com/bytedance/sonic v1.15.1 h1:nJD5PmM0vY7J8CT6MxoqbVAAMhkSmV2HgRAUrrpLoOw=
+github.com/bytedance/sonic v1.15.1/go.mod h1:mT2NbXunuaEbnZ+mRIX/vYqKISmgEuHFDI4UzmKx2SA=
 github.com/bytedance/sonic/loader v0.5.1 h1:Ygpfa9zwRCCKSlrp5bBP/b/Xzc3VxsAW+5NIYXrOOpI=
 github.com/bytedance/sonic/loader v0.5.1/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
-github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoGAc=
-github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U=
+github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw=
+github.com/caarlos0/env/v11 v11.4.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
-github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
+github.com/cloudwego/base64x v0.1.7 h1:NppS+Fgzg5ovhn4NkUXaDT3x9jldgH5ToMCqzBSi2zI=
+github.com/cloudwego/base64x v0.1.7/go.mod h1:Cu1PV9zfrSf7ET2tIbWbbEy7jO7HHJ13q4X2SQ8aWYg=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
+github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cristalhq/jwt/v5 v5.4.0 h1:Wxi1TocFHaijyV608j7v7B9mPc4ZNjvWT3LKBO0d4QI=
+github.com/cristalhq/jwt/v5 v5.4.0/go.mod h1:+b/BzaCWEpFDmXxspJ5h4SdJ1N/45KMjKOetWzmHvDA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 h1:5RVFMOWjMyRy8cARdy79nAmgYw3hK/4HUq48LQ6Wwqo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
+github.com/dgraph-io/ristretto/v2 v2.4.0 h1:I/w09yLjhdcVD2QV192UJcq8dPBaAJb9pOuMyNy0XlU=
+github.com/dgraph-io/ristretto/v2 v2.4.0/go.mod h1:0KsrXtXvnv0EqnzyowllbVJB8yBonswa2lTCK2gGo9E=
+github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da h1:aIftn67I1fkbMa512G+w+Pxci9hJPB8oMnkcP3iZF38=
+github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dhui/dktest v0.4.6 h1:+DPKyScKSEp3VLtbMDHcUq6V5Lm5zfZZVb0Sk7Ahom4=
 github.com/dhui/dktest v0.4.6/go.mod h1:JHTSYDtKkvFNFHJKqCzVzqXecyv+tKt8EzceOmQOgbU=
 github.com/disintegration/gift v1.1.2/go.mod h1:Jh2i7f7Q2BM7Ezno3PhfezbR1xpUg9dUg3/RlKGr4HI=
@@ -91,20 +109,48 @@ github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d h1:ygcRCGNKuEiA98k7X35hknEN8RIRUF1jrz7k1rZCvsk=
+github.com/dsoprea/go-exif v0.0.0-20230826092837-6579e82b732d/go.mod h1:lOaOt7+UEppOgyvRy749v3do836U/hw0YVJNjoyPaEs=
+github.com/dsoprea/go-exif/v2 v2.0.0-20200321225314-640175a69fe4/go.mod h1:Lm2lMM2zx8p4a34ZemkaUV95AnMl4ZvLbCUbwOvLC2E=
+github.com/dsoprea/go-exif/v2 v2.0.0-20200604193436-ca8584a0e1c4/go.mod h1:9EXlPeHfblFFnwu5UOqmP2eoZfJyAZ2Ri/Vki33ajO0=
+github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d h1:yeH8wrJa3+8uKKDAdURHUK1ds2UvKhMqX2MiOdVeKPs=
+github.com/dsoprea/go-exif/v2 v2.0.0-20230826092837-6579e82b732d/go.mod h1:oKrjk2kb3rAR5NbtSTLUMvMSbc+k8ZosI3MaVH47noc=
+github.com/dsoprea/go-exif/v3 v3.0.0-20200717053412-08f1b6708903/go.mod h1:0nsO1ce0mh5czxGeLo4+OCZ/C6Eo6ZlMWsz7rH/Gxv8=
+github.com/dsoprea/go-exif/v3 v3.0.0-20210512043655-120bcdb2a55e/go.mod h1:cg5SNYKHMmzxsr9X6ZeLh/nfBRHHp5PngtEPcujONtk=
+github.com/dsoprea/go-iptc v0.0.0-20200609062250-162ae6b44feb/go.mod h1:kYIdx9N9NaOyD7U6D+YtExN7QhRm+5kq7//yOsRXQtM=
+github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413 h1:YDRiMEm32T60Kpm35YzOK9ZHgjsS1Qrid+XskNcsdp8=
+github.com/dsoprea/go-iptc v0.0.0-20200610044640-bc9ca208b413/go.mod h1:kYIdx9N9NaOyD7U6D+YtExN7QhRm+5kq7//yOsRXQtM=
+github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102 h1:P1dsxzctGkmG6Zf7gH2xrZhNXWP5/FuLDI7xbCGsWTo=
+github.com/dsoprea/go-jpeg-image-structure v0.0.0-20221012074422-4f3f7e934102/go.mod h1:6+tQXZ+I62x13UZ+hemLVoZIuq/usVzvau7bqwUo9P0=
+github.com/dsoprea/go-logging v0.0.0-20190624164917-c4f10aab7696/go.mod h1:Nm/x2ZUNRW6Fe5C3LxdY1PyZY5wmDv/s5dkPJ/VB3iA=
+github.com/dsoprea/go-logging v0.0.0-20200517223158-a10564966e9d/go.mod h1:7I+3Pe2o/YSU88W0hWlm9S22W7XI1JFNJ86U0zPKMf8=
+github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd h1:l+vLbuxptsC6VQyQsfD7NnEC8BZuFpz45PgY+pH8YTg=
+github.com/dsoprea/go-logging v0.0.0-20200710184922-b02d349568dd/go.mod h1:7I+3Pe2o/YSU88W0hWlm9S22W7XI1JFNJ86U0zPKMf8=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200609050348-3db9b63b202c/go.mod h1:pqKB+ijp27cEcrHxhXVgUUMlSDRuGJJp1E+20Lj5H0E=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d h1:dg6UMHa50VI01WuPWXPbNJpO8QSyvIF5T5n2IZiqX3A=
+github.com/dsoprea/go-photoshop-info-format v0.0.0-20200610045659-121dd752914d/go.mod h1:pqKB+ijp27cEcrHxhXVgUUMlSDRuGJJp1E+20Lj5H0E=
+github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d h1:8+qI8ant/vZkNSsbwSjIR6XJfWcDVTg/qx/3pRUUZNA=
+github.com/dsoprea/go-png-image-structure v0.0.0-20210512210324-29b889a6093d/go.mod h1:yTR3tKgyk20phAFg6IE9ulMA5NjEDD2wyx+okRFLVtw=
+github.com/dsoprea/go-utility v0.0.0-20200711062821-fab8125e9bdf/go.mod h1:95+K3z2L0mqsVYd6yveIv1lmtT3tcQQ3dVakPySffW8=
+github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349 h1:/py11NlxDaOxkT9OKN+gXgT+QOH5xj1ZRoyusfRIlo4=
+github.com/dsoprea/go-utility v0.0.0-20221003172846-a3e1774ef349/go.mod h1:KVK+/Hul09ujXAGq+42UBgCTnXkiJZRnLYdURGjQUwo=
+github.com/dsoprea/go-utility/v2 v2.0.0-20200717064901-2fccff4aa15e/go.mod h1:uAzdkPTub5Y9yQwXe8W4m2XuP0tK4a9Q/dantD0+uaU=
 github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1 h1:RW22Y3QjGrb97NUA8yupdFcaqg//+hMI2fZrETBvQ4s=
 github.com/dunglas/go-urlpattern v0.0.0-20241020164140-716dfa1c80b1/go.mod h1:mnVcdqOeYg0HvT6veRo7wINa1mJ+lC/R4ig2lWcapSI=
+github.com/dunglas/httpsfv v1.1.0 h1:Jw76nAyKWKZKFrpMMcL76y35tOpYHqQPzHQiwDvpe54=
+github.com/dunglas/httpsfv v1.1.0/go.mod h1:zID2mqw9mFsnt7YC3vYQ9/cjq30q41W+1AnDwH8TiMg=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 h1:oP4q0fw+fOSWn3DfFi4EXdT+B+gTtzx8GC9xsc26Znk=
-github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6/go.mod h1:iL2twTeMvZnrg54ZoPDNfJaJaqy0xIQFuBdrLsmspwQ=
-github.com/emersion/go-smtp v0.24.0 h1:g6AfoF140mvW0vLNPD/LuCBLEAdlxOjIXqbIkJIS6Wk=
-github.com/emersion/go-smtp v0.24.0/go.mod h1:ZtRRkbTyp2XTHCA+BmyTFTrj8xY4I+b4McvHxCU2gsQ=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
-github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gin-contrib/slog v1.2.1 h1:tQbsmllW/PNgtvHRdVlI38jLfpN4IFLS7Pb4HgTeiYw=
@@ -113,14 +159,21 @@ github.com/gin-contrib/sse v1.1.1 h1:uGYpNwTacv5R68bSGMapo62iLTRa9l5zxGCps4hK6ko
 github.com/gin-contrib/sse v1.1.1/go.mod h1:QXzuVkA0YO7o/gun03UI1Q+FTI8ZV/n5t03kIQAI89s=
 github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
 github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
-github.com/glebarez/go-sqlite v1.22.0 h1:uAcMJhaA6r3LHMTFgP0SifzgXg46yJkgxqyuyec+ruQ=
-github.com/glebarez/go-sqlite v1.22.0/go.mod h1:PlBIdHe0+aUEFn+r2/uthrWq4FxbzugL0L8Li6yQJbc=
-github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
-github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-co-op/gocron/v2 v2.20.0 h1:9IMrnnVSWjfSh3E54gWmWCHbloQJLh6f9+nwyKfLNpc=
-github.com/go-co-op/gocron/v2 v2.20.0/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-co-op/gocron/v2 v2.21.2 h1:bD8/YwkojYHgXFr3iEulL148KBdTbKVxUZzFKpXcdbY=
+github.com/go-co-op/gocron/v2 v2.21.2/go.mod h1:5lEiCKk1oVJV39Zg7/YG10OnaVrDAV5GGR6O0663k6U=
+github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-errors/errors v1.0.2/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWEp4lssFEs=
+github.com/go-errors/errors v1.1.1/go.mod h1:psDX2osz5VnTOnFWbDeWwS7yejl+uV3FEWEp4lssFEs=
+github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
+github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-faster/city v1.0.1 h1:4WAxSZ3V2Ws4QRDrscLEDcibJY8uf41H6AhXDrNDcGw=
+github.com/go-faster/city v1.0.1/go.mod h1:jKcUJId49qdW3L1qKHH/3wPeUstCVpVSXTM6vO3VcTw=
+github.com/go-faster/errors v0.7.1 h1:MkJTnDoEdi9pDabt1dpWf7AA8/BaSYZqibYyhZ20AYg=
+github.com/go-faster/errors v0.7.1/go.mod h1:5ySTjWFiphBs07IKuiL69nxdfd5+fzh1u7FPGZP2quo=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
 github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -134,29 +187,44 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.2 h1:JiFIMtSSHb2/XBUbWM4i/MpeQm9ZK2xqPNk8vgvu5JQ=
-github.com/go-playground/validator/v10 v10.30.2/go.mod h1:mAf2pIOVXjTEBrwUMGKkCWKKPs9NheYGabeB04txQSc=
+github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
+github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
+github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/go-webauthn/webauthn v0.16.4 h1:R9jqR/cYZa7hRquFF7Za/8qoH/K/TIs1/Q/4CyGN+1Q=
-github.com/go-webauthn/webauthn v0.16.4/go.mod h1:SU2ljAgToTV/YLPI0C05QS4qn+e04WpB5g1RMfcZfS4=
-github.com/go-webauthn/x v0.2.3 h1:8oArS+Rc1SWFLXhE17KZNx258Z4kUSyaDgsSncCO5RA=
-github.com/go-webauthn/x v0.2.3/go.mod h1:tM04GF3V6VYq79AZMl7vbj4q6pz9r7L2criWRzbWhPk=
+github.com/go-webauthn/webauthn v0.17.4 h1:KFTSz3R2RYDiUn/0cDi3XTJgFenSG74eKTTHlqWhlxk=
+github.com/go-webauthn/webauthn v0.17.4/go.mod h1:pZk63EE/BdztlmyS4Yc+9H5g4a8blNlbtGmdHQHbZX8=
+github.com/go-webauthn/x v0.2.6 h1:TEyDuQAIiEgYpx60nKiBJIX/5nSUC8LxNbH+uf5U9uk=
+github.com/go-webauthn/x v0.2.6/go.mod h1:45bA7YEqyQhRcQJ/TiBb46Ww8yqHBGvgEhQ3WWF0aDo=
+github.com/go-xmlfmt/xmlfmt v0.0.0-20191208150333-d5b6f63a941b/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
+github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY=
+github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM=
 github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
 github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/gogo/googleapis v1.4.1 h1:1Yx4Myt7BxzvUr5ldGSbwYiZG6t9wGBZ+8/fX3Wvtq0=
+github.com/gogo/googleapis v1.4.1/go.mod h1:2lpHqI5OcWCtVElxXnPt+s8oJvMpySlOyM6xDCrzib4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-migrate/migrate/v4 v4.19.1 h1:OCyb44lFuQfYXYLx1SCxPZQGU7mcaZ7gH9yH4jSFbBA=
 github.com/golang-migrate/migrate/v4 v4.19.1/go.mod h1:CTcgfjxhaUtsLipnLoQRWCrjYXycRz/g5+RWDuYgPrE=
+github.com/golang/geo v0.0.0-20190916061304-5b978397cfec/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
+github.com/golang/geo v0.0.0-20200319012246-673a6f80352d/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
+github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7 h1:kG/6mhO8OwbQrA/0XEPwKJs3D3jG0m1rNH/ZRKDA/pQ=
+github.com/golang/geo v0.0.0-20250319145452-ed1c8b99c3d7/go.mod h1:J+F9/3Ofc8ysEOY2/cNjxTMl2eB1gvPIywEHUplPgDA=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -175,22 +243,44 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
+github.com/h2non/filetype v1.1.3/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
+github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/italypaleale/francis v0.1.0-beta.10 h1:LCYVwkZAkakv7g5ZS6TVIRH7hozr1A0eg24LXWWBJYE=
+github.com/italypaleale/francis v0.1.0-beta.10/go.mod h1:vqKhwdLs5Sx+n6JCNknEKAODtEU51E9/LC1q9JAG3zk=
+github.com/italypaleale/go-kit v0.0.0-20260708054611-e276b65dd3be h1:jgu+Mdsda++LqPxz8cj8vvgiFINQ8PhFB4Q1VZpyPjs=
+github.com/italypaleale/go-kit v0.0.0-20260708054611-e276b65dd3be/go.mod h1:pl0r3F+thZIyDsyDo8aOUsAIVcsRuAeP1bB4GuAHLoY=
+github.com/italypaleale/go-sql-utils v0.2.4 h1:6CN8y3qEdNzvYlS/JK6N65E8cL9F8a6OBCJjzaQIv3c=
+github.com/italypaleale/go-sql-utils v0.2.4/go.mod h1:BJStxMfB6fzYVcOe0oZQCjGIPZQu76UBmg1Wuy6Z/7I=
+github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 h1:D/V0gu4zQ3cL2WKeVNVM4r2gLxGGf6McLwgXzRTo2RQ=
+github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc=
-github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
+github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
+github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jaegertracing/jaeger-idl v0.9.0 h1:dI4olA7ArW3cjXwVbic/aYKDbdlfe7V+9wPQqAdzu8Y=
+github.com/jaegertracing/jaeger-idl v0.9.0/go.mod h1:W+9vbcr2cVZyS6z/cbr540EOzSkKYml3hmaWEavxkB0=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -203,6 +293,7 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -215,12 +306,26 @@ github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbd
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo=
+github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
+github.com/knadh/koanf/parsers/json v0.1.0 h1:dzSZl5pf5bBcW0Acnu20Djleto19T0CfHcvZ14NJ6fU=
+github.com/knadh/koanf/parsers/json v0.1.0/go.mod h1:ll2/MlXcZ2BfXD6YJcjVFzhG9P0TdJ207aIBKQhV2hY=
+github.com/knadh/koanf/providers/rawbytes v0.1.0 h1:dpzgu2KO6uf6oCb4aP05KDmKmAmI51k5pe8RYKQ0qME=
+github.com/knadh/koanf/providers/rawbytes v0.1.0/go.mod h1:mMTB1/IcJ/yE++A2iEZbY1MLygX7vttU+C+S/YmPu9c=
+github.com/knadh/koanf/v2 v2.3.2 h1:Ee6tuzQYFwcZXQpc2MiVeC6qHMandf5SMUJJNoFp/c4=
+github.com/knadh/koanf/v2 v2.3.2/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
@@ -235,31 +340,44 @@ github.com/lestrrat-go/dsig-secp256k1 v1.0.0 h1:JpDe4Aybfl0soBvoVwjqDbp+9S1Y2OM7
 github.com/lestrrat-go/dsig-secp256k1 v1.0.0/go.mod h1:CxUgAhssb8FToqbL8NjSPoGQlnO4w3LG1P0qPWQm/NU=
 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
-github.com/lestrrat-go/httprc/v3 v3.0.5 h1:S+Mb4L2I+bM6JGTibLmxExhyTOqnXjqx+zi9MoXw/TM=
-github.com/lestrrat-go/httprc/v3 v3.0.5/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
-github.com/lestrrat-go/jwx/v3 v3.0.13 h1:AdHKiPIYeCSnOJtvdpipPg/0SuFh9rdkN+HF3O0VdSk=
-github.com/lestrrat-go/jwx/v3 v3.0.13/go.mod h1:2m0PV1A9tM4b/jVLMx8rh6rBl7F6WGb3EG2hufN9OQU=
+github.com/lestrrat-go/httprc/v3 v3.0.6 h1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=
+github.com/lestrrat-go/httprc/v3 v3.0.6/go.mod h1:mSMtkZW92Z98M5YoNNztbRGxbXHql7tSitCvaxvo9l0=
+github.com/lestrrat-go/jwx/v3 v3.1.1 h1:yd9AdPmZ4INnQ7k42IrzXYpnEG803+SrQ6hdMvzHJzw=
+github.com/lestrrat-go/jwx/v3 v3.1.1/go.mod h1:uw/MN2M/Xiu4FhwcIwH11Zsh9JWx9SWzgALl7/uIEkU=
 github.com/lestrrat-go/option/v2 v2.0.0 h1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=
 github.com/lestrrat-go/option/v2 v2.0.0/go.mod h1:oSySsmzMoR0iRzCDCaUfsCzxQHUEuhOViQObyy7S6Vg=
 github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
 github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
+github.com/libtnb/sqlite v1.1.2 h1:3g8nez8MwdEhn+oqt3bfKWnYJxk0ZGTO0kVA1WT+hjQ=
+github.com/libtnb/sqlite v1.1.2/go.mod h1:2PGCWOR6HqqXuoIVMmwfJ655epvRO8sw0b9kHWuKNsQ=
 github.com/lmittmann/tint v1.1.3 h1:Hv4EaHWXQr+GTFnOU4VKf8UvAtZgn0VuKT+G0wFlO3I=
 github.com/lmittmann/tint v1.1.3/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
-github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
-github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
+github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
 github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/mattn/goveralls v0.0.12 h1:PEEeF0k1SsTjOBQ8FOmrOAoCu4ytuMaWCnWe94zxbCg=
+github.com/mattn/goveralls v0.0.12/go.mod h1:44ImGEUfmqH8bBtaMrYKsM65LXfNLWmwaxFGjZwgMSQ=
 github.com/mileusna/useragent v1.3.5 h1:SJM5NzBmh/hO+4LGeATKpaEX9+b4vcGg2qXGLiNGDws=
 github.com/mileusna/useragent v1.3.5/go.mod h1:3d8TOmwL/5I8pJjyVDteHtgDGcefrFUX4ccGOMKNYYc=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -268,37 +386,66 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/nlnwa/whatwg-url v0.6.2 h1:jU61lU2ig4LANydbEJmA2nPrtCGiKdtgT0rmMd2VZ/Q=
 github.com/nlnwa/whatwg-url v0.6.2/go.mod h1:x0FPXJzzOEieQtsBT/AKvbiBbQ46YlL6Xa7m02M1ECk=
+github.com/nyaruka/phonenumbers v1.5.0 h1:0M+Gd9zl53QC4Nl5z1Yj1O/zPk2XXBUwR/vlzdXSJv4=
+github.com/nyaruka/phonenumbers v1.5.0/go.mod h1:gv+CtldaFz+G3vHHnasBSirAi3O2XLqZzVWz4V1pl2E=
+github.com/oleiade/reflections v1.1.0 h1:D+I/UsXQB4esMathlt0kkZRJZdUDmhv5zGi/HOwYTWo=
+github.com/oleiade/reflections v1.1.0/go.mod h1:mCxx0QseeVCHs5Um5HhJeCKVC7AwS8kO67tky4rdisA=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/openzipkin/zipkin-go v0.4.3 h1:9EGwpqkgnwdEIJ+Od7QVSEIH+ocmm5nPat0G7sjsSdg=
+github.com/openzipkin/zipkin-go v0.4.3/go.mod h1:M9wCJZFWCo2RiY+o1eBCEMe0Dp2S5LDHcMZmk3RmK7c=
 github.com/orandin/slog-gorm v1.4.0 h1:FgA8hJufF9/jeNSYoEXmHPPBwET2gwlF3B85JdpsTUU=
 github.com/orandin/slog-gorm v1.4.0/go.mod h1:MoZ51+b7xE9lwGNPYEhxcUtRNrYzjdcKvA8QXQQGEPA=
-github.com/oschwald/maxminddb-golang/v2 v2.1.1 h1:lA8FH0oOrM4u7mLvowq8IT6a3Q/qEnqRzLQn9eH5ojc=
-github.com/oschwald/maxminddb-golang/v2 v2.1.1/go.mod h1:PLdx6PR+siSIoXqqy7C7r3SB3KZnhxWr1Dp6g0Hacl8=
-github.com/pelletier/go-toml/v2 v2.3.0 h1:k59bC/lIZREW0/iVaQR8nDHxVq8OVlIzYCOJf421CaM=
-github.com/pelletier/go-toml/v2 v2.3.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe h1:rvu4obdvqR0fkSIJ8IfgzKOWwZ5kOT2UNfLq81Qk7rc=
+github.com/ory/go-acc v0.2.9-0.20230103102148-6b1c9a70dbbe/go.mod h1:z4n3u6as84LbV4YmgjHhnwtccQqzf4cZlSk9f1FhygI=
+github.com/ory/go-convenience v0.1.0 h1:zouLKfF2GoSGnJwGq+PE/nJAE6dj2Zj5QlTgmMTsTS8=
+github.com/ory/go-convenience v0.1.0/go.mod h1:uEY/a60PL5c12nYz4V5cHY03IBmwIAEm8TWB0yn9KNs=
+github.com/ory/herodot v0.10.3-0.20250318104651-3179543efba8 h1:bBFBzJ+sy1l/9+uYaz5TLGNNe0GWeXPMyqLhUEy9gPg=
+github.com/ory/herodot v0.10.3-0.20250318104651-3179543efba8/go.mod h1:aq2fDNzFXlh8wF6+ILtlEin2oZSrqR79/Zdsi05WEVA=
+github.com/ory/jsonschema/v3 v3.0.9-0.20250317235931-280c5fc7bf0e h1:4tUrC7x4YWRVMFp+c64KACNSGchW1zXo4l6Pa9/1hA8=
+github.com/ory/jsonschema/v3 v3.0.9-0.20250317235931-280c5fc7bf0e/go.mod h1:XWLxVK4un/iuIcrw+6lCeanbF3NZwO5k6RdLeu/loQk=
+github.com/ory/pop/v6 v6.4.1 h1:mxwfgwIB+kRlE4hvcoeEuxFqXZai6TWgQ23sOCBTERo=
+github.com/ory/pop/v6 v6.4.1/go.mod h1:o+a3+gdnfWUd/IpFCTKidX7sRgQ6GdPmH02XYiMH8cw=
+github.com/ory/x v0.0.729 h1:7ttCYNCjCdspI6X0oaxGAXoiYWSBrwGRz6w/IG8s3I4=
+github.com/ory/x v0.0.729/go.mod h1:qdUK3Sp4K4nRbYJG0sEnFO1tDLN/Ct53G+ymre0JhCU=
+github.com/oschwald/maxminddb-golang/v2 v2.4.1 h1:OffzqSABE3Sw354GdBThqDsKfpA4GWBqOY2P91V8tjI=
+github.com/oschwald/maxminddb-golang/v2 v2.4.1/go.mod h1:CZK8iQQMKfy6mKOifoyUmrj4vTHnMiGVaS7hDaZZxQ0=
+github.com/paulmach/orb v0.11.1 h1:3koVegMC4X/WeiXYz9iswopaTwMem53NzTJuTF20JzU=
+github.com/paulmach/orb v0.11.1/go.mod h1:5mULz1xQfs3bmQm63QEJA6lNGujuRafwA5S/EnuLaLU=
+github.com/paulmach/protoscan v0.2.1/go.mod h1:SpcSwydNLrxUGSDvXvO0P7g7AuhJ7lcKfDlhJCDw2gY=
+github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
+github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pocket-id/fosite v0.0.0-20260708083902-56a3c0f378d6 h1:gD1LKfqFkbIHkE6d308IFJkZbHw4VwL7buxEnblNQTs=
+github.com/pocket-id/fosite v0.0.0-20260708083902-56a3c0f378d6/go.mod h1:KeQ7tTIBm3DyeBnKcKLnPbSdrd6ttM6w3TD3yy9x8rM=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
+github.com/prometheus/common v0.69.0 h1:OA85nJQS/T/MaYh/Q2CcgDKSGWqNIgrBDvDH85CuiNk=
+github.com/prometheus/common v0.69.0/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
 github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos=
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
+github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
+github.com/quic-go/webtransport-go v0.11.1 h1:rrFQMO+7/52ZDJ04fsrjIaWqn6q1z1MYo9iVFq6JtbA=
+github.com/quic-go/webtransport-go v0.11.1/go.mod h1:SHgEzUFVyj+9WUSuGB1P6Zd351Pww2leWV3SwlTovkA=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -306,18 +453,35 @@ github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzG
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sagikazarmark/locafero v0.12.0 h1:/NQhBAkUb4+fH1jivKHWusDYFjMOOKU88eegjfxfHb4=
+github.com/sagikazarmark/locafero v0.12.0/go.mod h1:sZh36u/YSZ918v0Io+U9ogLYQJ9tLLBmM4eneO6WwsI=
+github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761 h1:0b8DF5kR0PhRoRXDiEEdzrgBc8UqVY4JWLkQJCRsLME=
+github.com/seatgeek/logrus-gelf-formatter v0.0.0-20210414080842-5b05eb8ff761/go.mod h1:/THDZYi7F/BsVEcYzYPqdcWFQ+1C2InkawTKfLOAnzg=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -325,71 +489,111 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tinylib/msgp v1.6.3 h1:bCSxiTz386UTgyT1i0MSCvdbWjVW+8sG3PjkGsZQt4s=
-github.com/tinylib/msgp v1.6.3/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/tinylib/msgp v1.6.4 h1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=
+github.com/tinylib/msgp v1.6.4/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+github.com/urfave/negroni v1.0.0 h1:kIimOitoypq34K7TG7DUaJ9kq/N4Ofuwi1sjz0KipXc=
+github.com/urfave/negroni v1.0.0/go.mod h1:Meg73S6kFm/4PpbYdq35yYWoCZ9mS/YSx+lKnmiohz4=
 github.com/valyala/fastjson v1.6.10 h1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=
 github.com/valyala/fastjson v1.6.10/go.mod h1:e6FubmQouUNP73jtMLmcbxS6ydWIpOfhz34TSfO3JaE=
+github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
+github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
+github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
-go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+github.com/zitadel/exifremove v0.1.0 h1:qD50ezWsfeeqfcvs79QyyjVfK+snN12v0U0deaU8aKg=
+github.com/zitadel/exifremove v0.1.0/go.mod h1:rzKJ3woL/Rz2KthVBiSBKIBptNTvgmk9PLaeUKTm+ek=
+go.mongodb.org/mongo-driver v1.11.4/go.mod h1:PTSz5yu21bkT/wXpkS7WR5f0ddqw5quethTUn9WM+2g=
+go.mongodb.org/mongo-driver/v2 v2.6.0 h1:b9sJOYrkmt4l8bY43ZenFBcPlhYIjaOfYHLtbB/5qi8=
+go.mongodb.org/mongo-driver/v2 v2.6.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM=
-go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg=
-go.opentelemetry.io/contrib/bridges/prometheus v0.68.0 h1:w3zlHYETbDwXyWHZlyyR58ZC39XGi8rAhkBgUgJ9d5w=
-go.opentelemetry.io/contrib/bridges/prometheus v0.68.0/go.mod h1:GR/mClR2nn7vE8RLwxKjoBNg+QtgdDhRzxVa93koy5o=
-go.opentelemetry.io/contrib/exporters/autoexport v0.68.0 h1:0D3GFvELGIwQGfC6agLsbrEYSGWZTRTxIXxcQUqrOuk=
-go.opentelemetry.io/contrib/exporters/autoexport v0.68.0/go.mod h1:DM2NV7Zb8CcGeVPt6glouY0FAiwZQ/iqgcWExhgWeN8=
-go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.68.0 h1:5FXSL2s6afUC1bzNzl1iedZZ8yqR7GOhbCoEXtyeK6Q=
-go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.68.0/go.mod h1:MdHW7tLtkeGJnR4TyOrnd5D0zUGZQB1l84uHCe8hRpE=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
-go.opentelemetry.io/contrib/propagators/b3 v1.43.0 h1:CETqV3QLLPTy5yNrqyMr41VnAOOD4lsRved7n4QG00A=
-go.opentelemetry.io/contrib/propagators/b3 v1.43.0/go.mod h1:Q4mCiCdziYzpNR0g+6UqVotAlCDZdzz6L8jwY4knOrw=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag=
-go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0 h1:8UQVDcZxOJLtX6gxtDt3vY2WTgvZqMQRzjsqiIHQdkc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.43.0/go.mod h1:2lmweYCiHYpEjQ/lSJBYhj9jP1zvCvQW4BqL9dnT7FQ=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
-go.opentelemetry.io/otel/exporters/prometheus v0.65.0 h1:jOveH/b4lU9HT7y+Gfamf18BqlOuz2PWEvs8yM7Q6XE=
-go.opentelemetry.io/otel/exporters/prometheus v0.65.0/go.mod h1:i1P8pcumauPtUI4YNopea1dhzEMuEqWP1xoUZDylLHo=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0 h1:GJkybS+crDMdExT/BUNCEgfrmfboztcS6PhvSo88HKM=
-go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.19.0/go.mod h1:NuAyxRYIG2lKX3YQkB+83StTxM7s52PUUkRRiC0wnYI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0 h1:TC+BewnDpeiAmcscXbGMfxkO+mwYUwE/VySwvw88PfA=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.43.0/go.mod h1:J/ZyF4vfPwsSr9xJSPyQ4LqtcTPULFR64KwTikGLe+A=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0 h1:mS47AX77OtFfKG4vtp+84kuGSFZHTyxtXIN269vChY0=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.43.0/go.mod h1:PJnsC41lAGncJlPUniSwM81gc80GkgWJWr3cu2nKEtU=
-go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4=
-go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko=
-go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg=
-go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk=
-go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/contrib/bridges/otelslog v0.19.0 h1:5RgvxieNq9tS3ewrV1vnODvbHPfKUIJcYtF9Cvz+6aQ=
+go.opentelemetry.io/contrib/bridges/otelslog v0.19.0/go.mod h1:iTBIdNwx/xmUhfgJs6+84S4dIK059811cO1eUBjKcHY=
+go.opentelemetry.io/contrib/bridges/prometheus v0.69.0 h1:saQoWg5845Q8TojpqeVStS7zGwVZ6bc5W2PJavTPiBM=
+go.opentelemetry.io/contrib/bridges/prometheus v0.69.0/go.mod h1:AAaS6xs5AyqMdR3Ir0nSWK+QudL2XM8Vbw5INzUxNc8=
+go.opentelemetry.io/contrib/exporters/autoexport v0.69.0 h1:R3jsCoTIzv0BiYNhW0axyswn/6SMJ8xL1OuGxvni1Kw=
+go.opentelemetry.io/contrib/exporters/autoexport v0.69.0/go.mod h1:m07gqyr2QhQxKOKb5vqKCCBtLH3uqlNYR7PU/FISXVU=
+go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.69.0 h1:u5gsfBL8t1Km4ROhQKAs0cA0t9CzUE7nfkASj/UjAtI=
+go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.69.0/go.mod h1:W6FFYCZQuntC5hxVesXpu7Ppd9sT0a84njildAijc+k=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0 h1:MCcYL7J6Vt/X0kjqbMZkekCmwsurbQRbL69vkiye2lk=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0/go.mod h1:3jnStNwSufK+f5ktjL4EPcwtig4rtd81NS70lqHuXl8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
+go.opentelemetry.io/contrib/propagators/b3 v1.44.0 h1:1IFH4oFKK8KupzIelCl3u+bkxpGRps1oWRjQI2+TTWs=
+go.opentelemetry.io/contrib/propagators/b3 v1.44.0/go.mod h1:JqWFXsc7VDaqIyubFhEd2cPHqsrzqP0Lvn783SUwyro=
+go.opentelemetry.io/contrib/propagators/jaeger v1.44.0 h1:OyzvsAMc/zHt0DRPcfstn0wgfq8ApDkeY0ABMcueweM=
+go.opentelemetry.io/contrib/propagators/jaeger v1.44.0/go.mod h1:44kghcGX+BNxy9UTiWtd6VDt8Nd4EypGBkH2+v2Dqrc=
+go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.1 h1:pV2nZ1iE87X9ym+crkD9k15zTLbN08+IC4C7sk9sQYM=
+go.opentelemetry.io/contrib/samplers/jaegerremote v0.37.1/go.mod h1:nvgrM8LaG2+5G7WxbtjEPiSkg87+d0/ltZZK70p7FVo=
+go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
+go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4=
+go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0 h1:rydZ9sxbcFdm/oWrVyfLTjHIygMgv0bEeMd+3B/BvoM=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.20.0/go.mod h1:earQ25dooT0Hhspq59DZ8YCC50jWfOlFEeWoxy/P444=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0 h1:owlhcJ3QO3X0YTDTCcDZ4V+6aVDkWbNmBoQ5NUp7Oww=
+go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.20.0/go.mod h1:MP4eemTiI9zC8fgg+DYynhYDYf3ba72S376TvP+Ye0Q=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 h1:SUplec5dp06reu1zaXmOXdvqH398taqrDXqUl99jxSc=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0/go.mod h1:ho2g4N+ane+swq5I/VBkKWnRDY4kUINH3FuqyZqX/Ug=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 h1:RuynHbfU8JUEw7DyONgkVYg2SVtsoF28y0LGIr69jgA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0/go.mod h1:qZF+/lBs71APw8mlnEZcqZHMzqrYrsFiJOv83lX1OGo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0 h1:lgh3PiVrRUWMLOVSkQicxzZll5NjF1r+AtsX1XRIHw0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.44.0/go.mod h1:5Cnhth3m/AgOeTgE3ex12pPmiu/gGtZit03kSzx9X7s=
+go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ=
+go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0 h1:aZfdmtI6QU/DAPD4b7YZ5zuJgewxO1EW9miOZklqleU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.20.0/go.mod h1:isNl10/Om5CBWu9jj8WOb2+tJLbCVXDgqwzCaJMnJ6w=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0 h1:bl2S7Ubua0Nms+D/gAmznQTd4dxxMA93aKbcpKqiTCs=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.44.0/go.mod h1:L0hRV50XdVIODHUfWEqGRCXQvj2rV82STVo12FMFBU0=
+go.opentelemetry.io/otel/exporters/zipkin v1.44.0 h1:zv7PRYGLrQHkdeZj0c5SNAZOJcw55XgaTezUkNpwA+w=
+go.opentelemetry.io/otel/exporters/zipkin v1.44.0/go.mod h1:3+VZyCi6hFW+UuxFF+wSOvwsOwncfBpQfP7Qdb3JXKg=
+go.opentelemetry.io/otel/log v0.20.0 h1:/5i0vuHxCLWUfChWG41K9wkM0jafruPw9NU1/RCJirs=
+go.opentelemetry.io/otel/log v0.20.0/go.mod h1:wOcMcjsZpG8x7Bak7IhSi/lg8wscV2C1VdrKCLPlt0E=
+go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
+go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/log v0.20.0 h1:vM3xI7TQgKPiSghe6urZtAkyFY7SodrSpC83CffDFuY=
+go.opentelemetry.io/otel/sdk/log v0.20.0/go.mod h1:Knej2nmsTUzN79T2eeXdRsjjPcoxoq2pUyUHz9TFyyU=
+go.opentelemetry.io/otel/sdk/log/logtest v0.20.0 h1:OqdRZ1guyzamK3M6LlRsmGqRrjkHWw6WZOKKli5ELpg=
+go.opentelemetry.io/otel/sdk/log/logtest v0.20.0/go.mod h1:PuMIlm7zAt7c3z8zfOI5ox4iT1Z87We+PF6YoINux/M=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
+go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
+go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
 go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -398,71 +602,97 @@ go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/arch v0.26.0 h1:jZ6dpec5haP/fUv1kLCbuJy6dnRrfX6iVK08lZBFpk4=
-golang.org/x/arch v0.26.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
+golang.org/x/arch v0.27.0 h1:0WNVcR8u9yFz8j5FvdHpgwNp3FS5U4guYdzHwEiGjoU=
+golang.org/x/arch v0.27.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/exp v0.0.0-20260611194520-c48552f49976 h1:X8Hz2ImujgbmetVuW+w2YkyZChE3cBpZi2P158rTG9M=
+golang.org/x/exp v0.0.0-20260611194520-c48552f49976/go.mod h1:vnf4pv9iKZXY58sQE1L86zmNWJ4159e1RkcWiLCkeEY=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200320220750-118fecf932d8/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
@@ -471,6 +701,7 @@ golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
@@ -478,65 +709,88 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d h1:/aDRtSZJjyLQzm75d+a1wOJaqyKBMvIAfeQmoa3ORiI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:etfGUgejTiadZAUaEP14NP97xi1RGeawqkjDARA/UOs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=
+google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/clickhouse v0.7.0 h1:BCrqvgONayvZRgtuA6hdya+eAW5P2QVagV3OlEp1vtA=
+gorm.io/driver/clickhouse v0.7.0/go.mod h1:TmNo0wcVTsD4BBObiRnCahUgHJHjBIwuRejHwYt3JRs=
+gorm.io/driver/mysql v1.5.7 h1:MndhOPYOfEp2rHKgkZIhJ16eVUIRf2HmzgoPmh7FCWo=
+gorm.io/driver/mysql v1.5.7/go.mod h1:sEtPWMiqiN1N1cMXoXmBbd8C6/l+TESwriotuRRpkDM=
 gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
 gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
-gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
-gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
-modernc.org/cc/v4 v4.27.3 h1:uNCgn37E5U09mTv1XgskEVUJ8ADKpmFMPxzGJ0TSo+U=
-modernc.org/cc/v4 v4.27.3/go.mod h1:3YjcbCqhoTTHPycJDRl2WZKKFj0nwcOIPBfEZK0Hdk8=
-modernc.org/ccgo/v4 v4.32.4 h1:L5OB8rpEX4ZsXEQwGozRfJyJSFHbbNVOoQ59DU9/KuU=
-modernc.org/ccgo/v4 v4.32.4/go.mod h1:lY7f+fiTDHfcv6YlRgSkxYfhs+UvOEEzj49jAn2TOx0=
+gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
+gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
+gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
+gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo=
+gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
+gorm.io/plugin/opentelemetry v0.1.16 h1:Kypj2YYAliJqkIczDZDde6P6sFMhKSlG5IpngMFQGpc=
+gorm.io/plugin/opentelemetry v0.1.16/go.mod h1:P3RmTeZXT+9n0F1ccUqR5uuTvEXDxF8k2UpO7mTIB2Y=
+k8s.io/utils v0.0.0-20260617174310-a95e086a2553 h1:hmGqDecjc8d7HVzWzRFl0QD9bYuYKbBEG7t8xwnVxfI=
+k8s.io/utils v0.0.0-20260617174310-a95e086a2553/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
+modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.5 h1:hcwnthv2/LBl+mRLOYwnQA/LuW44Oln1NQlWppNaS1Q=
+modernc.org/ccgo/v4 v4.34.5/go.mod h1:aow0HNkO30OSA/2NrtDXkis92ff8ZFiDOmDOPhqhF8U=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.71.0 h1:bu0djXJGhqed3DnBzyzu3sY0fv432lesyz99ecEahyA=
-modernc.org/libc v1.71.0/go.mod h1:tTU8DL8A+XLVkEY3x5E/tO7s2Q/q42EtnNWda/L5QhQ=
+modernc.org/libc v1.73.5 h1:G34rN/cRqL+zOUnrbz9uPq/+OxJ8/vzQ2CQwTJ42Wmw=
+modernc.org/libc v1.73.5/go.mod h1:+Aoyx4M0etg6GikzCrip1VtvAtUlMlo2Aq+GHwQSqOA=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
 modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.48.2 h1:5CnW4uP8joZtA0LedVqLbZV5GD7F/0x91AXeSyjoh5c=
-modernc.org/sqlite v1.48.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
+modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

backend/internal/api/dto.go

@@ -0,0 +1,57 @@
+package api
+
+import (
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+)
+
+// apiResponseDto is the full representation of an API including its permissions
+type apiResponseDto struct {
+	ID          string                     `json:"id"`
+	Name        string                     `json:"name"`
+	Resource    string                     `json:"resource"`
+	CreatedAt   datatype.DateTime          `json:"createdAt"`
+	Permissions []apiPermissionResponseDto `json:"permissions"`
+}
+
+type apiPermissionResponseDto struct {
+	ID          string  `json:"id"`
+	Key         string  `json:"key"`
+	Name        string  `json:"name"`
+	Description *string `json:"description,omitempty"`
+}
+
+// apiCreateDto is the payload for creating an API
+// The resource identifier is only accepted here because changing it later would invalidate every token already minted for the API
+type apiCreateDto struct {
+	Name     string `json:"name" binding:"required,min=1,max=50" unorm:"nfc"`
+	Resource string `json:"resource" binding:"required,resource_uri,max=350" unorm:"nfc"`
+}
+
+// apiUpdateDto is the payload for updating an API
+// The resource identifier is intentionally not updatable
+type apiUpdateDto struct {
+	Name string `json:"name" binding:"required,min=1,max=50" unorm:"nfc"`
+}
+
+type apiPermissionInputDto struct {
+	Key         string  `json:"key" binding:"required,min=1,max=128" unorm:"nfc"`
+	Name        string  `json:"name" binding:"required,min=1,max=50" unorm:"nfc"`
+	Description *string `json:"description" binding:"omitempty,max=200"`
+}
+
+// apiPermissionsUpdateDto replaces the full permission set of an API
+type apiPermissionsUpdateDto struct {
+	Permissions []apiPermissionInputDto `json:"permissions" binding:"omitempty,dive"`
+}
+
+// clientApiAccessDto is the set of API permissions a client is allowed to request, split by subject type
+// User-delegated permissions may be requested on behalf of a signed-in user, client permissions may be obtained by the client itself through the client credentials grant
+type clientApiAccessDto struct {
+	UserDelegatedPermissionIDs []string `json:"userDelegatedPermissionIds"`
+	ClientPermissionIDs        []string `json:"clientPermissionIds"`
+}
+
+type clientApiAccessUpdateDto struct {
+	UserDelegatedPermissionIDs []string `json:"userDelegatedPermissionIds" binding:"omitempty,dive,required"`
+	ClientPermissionIDs        []string `json:"clientPermissionIds" binding:"omitempty,dive,required"`
+}

backend/internal/api/handler.go

@@ -0,0 +1,235 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pocket-id/pocket-id/backend/internal/dto"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
+)
+
+type handler struct {
+	service *Service
+}
+
+func newHandler(service *Service) *handler {
+	return &handler{service: service}
+}
+
+// list godoc
+// @Summary List APIs
+// @Description Get a paginated list of APIs with optional search and sorting
+// @Tags APIs
+// @Produce json
+// @Param search query string false "Search term to filter APIs by name or resource"
+// @Param pagination[page] query int false "Page number for pagination" default(1)
+// @Param pagination[limit] query int false "Number of items per page" default(20)
+// @Param sort[column] query string false "Column to sort by"
+// @Param sort[direction] query string false "Sort direction (asc or desc)" default("asc")
+// @Success 200 {object} dto.Paginated[apiResponseDto]
+// @Router /api/apis [get]
+func (h *handler) list(c *gin.Context) {
+	search := c.Query("search")
+	listRequestOptions := utils.ParseListRequestOptions(c)
+
+	apis, pagination, err := h.service.List(c.Request.Context(), search, listRequestOptions)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	items := make([]apiResponseDto, len(apis))
+	for i, api := range apis {
+		var item apiResponseDto
+		if err := dto.MapStruct(api, &item); err != nil {
+			_ = c.Error(err)
+			return
+		}
+		item.Resource = api.Audience
+		items[i] = item
+	}
+
+	c.JSON(http.StatusOK, dto.Paginated[apiResponseDto]{
+		Data:       items,
+		Pagination: pagination,
+	})
+}
+
+// get godoc
+// @Summary Get API by ID
+// @Description Retrieve a single API including its permissions
+// @Tags APIs
+// @Produce json
+// @Param id path string true "API ID"
+// @Success 200 {object} apiResponseDto
+// @Router /api/apis/{id} [get]
+func (h *handler) get(c *gin.Context) {
+	api, err := h.service.Get(c.Request.Context(), nil, c.Param("id"))
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	h.respond(c, http.StatusOK, api)
+}
+
+// create godoc
+// @Summary Create API
+// @Description Create a new API resource server
+// @Tags APIs
+// @Accept json
+// @Produce json
+// @Param api body apiCreateDto true "API information"
+// @Success 201 {object} apiResponseDto "Created API"
+// @Router /api/apis [post]
+func (h *handler) create(c *gin.Context) {
+	var input apiCreateDto
+	if err := dto.ShouldBindWithNormalizedJSON(c, &input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	api, err := h.service.Create(c.Request.Context(), input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	h.respond(c, http.StatusCreated, api)
+}
+
+// update godoc
+// @Summary Update API
+// @Description Update an existing API by ID
+// @Tags APIs
+// @Accept json
+// @Produce json
+// @Param id path string true "API ID"
+// @Param api body apiUpdateDto true "API information"
+// @Success 200 {object} apiResponseDto "Updated API"
+// @Router /api/apis/{id} [put]
+func (h *handler) update(c *gin.Context) {
+	var input apiUpdateDto
+	if err := dto.ShouldBindWithNormalizedJSON(c, &input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	api, err := h.service.Update(c.Request.Context(), c.Param("id"), input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	h.respond(c, http.StatusOK, api)
+}
+
+// delete godoc
+// @Summary Delete API
+// @Description Delete an API by ID
+// @Tags APIs
+// @Param id path string true "API ID"
+// @Success 204 "No Content"
+// @Router /api/apis/{id} [delete]
+func (h *handler) delete(c *gin.Context) {
+	if err := h.service.Delete(c.Request.Context(), c.Param("id")); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}
+
+// updatePermissions godoc
+// @Summary Update API permissions
+// @Description Replace the full set of permissions for an API
+// @Tags APIs
+// @Accept json
+// @Produce json
+// @Param id path string true "API ID"
+// @Param permissions body apiPermissionsUpdateDto true "Permissions to set"
+// @Success 200 {object} apiResponseDto "Updated API"
+// @Router /api/apis/{id}/permissions [put]
+func (h *handler) updatePermissions(c *gin.Context) {
+	var input apiPermissionsUpdateDto
+	if err := dto.ShouldBindWithNormalizedJSON(c, &input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	api, err := h.service.UpdatePermissions(c.Request.Context(), c.Param("id"), input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	h.respond(c, http.StatusOK, api)
+}
+
+// getClientAccess godoc
+// @Summary Get client API access
+// @Description Get the API permissions an OIDC client is allowed to request, split into user-delegated and client (machine-to-machine) access
+// @Tags APIs
+// @Produce json
+// @Param clientId path string true "OIDC Client ID"
+// @Success 200 {object} clientApiAccessDto
+// @Router /api/api-access/{clientId} [get]
+func (h *handler) getClientAccess(c *gin.Context) {
+	access, err := h.service.GetClientAPIAccess(c.Request.Context(), c.Param("clientId"))
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, newClientApiAccessDto(access))
+}
+
+// updateClientAccess godoc
+// @Summary Update client API access
+// @Description Replace the API permissions an OIDC client is allowed to request, split into user-delegated and client (machine-to-machine) access
+// @Tags APIs
+// @Accept json
+// @Produce json
+// @Param clientId path string true "OIDC Client ID"
+// @Param access body clientApiAccessUpdateDto true "Allowed permission IDs per subject type"
+// @Success 200 {object} clientApiAccessDto
+// @Router /api/api-access/{clientId} [put]
+func (h *handler) updateClientAccess(c *gin.Context) {
+	var input clientApiAccessUpdateDto
+	err := c.ShouldBindJSON(&input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	applied, err := h.service.SetClientAPIAccess(c.Request.Context(), c.Param("clientId"), ClientAPIAccess(input))
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, newClientApiAccessDto(applied))
+}
+
+// newClientApiAccessDto always serializes both permission lists as arrays rather than null
+func newClientApiAccessDto(access ClientAPIAccess) clientApiAccessDto {
+	dto := clientApiAccessDto(access)
+	if dto.UserDelegatedPermissionIDs == nil {
+		dto.UserDelegatedPermissionIDs = []string{}
+	}
+	if dto.ClientPermissionIDs == nil {
+		dto.ClientPermissionIDs = []string{}
+	}
+	return dto
+}
+
+func (h *handler) respond(c *gin.Context, status int, api API) {
+	var responseDto apiResponseDto
+	if err := dto.MapStruct(api, &responseDto); err != nil {
+		_ = c.Error(err)
+		return
+	}
+	responseDto.Resource = api.Audience
+	c.JSON(status, responseDto)
+}

backend/internal/api/models.go

@@ -0,0 +1,38 @@
+package api
+
+import (
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
+)
+
+type API struct {
+	model.Base
+
+	Name      string `sortable:"true"`
+	Audience  string `sortable:"true"`
+	UpdatedAt *datatype.DateTime
+
+	Permissions []Permission `gorm:"foreignKey:APIID;references:ID;constraint:OnDelete:CASCADE"`
+}
+
+type Permission struct {
+	model.Base
+
+	APIID       string `gorm:"column:api_id"`
+	Key         string `sortable:"true"`
+	Name        string
+	Description *string
+}
+
+func (Permission) TableName() string { return "api_permissions" }
+
+type OidcClientAllowedAPIPermission struct {
+	OidcClientID    string
+	APIPermissionID string
+	SubjectType     oidc.SubjectType
+}
+
+func (OidcClientAllowedAPIPermission) TableName() string {
+	return "oidc_clients_allowed_api_permissions"
+}

backend/internal/api/module.go

@@ -0,0 +1,78 @@
+package api
+
+import (
+	"context"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"github.com/pocket-id/pocket-id/backend/internal/dto"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
+)
+
+type Dependencies struct {
+	DB *gorm.DB
+	// Issuer is the OpenID Provider issuer URL, reserved so a custom API cannot claim it as its audience
+	Issuer string
+}
+
+type Module struct {
+	service *Service
+	handler *handler
+}
+
+func New(deps Dependencies) *Module {
+	service := newService(deps.DB, deps.Issuer)
+	return &Module{
+		service: service,
+		handler: newHandler(service),
+	}
+}
+
+// ClientAPIScopes implements the OIDC module's APIAccessProvider interface
+func (m *Module) ClientAPIScopes(ctx context.Context, tx *gorm.DB, clientID string) (scopes []string, audiences []string, err error) {
+	return m.service.ClientAPIScopesAndAudiences(ctx, tx, clientID)
+}
+
+// AllowedScopesForAudience implements the OIDC module's APIAccessProvider interface
+func (m *Module) AllowedScopesForAudience(ctx context.Context, tx *gorm.DB, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
+	return m.service.AllowedScopesForAudience(ctx, tx, clientID, audience, subjectType)
+}
+
+// DescribePermissions implements the OIDC module's APIAccessProvider interface
+func (m *Module) DescribePermissions(ctx context.Context, audience string, keys []string) ([]dto.ScopeInfoDto, error) {
+	permissions, err := m.service.DescribePermissions(ctx, audience, keys)
+	if err != nil {
+		return nil, err
+	}
+
+	infos := make([]dto.ScopeInfoDto, len(permissions))
+	for i, permission := range permissions {
+		description := ""
+		if permission.Description != nil {
+			description = *permission.Description
+		}
+		infos[i] = dto.ScopeInfoDto{Key: permission.Key, Name: permission.Name, Description: description}
+	}
+
+	return infos, nil
+}
+
+// RegisterRoutes mounts the admin CRUD endpoints
+// adminAuth is passed in as a gin handler so the module does not import internal/middleware
+func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, adminAuth gin.HandlerFunc) {
+	apis := apiGroup.Group("/apis")
+	apis.Use(adminAuth)
+	apis.GET("", m.handler.list)
+	apis.POST("", m.handler.create)
+	apis.GET("/:id", m.handler.get)
+	apis.PUT("/:id", m.handler.update)
+	apis.DELETE("/:id", m.handler.delete)
+	apis.PUT("/:id/permissions", m.handler.updatePermissions)
+
+	// The per-client API-access allow-list lives on a separate path so it does not collide with the /apis/:id wildcard
+	access := apiGroup.Group("/api-access")
+	access.Use(adminAuth)
+	access.GET("/:clientId", m.handler.getClientAccess)
+	access.PUT("/:clientId", m.handler.updateClientAccess)
+}

backend/internal/api/service.go

@@ -0,0 +1,484 @@
+package api
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/ory/fosite"
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+// isPermissionKeyReserved reports whether the key is a scope or claim name owned by Pocket ID's built-in identity layer
+// A custom API permission must not reuse one, otherwise its scope string would collide with a standard OIDC scope or claim
+func isPermissionKeyReserved(key string) bool {
+	switch strings.ToLower(key) {
+	case "openid", "profile", "email", "email_verified", "groups", "offline_access":
+		return true
+	default:
+		return false
+	}
+}
+
+// isValidPermissionKey reports whether the key consists only of RFC 6749 scope-token characters, which are printable ASCII without space, double-quote or backslash
+// This keeps a key safe as a space-delimited value in the token scope claim and free of the control character used to qualify consent records
+func isValidPermissionKey(key string) bool {
+	return fosite.IsValidScopeToken(key)
+}
+
+// Service holds the business logic for managing APIs and their permissions
+type Service struct {
+	db     *gorm.DB
+	issuer string
+}
+
+func newService(db *gorm.DB, issuer string) *Service {
+	return &Service{db: db, issuer: issuer}
+}
+
+// isIssuerAudience reports whether the audience refers to Pocket ID itself (the issuer)
+// A custom API must not claim the issuer as its audience, otherwise its tokens would be indistinguishable from Pocket ID's own identity tokens
+func isIssuerAudience(audience, issuer string) bool {
+	return issuer != "" && strings.ToLower(strings.TrimRight(audience, "/")) == issuer
+}
+
+func (s *Service) List(ctx context.Context, search string, listRequestOptions utils.ListRequestOptions) (apis []API, response utils.PaginationResponse, err error) {
+	query := s.db.
+		WithContext(ctx).
+		Preload("Permissions").
+		Model(&API{})
+
+	if listRequestOptions.Sort.Column == "resource" {
+		listRequestOptions.Sort.Column = "audience"
+	}
+
+	if search != "" {
+		like := "%" + search + "%"
+		query = query.Where("name LIKE ? OR audience LIKE ?", like, like)
+	}
+
+	response, err = utils.PaginateFilterAndSort(listRequestOptions, query, &apis)
+	return apis, response, err
+}
+
+// Get loads an API and its permissions
+func (s *Service) Get(ctx context.Context, tx *gorm.DB, id string) (api API, err error) {
+	query := s.db.WithContext(ctx)
+	if tx != nil {
+		query = tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"})
+	}
+
+	err = query.
+		Preload("Permissions").
+		Where("id = ?", id).
+		First(&api).
+		Error
+	return api, err
+}
+
+func (s *Service) Create(ctx context.Context, input apiCreateDto) (api API, err error) {
+	// Reject the issuer as an audience so a custom API cannot impersonate Pocket ID's own identity tokens
+	if isIssuerAudience(input.Resource, s.issuer) {
+		return API{}, &common.ValidationError{Message: "the resource is reserved by Pocket ID and cannot be used for a custom API"}
+	}
+
+	api = API{
+		Name:     input.Name,
+		Audience: input.Resource,
+	}
+
+	err = s.db.WithContext(ctx).Create(&api).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			return API{}, &common.AlreadyInUseError{Property: "resource"}
+		}
+		return API{}, err
+	}
+
+	return api, nil
+}
+
+func (s *Service) Update(ctx context.Context, id string, input apiUpdateDto) (api API, err error) {
+	tx := s.db.Begin()
+	defer func() {
+		tx.Rollback()
+	}()
+
+	api, err = s.Get(ctx, tx, id)
+	if err != nil {
+		return API{}, err
+	}
+
+	api.Name = input.Name
+	api.UpdatedAt = new(datatype.DateTime(time.Now()))
+
+	err = tx.WithContext(ctx).Save(&api).Error
+	if err != nil {
+		return API{}, err
+	}
+
+	if err = tx.Commit().Error; err != nil {
+		return API{}, err
+	}
+
+	return api, nil
+}
+
+func (s *Service) Delete(ctx context.Context, id string) error {
+	tx := s.db.Begin()
+	defer func() {
+		tx.Rollback()
+	}()
+
+	api, err := s.Get(ctx, tx, id)
+	if err != nil {
+		return err
+	}
+
+	if err = s.deletePermissions(ctx, tx, collectIDs(api.Permissions)); err != nil {
+		return err
+	}
+
+	if err = tx.WithContext(ctx).Delete(&API{}, "id = ?", id).Error; err != nil {
+		return err
+	}
+
+	return tx.Commit().Error
+}
+
+// UpdatePermissions replaces the full permission set of an API, matching existing permissions by key
+// Unchanged keys keep their grants, removed keys and their client grants are deleted, and new keys are inserted
+func (s *Service) UpdatePermissions(ctx context.Context, id string, input apiPermissionsUpdateDto) (api API, err error) {
+	tx := s.db.Begin()
+	defer func() {
+		tx.Rollback()
+	}()
+
+	api, err = s.Get(ctx, tx, id)
+	if err != nil {
+		return API{}, err
+	}
+
+	// Reject keys with invalid characters, that collide with Pocket ID's reserved scopes and claims, or that repeat within the request before persisting anything
+	// A duplicate key would otherwise be silently coalesced last-wins into the map below, dropping a row behind a 200
+	seen := make(map[string]struct{}, len(input.Permissions))
+	for _, permission := range input.Permissions {
+		if !isValidPermissionKey(permission.Key) {
+			return API{}, &common.ValidationError{Message: fmt.Sprintf("the permission key %q contains invalid characters", permission.Key)}
+		}
+		if isPermissionKeyReserved(permission.Key) {
+			return API{}, &common.ValidationError{Message: fmt.Sprintf("the permission key %q is reserved by Pocket ID", permission.Key)}
+		}
+		_, ok := seen[permission.Key]
+		if ok {
+			return API{}, &common.ValidationError{Message: fmt.Sprintf("the permission key %q is listed more than once", permission.Key)}
+		}
+		seen[permission.Key] = struct{}{}
+	}
+
+	existing := make(map[string]Permission, len(api.Permissions))
+	for _, p := range api.Permissions {
+		existing[p.Key] = p
+	}
+
+	wanted := make(map[string]apiPermissionInputDto, len(input.Permissions))
+	var removedIDs []string
+	for _, in := range input.Permissions {
+		wanted[in.Key] = in
+	}
+
+	// Delete permissions whose key is no longer wanted
+	for key, p := range existing {
+		if _, ok := wanted[key]; !ok {
+			removedIDs = append(removedIDs, p.ID)
+		}
+	}
+	if err = s.deletePermissions(ctx, tx, removedIDs); err != nil {
+		return API{}, err
+	}
+
+	// Insert new keys and update the display fields of existing ones
+	for key, in := range wanted {
+		if cur, ok := existing[key]; ok {
+			err = tx.WithContext(ctx).
+				Model(&Permission{}).
+				Where("id = ?", cur.ID).
+				Updates(map[string]any{"name": in.Name, "description": in.Description}).
+				Error
+			if err != nil {
+				return API{}, err
+			}
+			continue
+		}
+
+		newPermission := Permission{
+			APIID:       api.ID,
+			Key:         in.Key,
+			Name:        in.Name,
+			Description: in.Description,
+		}
+		if err = tx.WithContext(ctx).Create(&newPermission).Error; err != nil {
+			return API{}, err
+		}
+	}
+
+	err = tx.WithContext(ctx).
+		Model(&API{}).
+		Where("id = ?", api.ID).
+		Update("updated_at", new(datatype.DateTime(time.Now()))).
+		Error
+	if err != nil {
+		return API{}, err
+	}
+
+	api, err = s.Get(ctx, tx, id)
+	if err != nil {
+		return API{}, err
+	}
+
+	if err = tx.Commit().Error; err != nil {
+		return API{}, err
+	}
+
+	return api, nil
+}
+
+// ClientAPIAccess is the set of API permissions granted to a client, split by the subject the resulting tokens act for
+// User-delegated permissions may be requested on behalf of a signed-in user, client permissions may be obtained by the client itself through the client credentials grant
+type ClientAPIAccess struct {
+	UserDelegatedPermissionIDs []string
+	ClientPermissionIDs        []string
+}
+
+// GetClientAPIAccess returns the API permissions a client is allowed to request, split by subject type
+// Only custom-API permissions are tracked here because the identity scopes are freely requestable by every client
+func (s *Service) GetClientAPIAccess(ctx context.Context, clientID string) (access ClientAPIAccess, err error) {
+	var rows []OidcClientAllowedAPIPermission
+	err = s.db.WithContext(ctx).
+		Where("oidc_client_id = ?", clientID).
+		Find(&rows).
+		Error
+	if err != nil {
+		return ClientAPIAccess{}, err
+	}
+
+	for _, row := range rows {
+		switch row.SubjectType {
+		case oidc.SubjectTypeClient:
+			access.ClientPermissionIDs = append(access.ClientPermissionIDs, row.APIPermissionID)
+		case oidc.SubjectTypeUser:
+			access.UserDelegatedPermissionIDs = append(access.UserDelegatedPermissionIDs, row.APIPermissionID)
+		default:
+			// Nop - ignore
+		}
+	}
+
+	return access, nil
+}
+
+// SetClientAPIAccess replaces the client's API-access grants for both subject types with the given permission IDs
+// Unknown permission IDs are ignored
+// It returns the access that was actually applied
+func (s *Service) SetClientAPIAccess(ctx context.Context, clientID string, access ClientAPIAccess) (applied ClientAPIAccess, err error) {
+	tx := s.db.Begin()
+	defer func() {
+		tx.Rollback()
+	}()
+
+	// Ensure the client exists so callers get a 404 for an unknown client
+	var client model.OidcClient
+	if err = tx.WithContext(ctx).Select("id").Where("id = ?", clientID).First(&client).Error; err != nil {
+		return ClientAPIAccess{}, err
+	}
+
+	applied.UserDelegatedPermissionIDs, err = s.filterAssignablePermissionIDs(ctx, tx, access.UserDelegatedPermissionIDs)
+	if err != nil {
+		return ClientAPIAccess{}, err
+	}
+	applied.ClientPermissionIDs, err = s.filterAssignablePermissionIDs(ctx, tx, access.ClientPermissionIDs)
+	if err != nil {
+		return ClientAPIAccess{}, err
+	}
+
+	// Replace the grants for this client
+	err = tx.WithContext(ctx).
+		Where("oidc_client_id = ?", clientID).
+		Delete(&OidcClientAllowedAPIPermission{}).
+		Error
+	if err != nil {
+		return ClientAPIAccess{}, err
+	}
+
+	rows := make([]OidcClientAllowedAPIPermission, 0, len(applied.UserDelegatedPermissionIDs)+len(applied.ClientPermissionIDs))
+	for _, permissionID := range applied.UserDelegatedPermissionIDs {
+		rows = append(rows, OidcClientAllowedAPIPermission{OidcClientID: clientID, APIPermissionID: permissionID, SubjectType: oidc.SubjectTypeUser})
+	}
+	for _, permissionID := range applied.ClientPermissionIDs {
+		rows = append(rows, OidcClientAllowedAPIPermission{OidcClientID: clientID, APIPermissionID: permissionID, SubjectType: oidc.SubjectTypeClient})
+	}
+	if len(rows) > 0 {
+		if err = tx.WithContext(ctx).Create(&rows).Error; err != nil {
+			return ClientAPIAccess{}, err
+		}
+	}
+
+	if err = tx.Commit().Error; err != nil {
+		return ClientAPIAccess{}, err
+	}
+
+	return applied, nil
+}
+
+// ClientAPIScopesAndAudiences returns the permission keys a client may request and the distinct audiences of the custom APIs those permissions belong to, across both subject types
+// The OIDC module uses this to widen fosite's scope and audience validation for the client; the per-flow subject-type enforcement happens when the resource is resolved
+func (s *Service) ClientAPIScopesAndAudiences(ctx context.Context, tx *gorm.DB, clientID string) (scopes []string, audiences []string, err error) {
+	if tx == nil {
+		tx = s.db
+	}
+
+	var rows []struct {
+		Key      string
+		Audience string
+	}
+	err = tx.WithContext(ctx).
+		Table("oidc_clients_allowed_api_permissions AS g").
+		Select("api_permissions.key AS key, apis.audience AS audience").
+		Joins("JOIN api_permissions ON api_permissions.id = g.api_permission_id").
+		Joins("JOIN apis ON apis.id = api_permissions.api_id").
+		Where("g.oidc_client_id = ?", clientID).
+		Scan(&rows).
+		Error
+	if err != nil {
+		return nil, nil, err
+	}
+
+	scopeSeen := make(map[string]struct{}, len(rows))
+	audienceSeen := make(map[string]struct{}, len(rows))
+	scopes = make([]string, 0, len(rows))
+	audiences = make([]string, 0, len(rows))
+	for _, row := range rows {
+		if _, ok := scopeSeen[row.Key]; !ok {
+			scopeSeen[row.Key] = struct{}{}
+			scopes = append(scopes, row.Key)
+		}
+		if _, ok := audienceSeen[row.Audience]; !ok {
+			audienceSeen[row.Audience] = struct{}{}
+			audiences = append(audiences, row.Audience)
+		}
+	}
+
+	return scopes, audiences, nil
+}
+
+// AllowedScopesForAudience returns the permission keys the client is allowed for the API identified by the given audience and subject type, plus whether such an API exists
+func (s *Service) AllowedScopesForAudience(ctx context.Context, tx *gorm.DB, clientID, audience string, subjectType oidc.SubjectType) (scopes []string, apiExists bool, err error) {
+	if tx == nil {
+		tx = s.db
+	}
+
+	var api API
+	err = tx.WithContext(ctx).
+		Select("id").
+		Where("audience = ?", audience).
+		First(&api).
+		Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, err
+	}
+
+	err = tx.WithContext(ctx).
+		Table("api_permissions").
+		Select("api_permissions.key").
+		Joins("JOIN oidc_clients_allowed_api_permissions g ON g.api_permission_id = api_permissions.id AND g.oidc_client_id = ? AND g.subject_type = ?", clientID, subjectType).
+		Where("api_permissions.api_id = ?", api.ID).
+		Pluck("api_permissions.key", &scopes).
+		Error
+	if err != nil {
+		return nil, true, err
+	}
+
+	return scopes, true, nil
+}
+
+// DescribePermissions returns the permission rows of the API identified by the given audience whose key is in keys
+// The consent screen uses these to show friendly names instead of raw scope keys
+func (s *Service) DescribePermissions(ctx context.Context, audience string, keys []string) ([]Permission, error) {
+	if len(keys) == 0 {
+		return nil, nil
+	}
+
+	var permissions []Permission
+	err := s.db.WithContext(ctx).
+		Model(&Permission{}).
+		Joins("JOIN apis ON apis.id = api_permissions.api_id").
+		Where("apis.audience = ? AND api_permissions.key IN ?", audience, keys).
+		Find(&permissions).
+		Error
+	if err != nil {
+		return nil, err
+	}
+
+	return permissions, nil
+}
+
+// filterAssignablePermissionIDs returns the subset of the given permission IDs that exist
+func (s *Service) filterAssignablePermissionIDs(ctx context.Context, tx *gorm.DB, permissionIDs []string) ([]string, error) {
+	if len(permissionIDs) == 0 {
+		return nil, nil
+	}
+
+	var valid []string
+	err := tx.WithContext(ctx).
+		Model(&Permission{}).
+		Where("id IN ?", permissionIDs).
+		Pluck("id", &valid).
+		Error
+	if err != nil {
+		return nil, err
+	}
+
+	return valid, nil
+}
+
+// deletePermissions removes permissions by ID along with any client allow-list grants that reference them
+// The explicit grant delete keeps this correct even when the database does not enforce ON DELETE CASCADE at runtime
+func (s *Service) deletePermissions(ctx context.Context, tx *gorm.DB, permissionIDs []string) error {
+	if tx == nil {
+		tx = s.db
+	}
+	if len(permissionIDs) == 0 {
+		return nil
+	}
+
+	err := tx.WithContext(ctx).
+		Where("api_permission_id IN ?", permissionIDs).
+		Delete(&OidcClientAllowedAPIPermission{}).
+		Error
+	if err != nil {
+		return err
+	}
+
+	return tx.WithContext(ctx).
+		Where("id IN ?", permissionIDs).
+		Delete(&Permission{}).
+		Error
+}
+
+func collectIDs(permissions []Permission) []string {
+	ids := make([]string, len(permissions))
+	for i, p := range permissions {
+		ids[i] = p.ID
+	}
+	return ids
+}

backend/internal/api/service_test.go

@@ -0,0 +1,283 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
+	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
+)
+
+func TestAPICrudAndPermissionDiff(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	created, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders API", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+	assert.NotEmpty(t, created.ID)
+
+	// The resource is unique.
+	_, err = svc.Create(t.Context(), apiCreateDto{Name: "Dup", Resource: "https://api.orders.example.com"})
+	require.ErrorIs(t, err, &common.AlreadyInUseError{})
+
+	desc := "Read orders"
+	updated, err := svc.UpdatePermissions(t.Context(), created.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read orders", Description: &desc},
+		{Key: "write:orders", Name: "Write orders"},
+	}})
+	require.NoError(t, err)
+	assert.Len(t, updated.Permissions, 2)
+
+	// Grant a client the read:orders permission for both subject types, then remove that permission
+	// and confirm the grants are cleaned up while write:orders (and its key) survives.
+	readPerm := findPermission(updated, "read:orders")
+	require.NotNil(t, readPerm)
+	require.NoError(t, db.Create(&model.OidcClient{Base: model.Base{ID: "client-1"}, Name: "Client 1"}).Error)
+	require.NoError(t, db.Create(&OidcClientAllowedAPIPermission{OidcClientID: "client-1", APIPermissionID: readPerm.ID, SubjectType: oidc.SubjectTypeUser}).Error)
+	require.NoError(t, db.Create(&OidcClientAllowedAPIPermission{OidcClientID: "client-1", APIPermissionID: readPerm.ID, SubjectType: oidc.SubjectTypeClient}).Error)
+
+	updated, err = svc.UpdatePermissions(t.Context(), created.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "write:orders", Name: "Write orders (renamed)"},
+	}})
+	require.NoError(t, err)
+	require.Len(t, updated.Permissions, 1)
+	assert.Equal(t, "write:orders", updated.Permissions[0].Key)
+	assert.Equal(t, "Write orders (renamed)", updated.Permissions[0].Name)
+
+	var grantCount int64
+	require.NoError(t, db.Model(&OidcClientAllowedAPIPermission{}).Where("api_permission_id = ?", readPerm.ID).Count(&grantCount).Error)
+	assert.Equal(t, int64(0), grantCount)
+
+	renamed, err := svc.Update(t.Context(), created.ID, apiUpdateDto{Name: "Orders"})
+	require.NoError(t, err)
+	assert.Equal(t, "Orders", renamed.Name)
+	require.NotNil(t, renamed.UpdatedAt)
+
+	require.NoError(t, svc.Delete(t.Context(), created.ID))
+	_, err = svc.Get(t.Context(), nil, created.ID)
+	require.Error(t, err)
+}
+
+func TestClientApiAccessAllowList(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	require.NoError(t, db.Create(&model.OidcClient{Base: model.Base{ID: "client-1"}, Name: "Client 1"}).Error)
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+	orders, err = svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read"},
+		{Key: "write:orders", Name: "Write"},
+	}})
+	require.NoError(t, err)
+	readID := findPermission(orders, "read:orders").ID
+	writeID := findPermission(orders, "write:orders").ID
+
+	// Unknown IDs are filtered out, and the subject types are stored independently.
+	applied, err := svc.SetClientAPIAccess(t.Context(), "client-1", ClientAPIAccess{
+		UserDelegatedPermissionIDs: []string{readID, "does-not-exist"},
+		ClientPermissionIDs:        []string{writeID, "does-not-exist"},
+	})
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{readID}, applied.UserDelegatedPermissionIDs)
+	assert.ElementsMatch(t, []string{writeID}, applied.ClientPermissionIDs)
+
+	got, err := svc.GetClientAPIAccess(t.Context(), "client-1")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{readID}, got.UserDelegatedPermissionIDs)
+	assert.ElementsMatch(t, []string{writeID}, got.ClientPermissionIDs)
+
+	// The same permission can be granted for both subject types, and both sets are fully replaced on each call.
+	_, err = svc.SetClientAPIAccess(t.Context(), "client-1", ClientAPIAccess{
+		UserDelegatedPermissionIDs: []string{readID, writeID},
+		ClientPermissionIDs:        []string{readID},
+	})
+	require.NoError(t, err)
+	got, err = svc.GetClientAPIAccess(t.Context(), "client-1")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{readID, writeID}, got.UserDelegatedPermissionIDs)
+	assert.ElementsMatch(t, []string{readID}, got.ClientPermissionIDs)
+
+	// Clearing one subject type leaves the other untouched.
+	_, err = svc.SetClientAPIAccess(t.Context(), "client-1", ClientAPIAccess{ClientPermissionIDs: []string{readID}})
+	require.NoError(t, err)
+	got, err = svc.GetClientAPIAccess(t.Context(), "client-1")
+	require.NoError(t, err)
+	assert.Empty(t, got.UserDelegatedPermissionIDs)
+	assert.ElementsMatch(t, []string{readID}, got.ClientPermissionIDs)
+
+	// Clearing everything.
+	_, err = svc.SetClientAPIAccess(t.Context(), "client-1", ClientAPIAccess{})
+	require.NoError(t, err)
+	got, err = svc.GetClientAPIAccess(t.Context(), "client-1")
+	require.NoError(t, err)
+	assert.Empty(t, got.UserDelegatedPermissionIDs)
+	assert.Empty(t, got.ClientPermissionIDs)
+
+	// An unknown client is rejected (surfaces as 404 at the HTTP layer).
+	_, err = svc.SetClientAPIAccess(t.Context(), "nope", ClientAPIAccess{UserDelegatedPermissionIDs: []string{readID}})
+	require.Error(t, err)
+}
+
+// TestAllowedScopesForAudienceFiltersBySubjectType guards that the scopes resolved for a flow
+// only come from the grants of that flow's subject type.
+func TestAllowedScopesForAudienceFiltersBySubjectType(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	require.NoError(t, db.Create(&model.OidcClient{Base: model.Base{ID: "client-1"}, Name: "Client 1"}).Error)
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+	orders, err = svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read"},
+		{Key: "write:orders", Name: "Write"},
+	}})
+	require.NoError(t, err)
+	readID := findPermission(orders, "read:orders").ID
+	writeID := findPermission(orders, "write:orders").ID
+
+	_, err = svc.SetClientAPIAccess(t.Context(), "client-1", ClientAPIAccess{
+		UserDelegatedPermissionIDs: []string{readID},
+		ClientPermissionIDs:        []string{writeID},
+	})
+	require.NoError(t, err)
+
+	userScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), nil, "client-1", "https://api.orders.example.com", oidc.SubjectTypeUser)
+	require.NoError(t, err)
+	require.True(t, exists)
+	assert.ElementsMatch(t, []string{"read:orders"}, userScopes)
+
+	clientScopes, exists, err := svc.AllowedScopesForAudience(t.Context(), nil, "client-1", "https://api.orders.example.com", oidc.SubjectTypeClient)
+	require.NoError(t, err)
+	require.True(t, exists)
+	assert.ElementsMatch(t, []string{"write:orders"}, clientScopes)
+
+	// The fosite widening still sees the union of both subject types.
+	scopes, audiences, err := svc.ClientAPIScopesAndAudiences(t.Context(), nil, "client-1")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"read:orders", "write:orders"}, scopes)
+	assert.ElementsMatch(t, []string{"https://api.orders.example.com"}, audiences)
+}
+
+func TestUpdatePermissionsRejectsReservedKeys(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+
+	for _, key := range []string{"openid", "profile", "email", "email_verified", "groups", "offline_access", "Email"} {
+		_, err := svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+			{Key: key, Name: "Reserved"},
+		}})
+		require.Error(t, err, "key %q must be rejected", key)
+		var validationErr *common.ValidationError
+		require.ErrorAs(t, err, &validationErr)
+	}
+}
+
+func TestUpdatePermissionsRejectsDuplicateKeys(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+
+	// Two rows with the same key must be rejected rather than silently coalesced last-wins
+	_, err = svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read"},
+		{Key: "read:orders", Name: "Read again"},
+	}})
+	require.Error(t, err)
+	var validationErr *common.ValidationError
+	require.ErrorAs(t, err, &validationErr)
+}
+
+func TestUpdatePermissionsRejectsInvalidKeyCharacters(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+
+	// A space corrupts the space-delimited scope claim, and the unit separator is the consent delimiter
+	for _, key := range []string{"read orders", "read\x1forders", "read\"orders", "bad\\key", "tab\tkey"} {
+		_, err := svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+			{Key: key, Name: "Invalid"},
+		}})
+		require.Error(t, err, "key %q must be rejected", key)
+		var validationErr *common.ValidationError
+		require.ErrorAs(t, err, &validationErr)
+	}
+
+	// A valid scope-token key is accepted
+	_, err = svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read"},
+	}})
+	require.NoError(t, err)
+}
+
+func TestCreateRejectsIssuerResource(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	const issuer = "https://id.example.com"
+	svc := New(Dependencies{DB: db, Issuer: issuer}).service
+
+	// The issuer itself, a trailing-slash variant, and a different-cased variant are all reserved
+	for _, resource := range []string{issuer, issuer + "/", "https://ID.example.com"} {
+		_, err := svc.Create(t.Context(), apiCreateDto{Name: "Reserved", Resource: resource})
+		require.Error(t, err, "resource %q must be rejected", resource)
+		var validationErr *common.ValidationError
+		require.ErrorAs(t, err, &validationErr)
+	}
+
+	// A normal resource is accepted
+	_, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+}
+
+func TestCreateAcceptsAbsoluteResourceURIs(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	for _, resource := range []string{"https://api.orders.example.com", "api://PocketID", "urn:my-app"} {
+		_, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: resource})
+		require.NoError(t, err, "resource %q must be accepted", resource)
+	}
+}
+
+func TestDescribePermissions(t *testing.T) {
+	db := testutils.NewDatabaseForTest(t)
+	svc := New(Dependencies{DB: db}).service
+
+	orders, err := svc.Create(t.Context(), apiCreateDto{Name: "Orders", Resource: "https://api.orders.example.com"})
+	require.NoError(t, err)
+	desc := "Read orders"
+	_, err = svc.UpdatePermissions(t.Context(), orders.ID, apiPermissionsUpdateDto{Permissions: []apiPermissionInputDto{
+		{Key: "read:orders", Name: "Read orders", Description: &desc},
+		{Key: "write:orders", Name: "Write orders"},
+	}})
+	require.NoError(t, err)
+
+	infos, err := svc.DescribePermissions(t.Context(), "https://api.orders.example.com", []string{"read:orders", "unknown"})
+	require.NoError(t, err)
+	require.Len(t, infos, 1)
+	assert.Equal(t, "read:orders", infos[0].Key)
+	assert.Equal(t, "Read orders", infos[0].Name)
+	require.NotNil(t, infos[0].Description)
+	assert.Equal(t, "Read orders", *infos[0].Description)
+}
+
+func findPermission(api API, key string) *Permission {
+	for i := range api.Permissions {
+		if api.Permissions[i].Key == key {
+			return &api.Permissions[i]
+		}
+	}
+	return nil
+}

backend/internal/apikey/dto.go

@@ -1,20 +1,20 @@
-package dto
+package apikey
 
 import (
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
 )
 
-type ApiKeyCreateDto struct {
+type apiKeyCreateDto struct {
 	Name        string            `json:"name" binding:"required,min=3,max=50" unorm:"nfc"`
 	Description *string           `json:"description" unorm:"nfc"`
 	ExpiresAt   datatype.DateTime `json:"expiresAt" binding:"required"`
 }
 
-type ApiKeyRenewDto struct {
+type apiKeyRenewDto struct {
 	ExpiresAt datatype.DateTime `json:"expiresAt" binding:"required"`
 }
 
-type ApiKeyDto struct {
+type apiKeyDto struct {
 	ID                  string             `json:"id"`
 	Name                string             `json:"name"`
 	Description         *string            `json:"description"`
@@ -24,7 +24,7 @@ type ApiKeyDto struct {
 	ExpirationEmailSent bool               `json:"expirationEmailSent"`
 }
 
-type ApiKeyResponseDto struct {
-	ApiKey ApiKeyDto `json:"apiKey"`
+type apiKeyResponseDto struct {
+	ApiKey apiKeyDto `json:"apiKey"`
 	Token  string    `json:"token"`
 }

backend/internal/apikey/handler.go

@@ -0,0 +1,139 @@
+package apikey
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/pocket-id/pocket-id/backend/internal/dto"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
+)
+
+type handler struct {
+	service *Service
+}
+
+func newHandler(service *Service) *handler {
+	return &handler{service: service}
+}
+
+// list godoc
+// @Summary List API keys
+// @Description Get a paginated list of API keys belonging to the current user
+// @Tags API Keys
+// @Param pagination[page] query int false "Page number for pagination" default(1)
+// @Param pagination[limit] query int false "Number of items per page" default(20)
+// @Param sort[column] query string false "Column to sort by"
+// @Param sort[direction] query string false "Sort direction (asc or desc)" default("asc")
+// @Success 200 {object} dto.Paginated[apiKeyDto]
+// @Router /api/api-keys [get]
+func (h *handler) list(c *gin.Context) {
+	listRequestOptions := utils.ParseListRequestOptions(c)
+
+	userID := c.GetString("userID")
+
+	apiKeys, pagination, err := h.service.ListApiKeys(c.Request.Context(), userID, listRequestOptions)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	var apiKeysDto []apiKeyDto
+	if err := dto.MapStructList(apiKeys, &apiKeysDto); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, dto.Paginated[apiKeyDto]{
+		Data:       apiKeysDto,
+		Pagination: pagination,
+	})
+}
+
+// create godoc
+// @Summary Create API key
+// @Description Create a new API key for the current user
+// @Tags API Keys
+// @Param api_key body apiKeyCreateDto true "API key information"
+// @Success 201 {object} apiKeyResponseDto "Created API key with token"
+// @Router /api/api-keys [post]
+func (h *handler) create(c *gin.Context) {
+	userID := c.GetString("userID")
+
+	var input apiKeyCreateDto
+	if err := dto.ShouldBindWithNormalizedJSON(c, &input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	apiKey, token, err := h.service.CreateApiKey(c.Request.Context(), userID, input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	var responseDto apiKeyDto
+	if err := dto.MapStruct(apiKey, &responseDto); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusCreated, apiKeyResponseDto{
+		ApiKey: responseDto,
+		Token:  token,
+	})
+}
+
+// renew godoc
+// @Summary Renew API key
+// @Description Renew an existing API key by ID
+// @Tags API Keys
+// @Param id path string true "API Key ID"
+// @Success 200 {object} apiKeyResponseDto "Renewed API key with new token"
+// @Router /api/api-keys/{id}/renew [post]
+func (h *handler) renew(c *gin.Context) {
+	userID := c.GetString("userID")
+	apiKeyID := c.Param("id")
+
+	var input apiKeyRenewDto
+	if err := dto.ShouldBindWithNormalizedJSON(c, &input); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	apiKey, token, err := h.service.RenewApiKey(c.Request.Context(), userID, apiKeyID, input.ExpiresAt.ToTime())
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	var responseDto apiKeyDto
+	if err := dto.MapStruct(apiKey, &responseDto); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, apiKeyResponseDto{
+		ApiKey: responseDto,
+		Token:  token,
+	})
+}
+
+// revoke godoc
+// @Summary Revoke API key
+// @Description Revoke (delete) an existing API key by ID
+// @Tags API Keys
+// @Param id path string true "API Key ID"
+// @Success 204 "No Content"
+// @Router /api/api-keys/{id} [delete]
+func (h *handler) revoke(c *gin.Context) {
+	userID := c.GetString("userID")
+	apiKeyID := c.Param("id")
+
+	if err := h.service.RevokeApiKey(c.Request.Context(), userID, apiKeyID); err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.Status(http.StatusNoContent)
+}

backend/internal/apikey/models.go

@@ -1,9 +1,13 @@
-package model
+package apikey
 
-import datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+import (
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+)
 
+// ApiKey is a personal access token a user can use to authenticate against the API
 type ApiKey struct {
-	Base
+	model.Base
 
 	Name                string `sortable:"true"`
 	Key                 string
@@ -13,5 +17,5 @@ type ApiKey struct {
 	ExpirationEmailSent bool
 
 	UserID string
-	User   User
+	User   model.User
 }

backend/internal/apikey/module.go

@@ -0,0 +1,58 @@
+package apikey
+
+import (
+	"context"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+)
+
+type Dependencies struct {
+	DB           *gorm.DB
+	StaticApiKey string
+}
+
+type Module struct {
+	service *Service
+	handler *handler
+}
+
+func New(ctx context.Context, deps Dependencies) (*Module, error) {
+	service, err := newService(ctx, deps.DB, deps.StaticApiKey)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Module{
+		service: service,
+		handler: newHandler(service),
+	}, nil
+}
+
+// RegisterRoutes mounts the API key management endpoints
+// authWithoutApiKey disables API key authentication so an API key cannot be used to mint or renew further API keys
+func (m *Module) RegisterRoutes(apiGroup *gin.RouterGroup, auth, authWithoutApiKey gin.HandlerFunc) {
+	group := apiGroup.Group("/api-keys")
+	group.GET("", auth, m.handler.list)
+	group.POST("", authWithoutApiKey, m.handler.create)
+	group.POST("/:id/renew", authWithoutApiKey, m.handler.renew)
+	group.DELETE("/:id", auth, m.handler.revoke)
+}
+
+// ValidateApiKey resolves the user that owns the given raw API key
+// It is used by the authentication middleware
+func (m *Module) ValidateApiKey(ctx context.Context, apiKey string) (model.User, error) {
+	return m.service.ValidateApiKey(ctx, apiKey)
+}
+
+// ListExpiringApiKeys returns API keys expiring within the given number of days that have not been notified yet
+func (m *Module) ListExpiringApiKeys(ctx context.Context, daysAhead int) ([]ApiKey, error) {
+	return m.service.ListExpiringApiKeys(ctx, daysAhead)
+}
+
+// MarkExpirationEmailSent records that the expiration notification email was sent for the given API key
+func (m *Module) MarkExpirationEmailSent(ctx context.Context, apiKeyID string) error {
+	return m.service.MarkExpirationEmailSent(ctx, apiKeyID)
+}

backend/internal/apikey/service.go

@@ -1,33 +1,32 @@
-package service
+package apikey
 
 import (
 	"context"
 	"errors"
-	"fmt"
 	"time"
 
-	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
-	"github.com/pocket-id/pocket-id/backend/internal/utils/email"
-
-	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
-	"github.com/pocket-id/pocket-id/backend/internal/model"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
 	"gorm.io/gorm"
 	"gorm.io/gorm/clause"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
 )
 
-const staticApiKeyUserID = "00000000-0000-0000-0000-000000000000"
-
-type ApiKeyService struct {
+// Service holds the business logic for managing user API keys
+type Service struct {
 	db           *gorm.DB
-	emailService *EmailService
+	staticApiKey string
 }
 
-func NewApiKeyService(ctx context.Context, db *gorm.DB, emailService *EmailService) (*ApiKeyService, error) {
-	s := &ApiKeyService{db: db, emailService: emailService}
+func newService(ctx context.Context, db *gorm.DB, staticApiKey string) (*Service, error) {
+	s := &Service{
+		db:           db,
+		staticApiKey: staticApiKey,
+	}
 
-	if common.EnvConfig.StaticApiKey == "" {
+	if staticApiKey == "" {
 		err := s.deleteStaticApiKeyUser(ctx)
 		if err != nil {
 			return nil, err
@@ -35,16 +34,15 @@ func NewApiKeyService(ctx context.Context, db *gorm.DB, emailService *EmailServi
 	}
 
 	return s, nil
-
 }
 
-func (s *ApiKeyService) ListApiKeys(ctx context.Context, userID string, listRequestOptions utils.ListRequestOptions) ([]model.ApiKey, utils.PaginationResponse, error) {
+func (s *Service) ListApiKeys(ctx context.Context, userID string, listRequestOptions utils.ListRequestOptions) ([]ApiKey, utils.PaginationResponse, error) {
 	query := s.db.
 		WithContext(ctx).
 		Where("user_id = ?", userID).
-		Model(&model.ApiKey{})
+		Model(&ApiKey{})
 
-	var apiKeys []model.ApiKey
+	var apiKeys []ApiKey
 	pagination, err := utils.PaginateFilterAndSort(listRequestOptions, query, &apiKeys)
 	if err != nil {
 		return nil, utils.PaginationResponse{}, err
@@ -53,19 +51,19 @@ func (s *ApiKeyService) ListApiKeys(ctx context.Context, userID string, listRequ
 	return apiKeys, pagination, nil
 }
 
-func (s *ApiKeyService) CreateApiKey(ctx context.Context, userID string, input dto.ApiKeyCreateDto) (model.ApiKey, string, error) {
+func (s *Service) CreateApiKey(ctx context.Context, userID string, input apiKeyCreateDto) (ApiKey, string, error) {
 	// Check if expiration is in the future
 	if !input.ExpiresAt.ToTime().After(time.Now()) {
-		return model.ApiKey{}, "", &common.APIKeyExpirationDateError{}
+		return ApiKey{}, "", &common.APIKeyExpirationDateError{}
 	}
 
 	// Generate a secure random API key
 	token, err := utils.GenerateRandomAlphanumericString(32)
 	if err != nil {
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
-	apiKey := model.ApiKey{
+	apiKey := ApiKey{
 		Name:        input.Name,
 		Key:         utils.CreateSha256Hash(token), // Hash the token for storage
 		Description: input.Description,
@@ -79,48 +77,48 @@ func (s *ApiKeyService) CreateApiKey(ctx context.Context, userID string, input d
 		Error
 	if err != nil {
 		if errors.Is(err, gorm.ErrDuplicatedKey) {
-			return model.ApiKey{}, "", &common.AlreadyInUseError{Property: "API key name"}
+			return ApiKey{}, "", &common.AlreadyInUseError{Property: "API key name"}
 		}
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
 	// Return the raw token only once - it cannot be retrieved later
 	return apiKey, token, nil
 }
 
-func (s *ApiKeyService) RenewApiKey(ctx context.Context, userID, apiKeyID string, expiration time.Time) (model.ApiKey, string, error) {
+func (s *Service) RenewApiKey(ctx context.Context, userID, apiKeyID string, expiration time.Time) (ApiKey, string, error) {
 	// Check if expiration is in the future
 	if !expiration.After(time.Now()) {
-		return model.ApiKey{}, "", &common.APIKeyExpirationDateError{}
+		return ApiKey{}, "", &common.APIKeyExpirationDateError{}
 	}
 
 	tx := s.db.Begin()
 	defer tx.Rollback()
 
-	var apiKey model.ApiKey
+	var apiKey ApiKey
 	err := tx.
 		WithContext(ctx).
-		Model(&model.ApiKey{}).
+		Model(&ApiKey{}).
 		Where("id = ? AND user_id = ?", apiKeyID, userID).
 		First(&apiKey).
 		Error
 
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return model.ApiKey{}, "", &common.APIKeyNotFoundError{}
+			return ApiKey{}, "", &common.APIKeyNotFoundError{}
 		}
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
 	// Only allow renewal if the key has already expired
 	if apiKey.ExpiresAt.ToTime().After(time.Now()) {
-		return model.ApiKey{}, "", &common.APIKeyNotExpiredError{}
+		return ApiKey{}, "", &common.APIKeyNotExpiredError{}
 	}
 
 	// Generate a secure random API key
 	token, err := utils.GenerateRandomAlphanumericString(32)
 	if err != nil {
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
 	apiKey.Key = utils.CreateSha256Hash(token)
@@ -128,18 +126,18 @@ func (s *ApiKeyService) RenewApiKey(ctx context.Context, userID, apiKeyID string
 
 	err = tx.WithContext(ctx).Save(&apiKey).Error
 	if err != nil {
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
 	if err := tx.Commit().Error; err != nil {
-		return model.ApiKey{}, "", err
+		return ApiKey{}, "", err
 	}
 
 	return apiKey, token, nil
 }
 
-func (s *ApiKeyService) RevokeApiKey(ctx context.Context, userID, apiKeyID string) error {
-	var apiKey model.ApiKey
+func (s *Service) RevokeApiKey(ctx context.Context, userID, apiKeyID string) error {
+	var apiKey ApiKey
 	err := s.db.
 		WithContext(ctx).
 		Where("id = ? AND user_id = ?", apiKeyID, userID).
@@ -155,25 +153,25 @@ func (s *ApiKeyService) RevokeApiKey(ctx context.Context, userID, apiKeyID strin
 	return nil
 }
 
-func (s *ApiKeyService) ValidateApiKey(ctx context.Context, apiKey string) (model.User, error) {
+func (s *Service) ValidateApiKey(ctx context.Context, apiKey string) (model.User, error) {
 	if apiKey == "" {
 		return model.User{}, &common.NoAPIKeyProvidedError{}
 	}
 
-	if common.EnvConfig.StaticApiKey != "" && apiKey == common.EnvConfig.StaticApiKey {
+	if s.staticApiKey != "" && apiKey == s.staticApiKey {
 		return s.initStaticApiKeyUser(ctx)
 	}
 
 	now := time.Now()
 	hashedKey := utils.CreateSha256Hash(apiKey)
 
-	var key model.ApiKey
+	var key ApiKey
 	err := s.db.
 		WithContext(ctx).
-		Model(&model.ApiKey{}).
+		Model(&ApiKey{}).
 		Clauses(clause.Returning{}).
 		Where("key = ? AND expires_at > ?", hashedKey, datatype.DateTime(now)).
-		Updates(&model.ApiKey{
+		Updates(&ApiKey{
 			LastUsedAt: new(datatype.DateTime(now)),
 		}).
 		Preload("User").
@@ -190,8 +188,8 @@ func (s *ApiKeyService) ValidateApiKey(ctx context.Context, apiKey string) (mode
 	return key.User, nil
 }
 
-func (s *ApiKeyService) ListExpiringApiKeys(ctx context.Context, daysAhead int) ([]model.ApiKey, error) {
-	var keys []model.ApiKey
+func (s *Service) ListExpiringApiKeys(ctx context.Context, daysAhead int) ([]ApiKey, error) {
+	var keys []ApiKey
 	now := time.Now()
 	cutoff := now.AddDate(0, 0, daysAhead)
 
@@ -205,40 +203,19 @@ func (s *ApiKeyService) ListExpiringApiKeys(ctx context.Context, daysAhead int)
 	return keys, err
 }
 
-func (s *ApiKeyService) SendApiKeyExpiringSoonEmail(ctx context.Context, apiKey model.ApiKey) error {
-	if apiKey.User.Email == nil {
-		return &common.UserEmailNotSetError{}
-	}
-
-	err := SendEmail(ctx, s.emailService, email.Address{
-		Name:  apiKey.User.FullName(),
-		Email: *apiKey.User.Email,
-	}, ApiKeyExpiringSoonTemplate, &ApiKeyExpiringSoonTemplateData{
-		ApiKeyName: apiKey.Name,
-		ExpiresAt:  apiKey.ExpiresAt.ToTime(),
-		Name:       apiKey.User.FirstName,
-	})
-	if err != nil {
-		return fmt.Errorf("error sending notification email: %w", err)
-	}
-
-	// Mark the API key as having had an expiration email sent
-	err = s.db.WithContext(ctx).
-		Model(&model.ApiKey{}).
-		Where("id = ?", apiKey.ID).
+// MarkExpirationEmailSent records that the expiration notification email was sent for the given API key
+func (s *Service) MarkExpirationEmailSent(ctx context.Context, apiKeyID string) error {
+	return s.db.WithContext(ctx).
+		Model(&ApiKey{}).
+		Where("id = ?", apiKeyID).
 		Update("expiration_email_sent", true).
 		Error
-	if err != nil {
-		return fmt.Errorf("error recording expiration sent email in database: %w", err)
-	}
-
-	return nil
 }
 
-func (s *ApiKeyService) initStaticApiKeyUser(ctx context.Context) (user model.User, err error) {
+func (s *Service) initStaticApiKeyUser(ctx context.Context) (user model.User, err error) {
 	err = s.db.
 		WithContext(ctx).
-		First(&user, "id = ?", staticApiKeyUserID).
+		First(&user, "id = ?", common.StaticApiKeyUserID).
 		Error
 
 	if err == nil {
@@ -256,7 +233,7 @@ func (s *ApiKeyService) initStaticApiKeyUser(ctx context.Context) (user model.Us
 
 	user = model.User{
 		Base: model.Base{
-			ID: staticApiKeyUserID,
+			ID: common.StaticApiKeyUserID,
 		},
 		FirstName:   "Static API User",
 		Username:    "static-api-user-" + usernameSuffix,
@@ -272,9 +249,9 @@ func (s *ApiKeyService) initStaticApiKeyUser(ctx context.Context) (user model.Us
 	return user, err
 }
 
-func (s *ApiKeyService) deleteStaticApiKeyUser(ctx context.Context) error {
+func (s *Service) deleteStaticApiKeyUser(ctx context.Context) error {
 	return s.db.
 		WithContext(ctx).
-		Delete(&model.User{}, "id = ?", staticApiKeyUserID).
+		Delete(&model.User{}, "id = ?", common.StaticApiKeyUserID).
 		Error
 }

backend/internal/bootstrap/actors_bootstrap.go

@@ -0,0 +1,171 @@
+package bootstrap
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/italypaleale/francis/builtin/ratelimit"
+	"github.com/italypaleale/francis/components/postgres"
+	"github.com/italypaleale/francis/host/local"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"gorm.io/gorm"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/job"
+	"github.com/pocket-id/pocket-id/backend/internal/middleware"
+	"github.com/pocket-id/pocket-id/backend/internal/storage"
+	"github.com/pocket-id/pocket-id/backend/internal/utils/crypto"
+)
+
+type NewActorsOpts struct {
+	SQLite   *sql.DB
+	Postgres *pgxpool.Pool
+
+	EnvConfig   *common.EnvConfigSchema
+	InstanceID  string
+	HttpClient  *http.Client
+	DB          *gorm.DB
+	FileStorage storage.FileStorage
+}
+
+func NewActors(o NewActorsOpts) (*local.Host, map[string]*ratelimit.RateLimitService, error) {
+	log := slog.Default()
+
+	// Derive a PSK from the global encryption key
+	// The runtime PSK derives the cluster CA used for host-to-host mTLS
+	psk, err := o.getPSK()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to derive PSK: %w", err)
+	}
+
+	// Options for the host
+	opts := []local.HostOption{
+		local.WithAddress(net.JoinHostPort(o.EnvConfig.ActorsHost, o.EnvConfig.ActorsPort)),
+		local.WithLogger(log.With("scope", "actor-host")),
+		local.WithRuntimePSKs(psk),
+		local.WithShutdownGracePeriod(10 * time.Second),
+	}
+
+	// Add the database connection
+	providerOpt, err := o.getProvider()
+	if err != nil {
+		return nil, nil, err
+	}
+	opts = append(opts, providerOpt)
+
+	// Create a new actor host
+	h, err := local.NewHost(opts...)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create actor host: %w", err)
+	}
+
+	// Add all cron jobs
+	err = o.registerCronJobs(h)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Add the rate limiters
+	rateLimiters, err := o.registerRateLimiters(h)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// Bind a service for each rate limiter so the middleware can invoke them
+	rateLimitServices := make(map[string]*ratelimit.RateLimitService, len(rateLimiters))
+	for name, rl := range rateLimiters {
+		rateLimitServices[name] = rl.Service(h.Service())
+	}
+
+	return h, rateLimitServices, nil
+}
+
+// Derive a PSK from the global encryption key
+func (o *NewActorsOpts) getPSK() ([]byte, error) {
+	// This is tied to the instance ID of the Pocket ID deployment/cluster
+	// Note: changing the key derivation or the seed is a breaking change
+	return crypto.DeriveKey(o.EnvConfig.EncryptionKey, "pocketid/actors-psk/"+o.InstanceID)
+}
+
+func (o *NewActorsOpts) getProvider() (local.HostOption, error) {
+	switch {
+	case o.Postgres != nil && o.SQLite != nil:
+		return nil, errors.New("cannot have both Postgres and SQLite connections")
+	case o.Postgres != nil:
+		return local.WithPostgresProvider(postgres.PostgresProviderOptions{
+			DB: o.Postgres,
+		}), nil
+	case o.SQLite != nil:
+		return local.WithSQLiteProvider(local.SQLiteProviderOptions{
+			DB: o.SQLite,
+		}), nil
+	default:
+		return nil, errors.New("one of Postgres and SQLite must be set")
+	}
+}
+
+func (o *NewActorsOpts) registerCronJobs(host *local.Host) (err error) {
+	// In test mode, we do not register anything
+	if common.EnvConfig.AppEnv == "test" {
+		return nil
+	}
+
+	// Register the analytics job
+	analyticsJob, err := job.GetAnalyticsJob(o.HttpClient, o.InstanceID)
+	if err != nil {
+		return fmt.Errorf("failed to get analytics cron job: %w", err)
+	}
+
+	// This could be nil if analytics are disabled
+	if analyticsJob != nil {
+		err = host.RegisterBuiltInActor(analyticsJob)
+		if err != nil {
+			return fmt.Errorf("error registering built-in actor for analytics job: %w", err)
+		}
+	}
+
+	// Register the file cleanup jobs
+	fileCleanupJobs, err := job.GetFileCleanupJobs(o.DB, o.FileStorage)
+	if err != nil {
+		return fmt.Errorf("failed to get file cleanup cron jobs: %w", err)
+	}
+	for _, j := range fileCleanupJobs {
+		err = host.RegisterBuiltInActor(j)
+		if err != nil {
+			return fmt.Errorf("error registering built-in actor for cleanup job: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// registerRateLimiters creates a built-in rate-limit actor for each middleware policy and returns both the created actors (keyed by policy name) and the host options to register them
+// Unlike cron jobs, rate limiters keep no durable state, so they are registered in every environment
+func (o *NewActorsOpts) registerRateLimiters(host *local.Host) (actors map[string]*ratelimit.RateLimit, err error) {
+	policies := middleware.RateLimitPolicies()
+	actors = make(map[string]*ratelimit.RateLimit, len(policies))
+	for _, p := range policies {
+		rl, err := ratelimit.New(
+			p.Name,
+			ratelimit.WithRate(p.Rate),
+			ratelimit.WithPer(p.Per),
+			ratelimit.WithBurst(p.Burst),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("error creating rate limiter %q: %w", p.Name, err)
+		}
+		actors[p.Name] = rl
+
+		err = host.RegisterBuiltInActor(rl)
+		if err != nil {
+			return nil, fmt.Errorf("error registering built-in actor for rate limiter '%s': %w", p.Name, err)
+		}
+	}
+
+	return actors, nil
+}

backend/internal/bootstrap/actors_bootstrap_test.go

@@ -0,0 +1,28 @@
+package bootstrap
+
+import (
+	"encoding/hex"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+)
+
+func TestNewActorsOptsGetPSKUsesStableValue(t *testing.T) {
+	opts := NewActorsOpts{
+		EnvConfig: &common.EnvConfigSchema{
+			EncryptionKey: []byte("test-encryption-key"),
+		},
+		// Constant value for this test
+		InstanceID: "ee05c3eb-8129-47a6-a1c7-849998b6f876",
+	}
+
+	expectedHex := "db09067fa194c3731bf77b6415a1c5d903f03d4557605ba3236b31f6eddfc8d7"
+	expected, err := hex.DecodeString(expectedHex)
+	require.NoError(t, err)
+
+	actual, err := opts.getPSK()
+	require.NoError(t, err)
+	require.Equalf(t, expected, actual, "actual result: %s", actual)
+}

backend/internal/bootstrap/bootstrap.go

@@ -8,59 +8,105 @@ import (
 	"time"
 
 	_ "github.com/golang-migrate/migrate/v4/source/file"
+
+	"github.com/italypaleale/francis/host/local"
+	"github.com/italypaleale/go-kit/servicerunner"
 	"gorm.io/gorm"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	"github.com/pocket-id/pocket-id/backend/internal/job"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
 )
 
 func Bootstrap(ctx context.Context) error {
-	var shutdownFns []utils.Service
-	defer func() { //nolint:contextcheck
-		// Invoke all shutdown functions on exit
-		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if err := utils.NewServiceRunner(shutdownFns...).Run(shutdownCtx); err != nil {
-			slog.Error("Error during graceful shutdown", "error", err)
-		}
-	}()
+	// List of services to run
+	services := make([]servicerunner.Service, 0, 3)
+	shutdowns := &shutdownManager{
+		fns: make([]servicerunner.Service, 0, 4),
+	}
 
 	// Initialize the observability stack, including the logger, distributed tracing, and metrics
-	shutdownFns, httpClient, err := initObservability(ctx, common.EnvConfig.MetricsEnabled, common.EnvConfig.TracingEnabled)
+	shutdownFns, httpClient, err := initObservability(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize OpenTelemetry: %w", err)
 	}
+	shutdowns.Add(shutdownFns...)
+
 	slog.InfoContext(ctx, "Pocket ID is starting")
 
-	db, err := NewDatabase()
+	// Init database
+	db, pg, err := NewDatabase(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to initialize database: %w", err)
 	}
+	if pg != nil {
+		defer func() {
+			// Close the database connection pool only after the shutdown functions have run: some of them (e.g. releasing the application lock) still need to query the database.
+			pg.Close()
+		}()
+	}
 
+	// Load the instance ID
+	// This is stored in the "kv" table, and generated on first startup
+	instanceID, err := instanceid.Load(ctx, db)
+	if err != nil {
+		return fmt.Errorf("failed to initialize instance ID: %w", err)
+	}
+
+	// Init storage
 	fileStorage, err := InitStorage(ctx, db)
 	if err != nil {
 		return fmt.Errorf("failed to initialize file storage (backend: %s): %w", common.EnvConfig.FileBackend, err)
 	}
 
+	// Init application images
 	imageExtensions, err := initApplicationImages(ctx, fileStorage)
 	if err != nil {
 		return fmt.Errorf("failed to initialize application images: %w", err)
 	}
 
+	// Init the scheduler
 	scheduler, err := job.NewScheduler()
 	if err != nil {
 		return fmt.Errorf("failed to create job scheduler: %w", err)
 	}
 
+	// Init the actors
+	// The actor host is created and started before the services, so services can depend on it once it's ready
+	actorsOpts := NewActorsOpts{
+		Postgres: pg,
+
+		EnvConfig:   &common.EnvConfig,
+		InstanceID:  instanceID,
+		HttpClient:  httpClient,
+		DB:          db,
+		FileStorage: fileStorage,
+	}
+	if pg == nil {
+		actorsOpts.SQLite, err = db.DB()
+		if err != nil {
+			return fmt.Errorf("failed to get *sql.DB connection from Gorm: %w", err)
+		}
+	}
+	actors, rateLimitServices, err := NewActors(actorsOpts)
+	if err != nil {
+		return fmt.Errorf("failed to initialize actors: %w", err)
+	}
+
+	// Run the actor host as a background service and get a "ready" signal that other services can wait on
+	actorsRun, actorsReady := actorsRunServiceFn(actors)
+	services = append(services, actorsRun)
+
 	// Create all services
-	svc, err := initServices(ctx, db, httpClient, imageExtensions, fileStorage, scheduler)
+	svc, err := initServices(ctx, db, instanceID, httpClient, imageExtensions, fileStorage, scheduler)
 	if err != nil {
 		return fmt.Errorf("failed to initialize services: %w", err)
 	}
+	services = append(services, svc.appLockService.RunRenewal)
 
+	// Acquire the lock from the app lock service
 	waitUntil, err := svc.appLockService.Acquire(ctx, false)
 	if errors.Is(err, service.ErrLockUnavailable) {
 		return errors.New("it appears that there's already one instance of Pocket ID running; running multiple replicas of Pocket ID is currently not supported")
@@ -74,43 +120,78 @@ func Bootstrap(ctx context.Context) error {
 	case <-time.After(time.Until(waitUntil)):
 	}
 
-	shutdownFn := func(shutdownCtx context.Context) error {
+	shutdowns.Add(func(shutdownCtx context.Context) error {
 		sErr := svc.appLockService.Release(shutdownCtx)
 		if sErr != nil {
 			return fmt.Errorf("failed to release application lock: %w", sErr)
 		}
 		return nil
-	}
-	shutdownFns = append(shutdownFns, shutdownFn)
+	})
 
-	// Register scheduled jobs
-	err = registerScheduledJobs(ctx, db, svc, httpClient, scheduler)
-	if err != nil {
-		return fmt.Errorf("failed to register scheduled jobs: %w", err)
+	// Register scheduled jobs, only in non-test mode
+	if common.EnvConfig.AppEnv != "test" {
+		err = registerScheduledJobs(ctx, db, svc, scheduler)
+		if err != nil {
+			return fmt.Errorf("failed to register scheduled jobs: %w", err)
+		}
+		services = append(services, scheduler.Run)
 	}
 
 	// Init the router
-	router, err := initRouter(db, svc)
+	// The rate-limit middleware invokes the actor host with each request's own context, so the setup context is intentionally not threaded through the router
+	//nolint:contextcheck
+	router, err := initRouter(db, svc, rateLimitServices)
 	if err != nil {
 		return fmt.Errorf("failed to initialize router: %w", err)
 	}
 
+	// The router must wait on the actor host being ready, since the rate-limit middleware invokes actors
+	services = append(services, actorsReady.Await(router))
+
 	// Run all background services
 	// This call blocks until the context is canceled
-	services := []utils.Service{svc.appLockService.RunRenewal, router}
-
-	if common.EnvConfig.AppEnv != "test" {
-		services = append(services, scheduler.Run)
-	}
-
-	err = utils.NewServiceRunner(services...).Run(ctx)
+	err = servicerunner.NewServiceRunner(services...).Run(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to run services: %w", err)
 	}
 
+	// Run all shutdown functions
+	shutdowns.Run(ctx)
+
 	return nil
 }
 
+// actorsRunServiceFn wraps the actor host's Run method in a background service and returns a "ready" signal that other services can wait on
+func actorsRunServiceFn(actors *local.Host) (servicerunner.Service, *servicerunner.Ready) {
+	actorsReady := servicerunner.NewReady()
+	fn := func(ctx context.Context) error {
+		runErrCh := make(chan error, 1)
+		go func() {
+			runErrCh <- actors.Run(ctx)
+		}()
+
+		// Wait for the right signal
+		select {
+		case <-actors.Ready():
+			// Actor host is ready, signal actorsReady
+			actorsReady.Signal()
+		case runErr := <-runErrCh:
+			// Run returned with an error
+			return runErr
+		case <-ctx.Done():
+			// Context canceled
+			return ctx.Err()
+		}
+
+		// Now the actor host is running
+		// This goroutine must stay up until the actor host returns
+		// Here, context cancellation will surface through this channel too
+		return <-runErrCh
+	}
+
+	return fn, actorsReady
+}
+
 func InitStorage(ctx context.Context, db *gorm.DB) (fileStorage storage.FileStorage, err error) {
 	switch common.EnvConfig.FileBackend {
 	case storage.TypeFileSystem:
@@ -138,3 +219,30 @@ func InitStorage(ctx context.Context, db *gorm.DB) (fileStorage storage.FileStor
 
 	return fileStorage, nil
 }
+
+type shutdownManager struct {
+	fns []servicerunner.Service
+}
+
+func (s *shutdownManager) Add(fns ...servicerunner.Service) {
+	for _, fn := range fns {
+		if fn == nil {
+			continue
+		}
+
+		s.fns = append(s.fns, fn)
+	}
+}
+
+func (s *shutdownManager) Run(ctx context.Context) {
+	// Cleanup functions are one-shot and must each run to completion independently, so we set WaitAll to true
+	sr := servicerunner.NewServiceRunner(s.fns...)
+	sr.WaitAll = true
+
+	shutdownCtx, shutdownCancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+	defer shutdownCancel()
+	err := sr.Run(shutdownCtx)
+	if err != nil {
+		slog.ErrorContext(ctx, "Error shutting down services", slog.Any("error", err))
+	}
+}

backend/internal/bootstrap/db_bootstrap.go

@@ -1,74 +1,76 @@
 package bootstrap
 
 import (
+	"context"
 	"database/sql"
 	"errors"
 	"fmt"
 	"log/slog"
-	"net/url"
-	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
-	"github.com/glebarez/sqlite"
 	_ "github.com/golang-migrate/migrate/v4/source/github"
+	sqlitekit "github.com/italypaleale/go-sql-utils/sqlite"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/jackc/pgx/v5/stdlib"
+	"github.com/libtnb/sqlite"
 	slogGorm "github.com/orandin/slog-gorm"
 	"gorm.io/driver/postgres"
 	"gorm.io/gorm"
 	gormLogger "gorm.io/gorm/logger"
+	tracingGorm "gorm.io/plugin/opentelemetry/tracing"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
 	sqliteutil "github.com/pocket-id/pocket-id/backend/internal/utils/sqlite"
 )
 
-func NewDatabase() (db *gorm.DB, err error) {
-	db, err = ConnectDatabase()
+func NewDatabase(ctx context.Context) (db *gorm.DB, pg *pgxpool.Pool, err error) {
+	db, pg, err = ConnectDatabase(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("failed to connect to database: %w", err)
+		return nil, nil, fmt.Errorf("failed to connect to database: %w", err)
 	}
 	sqlDb, err := db.DB()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get sql.DB: %w", err)
+		return nil, nil, fmt.Errorf("failed to get sql.DB: %w", err)
 	}
 
 	// Run migrations
-	err = utils.MigrateDatabase(sqlDb)
+	err = utils.MigrateDatabase(ctx, sqlDb)
 	if err != nil {
-		return nil, fmt.Errorf("failed to run migrations: %w", err)
+		return nil, nil, fmt.Errorf("failed to run migrations: %w", err)
 	}
 
-	return db, nil
+	return db, pg, nil
 }
 
-func ConnectDatabase() (db *gorm.DB, err error) {
-	var (
-		dialector               gorm.Dialector
-		sqliteNetworkFilesystem bool
-	)
+//nolint:gocognit
+func ConnectDatabase(ctx context.Context) (db *gorm.DB, pg *pgxpool.Pool, err error) {
+	var dialector gorm.Dialector
 
 	// Choose the correct database provider
 	var onConnFn func(conn *sql.DB)
 	switch common.EnvConfig.DbProvider {
 	case common.DbProviderSqlite:
 		if common.EnvConfig.DbConnectionString == "" {
-			return nil, errors.New("missing required env var 'DB_CONNECTION_STRING' for SQLite database")
+			return nil, nil, errors.New("missing required env var 'DB_CONNECTION_STRING' for SQLite database")
 		}
 
 		sqliteutil.RegisterSqliteFunctions()
 
-		connString, dbPath, isMemoryDB, err := parseSqliteConnectionString(common.EnvConfig.DbConnectionString)
+		connString, dbPath, isMemoryDB, err := sqlitekit.ParseConnectionString(common.EnvConfig.DbConnectionString, slog.Default())
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		if !isMemoryDB {
-			if err := ensureSqliteDatabaseDir(dbPath); err != nil {
-				return nil, err
+			err = sqlitekit.EnsureDatabaseDir(dbPath)
+			if err != nil {
+				return nil, nil, err
 			}
 
-			sqliteNetworkFilesystem, err = utils.IsNetworkedFileSystem(filepath.Dir(dbPath))
+			var sqliteNetworkFilesystem bool
+			sqliteNetworkFilesystem, err = sqlitekit.IsNetworkedFileSystem(filepath.Dir(dbPath))
 			if err != nil {
 				// Log the error only
 				slog.Warn("Failed to detect filesystem type for the SQLite database directory", slog.String("path", filepath.Dir(dbPath)), slog.Any("error", err))
@@ -78,9 +80,9 @@ func ConnectDatabase() (db *gorm.DB, err error) {
 		}
 
 		// Before we connect, also make sure that there's a temporary folder for SQLite to write its data
-		err = ensureSqliteTempDir(filepath.Dir(dbPath))
+		err = sqlitekit.EnsureTempDir(filepath.Dir(dbPath), slog.Default())
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 
 		if isMemoryDB {
@@ -94,13 +96,33 @@ func ConnectDatabase() (db *gorm.DB, err error) {
 		dialector = sqlite.Open(connString)
 	case common.DbProviderPostgres:
 		if common.EnvConfig.DbConnectionString == "" {
-			return nil, errors.New("missing required env var 'DB_CONNECTION_STRING' for Postgres database")
+			return nil, nil, errors.New("missing required env var 'DB_CONNECTION_STRING' for Postgres database")
 		}
-		dialector = postgres.Open(common.EnvConfig.DbConnectionString)
+
+		// We need a pgxpool object for francis, so we open this as a pgxpool...
+		pg, err = pgxpool.New(ctx, common.EnvConfig.DbConnectionString)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to create Postgres pool: %w", err)
+		}
+
+		// ...test it with a ping...
+		pingCtx, pingCancel := context.WithTimeout(ctx, 10*time.Second)
+		defer pingCancel()
+		err = pg.Ping(pingCtx)
+		if err != nil {
+			pg.Close()
+			return nil, nil, fmt.Errorf("failed to ping Postgres database: %w", err)
+		}
+
+		// ...then create the dialector by adapting it to *sql.DB
+		dialector = postgres.New(postgres.Config{
+			Conn: stdlib.OpenDBFromPool(pg),
+		})
 	default:
-		return nil, fmt.Errorf("unsupported database provider: %s", common.EnvConfig.DbProvider)
+		return nil, nil, fmt.Errorf("unsupported database provider: %s", common.EnvConfig.DbProvider)
 	}
 
+	// Try connecting up to 3 times
 	for i := 1; i <= 3; i++ {
 		db, err = gorm.Open(dialector, &gorm.Config{
 			TranslateError: true,
@@ -109,268 +131,40 @@ func ConnectDatabase() (db *gorm.DB, err error) {
 		if err == nil {
 			slog.Info("Connected to database", slog.String("provider", string(common.EnvConfig.DbProvider)))
 
+			// Configure tracing and metrics
+			err = db.Use(tracingGorm.NewPlugin())
+			if err != nil {
+				return nil, nil, fmt.Errorf("failed to configure tracing for DB: %w", err)
+			}
+
+			// Invoke the onConnFn callback if any
 			if onConnFn != nil {
 				conn, err := db.DB()
 				if err != nil {
-					slog.Warn("Failed to get database connection, will retry in 3s", slog.Int("attempt", i), slog.String("provider", string(common.EnvConfig.DbProvider)), slog.Any("error", err))
-					time.Sleep(3 * time.Second)
+					if pg != nil {
+						pg.Close()
+					}
+					return nil, nil, fmt.Errorf("failed to get database connection for onConnFn callback: %w", err)
 				}
+
 				onConnFn(conn)
 			}
 
-			return db, nil
+			return db, pg, nil
 		}
 
+		// If we're here, the connection failed
 		slog.Warn("Failed to connect to database, will retry in 3s", slog.Int("attempt", i), slog.String("provider", string(common.EnvConfig.DbProvider)), slog.Any("error", err))
 		time.Sleep(3 * time.Second)
 	}
 
 	slog.Error("Failed to connect to database after 3 attempts", slog.String("provider", string(common.EnvConfig.DbProvider)), slog.Any("error", err))
 
-	return nil, err
-}
-
-func parseSqliteConnectionString(connString string) (parsedConnString string, dbPath string, isMemoryDB bool, err error) {
-	if !strings.HasPrefix(connString, "file:") {
-		connString = "file:" + connString
+	if pg != nil {
+		pg.Close()
 	}
 
-	// Check if we're using an in-memory database
-	isMemoryDB = isSqliteInMemory(connString)
-
-	// Parse the connection string
-	connStringUrl, err := url.Parse(connString)
-	if err != nil {
-		return "", "", false, fmt.Errorf("failed to parse SQLite connection string: %w", err)
-	}
-
-	// Convert options for the old SQLite driver to the new one
-	convertSqlitePragmaArgs(connStringUrl)
-
-	// Add the default and required params
-	err = addSqliteDefaultParameters(connStringUrl, isMemoryDB)
-	if err != nil {
-		return "", "", false, fmt.Errorf("invalid SQLite connection string: %w", err)
-	}
-
-	// Get the absolute path to the database
-	// Here, we know for a fact that the ? is present
-	parsedConnString = connStringUrl.String()
-	idx := strings.IndexRune(parsedConnString, '?')
-	dbPath, err = filepath.Abs(parsedConnString[len("file:"):idx])
-	if err != nil {
-		return "", "", false, fmt.Errorf("failed to determine absolute path to the database: %w", err)
-	}
-
-	return parsedConnString, dbPath, isMemoryDB, nil
-}
-
-// The official C implementation of SQLite allows some additional properties in the connection string
-// that are not supported in the in the modernc.org/sqlite driver, and which must be passed as PRAGMA args instead.
-// To ensure that people can use similar args as in the C driver, which was also used by Pocket ID
-// previously (via github.com/mattn/go-sqlite3), we are converting some options.
-// Note this function updates connStringUrl.
-func convertSqlitePragmaArgs(connStringUrl *url.URL) {
-	// Reference: https://github.com/mattn/go-sqlite3?tab=readme-ov-file#connection-string
-	// This only includes a subset of options, excluding those that are not relevant to us
-	qs := make(url.Values, len(connStringUrl.Query()))
-	for k, v := range connStringUrl.Query() {
-		switch strings.ToLower(k) {
-		case "_auto_vacuum", "_vacuum":
-			qs.Add("_pragma", "auto_vacuum("+v[0]+")")
-		case "_busy_timeout", "_timeout":
-			qs.Add("_pragma", "busy_timeout("+v[0]+")")
-		case "_case_sensitive_like", "_cslike":
-			qs.Add("_pragma", "case_sensitive_like("+v[0]+")")
-		case "_foreign_keys", "_fk":
-			qs.Add("_pragma", "foreign_keys("+v[0]+")")
-		case "_locking_mode", "_locking":
-			qs.Add("_pragma", "locking_mode("+v[0]+")")
-		case "_secure_delete":
-			qs.Add("_pragma", "secure_delete("+v[0]+")")
-		case "_synchronous", "_sync":
-			qs.Add("_pragma", "synchronous("+v[0]+")")
-		default:
-			// Pass other query-string args as-is
-			qs[k] = v
-		}
-	}
-
-	// Update the connStringUrl object
-	connStringUrl.RawQuery = qs.Encode()
-}
-
-// Adds the default (and some required) parameters to the SQLite connection string.
-// Note this function updates connStringUrl.
-func addSqliteDefaultParameters(connStringUrl *url.URL, isMemoryDB bool) error {
-	// This function include code adapted from https://github.com/dapr/components-contrib/blob/v1.14.6/
-	// Copyright (C) 2023 The Dapr Authors
-	// License: Apache2
-	const defaultBusyTimeout = 2500 * time.Millisecond
-
-	// Get the "query string" from the connection string if present
-	qs := connStringUrl.Query()
-	if len(qs) == 0 {
-		qs = make(url.Values, 2)
-	}
-
-	// Check if the database is read-only or immutable
-	isReadOnly := false
-	if len(qs["mode"]) > 0 {
-		// Keep the first value only
-		qs["mode"] = []string{
-			strings.ToLower(qs["mode"][0]),
-		}
-		if qs["mode"][0] == "ro" {
-			isReadOnly = true
-		}
-	}
-	if len(qs["immutable"]) > 0 {
-		// Keep the first value only
-		qs["immutable"] = []string{
-			strings.ToLower(qs["immutable"][0]),
-		}
-		if qs["immutable"][0] == "1" {
-			isReadOnly = true
-		}
-	}
-
-	// We do not want to override a _txlock if set, but we'll show a warning if it's not "immediate"
-	if len(qs["_txlock"]) > 0 {
-		// Keep the first value only
-		qs["_txlock"] = []string{
-			strings.ToLower(qs["_txlock"][0]),
-		}
-		if qs["_txlock"][0] != "immediate" {
-			slog.Warn("SQLite connection is being created with a _txlock different from the recommended value 'immediate'")
-		}
-	} else {
-		qs["_txlock"] = []string{"immediate"}
-	}
-
-	// Add pragma values
-	var hasBusyTimeout, hasJournalMode bool
-	if len(qs["_pragma"]) == 0 {
-		qs["_pragma"] = make([]string, 0, 3)
-	} else {
-		for _, p := range qs["_pragma"] {
-			p = strings.ToLower(p)
-			switch {
-			case strings.HasPrefix(p, "busy_timeout"):
-				hasBusyTimeout = true
-			case strings.HasPrefix(p, "journal_mode"):
-				hasJournalMode = true
-			case strings.HasPrefix(p, "foreign_keys"):
-				return errors.New("found forbidden option '_pragma=foreign_keys' in the connection string")
-			}
-		}
-	}
-	if !hasBusyTimeout {
-		qs["_pragma"] = append(qs["_pragma"], fmt.Sprintf("busy_timeout(%d)", defaultBusyTimeout.Milliseconds()))
-	}
-	if !hasJournalMode {
-		switch {
-		case isMemoryDB:
-			// For in-memory databases, set the journal to MEMORY, the only allowed option besides OFF (which would make transactions ineffective)
-			qs["_pragma"] = append(qs["_pragma"], "journal_mode(MEMORY)")
-		case isReadOnly:
-			// Set the journaling mode to "DELETE" (the default) if the database is read-only
-			qs["_pragma"] = append(qs["_pragma"], "journal_mode(DELETE)")
-		default:
-			// Enable WAL
-			qs["_pragma"] = append(qs["_pragma"], "journal_mode(WAL)")
-		}
-	}
-
-	// Forcefully enable foreign keys
-	qs["_pragma"] = append(qs["_pragma"], "foreign_keys(1)")
-
-	// Update the connStringUrl object
-	connStringUrl.RawQuery = qs.Encode()
-
-	return nil
-}
-
-// isSqliteInMemory returns true if the connection string is for an in-memory database.
-func isSqliteInMemory(connString string) bool {
-	lc := strings.ToLower(connString)
-
-	// First way to define an in-memory database is to use ":memory:" or "file::memory:" as connection string
-	if strings.HasPrefix(lc, ":memory:") || strings.HasPrefix(lc, "file::memory:") {
-		return true
-	}
-
-	// Another way is to pass "mode=memory" in the "query string"
-	idx := strings.IndexRune(lc, '?')
-	if idx < 0 {
-		return false
-	}
-	qs, _ := url.ParseQuery(lc[(idx + 1):])
-
-	return len(qs["mode"]) > 0 && qs["mode"][0] == "memory"
-}
-
-// ensureSqliteDatabaseDir creates the parent directory for the SQLite database file if it doesn't exist yet
-func ensureSqliteDatabaseDir(dbPath string) error {
-	dir := filepath.Dir(dbPath)
-
-	info, err := os.Stat(dir)
-	switch {
-	case err == nil:
-		if !info.IsDir() {
-			return fmt.Errorf("SQLite database directory '%s' is not a directory", dir)
-		}
-		return nil
-	case os.IsNotExist(err):
-		if err := os.MkdirAll(dir, 0700); err != nil {
-			return fmt.Errorf("failed to create SQLite database directory '%s': %w", dir, err)
-		}
-		return nil
-	default:
-		return fmt.Errorf("failed to check SQLite database directory '%s': %w", dir, err)
-	}
-}
-
-// ensureSqliteTempDir ensures that SQLite has a directory where it can write temporary files if needed
-// The default directory may not be writable when using a container with a read-only root file system
-// See: https://www.sqlite.org/tempfiles.html
-func ensureSqliteTempDir(dbPath string) error {
-	// Per docs, SQLite tries these folders in order (excluding those that aren't applicable to us):
-	//
-	// - The SQLITE_TMPDIR environment variable
-	// - The TMPDIR environment variable
-	// - /var/tmp
-	// - /usr/tmp
-	// - /tmp
-	//
-	// Source: https://www.sqlite.org/tempfiles.html#temporary_file_storage_locations
-	//
-	// First, let's check if SQLITE_TMPDIR or TMPDIR are set, in which case we trust the user has taken care of the problem already
-	if os.Getenv("SQLITE_TMPDIR") != "" || os.Getenv("TMPDIR") != "" {
-		return nil
-	}
-
-	// Now, let's check if /var/tmp, /usr/tmp, or /tmp exist and are writable
-	for _, dir := range []string{"/var/tmp", "/usr/tmp", "/tmp"} {
-		ok, err := utils.IsWritableDir(dir)
-		if err != nil {
-			return fmt.Errorf("failed to check if %s is writable: %w", dir, err)
-		}
-		if ok {
-			// We found a folder that's writable
-			return nil
-		}
-	}
-
-	// If we're here, there's no temporary directory that's writable (not unusual for containers with a read-only root file system), so we set SQLITE_TMPDIR to the folder where the SQLite database is set
-	err := os.Setenv("SQLITE_TMPDIR", dbPath)
-	if err != nil {
-		return fmt.Errorf("failed to set SQLITE_TMPDIR environmental variable: %w", err)
-	}
-
-	slog.Debug("Set SQLITE_TMPDIR to the database directory", "path", dbPath)
-
-	return nil
+	return nil, nil, err
 }
 
 func getGormLogger() gormLogger.Interface {

backend/internal/bootstrap/db_bootstrap_test.go

@@ -1,349 +0,0 @@
-package bootstrap
-
-import (
-	"net/url"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestIsSqliteInMemory(t *testing.T) {
-	tests := []struct {
-		name     string
-		connStr  string
-		expected bool
-	}{
-		{
-			name:     "memory database with :memory:",
-			connStr:  ":memory:",
-			expected: true,
-		},
-		{
-			name:     "memory database with file::memory:",
-			connStr:  "file::memory:",
-			expected: true,
-		},
-		{
-			name:     "memory database with :MEMORY: (uppercase)",
-			connStr:  ":MEMORY:",
-			expected: true,
-		},
-		{
-			name:     "memory database with FILE::MEMORY: (uppercase)",
-			connStr:  "FILE::MEMORY:",
-			expected: true,
-		},
-		{
-			name:     "memory database with mixed case",
-			connStr:  ":Memory:",
-			expected: true,
-		},
-		{
-			name:     "has mode=memory",
-			connStr:  "file:data?mode=memory",
-			expected: true,
-		},
-		{
-			name:     "file database",
-			connStr:  "data.db",
-			expected: false,
-		},
-		{
-			name:     "file database with path",
-			connStr:  "/path/to/data.db",
-			expected: false,
-		},
-		{
-			name:     "file database with file: prefix",
-			connStr:  "file:data.db",
-			expected: false,
-		},
-		{
-			name:     "empty string",
-			connStr:  "",
-			expected: false,
-		},
-		{
-			name:     "string containing memory but not at start",
-			connStr:  "data:memory:.db",
-			expected: false,
-		},
-		{
-			name:     "has mode=ro",
-			connStr:  "file:data?mode=ro",
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isSqliteInMemory(tt.connStr)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestEnsureSqliteDatabaseDir(t *testing.T) {
-	t.Run("creates missing directory", func(t *testing.T) {
-		tempDir := t.TempDir()
-		dbPath := filepath.Join(tempDir, "nested", "pocket-id.db")
-
-		err := ensureSqliteDatabaseDir(dbPath)
-		require.NoError(t, err)
-
-		info, err := os.Stat(filepath.Dir(dbPath))
-		require.NoError(t, err)
-		assert.True(t, info.IsDir())
-	})
-
-	t.Run("fails when parent is file", func(t *testing.T) {
-		tempDir := t.TempDir()
-		filePath := filepath.Join(tempDir, "file.txt")
-		require.NoError(t, os.WriteFile(filePath, []byte("test"), 0o600))
-
-		err := ensureSqliteDatabaseDir(filepath.Join(filePath, "data.db"))
-		require.Error(t, err)
-	})
-}
-
-func TestConvertSqlitePragmaArgs(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    string
-		expected string
-	}{
-		{
-			name:     "basic file path",
-			input:    "file:test.db",
-			expected: "file:test.db",
-		},
-		{
-			name:     "converts _busy_timeout to pragma",
-			input:    "file:test.db?_busy_timeout=5000",
-			expected: "file:test.db?_pragma=busy_timeout%285000%29",
-		},
-		{
-			name:     "converts _timeout to pragma",
-			input:    "file:test.db?_timeout=5000",
-			expected: "file:test.db?_pragma=busy_timeout%285000%29",
-		},
-		{
-			name:     "converts _foreign_keys to pragma",
-			input:    "file:test.db?_foreign_keys=1",
-			expected: "file:test.db?_pragma=foreign_keys%281%29",
-		},
-		{
-			name:     "converts _fk to pragma",
-			input:    "file:test.db?_fk=1",
-			expected: "file:test.db?_pragma=foreign_keys%281%29",
-		},
-		{
-			name:     "converts _synchronous to pragma",
-			input:    "file:test.db?_synchronous=NORMAL",
-			expected: "file:test.db?_pragma=synchronous%28NORMAL%29",
-		},
-		{
-			name:     "converts _sync to pragma",
-			input:    "file:test.db?_sync=NORMAL",
-			expected: "file:test.db?_pragma=synchronous%28NORMAL%29",
-		},
-		{
-			name:     "converts _auto_vacuum to pragma",
-			input:    "file:test.db?_auto_vacuum=FULL",
-			expected: "file:test.db?_pragma=auto_vacuum%28FULL%29",
-		},
-		{
-			name:     "converts _vacuum to pragma",
-			input:    "file:test.db?_vacuum=FULL",
-			expected: "file:test.db?_pragma=auto_vacuum%28FULL%29",
-		},
-		{
-			name:     "converts _case_sensitive_like to pragma",
-			input:    "file:test.db?_case_sensitive_like=1",
-			expected: "file:test.db?_pragma=case_sensitive_like%281%29",
-		},
-		{
-			name:     "converts _cslike to pragma",
-			input:    "file:test.db?_cslike=1",
-			expected: "file:test.db?_pragma=case_sensitive_like%281%29",
-		},
-		{
-			name:     "converts _locking_mode to pragma",
-			input:    "file:test.db?_locking_mode=EXCLUSIVE",
-			expected: "file:test.db?_pragma=locking_mode%28EXCLUSIVE%29",
-		},
-		{
-			name:     "converts _locking to pragma",
-			input:    "file:test.db?_locking=EXCLUSIVE",
-			expected: "file:test.db?_pragma=locking_mode%28EXCLUSIVE%29",
-		},
-		{
-			name:     "converts _secure_delete to pragma",
-			input:    "file:test.db?_secure_delete=1",
-			expected: "file:test.db?_pragma=secure_delete%281%29",
-		},
-		{
-			name:     "preserves unrecognized parameters",
-			input:    "file:test.db?mode=rw&cache=shared",
-			expected: "file:test.db?cache=shared&mode=rw",
-		},
-		{
-			name:     "handles multiple parameters",
-			input:    "file:test.db?_fk=1&mode=rw&_timeout=5000",
-			expected: "file:test.db?_pragma=foreign_keys%281%29&_pragma=busy_timeout%285000%29&mode=rw",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			resultURL, _ := url.Parse(tt.input)
-			convertSqlitePragmaArgs(resultURL)
-
-			// Parse both URLs to compare components independently
-			expectedURL, err := url.Parse(tt.expected)
-			require.NoError(t, err)
-
-			// Compare scheme and path components
-			compareQueryStrings(t, expectedURL, resultURL)
-		})
-	}
-}
-
-func TestAddSqliteDefaultParameters(t *testing.T) {
-	tests := []struct {
-		name        string
-		input       string
-		isMemoryDB  bool
-		expected    string
-		expectError bool
-	}{
-		{
-			name:       "basic file database",
-			input:      "file:test.db",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_txlock=immediate",
-		},
-		{
-			name:       "in-memory database",
-			input:      "file::memory:",
-			isMemoryDB: true,
-			expected:   "file::memory:?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28MEMORY%29&_txlock=immediate",
-		},
-		{
-			name:       "read-only database with mode=ro",
-			input:      "file:test.db?mode=ro",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28DELETE%29&_txlock=immediate&mode=ro",
-		},
-		{
-			name:       "immutable database",
-			input:      "file:test.db?immutable=1",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28DELETE%29&_txlock=immediate&immutable=1",
-		},
-		{
-			name:       "database with existing _txlock",
-			input:      "file:test.db?_txlock=deferred",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_txlock=deferred",
-		},
-		{
-			name:       "database with existing busy_timeout pragma",
-			input:      "file:test.db?_pragma=busy_timeout%285000%29",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%285000%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_txlock=immediate",
-		},
-		{
-			name:       "database with existing journal_mode pragma",
-			input:      "file:test.db?_pragma=journal_mode%28DELETE%29",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28DELETE%29&_txlock=immediate",
-		},
-		{
-			name:        "database with forbidden foreign_keys pragma",
-			input:       "file:test.db?_pragma=foreign_keys%280%29",
-			isMemoryDB:  false,
-			expectError: true,
-		},
-		{
-			name:       "database with multiple existing pragmas",
-			input:      "file:test.db?_pragma=busy_timeout%283000%29&_pragma=journal_mode%28TRUNCATE%29&_pragma=synchronous%28NORMAL%29",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%283000%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28TRUNCATE%29&_pragma=synchronous%28NORMAL%29&_txlock=immediate",
-		},
-		{
-			name:       "database with mode=rw (not read-only)",
-			input:      "file:test.db?mode=rw",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_txlock=immediate&mode=rw",
-		},
-		{
-			name:       "database with immutable=0 (not immutable)",
-			input:      "file:test.db?immutable=0",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_txlock=immediate&immutable=0",
-		},
-		{
-			name:       "database with mixed case mode=RO",
-			input:      "file:test.db?mode=RO",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28DELETE%29&_txlock=immediate&mode=ro",
-		},
-		{
-			name:       "database with mixed case immutable=1",
-			input:      "file:test.db?immutable=1",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28DELETE%29&_txlock=immediate&immutable=1",
-		},
-		{
-			name:       "complex database configuration",
-			input:      "file:test.db?cache=shared&mode=rwc&_txlock=immediate&_pragma=synchronous%28FULL%29",
-			isMemoryDB: false,
-			expected:   "file:test.db?_pragma=busy_timeout%282500%29&_pragma=foreign_keys%281%29&_pragma=journal_mode%28WAL%29&_pragma=synchronous%28FULL%29&_txlock=immediate&cache=shared&mode=rwc",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			resultURL, err := url.Parse(tt.input)
-			require.NoError(t, err)
-
-			err = addSqliteDefaultParameters(resultURL, tt.isMemoryDB)
-
-			if tt.expectError {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-
-			expectedURL, err := url.Parse(tt.expected)
-			require.NoError(t, err)
-
-			compareQueryStrings(t, expectedURL, resultURL)
-		})
-	}
-}
-
-func compareQueryStrings(t *testing.T, expectedURL *url.URL, resultURL *url.URL) {
-	t.Helper()
-
-	// Compare scheme and path components
-	assert.Equal(t, expectedURL.Scheme, resultURL.Scheme)
-	assert.Equal(t, expectedURL.Path, resultURL.Path)
-
-	// Compare query parameters regardless of order
-	expectedQuery := expectedURL.Query()
-	resultQuery := resultURL.Query()
-
-	assert.Len(t, expectedQuery, len(resultQuery))
-
-	for key, expectedValues := range expectedQuery {
-		resultValues, ok := resultQuery[key]
-		_ = assert.True(t, ok) &&
-			assert.ElementsMatch(t, expectedValues, resultValues)
-	}
-}

backend/internal/bootstrap/observability_boostrap.go

@@ -9,7 +9,7 @@ import (
 	"time"
 
 	sloggin "github.com/gin-contrib/slog"
-
+	"github.com/italypaleale/go-kit/servicerunner"
 	"github.com/lmittmann/tint"
 	"github.com/mattn/go-isatty"
 	"go.opentelemetry.io/contrib/bridges/otelslog"
@@ -17,17 +17,14 @@ import (
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
 	"go.opentelemetry.io/otel"
 	globallog "go.opentelemetry.io/otel/log/global"
-	metricnoop "go.opentelemetry.io/otel/metric/noop"
 	"go.opentelemetry.io/otel/propagation"
 	sdklog "go.opentelemetry.io/otel/sdk/log"
 	"go.opentelemetry.io/otel/sdk/metric"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	semconv "go.opentelemetry.io/otel/semconv/v1.30.0"
-	tracenoop "go.opentelemetry.io/otel/trace/noop"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
 )
 
 func defaultResource() (*resource.Resource, error) {
@@ -40,13 +37,13 @@ func defaultResource() (*resource.Resource, error) {
 	)
 }
 
-func initObservability(ctx context.Context, metrics, traces bool) (shutdownFns []utils.Service, httpClient *http.Client, err error) {
+func initObservability(ctx context.Context) (shutdownFns []servicerunner.Service, httpClient *http.Client, err error) {
 	resource, err := defaultResource()
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to create OpenTelemetry resource: %w", err)
 	}
 
-	shutdownFns = make([]utils.Service, 0, 2)
+	shutdownFns = make([]servicerunner.Service, 0, 3)
 
 	httpClient = &http.Client{}
 	defaultTransport, ok := http.DefaultTransport.(*http.Transport)
@@ -57,13 +54,15 @@ func initObservability(ctx context.Context, metrics, traces bool) (shutdownFns [
 	httpClient.Transport = defaultTransport.Clone()
 
 	// Logging
-	err = initOtelLogging(ctx, resource)
+	loggingShutdownFn, err := initOtelLogging(ctx, resource)
 	if err != nil {
 		return nil, nil, err
+	} else if loggingShutdownFn != nil {
+		shutdownFns = append(shutdownFns, loggingShutdownFn)
 	}
 
 	// Tracing
-	tracingShutdownFn, err := initOtelTracing(ctx, traces, resource, httpClient)
+	tracingShutdownFn, err := initOtelTracing(ctx, resource, httpClient)
 	if err != nil {
 		return nil, nil, err
 	} else if tracingShutdownFn != nil {
@@ -71,7 +70,7 @@ func initObservability(ctx context.Context, metrics, traces bool) (shutdownFns [
 	}
 
 	// Metrics
-	metricsShutdownFn, err := initOtelMetrics(ctx, metrics, resource)
+	metricsShutdownFn, err := initOtelMetrics(ctx, resource)
 	if err != nil {
 		return nil, nil, err
 	} else if metricsShutdownFn != nil {
@@ -81,19 +80,19 @@ func initObservability(ctx context.Context, metrics, traces bool) (shutdownFns [
 	return shutdownFns, httpClient, nil
 }
 
-func initOtelLogging(ctx context.Context, resource *resource.Resource) error {
+func initOtelLogging(ctx context.Context, resource *resource.Resource) (shutdownFn servicerunner.Service, err error) {
 	// If the env var OTEL_LOGS_EXPORTER is empty, we set it to "none", for autoexport to work
 	if os.Getenv("OTEL_LOGS_EXPORTER") == "" {
 		os.Setenv("OTEL_LOGS_EXPORTER", "none")
 	}
 	exp, err := autoexport.NewLogExporter(ctx)
 	if err != nil {
-		return fmt.Errorf("failed to initialize OpenTelemetry log exporter: %w", err)
+		return nil, fmt.Errorf("failed to initialize OpenTelemetry log exporter: %w", err)
 	}
 
 	level, _ := sloggin.ParseLevel(common.EnvConfig.LogLevel)
 
-	// Create the handler
+	// Create the console handler
 	var handler slog.Handler
 	if common.EnvConfig.LogJSON {
 		handler = slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
@@ -107,21 +106,35 @@ func initOtelLogging(ctx context.Context, resource *resource.Resource) error {
 		})
 	}
 
-	// Create the logger provider
-	provider := sdklog.NewLoggerProvider(
-		sdklog.WithProcessor(
-			sdklog.NewBatchProcessor(exp),
-		),
-		sdklog.WithResource(resource),
-	)
+	// When log export is enabled, also send logs to OpenTelemetry through a batch processor.
+	// When it's disabled (the exporter is a no-op), we skip the OTel handler entirely so we don't convert and buffer every log record just to drop it.
+	if !autoexport.IsNoneLogExporter(exp) {
+		// Create the logger provider
+		provider := sdklog.NewLoggerProvider(
+			sdklog.WithProcessor(
+				sdklog.NewBatchProcessor(exp),
+			),
+			sdklog.WithResource(resource),
+		)
 
-	// Set the logger provider globally
-	globallog.SetLoggerProvider(provider)
+		// Set the logger provider globally
+		globallog.SetLoggerProvider(provider)
 
-	handler = slog.NewMultiHandler(
-		handler,
-		otelslog.NewHandler(common.Name, otelslog.WithLoggerProvider(provider)),
-	)
+		handler = slog.NewMultiHandler(
+			handler,
+			otelslog.NewHandler(common.Name, otelslog.WithLoggerProvider(provider)),
+		)
+
+		shutdownFn = func(shutdownCtx context.Context) error { //nolint:contextcheck
+			lpCtx, lpCancel := context.WithTimeout(shutdownCtx, 10*time.Second)
+			defer lpCancel()
+			shutdownErr := provider.Shutdown(lpCtx)
+			if shutdownErr != nil {
+				return fmt.Errorf("failed to gracefully shut down logs exporter: %w", shutdownErr)
+			}
+			return nil
+		}
+	}
 
 	// Set the default slog to send logs to OTel and add the app name
 	log := slog.New(handler).
@@ -129,13 +142,13 @@ func initOtelLogging(ctx context.Context, resource *resource.Resource) error {
 		With(slog.String("version", common.Version))
 	slog.SetDefault(log)
 
-	return nil
+	return shutdownFn, nil
 }
 
-func initOtelTracing(ctx context.Context, traces bool, resource *resource.Resource, httpClient *http.Client) (shutdownFn utils.Service, err error) {
-	if !traces {
-		otel.SetTracerProvider(tracenoop.NewTracerProvider())
-		return nil, nil
+func initOtelTracing(ctx context.Context, resource *resource.Resource, httpClient *http.Client) (shutdownFn servicerunner.Service, err error) {
+	// If the env var OTEL_TRACES_EXPORTER is empty, we set it to "none"
+	if os.Getenv("OTEL_TRACES_EXPORTER") == "" {
+		os.Setenv("OTEL_TRACES_EXPORTER", "none")
 	}
 
 	tr, err := autoexport.NewSpanExporter(ctx)
@@ -171,10 +184,10 @@ func initOtelTracing(ctx context.Context, traces bool, resource *resource.Resour
 	return shutdownFn, nil
 }
 
-func initOtelMetrics(ctx context.Context, metrics bool, resource *resource.Resource) (shutdownFn utils.Service, err error) {
-	if !metrics {
-		otel.SetMeterProvider(metricnoop.NewMeterProvider())
-		return nil, nil
+func initOtelMetrics(ctx context.Context, resource *resource.Resource) (shutdownFn servicerunner.Service, err error) {
+	// If the env var OTEL_METRICS_EXPORTER is empty, we set it to "none"
+	if os.Getenv("OTEL_METRICS_EXPORTER") == "" {
+		os.Setenv("OTEL_METRICS_EXPORTER", "none")
 	}
 
 	mr, err := autoexport.NewMetricReader(ctx)

backend/internal/bootstrap/router_bootstrap.go

@@ -9,7 +9,6 @@ import (
 	"net"
 	"net/http"
 	"os"
-	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -18,29 +17,31 @@ import (
 	"github.com/fsnotify/fsnotify"
 	sloggin "github.com/gin-contrib/slog"
 	"github.com/gin-gonic/gin"
+	"github.com/italypaleale/francis/builtin/ratelimit"
+	"github.com/italypaleale/go-kit/servicerunner"
 	"go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin"
-	"golang.org/x/net/http2"
-	"golang.org/x/net/http2/h2c"
-	"golang.org/x/time/rate"
 	"gorm.io/gorm"
 
 	"github.com/pocket-id/pocket-id/backend/frontend"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/controller"
 	"github.com/pocket-id/pocket-id/backend/internal/middleware"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
+	"github.com/pocket-id/pocket-id/backend/internal/tracing"
 	"github.com/pocket-id/pocket-id/backend/internal/utils/systemd"
 )
 
 // This is used to register additional controllers for tests
 var registerTestControllers []func(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services)
 
-func initRouter(db *gorm.DB, svc *services) (utils.Service, error) {
+func initRouter(db *gorm.DB, svc *services, rateLimitServices map[string]*ratelimit.RateLimitService) (servicerunner.Service, error) {
 	r, err := initEngine()
 	if err != nil {
 		return nil, err
 	}
-	registerRoutes(r, db, svc)
+	err = registerRoutes(r, db, svc, rateLimitServices)
+	if err != nil {
+		return nil, err
+	}
 
 	serverConfig, err := initServer(r)
 	if err != nil {
@@ -67,17 +68,11 @@ func initEngine() (*gin.Engine, error) {
 
 	r := gin.New()
 	initLogger(r)
-	configureEngine(r)
-	registerGlobalMiddleware(r)
-
-	frontendRateLimitMiddleware := middleware.NewRateLimitMiddleware().Add(rate.Every(100*time.Millisecond), 300)
-	if err := frontend.RegisterFrontend(r, frontendRateLimitMiddleware); err != nil {
-		if errors.Is(err, frontend.ErrFrontendNotIncluded) {
-			slog.Warn("Frontend is not included in the build. Skipping frontend registration.")
-			return r, nil
-		}
-		return nil, fmt.Errorf("failed to register frontend: %w", err)
+	err := configureEngine(r)
+	if err != nil {
+		return nil, err
 	}
+	registerGlobalMiddleware(r)
 
 	return r, nil
 }
@@ -94,17 +89,36 @@ func setGinMode() {
 	}
 }
 
-func configureEngine(r *gin.Engine) {
-	if !common.EnvConfig.TrustProxy {
-		_ = r.SetTrustedProxies(nil)
+func configureEngine(r *gin.Engine) error {
+	err := r.SetTrustedProxies(common.EnvConfig.TrustProxy)
+	if err != nil {
+		return fmt.Errorf("failed to configure trusted proxies: %w", err)
 	}
 
 	if common.EnvConfig.TrustedPlatform != "" {
 		r.TrustedPlatform = common.EnvConfig.TrustedPlatform
 	}
 
-	if common.EnvConfig.TracingEnabled {
-		r.Use(otelgin.Middleware(common.Name))
+	r.Use(otelgin.Middleware(
+		common.Name,
+		otelgin.WithFilter(shouldTraceRequest)),
+	)
+
+	return nil
+}
+
+// shouldTraceRequest reports whether an incoming request should be traced.
+// It traces only requests handled by real backend routes (the API, the OIDC/OAuth endpoints, and the well-known documents).
+// Everything else falls through to the frontend NoRoute handler, which serves the SPA shell and static assets; tracing those would produce noisy, unparented spans named just "GET" with an empty http.route.
+func shouldTraceRequest(r *http.Request) bool {
+	p := r.URL.Path
+	switch {
+	case strings.HasPrefix(p, "/api/"),
+		strings.HasPrefix(p, "/.well-known/"),
+		p == "/authorize":
+		return true
+	default:
+		return false
 	}
 }
 
@@ -116,32 +130,64 @@ func registerGlobalMiddleware(r *gin.Engine) {
 	r.Use(middleware.NewErrorHandlerMiddleware().Add())
 }
 
-func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services) {
-	authMiddleware := middleware.NewAuthMiddleware(svc.apiKeyService, svc.userService, svc.jwtService)
+func registerRoutes(r *gin.Engine, db *gorm.DB, svc *services, rateLimitServices map[string]*ratelimit.RateLimitService) error {
+
+	err := frontend.RegisterFrontend(r)
+	if errors.Is(err, frontend.ErrFrontendNotIncluded) {
+		slog.Warn("Frontend is not included in the build. Skipping frontend registration.")
+	} else if err != nil {
+		return fmt.Errorf("failed to register frontend: %w", err)
+	}
+
+	// Initialize middleware for specific routes
+	authMiddleware := middleware.NewAuthMiddleware(svc.apiKeyModule, svc.userService, svc.jwtService)
 	fileSizeLimitMiddleware := middleware.NewFileSizeLimitMiddleware()
-	apiRateLimitMiddleware := middleware.NewRateLimitMiddleware().Add(rate.Every(time.Second), 100)
+	rateLimitMiddleware := middleware.NewRateLimitMiddleware(rateLimitServices)
+	apiRateLimitMiddleware := rateLimitMiddleware.Add(middleware.RateLimitAPI)
 
 	apiGroup := r.Group("/api", apiRateLimitMiddleware)
-	controller.NewApiKeyController(apiGroup, authMiddleware, svc.apiKeyService)
-	controller.NewWebauthnController(apiGroup, authMiddleware, middleware.NewRateLimitMiddleware(), svc.webauthnService, svc.appConfigService)
-	controller.NewOidcController(apiGroup, authMiddleware, fileSizeLimitMiddleware, svc.oidcService, svc.jwtService)
-	controller.NewUserController(apiGroup, authMiddleware, middleware.NewRateLimitMiddleware(), svc.userService, svc.oneTimeAccessService, svc.webauthnService, svc.appConfigService)
+	baseGroup := r.Group("/", apiRateLimitMiddleware)
+
+	svc.apiKeyModule.RegisterRoutes(apiGroup,
+		authMiddleware.WithAdminNotRequired().Add(),
+		authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(),
+	)
+	svc.webauthnModule.RegisterRoutes(apiGroup,
+		authMiddleware.WithAdminNotRequired().Add(),
+		rateLimitMiddleware.Add(middleware.RateLimitWebauthnLogin),
+		rateLimitMiddleware.Add(middleware.RateLimitWebauthnReauthenticate),
+	)
+	controller.NewOidcController(apiGroup, authMiddleware, fileSizeLimitMiddleware, svc.oidcService)
+	controller.NewUserController(apiGroup, authMiddleware, rateLimitMiddleware, svc.userService, svc.oneTimeAccessService, svc.webauthnModule, svc.appConfigService)
 	controller.NewAppConfigController(apiGroup, authMiddleware, svc.appConfigService, svc.emailService, svc.ldapService)
 	controller.NewAppImagesController(apiGroup, authMiddleware, svc.appImagesService)
 	controller.NewAuditLogController(apiGroup, svc.auditLogService, authMiddleware)
 	controller.NewUserGroupController(apiGroup, authMiddleware, svc.userGroupService)
+	svc.apiModule.RegisterRoutes(apiGroup, authMiddleware.Add())
 	controller.NewCustomClaimController(apiGroup, authMiddleware, svc.customClaimService)
 	controller.NewVersionController(apiGroup, authMiddleware, svc.versionService)
 	controller.NewScimController(apiGroup, authMiddleware, svc.scimService)
-	controller.NewUserSignupController(apiGroup, authMiddleware, middleware.NewRateLimitMiddleware(), svc.userSignUpService, svc.appConfigService)
+	svc.userSignUpModule.RegisterRoutes(apiGroup,
+		authMiddleware.Add(),
+		rateLimitMiddleware.Add(middleware.RateLimitSignup),
+	)
+
+	optionalBrowserAuth := authMiddleware.WithAdminNotRequired().WithSuccessOptional().WithApiKeyAuthDisabled().Add()
+	browserAuth := authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add()
+	svc.oidcModule.RegisterRoutes(baseGroup, apiGroup, optionalBrowserAuth, browserAuth)
 
 	registerTestRoutes(apiGroup, db, svc)
 
-	baseGroup := r.Group("/", apiRateLimitMiddleware)
 	controller.NewWellKnownController(baseGroup, svc.jwtService)
 
 	// These are not rate-limited.
 	controller.NewHealthzController(r)
+
+	// Receives OTLP trace payloads from the browser SPA (POST /internal/telemetry/traces) and forwards them to the collector, when trace export is enabled.
+	// Outside /api, so it's unauthenticated and not traced, but it is rate-limited.
+	tracing.NewTelemetryController(r, rateLimitMiddleware.Add(middleware.RateLimitInternal))
+
+	return nil
 }
 
 func registerTestRoutes(apiGroup *gin.RouterGroup, db *gorm.DB, svc *services) {
@@ -160,24 +206,26 @@ func initServer(r *gin.Engine) (*serverConfig, error) {
 		return nil, err
 	}
 
-	network, addr := listenerNetworkAndAddr()
-	listener, err := net.Listen(network, addr) //nolint:noctx
-	if err != nil {
-		return nil, fmt.Errorf("failed to create %s listener: %w", network, err)
+	var socketFn func() (*socket, error)
+	switch {
+	case common.EnvConfig.SystemdSocket:
+		socketFn = systemdSocket
+	case common.EnvConfig.UnixSocket != "":
+		socketFn = unixSocket
+	default:
+		socketFn = tcpSocket
 	}
 
-	if err := setUnixSocketMode(network, addr); err != nil {
-		listener.Close()
+	socket, err := socketFn()
+	if err != nil {
 		return nil, err
 	}
 
-	return &serverConfig{
-		addr:         addr,
-		certProvider: certProvider,
-		listener:     listener,
-		server:       newHTTPServer(r, protocols),
-		tlsConfig:    tlsConfig,
-	}, nil
+	addr := socket.addr
+	listener := socket.listener
+	server := newHTTPServer(r, protocols)
+
+	return &serverConfig{addr, certProvider, listener, server, tlsConfig}, nil
 }
 
 func initServerProtocols() (*http.Protocols, *tls.Config, *tlsCertProvider, error) {
@@ -210,7 +258,7 @@ func newHTTPServer(r *gin.Engine, protocols *http.Protocols) *http.Server {
 		MaxHeaderBytes:    1 << 20,
 		ReadHeaderTimeout: 10 * time.Second,
 		Protocols:         protocols,
-		Handler: h2c.NewHandler(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 			// HEAD requests don't get matched by Gin routes, so we convert them to GET
 			// middleware.HeadMiddleware will convert them back to HEAD later
 			if req.Method == http.MethodHead {
@@ -220,37 +268,10 @@ func newHTTPServer(r *gin.Engine, protocols *http.Protocols) *http.Server {
 			}
 
 			r.ServeHTTP(w, req)
-		}), &http2.Server{}),
+		}),
 	}
 }
 
-func listenerNetworkAndAddr() (string, string) {
-	if common.EnvConfig.UnixSocket == "" {
-		return "tcp", net.JoinHostPort(common.EnvConfig.Host, common.EnvConfig.Port)
-	}
-
-	addr := common.EnvConfig.UnixSocket
-	os.Remove(addr) // remove dangling the socket file to avoid file-exist error
-	return "unix", addr
-}
-
-func setUnixSocketMode(network, addr string) error {
-	if network != "unix" || common.EnvConfig.UnixSocketMode == "" {
-		return nil
-	}
-
-	mode, err := strconv.ParseUint(common.EnvConfig.UnixSocketMode, 8, 32)
-	if err != nil {
-		return fmt.Errorf("failed to parse UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
-	}
-
-	if err := os.Chmod(addr, os.FileMode(mode)); err != nil {
-		return fmt.Errorf("failed to set UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
-	}
-
-	return nil
-}
-
 func runServer(ctx context.Context, config *serverConfig) error {
 	slog.Info("Server listening", slog.String("addr", config.addr), slog.Bool("tls", config.tlsConfig != nil))
 

backend/internal/bootstrap/scheduler_bootstrap.go

@@ -3,14 +3,13 @@ package bootstrap
 import (
 	"context"
 	"fmt"
-	"net/http"
 
 	"gorm.io/gorm"
 
 	"github.com/pocket-id/pocket-id/backend/internal/job"
 )
 
-func registerScheduledJobs(ctx context.Context, db *gorm.DB, svc *services, httpClient *http.Client, scheduler *job.Scheduler) error {
+func registerScheduledJobs(ctx context.Context, db *gorm.DB, svc *services, scheduler *job.Scheduler) error {
 	err := scheduler.RegisterLdapJobs(ctx, svc.ldapService, svc.appConfigService)
 	if err != nil {
 		return fmt.Errorf("failed to register LDAP jobs in scheduler: %w", err)
@@ -23,18 +22,10 @@ func registerScheduledJobs(ctx context.Context, db *gorm.DB, svc *services, http
 	if err != nil {
 		return fmt.Errorf("failed to register DB cleanup jobs in scheduler: %w", err)
 	}
-	err = scheduler.RegisterFileCleanupJobs(ctx, db, svc.fileStorage)
-	if err != nil {
-		return fmt.Errorf("failed to register file cleanup jobs in scheduler: %w", err)
-	}
-	err = scheduler.RegisterApiKeyExpiryJob(ctx, svc.apiKeyService, svc.appConfigService)
+	err = scheduler.RegisterApiKeyExpiryJob(ctx, svc.apiKeyModule, svc.appConfigService, svc.emailService)
 	if err != nil {
 		return fmt.Errorf("failed to register API key expiration jobs in scheduler: %w", err)
 	}
-	err = scheduler.RegisterAnalyticsJob(ctx, svc.appConfigService, httpClient)
-	if err != nil {
-		return fmt.Errorf("failed to register analytics job in scheduler: %w", err)
-	}
 	err = scheduler.RegisterScimJobs(ctx, svc.scimService)
 	if err != nil {
 		return fmt.Errorf("failed to register SCIM scheduler job: %w", err)

backend/internal/bootstrap/services_bootstrap.go

@@ -5,11 +5,17 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/pocket-id/pocket-id/backend/internal/apikey"
 	"github.com/pocket-id/pocket-id/backend/internal/job"
 	"gorm.io/gorm"
 
+	"github.com/pocket-id/pocket-id/backend/internal/api"
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
+	"github.com/pocket-id/pocket-id/backend/internal/usersignup"
+	"github.com/pocket-id/pocket-id/backend/internal/webauthn"
 )
 
 type services struct {
@@ -19,23 +25,26 @@ type services struct {
 	geoLiteService       *service.GeoLiteService
 	auditLogService      *service.AuditLogService
 	jwtService           *service.JwtService
-	webauthnService      *service.WebAuthnService
 	scimService          *service.ScimService
 	userService          *service.UserService
 	customClaimService   *service.CustomClaimService
 	oidcService          *service.OidcService
 	userGroupService     *service.UserGroupService
 	ldapService          *service.LdapService
-	apiKeyService        *service.ApiKeyService
 	versionService       *service.VersionService
 	fileStorage          storage.FileStorage
 	appLockService       *service.AppLockService
-	userSignUpService    *service.UserSignUpService
 	oneTimeAccessService *service.OneTimeAccessService
+
+	apiKeyModule     *apikey.Module
+	oidcModule       *oidc.Module
+	webauthnModule   *webauthn.Module
+	userSignUpModule *usersignup.Module
+	apiModule        *api.Module
 }
 
 // Initializes all services
-func initServices(ctx context.Context, db *gorm.DB, httpClient *http.Client, imageExtensions map[string]string, fileStorage storage.FileStorage, scheduler *job.Scheduler) (svc *services, err error) {
+func initServices(ctx context.Context, db *gorm.DB, instanceID string, httpClient *http.Client, imageExtensions map[string]string, fileStorage storage.FileStorage, scheduler *job.Scheduler) (svc *services, err error) {
 	svc = &services{}
 
 	svc.appConfigService, err = service.NewAppConfigService(ctx, db)
@@ -54,20 +63,47 @@ func initServices(ctx context.Context, db *gorm.DB, httpClient *http.Client, ima
 
 	svc.geoLiteService = service.NewGeoLiteService(httpClient)
 	svc.auditLogService = service.NewAuditLogService(db, svc.appConfigService, svc.emailService, svc.geoLiteService)
-	svc.jwtService, err = service.NewJwtService(ctx, db, svc.appConfigService)
+	svc.jwtService, err = service.NewJwtService(ctx, db, instanceID, svc.appConfigService)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create JWT service: %w", err)
 	}
 
 	svc.customClaimService = service.NewCustomClaimService(db)
-	svc.webauthnService, err = service.NewWebAuthnService(db, svc.jwtService, svc.auditLogService, svc.appConfigService)
+	svc.webauthnModule, err = webauthn.New(webauthn.Dependencies{
+		DB:        db,
+		AppURL:    common.EnvConfig.AppURL,
+		Signer:    svc.jwtService,
+		AuditLog:  svc.auditLogService,
+		AppConfig: svc.appConfigService,
+	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to create WebAuthn service: %w", err)
+		return nil, fmt.Errorf("failed to create WebAuthn module: %w", err)
 	}
 
 	svc.scimService = service.NewScimService(db, scheduler, httpClient)
 
-	svc.oidcService, err = service.NewOidcService(ctx, db, svc.jwtService, svc.appConfigService, svc.auditLogService, svc.customClaimService, svc.webauthnService, svc.scimService, httpClient, fileStorage)
+	svc.apiModule = api.New(api.Dependencies{DB: db, Issuer: common.EnvConfig.AppURL})
+
+	svc.oidcModule, err = oidc.New(ctx, oidc.Dependencies{
+		DB:         db,
+		HTTPClient: httpClient,
+		Config: oidc.Config{
+			BaseURL:                   common.EnvConfig.AppURL,
+			TokenBaseURL:              common.EnvConfig.AppURL,
+			Secret:                    common.EnvConfig.EncryptionKey,
+			AllowInsecureCallbackURLs: common.EnvConfig.AllowInsecureCallbackURLs,
+		},
+		Signer:       svc.jwtService,
+		CustomClaims: svc.customClaimService,
+		Reauth:       svc.webauthnModule,
+		AuditLog:     svc.auditLogService,
+		APIAccess:    svc.apiModule,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create OIDC module: %w", err)
+	}
+
+	svc.oidcService, err = service.NewOidcService(db, svc.jwtService, svc.appConfigService, svc.oidcModule.Preview, svc.scimService, httpClient, fileStorage)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create OIDC service: %w", err)
 	}
@@ -76,12 +112,21 @@ func initServices(ctx context.Context, db *gorm.DB, httpClient *http.Client, ima
 	svc.userService = service.NewUserService(db, svc.jwtService, svc.auditLogService, svc.emailService, svc.appConfigService, svc.customClaimService, svc.appImagesService, svc.scimService, fileStorage)
 	svc.ldapService = service.NewLdapService(db, httpClient, svc.appConfigService, svc.userService, svc.userGroupService, fileStorage)
 
-	svc.apiKeyService, err = service.NewApiKeyService(ctx, db, svc.emailService)
+	svc.apiKeyModule, err = apikey.New(ctx, apikey.Dependencies{
+		DB:           db,
+		StaticApiKey: common.EnvConfig.StaticApiKey,
+	})
 	if err != nil {
-		return nil, fmt.Errorf("failed to create API key service: %w", err)
+		return nil, fmt.Errorf("failed to create API key module: %w", err)
 	}
 
-	svc.userSignUpService = service.NewUserSignupService(db, svc.jwtService, svc.auditLogService, svc.appConfigService, svc.userService)
+	svc.userSignUpModule = usersignup.New(usersignup.Dependencies{
+		DB:          db,
+		Signer:      svc.jwtService,
+		AuditLog:    svc.auditLogService,
+		AppConfig:   svc.appConfigService,
+		UserCreator: svc.userService,
+	})
 	svc.oneTimeAccessService = service.NewOneTimeAccessService(db, svc.userService, svc.jwtService, svc.auditLogService, svc.emailService, svc.appConfigService)
 
 	svc.versionService = service.NewVersionService(httpClient)

backend/internal/bootstrap/socket.go

@@ -0,0 +1,51 @@
+package bootstrap
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"strconv"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+)
+
+type socket struct {
+	addr     string
+	listener net.Listener
+}
+
+func unixSocket() (*socket, error) {
+	addr := common.EnvConfig.UnixSocket
+	os.Remove(addr) // remove dangling the socket file to avoid file-exist error
+
+	listener, err := net.Listen("unix", addr) //nolint:noctx
+	if err != nil {
+		return nil, fmt.Errorf("failed to create UNIX socket: %w", err)
+	}
+
+	if common.EnvConfig.UnixSocketMode != "" {
+		mode, err := strconv.ParseUint(common.EnvConfig.UnixSocketMode, 8, 32)
+		if err != nil {
+			listener.Close()
+			return nil, fmt.Errorf("failed to parse UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
+		}
+
+		if err := os.Chmod(addr, os.FileMode(mode)); err != nil {
+			listener.Close()
+			return nil, fmt.Errorf("failed to set UNIX socket mode '%s': %w", common.EnvConfig.UnixSocketMode, err)
+		}
+	}
+
+	return &socket{addr, listener}, nil
+}
+
+func tcpSocket() (*socket, error) {
+	addr := net.JoinHostPort(common.EnvConfig.Host, common.EnvConfig.Port)
+
+	listener, err := net.Listen("tcp", addr) //nolint:noctx
+	if err != nil {
+		return nil, fmt.Errorf("failed to create TCP socket: %w", err)
+	}
+
+	return &socket{addr, listener}, nil
+}

backend/internal/bootstrap/systemd_socket_linux.go

@@ -0,0 +1,27 @@
+//go:build linux
+
+package bootstrap
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/coreos/go-systemd/activation"
+)
+
+func systemdSocket() (*socket, error) {
+	listeners, err := activation.Listeners()
+	if err != nil {
+		return nil, fmt.Errorf("failed to receive socket from systemd: %w", err)
+	}
+
+	if len(listeners) == 0 {
+		return nil, errors.New("did not receive any sockets from systemd")
+	}
+
+	if len(listeners) > 1 {
+		return nil, errors.New("received too many sockets from systemd")
+	}
+
+	return &socket{"(systemd)", listeners[0]}, nil
+}

backend/internal/bootstrap/systemd_socket_nonlinux.go

@@ -0,0 +1,9 @@
+//go:build !linux
+
+package bootstrap
+
+import "errors"
+
+func systemdSocket() (*socket, error) {
+	return nil, errors.New("systemd socket activation is only supported on Linux")
+}

backend/internal/cmds/encryption_key_rotate.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/pocket-id/pocket-id/backend/internal/bootstrap"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
 	jwkutils "github.com/pocket-id/pocket-id/backend/internal/utils/jwk"
 )
@@ -30,12 +30,17 @@ func init() {
 		Use:   "encryption-key-rotate",
 		Short: "Re-encrypts data using a new encryption key",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			db, err := bootstrap.NewDatabase()
+			db, _, err := bootstrap.NewDatabase(cmd.Context())
 			if err != nil {
 				return err
 			}
 
-			return encryptionKeyRotate(cmd.Context(), flags, db, &common.EnvConfig)
+			instanceID, err := instanceid.Load(cmd.Context(), db)
+			if err != nil {
+				return err
+			}
+
+			return encryptionKeyRotate(cmd.Context(), flags, db, instanceID, &common.EnvConfig)
 		},
 	}
 
@@ -45,7 +50,7 @@ func init() {
 	rootCmd.AddCommand(encryptionKeyRotateCmd)
 }
 
-func encryptionKeyRotate(ctx context.Context, flags encryptionKeyRotateFlags, db *gorm.DB, envConfig *common.EnvConfigSchema) error {
+func encryptionKeyRotate(ctx context.Context, flags encryptionKeyRotateFlags, db *gorm.DB, instanceID string, envConfig *common.EnvConfigSchema) error {
 	oldKey := envConfig.EncryptionKey
 	newKey := []byte(flags.NewKey)
 	if len(newKey) == 0 {
@@ -67,12 +72,6 @@ func encryptionKeyRotate(ctx context.Context, flags encryptionKeyRotateFlags, db
 		}
 	}
 
-	appConfigService, err := service.NewAppConfigService(ctx, db)
-	if err != nil {
-		return fmt.Errorf("failed to create app config service: %w", err)
-	}
-	instanceID := appConfigService.GetDbConfig().InstanceID.Value
-
 	// Derive the encryption keys used for the JWK encryption
 	oldKek, err := jwkutils.LoadKeyEncryptionKey(&common.EnvConfigSchema{EncryptionKey: oldKey}, instanceID)
 	if err != nil {

backend/internal/cmds/encryption_key_rotate_test.go

@@ -9,8 +9,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
 	jwkutils "github.com/pocket-id/pocket-id/backend/internal/utils/jwk"
 	testingutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
 )
@@ -25,9 +25,8 @@ func TestEncryptionKeyRotate(t *testing.T) {
 
 	db := testingutils.NewDatabaseForTest(t)
 
-	appConfigService, err := service.NewAppConfigService(t.Context(), db)
+	instanceID, err := instanceid.Load(t.Context(), db)
 	require.NoError(t, err)
-	instanceID := appConfigService.GetDbConfig().InstanceID.Value
 
 	oldKek, err := jwkutils.LoadKeyEncryptionKey(envConfig, instanceID)
 	require.NoError(t, err)
@@ -61,7 +60,8 @@ func TestEncryptionKeyRotate(t *testing.T) {
 		NewKey: string(newKey),
 		Yes:    true,
 	}
-	require.NoError(t, encryptionKeyRotate(t.Context(), flags, db, envConfig))
+	err = encryptionKeyRotate(t.Context(), flags, db, instanceID, envConfig)
+	require.NoError(t, err)
 
 	newKek, err := jwkutils.LoadKeyEncryptionKey(&common.EnvConfigSchema{EncryptionKey: newKey}, instanceID)
 	require.NoError(t, err)

backend/internal/cmds/export.go

@@ -33,7 +33,7 @@ func init() {
 
 // runExport orchestrates the export flow
 func runExport(ctx context.Context, flags exportFlags) error {
-	db, err := bootstrap.NewDatabase()
+	db, _, err := bootstrap.NewDatabase(ctx)
 	if err != nil {
 		return fmt.Errorf("failed to connect to database: %w", err)
 	}

backend/internal/cmds/healthcheck.go

@@ -2,9 +2,12 @@ package cmds
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 
 	"github.com/spf13/cobra"
@@ -13,8 +16,14 @@ import (
 )
 
 type healthcheckFlags struct {
-	Endpoint string
-	Verbose  bool
+	Endpoint   string
+	UnixSocket string
+	Verbose    bool
+}
+
+type healthcheckResult struct {
+	StatusCode int
+	URL        string
 }
 
 func init() {
@@ -29,47 +38,26 @@ func init() {
 			ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
 			defer cancel()
 
-			url := flags.Endpoint + "/healthz"
-			req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+			if flags.UnixSocket == "" && !cmd.Flags().Changed("endpoint") {
+				flags.UnixSocket = common.EnvConfig.UnixSocket
+			}
+
+			result, err := healthcheck(ctx, flags)
 			if err != nil {
 				slog.ErrorContext(ctx,
-					"Failed to create request object",
+					"Healthcheck failed",
 					"error", err,
-					"url", url,
 					"ms", time.Since(start).Milliseconds(),
 				)
 				os.Exit(1)
 			}
 
-			res, err := http.DefaultClient.Do(req)
-			if err != nil {
-				slog.ErrorContext(ctx,
-					"Failed to perform request",
-					"error", err,
-					"url", url,
-					"ms", time.Since(start).Milliseconds(),
-				)
-				os.Exit(1)
-			}
-			defer res.Body.Close()
-
-			if res.StatusCode < 200 || res.StatusCode >= 300 {
-				if err != nil {
-					slog.ErrorContext(ctx,
-						"Healthcheck failed",
-						"status", res.StatusCode,
-						"url", url,
-						"ms", time.Since(start).Milliseconds(),
-					)
-					os.Exit(1)
-				}
-			}
-
 			if flags.Verbose {
 				slog.InfoContext(ctx,
 					"Healthcheck succeeded",
-					"status", res.StatusCode,
-					"url", url,
+					"status", result.StatusCode,
+					"url", result.URL,
+					"unixSocket", flags.UnixSocket,
 					"ms", time.Since(start).Milliseconds(),
 				)
 			}
@@ -77,7 +65,42 @@ func init() {
 	}
 
 	healthcheckCmd.Flags().StringVarP(&flags.Endpoint, "endpoint", "e", "http://localhost:"+common.EnvConfig.Port, "Endpoint for Pocket ID")
+	healthcheckCmd.Flags().StringVar(&flags.UnixSocket, "unix-socket", "", "UNIX socket path for Pocket ID")
 	healthcheckCmd.Flags().BoolVarP(&flags.Verbose, "verbose", "v", false, "Enable verbose mode")
 
 	rootCmd.AddCommand(healthcheckCmd)
 }
+
+func healthcheck(ctx context.Context, flags healthcheckFlags) (*healthcheckResult, error) {
+	url := strings.TrimRight(flags.Endpoint, "/") + "/healthz"
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request object for %q: %w", url, err)
+	}
+
+	client := http.DefaultClient
+	if flags.UnixSocket != "" {
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		transport.Proxy = nil
+		transport.DialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, "unix", flags.UnixSocket)
+		}
+		client = &http.Client{Transport: transport}
+	}
+
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to perform request to %q: %w", url, err)
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode < 200 || res.StatusCode >= 300 {
+		return nil, fmt.Errorf("unexpected status %d from %q", res.StatusCode, url)
+	}
+
+	return &healthcheckResult{
+		StatusCode: res.StatusCode,
+		URL:        url,
+	}, nil
+}

backend/internal/cmds/healthcheck_test.go

@@ -0,0 +1,79 @@
+package cmds
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHealthcheckTCPSuccess(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "/healthz", r.URL.Path)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	result, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint: server.URL,
+	})
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNoContent, result.StatusCode)
+	require.Equal(t, server.URL+"/healthz", result.URL)
+}
+
+func TestHealthcheckFailsOnUnexpectedStatus(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	_, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint: server.URL,
+	})
+
+	require.Error(t, err)
+	require.ErrorContains(t, err, "unexpected status 500")
+}
+
+func TestHealthcheckUnixSocket(t *testing.T) {
+	socketPath := filepath.Join(t.TempDir(), "pocket-id.sock")
+	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "unix", socketPath)
+	require.NoError(t, err)
+
+	server := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			assert.Equal(t, "/healthz", r.URL.Path)
+			w.WriteHeader(http.StatusNoContent)
+		}),
+		ReadHeaderTimeout: time.Second,
+	}
+
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- server.Serve(listener)
+	}()
+
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
+		require.ErrorIs(t, <-errCh, http.ErrServerClosed)
+	})
+
+	result, err := healthcheck(t.Context(), healthcheckFlags{
+		Endpoint:   "http://localhost:1411",
+		UnixSocket: socketPath,
+	})
+
+	require.NoError(t, err)
+	require.Equal(t, http.StatusNoContent, result.StatusCode)
+	require.Equal(t, "http://localhost:1411/healthz", result.URL)
+}

backend/internal/cmds/import.go

@@ -73,7 +73,7 @@ func runImport(ctx context.Context, flags importFlags) error {
 	}
 	defer zipReader.Close()
 
-	db, err := bootstrap.ConnectDatabase()
+	db, _, err := bootstrap.ConnectDatabase(ctx)
 	if err != nil {
 		return err
 	}

backend/internal/cmds/key_rotate.go

@@ -13,7 +13,7 @@ import (
 
 	"github.com/pocket-id/pocket-id/backend/internal/bootstrap"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
 	jwkutils "github.com/pocket-id/pocket-id/backend/internal/utils/jwk"
 )
@@ -31,12 +31,17 @@ func init() {
 		Use:   "key-rotate",
 		Short: "Generates a new token signing key and replaces the current one",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			db, err := bootstrap.NewDatabase()
+			db, _, err := bootstrap.NewDatabase(cmd.Context())
 			if err != nil {
 				return err
 			}
 
-			return keyRotate(cmd.Context(), flags, db, &common.EnvConfig)
+			instanceID, err := instanceid.Load(cmd.Context(), db)
+			if err != nil {
+				return err
+			}
+
+			return keyRotate(cmd.Context(), flags, db, instanceID, &common.EnvConfig)
 		},
 	}
 
@@ -47,7 +52,7 @@ func init() {
 	rootCmd.AddCommand(keyRotateCmd)
 }
 
-func keyRotate(ctx context.Context, flags keyRotateFlags, db *gorm.DB, envConfig *common.EnvConfigSchema) error {
+func keyRotate(ctx context.Context, flags keyRotateFlags, db *gorm.DB, instanceID string, envConfig *common.EnvConfigSchema) error {
 	// Validate the flags
 	switch strings.ToUpper(flags.Alg) {
 	case jwa.RS256().String(), jwa.RS384().String(), jwa.RS512().String(),
@@ -83,14 +88,8 @@ func keyRotate(ctx context.Context, flags keyRotateFlags, db *gorm.DB, envConfig
 		}
 	}
 
-	// Init the services we need
-	appConfigService, err := service.NewAppConfigService(ctx, db)
-	if err != nil {
-		return fmt.Errorf("failed to create app config service: %w", err)
-	}
-
 	// Get the key provider
-	keyProvider, err := jwkutils.GetKeyProvider(db, envConfig, appConfigService.GetDbConfig().InstanceID.Value)
+	keyProvider, err := jwkutils.GetKeyProvider(db, envConfig, instanceID)
 	if err != nil {
 		return fmt.Errorf("failed to get key provider: %w", err)
 	}

backend/internal/cmds/key_rotate_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	jwkutils "github.com/pocket-id/pocket-id/backend/internal/utils/jwk"
 	testingutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
 )
@@ -81,17 +81,16 @@ func testKeyRotateWithDatabaseStorage(t *testing.T, flags keyRotateFlags, wantEr
 	// Create test database
 	db := testingutils.NewDatabaseForTest(t)
 
-	// Initialize app config service and create instance
-	appConfigService, err := service.NewAppConfigService(t.Context(), db)
+	// Load the instance ID
+	instanceID, err := instanceid.Load(t.Context(), db)
 	require.NoError(t, err)
-	instanceID := appConfigService.GetDbConfig().InstanceID.Value
 
 	// Get key provider
 	keyProvider, err := jwkutils.GetKeyProvider(db, envConfig, instanceID)
 	require.NoError(t, err)
 
 	// Run the key rotation
-	err = keyRotate(t.Context(), flags, db, envConfig)
+	err = keyRotate(t.Context(), flags, db, instanceID, envConfig)
 
 	if wantErr {
 		require.Error(t, err)

backend/internal/cmds/one_time_access_token.go

@@ -24,7 +24,7 @@ var oneTimeAccessTokenCmd = &cobra.Command{
 		userArg := args[0]
 
 		// Connect to the database
-		db, err := bootstrap.NewDatabase()
+		db, _, err := bootstrap.NewDatabase(cmd.Context())
 		if err != nil {
 			return err
 		}

backend/internal/cmds/root.go

@@ -5,10 +5,10 @@ import (
 	"log/slog"
 	"os"
 
+	"github.com/italypaleale/go-kit/signals"
 	"github.com/spf13/cobra"
 
 	"github.com/pocket-id/pocket-id/backend/internal/bootstrap"
-	"github.com/pocket-id/pocket-id/backend/internal/utils/signals"
 )
 
 var rootCmd = &cobra.Command{

backend/internal/common/claims.go

@@ -0,0 +1,8 @@
+package common
+
+// AuthenticationMethodsClaim is the JWT claim ("amr") used to identify how the user
+// authenticated. It is shared between the session JWTs and the OIDC tokens.
+const AuthenticationMethodsClaim = "amr"
+
+// TokenTypeClaim is the JWT claim ("type") used to identify the type of token.
+const TokenTypeClaim = "type"

backend/internal/common/env_config.go

@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"reflect"
+	"strconv"
 	"strings"
 
 	"github.com/caarlos0/env/v11"
@@ -17,6 +18,7 @@ import (
 
 type AppEnv string
 type DbProvider string
+type TrustProxyConfig []string
 
 const (
 	// TracerName should be passed to otel.Tracer, trace.SpanFromContext when creating custom spans.
@@ -38,21 +40,22 @@ const (
 )
 
 type EnvConfigSchema struct {
-	AppEnv                AppEnv `env:"APP_ENV" options:"toLower"`
-	EncryptionKey         []byte `env:"ENCRYPTION_KEY" options:"file"`
-	AppURL                string `env:"APP_URL" options:"toLower,trimTrailingSlash"`
-	DbProvider            DbProvider
-	DbConnectionString    string `env:"DB_CONNECTION_STRING" options:"file"`
-	TrustProxy            bool   `env:"TRUST_PROXY"`
-	TrustedPlatform       string `env:"TRUSTED_PLATFORM"`
-	AuditLogRetentionDays int    `env:"AUDIT_LOG_RETENTION_DAYS"`
-	AnalyticsDisabled     bool   `env:"ANALYTICS_DISABLED"`
-	AllowDowngrade        bool   `env:"ALLOW_DOWNGRADE"`
-	InternalAppURL        string `env:"INTERNAL_APP_URL"`
-	UiConfigDisabled      bool   `env:"UI_CONFIG_DISABLED"`
-	DisableRateLimiting   bool   `env:"DISABLE_RATE_LIMITING"`
-	VersionCheckDisabled  bool   `env:"VERSION_CHECK_DISABLED"`
-	StaticApiKey          string `env:"STATIC_API_KEY" options:"file"`
+	AppEnv                    AppEnv `env:"APP_ENV" options:"toLower"`
+	EncryptionKey             []byte `env:"ENCRYPTION_KEY" options:"file"`
+	AppURL                    string `env:"APP_URL" options:"toLower,trimTrailingSlash"`
+	DbProvider                DbProvider
+	DbConnectionString        string           `env:"DB_CONNECTION_STRING" options:"file"`
+	TrustProxy                TrustProxyConfig `env:"TRUST_PROXY"`
+	TrustedPlatform           string           `env:"TRUSTED_PLATFORM"`
+	AuditLogRetentionDays     int              `env:"AUDIT_LOG_RETENTION_DAYS"`
+	AnalyticsDisabled         bool             `env:"ANALYTICS_DISABLED"`
+	AllowDowngrade            bool             `env:"ALLOW_DOWNGRADE"`
+	AllowInsecureCallbackURLs bool             `env:"ALLOW_INSECURE_CALLBACK_URLS"`
+	InternalAppURL            string           `env:"INTERNAL_APP_URL"`
+	UiConfigDisabled          bool             `env:"UI_CONFIG_DISABLED"`
+	DisableRateLimiting       bool             `env:"DISABLE_RATE_LIMITING"`
+	VersionCheckDisabled      bool             `env:"VERSION_CHECK_DISABLED"`
+	StaticApiKey              string           `env:"STATIC_API_KEY" options:"file"`
 
 	FileBackend                     string `env:"FILE_BACKEND" options:"toLower"`
 	UploadPath                      string `env:"UPLOAD_PATH"`
@@ -60,7 +63,7 @@ type EnvConfigSchema struct {
 	S3Region                        string `env:"S3_REGION"`
 	S3Endpoint                      string `env:"S3_ENDPOINT"`
 	S3AccessKeyID                   string `env:"S3_ACCESS_KEY_ID"`
-	S3SecretAccessKey               string `env:"S3_SECRET_ACCESS_KEY"`
+	S3SecretAccessKey               string `env:"S3_SECRET_ACCESS_KEY" options:"file"`
 	S3ForcePathStyle                bool   `env:"S3_FORCE_PATH_STYLE"`
 	S3DisableDefaultIntegrityChecks bool   `env:"S3_DISABLE_DEFAULT_INTEGRITY_CHECKS"`
 
@@ -68,6 +71,7 @@ type EnvConfigSchema struct {
 	Host            string `env:"HOST" options:"toLower"`
 	UnixSocket      string `env:"UNIX_SOCKET"`
 	UnixSocketMode  string `env:"UNIX_SOCKET_MODE"`
+	SystemdSocket   bool   `env:"SYSTEMD_SOCKET"`
 	LocalIPv6Ranges string `env:"LOCAL_IPV6_RANGES"`
 
 	TLSCertFile string `env:"TLS_CERT" options:"file"`
@@ -77,10 +81,11 @@ type EnvConfigSchema struct {
 	GeoLiteDBPath     string `env:"GEOLITE_DB_PATH"`
 	GeoLiteDBUrl      string `env:"GEOLITE_DB_URL"`
 
-	LogLevel       string `env:"LOG_LEVEL" options:"toLower"`
-	MetricsEnabled bool   `env:"METRICS_ENABLED"`
-	TracingEnabled bool   `env:"TRACING_ENABLED"`
-	LogJSON        bool   `env:"LOG_JSON"`
+	ActorsPort string `env:"ACTORS_PORT"`
+	ActorsHost string `env:"ACTORS_HOST" options:"toLower"`
+
+	LogLevel string `env:"LOG_LEVEL" options:"toLower"`
+	LogJSON  bool   `env:"LOG_JSON"`
 }
 
 var EnvConfig = defaultConfig()
@@ -95,16 +100,19 @@ func init() {
 
 func defaultConfig() EnvConfigSchema {
 	return EnvConfigSchema{
-		AppEnv:                AppEnvProduction,
-		LogLevel:              "info",
-		DbProvider:            "sqlite",
-		FileBackend:           "filesystem",
-		AuditLogRetentionDays: 90,
-		AppURL:                AppUrl,
-		Port:                  "1411",
-		Host:                  "0.0.0.0",
-		GeoLiteDBPath:         "data/GeoLite2-City.mmdb",
-		GeoLiteDBUrl:          MaxMindGeoLiteCityUrl,
+		AppEnv:                    AppEnvProduction,
+		LogLevel:                  "info",
+		DbProvider:                "sqlite",
+		FileBackend:               "filesystem",
+		AuditLogRetentionDays:     90,
+		AllowInsecureCallbackURLs: true, // TODO: Default to false in major v3
+		AppURL:                    AppUrl,
+		Port:                      "1411",
+		Host:                      "0.0.0.0",
+		ActorsPort:                "1414",
+		ActorsHost:                "0.0.0.0",
+		GeoLiteDBPath:             "data/GeoLite2-City.mmdb",
+		GeoLiteDBUrl:              MaxMindGeoLiteCityUrl,
 	}
 }
 
@@ -137,24 +145,18 @@ func ValidateEnvConfig(config *EnvConfigSchema) error {
 		return nil
 	}
 
-	if _, err := sloggin.ParseLevel(config.LogLevel); err != nil {
+	_, err := sloggin.ParseLevel(config.LogLevel)
+	if err != nil {
 		return errors.New("invalid LOG_LEVEL value. Must be 'debug', 'info', 'warn' or 'error'")
 	}
 
+	// Check required properties
 	if len(config.EncryptionKey) < 16 {
 		return errors.New("ENCRYPTION_KEY must be at least 16 bytes long")
 	}
 
-	prepareDbConfig(config)
-
-	if err := validateAppURLs(config); err != nil {
-		return err
-	}
-	if err := validateFileBackend(config); err != nil {
-		return err
-	}
-	if err := validateLocalIPv6Ranges(config.LocalIPv6Ranges); err != nil {
-		return err
+	if config.SystemdSocket && config.UnixSocket != "" {
+		return errors.New("SYSTEMD_SOCKET and UNIX_SOCKET are mutually exclusive")
 	}
 
 	if config.AuditLogRetentionDays <= 0 {
@@ -162,11 +164,34 @@ func ValidateEnvConfig(config *EnvConfigSchema) error {
 	}
 
 	if config.StaticApiKey != "" && len(config.StaticApiKey) < 16 {
-		return errors.New("STATIC_API_KEY must be at least 16 characters long")
+		return errors.New("when set, STATIC_API_KEY must be at least 16 characters long")
 	}
 
-	return validateTLSConfig(config)
+	// Prepare the DB config
+	prepareDbConfig(config)
 
+	// Validate other required options
+	err = validateAppURLs(config)
+	if err != nil {
+		return err
+	}
+
+	err = validateFileBackend(config)
+	if err != nil {
+		return err
+	}
+
+	err = validateLocalIPv6Ranges(config.LocalIPv6Ranges)
+	if err != nil {
+		return err
+	}
+
+	err = validateTLSConfig(config)
+	if err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func prepareDbConfig(config *EnvConfigSchema) {
@@ -369,3 +394,29 @@ func (a AppEnv) IsProduction() bool {
 func (a AppEnv) IsTest() bool {
 	return a == AppEnvTest
 }
+
+func (config *TrustProxyConfig) UnmarshalText(text []byte) error {
+	value := strings.TrimSpace(string(text))
+
+	// Support boolean values for completely enabling or disabling trust proxy
+	enabled, err := strconv.ParseBool(value)
+	if err == nil {
+		if enabled {
+			*config = TrustProxyConfig{"0.0.0.0/0", "::/0"}
+		} else {
+			*config = nil
+		}
+
+		return nil
+	}
+
+	// Normalize and validate each explicit proxy before the server starts
+	proxies := strings.Split(value, ",")
+	for i, proxy := range proxies {
+		proxy = strings.TrimSpace(proxy)
+		proxies[i] = proxy
+	}
+
+	*config = proxies
+	return nil
+}

backend/internal/common/env_config_test.go

@@ -119,14 +119,36 @@ func TestParseEnvConfig(t *testing.T) {
 		t.Setenv("TRACING_ENABLED", "false")
 		t.Setenv("TRUST_PROXY", "true")
 		t.Setenv("ANALYTICS_DISABLED", "false")
+		t.Setenv("ALLOW_INSECURE_CALLBACK_URLS", "false")
 
 		err := parseAndValidateEnvConfig(t)
 		require.NoError(t, err)
 		assert.True(t, EnvConfig.UiConfigDisabled)
-		assert.True(t, EnvConfig.MetricsEnabled)
-		assert.False(t, EnvConfig.TracingEnabled)
-		assert.True(t, EnvConfig.TrustProxy)
+		assert.Equal(t, TrustProxyConfig{"0.0.0.0/0", "::/0"}, EnvConfig.TrustProxy)
 		assert.False(t, EnvConfig.AnalyticsDisabled)
+		assert.False(t, EnvConfig.AllowInsecureCallbackURLs)
+	})
+
+	t.Run("should parse trusted proxy IP addresses and CIDR ranges", func(t *testing.T) {
+		EnvConfig = defaultConfig()
+		t.Setenv("TRUST_PROXY", "10.0.0.0/8, 192.168.1.10, ::1/128")
+
+		err := parseAndValidateEnvConfig(t)
+		require.NoError(t, err)
+		assert.Equal(t, TrustProxyConfig{"10.0.0.0/8", "192.168.1.10", "::1/128"}, EnvConfig.TrustProxy)
+	})
+
+	t.Run("should disable trusted proxies when set to false", func(t *testing.T) {
+		EnvConfig = defaultConfig()
+		t.Setenv("TRUST_PROXY", "false")
+
+		err := parseAndValidateEnvConfig(t)
+		require.NoError(t, err)
+		assert.Nil(t, EnvConfig.TrustProxy)
+	})
+
+	t.Run("should allow insecure callback URLs by default", func(t *testing.T) {
+		assert.True(t, defaultConfig().AllowInsecureCallbackURLs)
 	})
 
 	t.Run("should default audit log retention days to 90", func(t *testing.T) {
@@ -175,6 +197,8 @@ func TestParseEnvConfig(t *testing.T) {
 		t.Setenv("UNIX_SOCKET", "/tmp/app.sock")
 		t.Setenv("MAXMIND_LICENSE_KEY", "test-license")
 		t.Setenv("GEOLITE_DB_PATH", "/custom/geolite.mmdb")
+		t.Setenv("ACTORS_PORT", "9999")
+		t.Setenv("ACTORS_HOST", "LOCALHOST")
 
 		err := parseAndValidateEnvConfig(t)
 		require.NoError(t, err)
@@ -182,6 +206,8 @@ func TestParseEnvConfig(t *testing.T) {
 		assert.Equal(t, "/custom/uploads", EnvConfig.UploadPath)
 		assert.Equal(t, "8080", EnvConfig.Port)
 		assert.Equal(t, "localhost", EnvConfig.Host) // lowercased
+		assert.Equal(t, "9999", EnvConfig.ActorsPort)
+		assert.Equal(t, "localhost", EnvConfig.ActorsHost) // lowercased
 	})
 
 	t.Run("should normalize file backend and default upload path", func(t *testing.T) {

backend/internal/common/errors.go

@@ -8,21 +8,28 @@ import (
 
 type AppError interface {
 	error
+
 	HttpStatusCode() int
 }
 
+type AppErrorDescription interface {
+	AppError
+
+	Description() string
+}
+
 // Custom error types for various conditions
 
 type AlreadyInUseError struct {
 	Property string
 }
 
-func (e *AlreadyInUseError) Error() string {
+func (e AlreadyInUseError) Error() string {
 	return e.Property + " is already in use"
 }
-func (e *AlreadyInUseError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e AlreadyInUseError) HttpStatusCode() int { return http.StatusBadRequest }
 
-func (e *AlreadyInUseError) Is(target error) bool {
+func (e AlreadyInUseError) Is(target error) bool {
 	// Ignore the field property when checking if an error is of the type AlreadyInUseError
 	x := &AlreadyInUseError{}
 	return errors.As(target, &x)
@@ -30,445 +37,243 @@ func (e *AlreadyInUseError) Is(target error) bool {
 
 type SetupNotAvailableError struct{}
 
-func (e *SetupNotAvailableError) Error() string       { return "not found" }
-func (e *SetupNotAvailableError) HttpStatusCode() int { return http.StatusNotFound }
+func (e SetupNotAvailableError) Error() string       { return "not found" }
+func (e SetupNotAvailableError) HttpStatusCode() int { return http.StatusNotFound }
 
 type TokenInvalidOrExpiredError struct{}
 
-func (e *TokenInvalidOrExpiredError) Error() string       { return "token is invalid or expired" }
-func (e *TokenInvalidOrExpiredError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e TokenInvalidOrExpiredError) Error() string       { return "token is invalid or expired" }
+func (e TokenInvalidOrExpiredError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type DeviceCodeInvalid struct{}
 
-func (e *DeviceCodeInvalid) Error() string {
+func (e DeviceCodeInvalid) Error() string {
 	return "one time access code must be used on the device it was generated for"
 }
-func (e *DeviceCodeInvalid) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e DeviceCodeInvalid) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type TokenInvalidError struct{}
 
-func (e *TokenInvalidError) Error() string {
-	return "Token is invalid"
-}
-func (e *TokenInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e TokenInvalidError) Error() string       { return "Token is invalid" }
+func (e TokenInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type OidcMissingAuthorizationError struct{}
 
-func (e *OidcMissingAuthorizationError) Error() string       { return "missing authorization" }
-func (e *OidcMissingAuthorizationError) HttpStatusCode() int { return http.StatusForbidden }
-
-type OidcGrantTypeNotSupportedError struct{}
-
-func (e *OidcGrantTypeNotSupportedError) Error() string       { return "grant type not supported" }
-func (e *OidcGrantTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcMissingClientCredentialsError struct{}
-
-func (e *OidcMissingClientCredentialsError) Error() string       { return "client id or secret not provided" }
-func (e *OidcMissingClientCredentialsError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcClientSecretInvalidError struct{}
-
-func (e *OidcClientSecretInvalidError) Error() string       { return "invalid client secret" }
-func (e *OidcClientSecretInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
-
-type OidcClientAssertionInvalidError struct{}
-
-func (e *OidcClientAssertionInvalidError) Error() string       { return "invalid client assertion" }
-func (e *OidcClientAssertionInvalidError) HttpStatusCode() int { return http.StatusUnauthorized }
-
-type OidcInvalidAuthorizationCodeError struct{}
-
-func (e *OidcInvalidAuthorizationCodeError) Error() string       { return "invalid authorization code" }
-func (e *OidcInvalidAuthorizationCodeError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcClientNotFoundError struct{}
-
-func (e *OidcClientNotFoundError) Error() string       { return "client not found" }
-func (e *OidcClientNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
-
-type OidcMissingCallbackURLError struct{}
-
-func (e *OidcMissingCallbackURLError) Error() string {
-	return "unable to detect callback url, it might be necessary for an admin to fix this"
-}
-func (e *OidcMissingCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcMissingAuthorizationError) Error() string       { return "missing authorization" }
+func (e OidcMissingAuthorizationError) HttpStatusCode() int { return http.StatusForbidden }
 
 type OidcInvalidCallbackURLError struct{}
 
-func (e *OidcInvalidCallbackURLError) Error() string {
+func (e OidcInvalidCallbackURLError) Error() string {
 	return "invalid callback URL, it might be necessary for an admin to fix this"
 }
-func (e *OidcInvalidCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcInvalidCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type FileTypeNotSupportedError struct{}
 
-func (e *FileTypeNotSupportedError) Error() string       { return "file type not supported" }
-func (e *FileTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e FileTypeNotSupportedError) Error() string       { return "file type not supported" }
+func (e FileTypeNotSupportedError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type FileTooLargeError struct {
 	MaxSize string
 }
 
-func (e *FileTooLargeError) Error() string {
+func (e FileTooLargeError) Error() string {
 	return fmt.Sprintf("The file can't be larger than %s", e.MaxSize)
 }
-func (e *FileTooLargeError) HttpStatusCode() int { return http.StatusRequestEntityTooLarge }
+func (e FileTooLargeError) HttpStatusCode() int { return http.StatusRequestEntityTooLarge }
 
 type NotSignedInError struct{}
 
-func (e *NotSignedInError) Error() string       { return "You are not signed in" }
-func (e *NotSignedInError) HttpStatusCode() int { return http.StatusUnauthorized }
-
-type MissingAccessToken struct{}
-
-func (e *MissingAccessToken) Error() string       { return "Missing access token" }
-func (e *MissingAccessToken) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e NotSignedInError) Error() string       { return "You are not signed in" }
+func (e NotSignedInError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type MissingPermissionError struct{}
 
-func (e *MissingPermissionError) Error() string {
+func (e MissingPermissionError) Error() string {
 	return "You don't have permission to perform this action"
 }
-func (e *MissingPermissionError) HttpStatusCode() int { return http.StatusForbidden }
+func (e MissingPermissionError) HttpStatusCode() int { return http.StatusForbidden }
 
 type TooManyRequestsError struct{}
 
-func (e *TooManyRequestsError) Error() string {
-	return "Too many requests"
-}
-func (e *TooManyRequestsError) HttpStatusCode() int { return http.StatusTooManyRequests }
+func (e TooManyRequestsError) Error() string       { return "Too many requests" }
+func (e TooManyRequestsError) HttpStatusCode() int { return http.StatusTooManyRequests }
 
 type UserIdNotProvidedError struct{}
 
-func (e *UserIdNotProvidedError) Error() string {
-	return "User id not provided"
-}
-func (e *UserIdNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e UserIdNotProvidedError) Error() string       { return "User id not provided" }
+func (e UserIdNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type UserNotFoundError struct{}
 
-func (e *UserNotFoundError) Error() string {
-	return "User not found"
-}
-func (e *UserNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
-
-type ClientIdOrSecretNotProvidedError struct{}
-
-func (e *ClientIdOrSecretNotProvidedError) Error() string {
-	return "Client id or secret not provided"
-}
-func (e *ClientIdOrSecretNotProvidedError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e UserNotFoundError) Error() string       { return "User not found" }
+func (e UserNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
 
 type WrongFileTypeError struct {
 	ExpectedFileType string
 }
 
-func (e *WrongFileTypeError) Error() string {
+func (e WrongFileTypeError) Error() string {
 	return fmt.Sprintf("File must be of type %s", e.ExpectedFileType)
 }
-func (e *WrongFileTypeError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e WrongFileTypeError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type MissingSessionIdError struct{}
 
-func (e *MissingSessionIdError) Error() string {
-	return "Missing session id"
-}
-func (e *MissingSessionIdError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e MissingSessionIdError) Error() string       { return "Missing session id" }
+func (e MissingSessionIdError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type ReservedClaimError struct {
 	Key string
 }
 
-func (e *ReservedClaimError) Error() string {
+func (e ReservedClaimError) Error() string {
 	return fmt.Sprintf("Claim %s is reserved and can't be used", e.Key)
 }
-func (e *ReservedClaimError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e ReservedClaimError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type DuplicateClaimError struct {
 	Key string
 }
 
-func (e *DuplicateClaimError) Error() string {
+func (e DuplicateClaimError) Error() string {
 	return fmt.Sprintf("Claim %s is already defined", e.Key)
 }
-func (e *DuplicateClaimError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcInvalidCodeVerifierError struct{}
-
-func (e *OidcInvalidCodeVerifierError) Error() string {
-	return "Invalid code verifier"
-}
-func (e *OidcInvalidCodeVerifierError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcMissingCodeChallengeError struct{}
-
-func (e *OidcMissingCodeChallengeError) Error() string {
-	return "Missing code challenge"
-}
-func (e *OidcMissingCodeChallengeError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e DuplicateClaimError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type LdapUserUpdateError struct{}
 
-func (e *LdapUserUpdateError) Error() string {
-	return "LDAP users can't be updated"
-}
-func (e *LdapUserUpdateError) HttpStatusCode() int { return http.StatusForbidden }
+func (e LdapUserUpdateError) Error() string       { return "LDAP users can't be updated" }
+func (e LdapUserUpdateError) HttpStatusCode() int { return http.StatusForbidden }
 
 type LdapUserGroupUpdateError struct{}
 
-func (e *LdapUserGroupUpdateError) Error() string {
-	return "LDAP user groups can't be updated"
-}
-func (e *LdapUserGroupUpdateError) HttpStatusCode() int { return http.StatusForbidden }
+func (e LdapUserGroupUpdateError) Error() string       { return "LDAP user groups can't be updated" }
+func (e LdapUserGroupUpdateError) HttpStatusCode() int { return http.StatusForbidden }
 
 type OidcAccessDeniedError struct{}
 
-func (e *OidcAccessDeniedError) Error() string {
-	return "You're not allowed to access this service"
-}
-func (e *OidcAccessDeniedError) HttpStatusCode() int { return http.StatusForbidden }
+func (e OidcAccessDeniedError) Error() string       { return "You're not allowed to access this service" }
+func (e OidcAccessDeniedError) HttpStatusCode() int { return http.StatusForbidden }
 
 type OidcClientIdNotMatchingError struct{}
 
-func (e *OidcClientIdNotMatchingError) Error() string {
+func (e OidcClientIdNotMatchingError) Error() string {
 	return "Client id in request doesn't match client id in token"
 }
-func (e *OidcClientIdNotMatchingError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcNoCallbackURLError struct{}
-
-func (e *OidcNoCallbackURLError) Error() string {
-	return "No callback URL provided"
-}
-func (e *OidcNoCallbackURLError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OidcClientIdNotMatchingError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type UiConfigDisabledError struct{}
 
-func (e *UiConfigDisabledError) Error() string {
+func (e UiConfigDisabledError) Error() string {
 	return "The configuration can't be changed since the UI configuration is disabled"
 }
-func (e *UiConfigDisabledError) HttpStatusCode() int { return http.StatusForbidden }
+func (e UiConfigDisabledError) HttpStatusCode() int { return http.StatusForbidden }
 
 type InvalidUUIDError struct{}
 
-func (e *InvalidUUIDError) Error() string {
-	return "Invalid UUID"
-}
-func (e *InvalidUUIDError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e InvalidUUIDError) Error() string       { return "Invalid UUID" }
+func (e InvalidUUIDError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type OneTimeAccessDisabledError struct{}
 
-func (e *OneTimeAccessDisabledError) Error() string {
-	return "One-time access is disabled"
-}
-func (e *OneTimeAccessDisabledError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e OneTimeAccessDisabledError) Error() string       { return "One-time access is disabled" }
+func (e OneTimeAccessDisabledError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type InvalidAPIKeyError struct{}
 
-func (e *InvalidAPIKeyError) Error() string {
-	return "Invalid Api Key"
-}
-func (e *InvalidAPIKeyError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e InvalidAPIKeyError) Error() string       { return "Invalid Api Key" }
+func (e InvalidAPIKeyError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type NoAPIKeyProvidedError struct{}
 
-func (e *NoAPIKeyProvidedError) Error() string {
-	return "No API Key Provided"
-}
-func (e *NoAPIKeyProvidedError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e NoAPIKeyProvidedError) Error() string       { return "No API Key Provided" }
+func (e NoAPIKeyProvidedError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type APIKeyNotFoundError struct{}
 
-func (e *APIKeyNotFoundError) Error() string {
-	return "API Key Not Found"
-}
-func (e *APIKeyNotFoundError) HttpStatusCode() int { return http.StatusUnauthorized }
+func (e APIKeyNotFoundError) Error() string       { return "API Key Not Found" }
+func (e APIKeyNotFoundError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type APIKeyNotExpiredError struct{}
 
-func (e *APIKeyNotExpiredError) Error() string {
-	return "API Key is not expired yet"
-}
-func (e *APIKeyNotExpiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e APIKeyNotExpiredError) Error() string       { return "API Key is not expired yet" }
+func (e APIKeyNotExpiredError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type APIKeyExpirationDateError struct{}
 
-func (e *APIKeyExpirationDateError) Error() string {
+func (e APIKeyExpirationDateError) Error() string {
 	return "API Key expiration time must be in the future"
 }
-func (e *APIKeyExpirationDateError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e APIKeyExpirationDateError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type APIKeyAuthNotAllowedError struct{}
 
-func (e *APIKeyAuthNotAllowedError) Error() string {
+func (e APIKeyAuthNotAllowedError) Error() string {
 	return "API key authentication is not allowed for this endpoint"
 }
-func (e *APIKeyAuthNotAllowedError) HttpStatusCode() int { return http.StatusForbidden }
-
-type OidcInvalidRefreshTokenError struct{}
-
-func (e *OidcInvalidRefreshTokenError) Error() string {
-	return "refresh token is invalid or expired"
-}
-func (e *OidcInvalidRefreshTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
-
-type OidcMissingRefreshTokenError struct{}
-
-func (e *OidcMissingRefreshTokenError) Error() string {
-	return "refresh token is required"
-}
-func (e *OidcMissingRefreshTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
-
-type OidcMissingAuthorizationCodeError struct{}
-
-func (e *OidcMissingAuthorizationCodeError) Error() string {
-	return "authorization code is required"
-}
-func (e *OidcMissingAuthorizationCodeError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e APIKeyAuthNotAllowedError) HttpStatusCode() int { return http.StatusForbidden }
 
 type UserDisabledError struct{}
 
-func (e *UserDisabledError) Error() string {
-	return "User account is disabled"
-}
-func (e *UserDisabledError) HttpStatusCode() int {
-	return http.StatusForbidden
-}
+func (e UserDisabledError) Error() string       { return "User account is disabled" }
+func (e UserDisabledError) HttpStatusCode() int { return http.StatusForbidden }
 
-type ValidationError struct {
-	Message string
-}
+type ValidationError struct{ Message string }
 
-func (e *ValidationError) Error() string {
-	return e.Message
-}
+func (e ValidationError) Error() string { return e.Message }
 
-func (e *ValidationError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e ValidationError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type OidcDeviceCodeExpiredError struct{}
 
-func (e *OidcDeviceCodeExpiredError) Error() string {
-	return "device code has expired"
-}
-func (e *OidcDeviceCodeExpiredError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcDeviceCodeExpiredError) Error() string       { return "device code has expired" }
+func (e OidcDeviceCodeExpiredError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type OidcInvalidDeviceCodeError struct{}
 
-func (e *OidcInvalidDeviceCodeError) Error() string {
-	return "invalid device code"
-}
-func (e *OidcInvalidDeviceCodeError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
-
-type OidcSlowDownError struct{}
-
-func (e *OidcSlowDownError) Error() string {
-	return "polling too frequently"
-}
-func (e *OidcSlowDownError) HttpStatusCode() int {
-	return http.StatusTooManyRequests
-}
-
-type OidcAuthorizationPendingError struct{}
-
-func (e *OidcAuthorizationPendingError) Error() string {
-	return "authorization is still pending"
-}
-func (e *OidcAuthorizationPendingError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e OidcInvalidDeviceCodeError) Error() string       { return "invalid device code" }
+func (e OidcInvalidDeviceCodeError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type ReauthenticationRequiredError struct{}
 
-func (e *ReauthenticationRequiredError) Error() string {
-	return "reauthentication required"
-}
-func (e *ReauthenticationRequiredError) HttpStatusCode() int {
-	return http.StatusUnauthorized
-}
+func (e ReauthenticationRequiredError) Error() string       { return "reauthentication required" }
+func (e ReauthenticationRequiredError) HttpStatusCode() int { return http.StatusUnauthorized }
 
 type OpenSignupDisabledError struct{}
 
-func (e *OpenSignupDisabledError) Error() string {
-	return "Open user signup is not enabled"
-}
+func (e OpenSignupDisabledError) Error() string { return "Open user signup is not enabled" }
 
-func (e *OpenSignupDisabledError) HttpStatusCode() int {
-	return http.StatusForbidden
-}
+func (e OpenSignupDisabledError) HttpStatusCode() int { return http.StatusForbidden }
 
 type ClientIdAlreadyExistsError struct{}
 
-func (e *ClientIdAlreadyExistsError) Error() string {
-	return "Client ID already in use"
-}
+func (e ClientIdAlreadyExistsError) Error() string { return "Client ID already in use" }
 
-func (e *ClientIdAlreadyExistsError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e ClientIdAlreadyExistsError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type UserEmailNotSetError struct{}
 
-func (e *UserEmailNotSetError) Error() string {
-	return "The user does not have an email address set"
-}
+func (e UserEmailNotSetError) Error() string { return "The user does not have an email address set" }
 
-func (e *UserEmailNotSetError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
+func (e UserEmailNotSetError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type ImageNotFoundError struct{}
 
-func (e *ImageNotFoundError) Error() string {
-	return "Image not found"
-}
+func (e ImageNotFoundError) Error() string { return "Image not found" }
 
-func (e *ImageNotFoundError) HttpStatusCode() int {
-	return http.StatusNotFound
+func (e ImageNotFoundError) HttpStatusCode() int { return http.StatusNotFound }
+
+type OidcPARRequiredError struct{}
+
+func (e OidcPARRequiredError) Error() string {
+	return "this client requires pushed authorization requests"
 }
+func (e OidcPARRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
 
 type InvalidEmailVerificationTokenError struct{}
 
-func (e *InvalidEmailVerificationTokenError) Error() string {
-	return "Invalid email verification token"
-}
+func (e InvalidEmailVerificationTokenError) Error() string { return "Invalid email verification token" }
 
-func (e *InvalidEmailVerificationTokenError) HttpStatusCode() int {
-	return http.StatusBadRequest
-}
-
-// OIDC prompt parameter errors - used for redirect error responses
-
-type OidcLoginRequiredError struct{}
-
-func (e *OidcLoginRequiredError) Error() string       { return "login_required" }
-func (e *OidcLoginRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcConsentRequiredError struct{}
-
-func (e *OidcConsentRequiredError) Error() string       { return "consent_required" }
-func (e *OidcConsentRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcInteractionRequiredError struct{}
-
-func (e *OidcInteractionRequiredError) Error() string       { return "interaction_required" }
-func (e *OidcInteractionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
-
-type OidcAccountSelectionRequiredError struct{}
-
-func (e *OidcAccountSelectionRequiredError) Error() string {
-	return "account_selection_required"
-}
-func (e *OidcAccountSelectionRequiredError) HttpStatusCode() int { return http.StatusBadRequest }
+func (e InvalidEmailVerificationTokenError) HttpStatusCode() int { return http.StatusBadRequest }

backend/internal/common/reserved.go

@@ -0,0 +1,5 @@
+package common
+
+// StaticApiKeyUserID is the fixed ID of the synthetic admin user that the static API key authenticates as
+// It is excluded from real-user counts such as the initial-admin-setup check
+const StaticApiKeyUserID = "00000000-0000-0000-0000-000000000000"

backend/internal/controller/api_key_controller.go

@@ -1,156 +0,0 @@
-package controller
-
-import (
-	"net/http"
-
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
-
-	"github.com/gin-gonic/gin"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
-	"github.com/pocket-id/pocket-id/backend/internal/middleware"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
-)
-
-// swag init -g cmd/main.go -o ./docs/swagger --parseDependency
-
-// ApiKeyController manages API keys for authenticated users
-type ApiKeyController struct {
-	apiKeyService *service.ApiKeyService
-}
-
-// NewApiKeyController creates a new controller for API key management
-// @Summary API key management controller
-// @Description Initializes API endpoints for managing API keys
-// @Tags API Keys
-func NewApiKeyController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, apiKeyService *service.ApiKeyService) {
-	uc := &ApiKeyController{apiKeyService: apiKeyService}
-
-	apiKeyGroup := group.Group("/api-keys")
-	{
-		apiKeyGroup.GET("", authMiddleware.WithAdminNotRequired().Add(), uc.listApiKeysHandler)
-		apiKeyGroup.POST("", authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(), uc.createApiKeyHandler)
-		apiKeyGroup.POST("/:id/renew", authMiddleware.WithAdminNotRequired().WithApiKeyAuthDisabled().Add(), uc.renewApiKeyHandler)
-		apiKeyGroup.DELETE("/:id", authMiddleware.WithAdminNotRequired().Add(), uc.revokeApiKeyHandler)
-	}
-}
-
-// listApiKeysHandler godoc
-// @Summary List API keys
-// @Description Get a paginated list of API keys belonging to the current user
-// @Tags API Keys
-// @Param pagination[page] query int false "Page number for pagination" default(1)
-// @Param pagination[limit] query int false "Number of items per page" default(20)
-// @Param sort[column] query string false "Column to sort by"
-// @Param sort[direction] query string false "Sort direction (asc or desc)" default("asc")
-// @Success 200 {object} dto.Paginated[dto.ApiKeyDto]
-// @Router /api/api-keys [get]
-func (c *ApiKeyController) listApiKeysHandler(ctx *gin.Context) {
-	listRequestOptions := utils.ParseListRequestOptions(ctx)
-
-	userID := ctx.GetString("userID")
-
-	apiKeys, pagination, err := c.apiKeyService.ListApiKeys(ctx.Request.Context(), userID, listRequestOptions)
-	if err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	var apiKeysDto []dto.ApiKeyDto
-	if err := dto.MapStructList(apiKeys, &apiKeysDto); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, dto.Paginated[dto.ApiKeyDto]{
-		Data:       apiKeysDto,
-		Pagination: pagination,
-	})
-}
-
-// createApiKeyHandler godoc
-// @Summary Create API key
-// @Description Create a new API key for the current user
-// @Tags API Keys
-// @Param api_key body dto.ApiKeyCreateDto true "API key information"
-// @Success 201 {object} dto.ApiKeyResponseDto "Created API key with token"
-// @Router /api/api-keys [post]
-func (c *ApiKeyController) createApiKeyHandler(ctx *gin.Context) {
-	userID := ctx.GetString("userID")
-
-	var input dto.ApiKeyCreateDto
-	if err := dto.ShouldBindWithNormalizedJSON(ctx, &input); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	apiKey, token, err := c.apiKeyService.CreateApiKey(ctx.Request.Context(), userID, input)
-	if err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	var apiKeyDto dto.ApiKeyDto
-	if err := dto.MapStruct(apiKey, &apiKeyDto); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	ctx.JSON(http.StatusCreated, dto.ApiKeyResponseDto{
-		ApiKey: apiKeyDto,
-		Token:  token,
-	})
-}
-
-// renewApiKeyHandler godoc
-// @Summary Renew API key
-// @Description Renew an existing API key by ID
-// @Tags API Keys
-// @Param id path string true "API Key ID"
-// @Success 200 {object} dto.ApiKeyResponseDto "Renewed API key with new token"
-// @Router /api/api-keys/{id}/renew [post]
-func (c *ApiKeyController) renewApiKeyHandler(ctx *gin.Context) {
-	userID := ctx.GetString("userID")
-	apiKeyID := ctx.Param("id")
-
-	var input dto.ApiKeyRenewDto
-	if err := dto.ShouldBindWithNormalizedJSON(ctx, &input); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	apiKey, token, err := c.apiKeyService.RenewApiKey(ctx.Request.Context(), userID, apiKeyID, input.ExpiresAt.ToTime())
-	if err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	var apiKeyDto dto.ApiKeyDto
-	if err := dto.MapStruct(apiKey, &apiKeyDto); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	ctx.JSON(http.StatusOK, dto.ApiKeyResponseDto{
-		ApiKey: apiKeyDto,
-		Token:  token,
-	})
-}
-
-// revokeApiKeyHandler godoc
-// @Summary Revoke API key
-// @Description Revoke (delete) an existing API key by ID
-// @Tags API Keys
-// @Param id path string true "API Key ID"
-// @Success 204 "No Content"
-// @Router /api/api-keys/{id} [delete]
-func (c *ApiKeyController) revokeApiKeyHandler(ctx *gin.Context) {
-	userID := ctx.GetString("userID")
-	apiKeyID := ctx.Param("id")
-
-	if err := c.apiKeyService.RevokeApiKey(ctx.Request.Context(), userID, apiKeyID); err != nil {
-		_ = ctx.Error(err)
-		return
-	}
-
-	ctx.Status(http.StatusNoContent)
-}

backend/internal/controller/app_config_controller.go

@@ -9,6 +9,7 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/dto"
 	"github.com/pocket-id/pocket-id/backend/internal/middleware"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/tracing"
 )
 
 // NewAppConfigController creates a new controller for application configuration endpoints
@@ -49,7 +50,7 @@ type AppConfigController struct {
 // @Accept json
 // @Produce json
 // @Success 200 {array} dto.PublicAppConfigVariableDto
-// @Router /application-configuration [get]
+// @Router /api/application-configuration [get]
 func (acc *AppConfigController) listAppConfigHandler(c *gin.Context) {
 	configuration := acc.appConfigService.ListAppConfig(false)
 
@@ -66,6 +67,13 @@ func (acc *AppConfigController) listAppConfigHandler(c *gin.Context) {
 		Type:  "boolean",
 	})
 
+	// Manually add tracingEnabled, derived from the OTel environment, so the frontend only exports traces when the backend can forward them to a collector
+	configVariablesDto = append(configVariablesDto, dto.PublicAppConfigVariableDto{
+		Key:   "tracingEnabled",
+		Value: strconv.FormatBool(tracing.FrontendTracingEnabled()),
+		Type:  "boolean",
+	})
+
 	c.JSON(http.StatusOK, configVariablesDto)
 }
 
@@ -76,7 +84,7 @@ func (acc *AppConfigController) listAppConfigHandler(c *gin.Context) {
 // @Accept json
 // @Produce json
 // @Success 200 {array} dto.AppConfigVariableDto
-// @Router /application-configuration/all [get]
+// @Router /api/application-configuration/all [get]
 func (acc *AppConfigController) listAllAppConfigHandler(c *gin.Context) {
 	configuration := acc.appConfigService.ListAppConfig(true)
 

backend/internal/controller/e2etest_controller.go

@@ -14,6 +14,7 @@ func NewTestController(group *gin.RouterGroup, testService *service.TestService)
 	testController := &TestController{TestService: testService}
 
 	group.POST("/test/reset", testController.resetAndSeedHandler)
+	group.POST("/test/accesstoken", testController.signAccessToken)
 	group.POST("/test/refreshtoken", testController.signRefreshToken)
 
 	group.GET("/externalidp/jwks.json", testController.externalIdPJWKS)
@@ -108,6 +109,27 @@ func (tc *TestController) externalIdPSignToken(c *gin.Context) {
 	c.Writer.WriteString(token)
 }
 
+func (tc *TestController) signAccessToken(c *gin.Context) {
+	var input struct {
+		UserID   string `json:"user"`
+		ClientID string `json:"client"`
+		Expired  bool   `json:"expired"`
+	}
+	err := c.ShouldBindJSON(&input)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	token, err := tc.TestService.SignAccessToken(c.Request.Context(), input.UserID, input.ClientID, input.Expired)
+	if err != nil {
+		_ = c.Error(err)
+		return
+	}
+
+	c.Writer.WriteString(token)
+}
+
 func (tc *TestController) signRefreshToken(c *gin.Context) {
 	var input struct {
 		UserID       string `json:"user"`
@@ -120,7 +142,7 @@ func (tc *TestController) signRefreshToken(c *gin.Context) {
 		return
 	}
 
-	token, err := tc.TestService.SignRefreshToken(input.UserID, input.ClientID, input.RefreshToken)
+	token, err := tc.TestService.SignRefreshToken(c.Request.Context(), input.UserID, input.ClientID, input.RefreshToken)
 	if err != nil {
 		_ = c.Error(err)
 		return

backend/internal/controller/oidc_controller.go

@@ -1,11 +1,7 @@
 package controller
 
 import (
-	"context"
-	"errors"
-	"log/slog"
 	"net/http"
-	"net/url"
 	"strconv"
 	"strings"
 	"time"
@@ -17,30 +13,17 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/middleware"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
-	"github.com/pocket-id/pocket-id/backend/internal/utils/cookie"
 )
 
 // NewOidcController creates a new controller for OIDC related endpoints
 // @Summary OIDC controller
 // @Description Initializes all OIDC-related API endpoints for authentication and client management
 // @Tags OIDC
-func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, fileSizeLimitMiddleware *middleware.FileSizeLimitMiddleware, oidcService *service.OidcService, jwtService *service.JwtService) {
+func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, fileSizeLimitMiddleware *middleware.FileSizeLimitMiddleware, oidcService *service.OidcService) {
 	oc := &OidcController{
-		oidcService:  oidcService,
-		jwtService:   jwtService,
-		createTokens: oidcService.CreateTokens,
+		oidcService: oidcService,
 	}
 
-	group.POST("/oidc/authorize", authMiddleware.WithAdminNotRequired().Add(), oc.authorizeHandler)
-	group.POST("/oidc/authorization-required", authMiddleware.WithAdminNotRequired().Add(), oc.authorizationConfirmationRequiredHandler)
-
-	group.POST("/oidc/token", oc.createTokensHandler)
-	group.GET("/oidc/userinfo", oc.userInfoHandler)
-	group.POST("/oidc/userinfo", oc.userInfoHandler)
-	group.POST("/oidc/end-session", authMiddleware.WithAdminNotRequired().WithSuccessOptional().Add(), oc.EndSessionHandler)
-	group.GET("/oidc/end-session", authMiddleware.WithAdminNotRequired().WithSuccessOptional().Add(), oc.EndSessionHandler)
-	group.POST("/oidc/introspect", oc.introspectTokenHandler)
-
 	group.GET("/oidc/clients", authMiddleware.Add(), oc.listClientsHandler)
 	group.POST("/oidc/clients", authMiddleware.Add(), oc.createClientHandler)
 	group.GET("/oidc/clients/:id", authMiddleware.Add(), oc.getClientHandler)
@@ -57,10 +40,6 @@ func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi
 
 	group.GET("/oidc/clients/:id/preview/:userId", authMiddleware.Add(), oc.getClientPreviewHandler)
 
-	group.POST("/oidc/device/authorize", oc.deviceAuthorizationHandler)
-	group.POST("/oidc/device/verify", authMiddleware.WithAdminNotRequired().Add(), oc.verifyDeviceCodeHandler)
-	group.GET("/oidc/device/info", authMiddleware.WithAdminNotRequired().Add(), oc.getDeviceCodeInfoHandler)
-
 	group.GET("/oidc/users/me/authorized-clients", authMiddleware.WithAdminNotRequired().Add(), oc.listOwnAuthorizedClientsHandler)
 	group.GET("/oidc/users/:id/authorized-clients", authMiddleware.Add(), oc.listAuthorizedClientsHandler)
 
@@ -73,314 +52,7 @@ func NewOidcController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi
 }
 
 type OidcController struct {
-	oidcService  *service.OidcService
-	jwtService   *service.JwtService
-	createTokens func(context.Context, dto.OidcCreateTokensDto) (service.CreatedTokens, error)
-}
-
-// authorizeHandler godoc
-// @Summary Authorize OIDC client
-// @Description Start the OIDC authorization process for a client
-// @Tags OIDC
-// @Accept json
-// @Produce json
-// @Param request body dto.AuthorizeOidcClientRequestDto true "Authorization request parameters"
-// @Success 200 {object} dto.AuthorizeOidcClientResponseDto "Authorization code and callback URL"
-// @Router /api/oidc/authorize [post]
-func (oc *OidcController) authorizeHandler(c *gin.Context) {
-	var input dto.AuthorizeOidcClientRequestDto
-	err := c.ShouldBindJSON(&input)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	code, callbackURL, err := oc.oidcService.Authorize(
-		c.Request.Context(),
-		input,
-		c.GetString("userID"),
-		c.GetString("authenticationMethod"),
-		c.ClientIP(),
-		c.Request.UserAgent(),
-	)
-	if err != nil {
-		// Check if this is a prompt-related error that should be returned as a redirect error
-		if isOidcPromptError(err) {
-			c.JSON(http.StatusOK, gin.H{
-				"error":            err.Error(),
-				"requiresRedirect": true,
-			})
-			return
-		}
-		_ = c.Error(err)
-		return
-	}
-
-	response := dto.AuthorizeOidcClientResponseDto{
-		Code:        code,
-		CallbackURL: callbackURL,
-		Issuer:      common.EnvConfig.AppURL,
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
-// isOidcPromptError checks if an error is a prompt-related OIDC error that should trigger a redirect
-func isOidcPromptError(err error) bool {
-	var loginReq *common.OidcLoginRequiredError
-	var consentReq *common.OidcConsentRequiredError
-	var interactionReq *common.OidcInteractionRequiredError
-	var accountSelectionReq *common.OidcAccountSelectionRequiredError
-
-	return errors.As(err, &loginReq) ||
-		errors.As(err, &consentReq) ||
-		errors.As(err, &interactionReq) ||
-		errors.As(err, &accountSelectionReq)
-}
-
-// authorizationConfirmationRequiredHandler godoc
-// @Summary Check if authorization confirmation is required
-// @Description Check if the user needs to confirm authorization for the client
-// @Tags OIDC
-// @Accept json
-// @Produce json
-// @Param request body dto.AuthorizationRequiredDto true "Authorization check parameters"
-// @Success 200 {object} object "{ \"authorizationRequired\": true/false }"
-// @Router /api/oidc/authorization-required [post]
-func (oc *OidcController) authorizationConfirmationRequiredHandler(c *gin.Context) {
-	var input dto.AuthorizationRequiredDto
-	if err := c.ShouldBindJSON(&input); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	hasAuthorizedClient, err := oc.oidcService.HasAuthorizedClient(c.Request.Context(), input.ClientID, c.GetString("userID"), input.Scope)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{"authorizationRequired": !hasAuthorizedClient})
-}
-
-// createTokensHandler godoc
-// @Summary Create OIDC tokens
-// @Description Exchange authorization code or refresh token for access tokens
-// @Tags OIDC
-// @Produce json
-// @Param client_id formData string false "Client ID (if not using Basic Auth)"
-// @Param client_secret formData string false "Client secret (if not using Basic Auth or client assertions)"
-// @Param code formData string false "Authorization code (required for 'authorization_code' grant)"
-// @Param grant_type formData string true "Grant type ('authorization_code' or 'refresh_token')"
-// @Param code_verifier formData string false "PKCE code verifier (for authorization_code with PKCE)"
-// @Param refresh_token formData string false "Refresh token (required for 'refresh_token' grant)"
-// @Param client_assertion formData string false "Client assertion type (for 'authorization_code' grant when using client assertions)"
-// @Param client_assertion_type formData string false "Client assertion type (for 'authorization_code' grant when using client assertions)"
-// @Success 200 {object} dto.OidcTokenResponseDto "Token response with access_token and optional id_token and refresh_token"
-// @Router /api/oidc/token [post]
-func (oc *OidcController) createTokensHandler(c *gin.Context) {
-	// Per RFC-6749, parameters passed to the /token endpoint MUST be passed in the body of the request
-	// Gin's "ShouldBind" by default reads from the query string too, so we need to reset all query string args before invoking ShouldBind
-	c.Request.URL.RawQuery = ""
-
-	var input dto.OidcCreateTokensDto
-	err := c.ShouldBind(&input)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	// Validate that code is provided for authorization_code grant type
-	if input.GrantType == service.GrantTypeAuthorizationCode && input.Code == "" {
-		_ = c.Error(&common.OidcMissingAuthorizationCodeError{})
-		return
-	}
-
-	// Validate that refresh_token is provided for refresh_token grant type
-	if input.GrantType == service.GrantTypeRefreshToken && input.RefreshToken == "" {
-		_ = c.Error(&common.OidcMissingRefreshTokenError{})
-		return
-	}
-
-	// Client id and secret can also be passed over the Authorization header
-	if input.ClientID == "" && input.ClientSecret == "" {
-		input.ClientID, input.ClientSecret, _ = utils.OAuthClientBasicAuth(c.Request)
-	}
-
-	tokens, err := oc.createTokens(c.Request.Context(), input)
-
-	switch {
-	case errors.Is(err, &common.OidcAuthorizationPendingError{}):
-		c.JSON(http.StatusBadRequest, gin.H{
-			"error": "authorization_pending",
-		})
-		return
-	case errors.Is(err, &common.OidcSlowDownError{}):
-		c.JSON(http.StatusBadRequest, gin.H{
-			"error": "slow_down",
-		})
-		return
-	case err != nil:
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, dto.OidcTokenResponseDto{
-		AccessToken:  tokens.AccessToken,
-		TokenType:    "Bearer",
-		ExpiresIn:    int(tokens.ExpiresIn.Seconds()),
-		IdToken:      tokens.IdToken,      // May be empty
-		RefreshToken: tokens.RefreshToken, // May be empty
-	})
-}
-
-// userInfoHandler godoc
-// @Summary Get user information
-// @Description Get user information based on the access token
-// @Tags OIDC
-// @Accept json
-// @Produce json
-// @Success 200 {object} object "User claims based on requested scopes"
-// @Security OAuth2AccessToken
-// @Router /api/oidc/userinfo [get]
-func (oc *OidcController) userInfoHandler(c *gin.Context) {
-	_, authToken, ok := strings.Cut(c.GetHeader("Authorization"), " ")
-	if !ok || authToken == "" {
-		_ = c.Error(&common.MissingAccessToken{})
-		return
-	}
-
-	token, err := oc.jwtService.VerifyOAuthAccessToken(authToken)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-	userID, ok := token.Subject()
-	if !ok {
-		_ = c.Error(&common.TokenInvalidError{})
-		return
-	}
-	clientID, ok := token.Audience()
-	if !ok || len(clientID) != 1 {
-		_ = c.Error(&common.TokenInvalidError{})
-		return
-	}
-	claims, err := oc.oidcService.GetUserClaimsForClient(c.Request.Context(), userID, clientID[0])
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, claims)
-}
-
-// EndSessionHandler godoc
-// @Summary End OIDC session
-// @Description End user session and handle OIDC logout
-// @Tags OIDC
-// @Accept application/x-www-form-urlencoded
-// @Param id_token_hint query string false "ID token"
-// @Param post_logout_redirect_uri query string false "URL to redirect to after logout"
-// @Param state query string false "State parameter to include in the redirect"
-// @Success 302 "Redirect to post-logout URL or application logout page"
-// @Router /api/oidc/end-session [get]
-func (oc *OidcController) EndSessionHandler(c *gin.Context) {
-	var input dto.OidcLogoutDto
-
-	// Bind query parameters to the struct
-	switch c.Request.Method {
-	case http.MethodGet:
-		if err := c.ShouldBindQuery(&input); err != nil {
-			_ = c.Error(err)
-			return
-		}
-	case http.MethodPost:
-		// Bind form parameters to the struct
-		if err := c.ShouldBind(&input); err != nil {
-			_ = c.Error(err)
-			return
-		}
-	}
-
-	callbackURL, err := oc.oidcService.ValidateEndSession(c.Request.Context(), input, c.GetString("userID"))
-	if err != nil {
-		// If the validation fails, the user has to confirm the logout manually and doesn't get redirected
-		slog.WarnContext(c.Request.Context(), "Error getting logout callback URL, the user has to confirm the logout manually", "error", err)
-		c.Redirect(http.StatusFound, common.EnvConfig.AppURL+"/logout")
-		return
-	}
-
-	// The validation was successful, so we can log out and redirect the user to the callback URL without confirmation
-	cookie.AddAccessTokenCookie(c, 0, "")
-
-	logoutCallbackURL, _ := url.Parse(callbackURL)
-	if input.State != "" {
-		q := logoutCallbackURL.Query()
-		q.Set("state", input.State)
-		logoutCallbackURL.RawQuery = q.Encode()
-	}
-
-	c.Redirect(http.StatusFound, logoutCallbackURL.String())
-}
-
-// EndSessionHandler godoc (POST method)
-// @Summary End OIDC session (POST method)
-// @Description End user session and handle OIDC logout using POST
-// @Tags OIDC
-// @Accept application/x-www-form-urlencoded
-// @Produce html
-// @Param id_token_hint formData string false "ID token"
-// @Param post_logout_redirect_uri formData string false "URL to redirect to after logout"
-// @Param state formData string false "State parameter to include in the redirect"
-// @Success 302 "Redirect to post-logout URL or application logout page"
-// @Router /api/oidc/end-session [post]
-func (oc *OidcController) EndSessionHandlerPost(c *gin.Context) {
-	// Implementation is the same as GET
-}
-
-// introspectToken godoc
-// @Summary Introspect OIDC tokens
-// @Description Pass an access_token to verify if it is considered valid.
-// @Tags OIDC
-// @Produce json
-// @Param token formData string true "The token to be introspected."
-// @Success 200 {object} dto.OidcIntrospectionResponseDto "Response with the introspection result."
-// @Router /api/oidc/introspect [post]
-func (oc *OidcController) introspectTokenHandler(c *gin.Context) {
-	var input dto.OidcIntrospectDto
-	if err := c.ShouldBind(&input); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	// Client id and secret have to be passed over the Authorization header. This kind of
-	// authentication allows us to keep the endpoint protected (since it could be used to
-	// find valid tokens) while still allowing it to be used by an application that is
-	// supposed to interact with our IdP (since that needs to have a client_id
-	// and client_secret anyway).
-	var (
-		creds service.ClientAuthCredentials
-		ok    bool
-	)
-	creds.ClientID, creds.ClientSecret, ok = utils.OAuthClientBasicAuth(c.Request)
-	if !ok {
-		// If there's no basic auth, check if we have a bearer token (used as client assertion)
-		bearer, ok := utils.BearerAuth(c.Request)
-		if ok {
-			creds.ClientAssertionType = service.ClientAssertionTypeJWTBearer
-			creds.ClientAssertion = bearer
-			// When using client assertions, client_id can be passed as a form field
-			creds.ClientID = input.ClientID
-		}
-	}
-
-	response, err := oc.oidcService.IntrospectToken(c.Request.Context(), creds, input.Token)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, response)
+	oidcService *service.OidcService
 }
 
 // getClientMetaDataHandler godoc
@@ -692,32 +364,6 @@ func (oc *OidcController) updateAllowedUserGroupsHandler(c *gin.Context) {
 	c.JSON(http.StatusOK, oidcClientDto)
 }
 
-func (oc *OidcController) deviceAuthorizationHandler(c *gin.Context) {
-	// Per RFC 8628 (OAuth 2.0 Device Authorization Grant), parameters for the device authorization request MUST be sent in the body of the POST request
-	// Gin's "ShouldBind" by default reads from the query string too, so we need to reset all query string args before invoking ShouldBind
-	c.Request.URL.RawQuery = ""
-
-	var input dto.OidcDeviceAuthorizationRequestDto
-	err := c.ShouldBind(&input)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	// Client id and secret can also be passed over the Authorization header
-	if input.ClientID == "" && input.ClientSecret == "" {
-		input.ClientID, input.ClientSecret, _ = utils.OAuthClientBasicAuth(c.Request)
-	}
-
-	response, err := oc.oidcService.CreateDeviceAuthorization(c.Request.Context(), input)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
 // listOwnAuthorizedClientsHandler godoc
 // @Summary List authorized clients for current user
 // @Description Get a paginated list of OIDC clients that the current user has authorized
@@ -819,49 +465,6 @@ func (oc *OidcController) listOwnAccessibleClientsHandler(c *gin.Context) {
 	})
 }
 
-func (oc *OidcController) verifyDeviceCodeHandler(c *gin.Context) {
-	userCode := c.Query("code")
-	if userCode == "" {
-		_ = c.Error(&common.ValidationError{Message: "code is required"})
-		return
-	}
-
-	// Get IP address and user agent from the request context
-	ipAddress := c.ClientIP()
-	userAgent := c.Request.UserAgent()
-
-	err := oc.oidcService.VerifyDeviceCode(
-		c.Request.Context(),
-		userCode,
-		c.GetString("userID"),
-		c.GetString("authenticationMethod"),
-		ipAddress,
-		userAgent)
-
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.Status(http.StatusNoContent)
-}
-
-func (oc *OidcController) getDeviceCodeInfoHandler(c *gin.Context) {
-	userCode := c.Query("code")
-	if userCode == "" {
-		_ = c.Error(&common.ValidationError{Message: "code is required"})
-		return
-	}
-
-	deviceCodeInfo, err := oc.oidcService.GetDeviceCodeInfo(c.Request.Context(), userCode, c.GetString("userID"))
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, deviceCodeInfo)
-}
-
 // getClientPreviewHandler godoc
 // @Summary Preview OIDC client data for user
 // @Description Get a preview of the OIDC data (ID token, access token, userinfo) that would be sent to the client for a specific user

backend/internal/controller/oidc_controller_test.go

@@ -1,227 +0,0 @@
-package controller
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/gin-gonic/gin"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
-)
-
-func TestCreateTokensHandler(t *testing.T) {
-	createTestContext := func(t *testing.T, rawURL string, form url.Values, authHeader string, noCT bool) (*gin.Context, *httptest.ResponseRecorder) {
-		t.Helper()
-
-		mode := gin.Mode()
-		gin.SetMode(gin.TestMode)
-		t.Cleanup(func() { gin.SetMode(mode) })
-
-		recorder := httptest.NewRecorder()
-		c, _ := gin.CreateTestContext(recorder)
-
-		req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, rawURL, strings.NewReader(form.Encode()))
-		require.NoError(t, err)
-
-		if !noCT {
-			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		}
-		if authHeader != "" {
-			req.Header.Set("Authorization", authHeader)
-		}
-
-		c.Request = req
-		return c, recorder
-	}
-
-	t.Run("Ignores Query String Parameters For Binding", func(t *testing.T) {
-		oc := &OidcController{}
-
-		c, _ := createTestContext(
-			t,
-			"http://example.com/oidc/token?grant_type=refresh_token&refresh_token=query-value",
-			url.Values{},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Len(t, c.Errors, 1)
-		assert.Contains(t, c.Errors[0].Err.Error(), "GrantType")
-	})
-
-	t.Run("Missing Authorization Code", func(t *testing.T) {
-		oc := &OidcController{}
-
-		c, _ := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type": {service.GrantTypeAuthorizationCode},
-			},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Len(t, c.Errors, 1)
-		var missingCodeErr *common.OidcMissingAuthorizationCodeError
-		require.ErrorAs(t, c.Errors[0].Err, &missingCodeErr)
-	})
-
-	t.Run("Missing Refresh Token", func(t *testing.T) {
-		oc := &OidcController{}
-
-		c, _ := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type": {service.GrantTypeRefreshToken},
-			},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Len(t, c.Errors, 1)
-		var missingRefreshErr *common.OidcMissingRefreshTokenError
-		require.ErrorAs(t, c.Errors[0].Err, &missingRefreshErr)
-	})
-
-	t.Run("Uses Basic Auth Credentials When Body Credentials Missing", func(t *testing.T) {
-		var capturedInput dto.OidcCreateTokensDto
-		oc := &OidcController{
-			createTokens: func(_ context.Context, input dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
-				capturedInput = input
-				return service.CreatedTokens{
-					AccessToken:  "access-token",
-					IdToken:      "id-token",
-					RefreshToken: "refresh-token",
-					ExpiresIn:    2 * time.Minute,
-				}, nil
-			},
-		}
-
-		basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte("client-id:client-secret"))
-		c, recorder := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type":    {service.GrantTypeRefreshToken},
-				"refresh_token": {"input-refresh-token"},
-			},
-			basicAuth,
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Empty(t, c.Errors)
-		assert.Equal(t, "client-id", capturedInput.ClientID)
-		assert.Equal(t, "client-secret", capturedInput.ClientSecret)
-		assert.Equal(t, "input-refresh-token", capturedInput.RefreshToken)
-
-		require.Equal(t, http.StatusOK, recorder.Code)
-		var response dto.OidcTokenResponseDto
-		require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &response))
-		assert.Equal(t, "access-token", response.AccessToken)
-		assert.Equal(t, "Bearer", response.TokenType)
-		assert.Equal(t, "id-token", response.IdToken)
-		assert.Equal(t, "refresh-token", response.RefreshToken)
-		assert.Equal(t, 120, response.ExpiresIn)
-	})
-
-	t.Run("Maps Authorization Pending Error", func(t *testing.T) {
-		oc := &OidcController{
-			createTokens: func(context.Context, dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
-				return service.CreatedTokens{}, &common.OidcAuthorizationPendingError{}
-			},
-		}
-
-		c, recorder := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type":    {service.GrantTypeRefreshToken},
-				"refresh_token": {"input-refresh-token"},
-			},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Empty(t, c.Errors)
-		require.Equal(t, http.StatusBadRequest, recorder.Code)
-		var response map[string]string
-		require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &response))
-		assert.Equal(t, "authorization_pending", response["error"])
-	})
-
-	t.Run("Maps Slow Down Error", func(t *testing.T) {
-		oc := &OidcController{
-			createTokens: func(context.Context, dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
-				return service.CreatedTokens{}, &common.OidcSlowDownError{}
-			},
-		}
-
-		c, recorder := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type":    {service.GrantTypeRefreshToken},
-				"refresh_token": {"input-refresh-token"},
-			},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Empty(t, c.Errors)
-		require.Equal(t, http.StatusBadRequest, recorder.Code)
-		var response map[string]string
-		require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &response))
-		assert.Equal(t, "slow_down", response["error"])
-	})
-
-	t.Run("Returns Generic Service Error In Context", func(t *testing.T) {
-		expectedErr := errors.New("boom")
-		oc := &OidcController{
-			createTokens: func(context.Context, dto.OidcCreateTokensDto) (service.CreatedTokens, error) {
-				return service.CreatedTokens{}, expectedErr
-			},
-		}
-
-		c, _ := createTestContext(
-			t,
-			"http://example.com/oidc/token",
-			url.Values{
-				"grant_type":    {service.GrantTypeRefreshToken},
-				"refresh_token": {"input-refresh-token"},
-			},
-			"",
-			false,
-		)
-
-		oc.createTokensHandler(c)
-
-		require.Len(t, c.Errors, 1)
-		assert.ErrorIs(t, c.Errors[0].Err, expectedErr)
-	})
-}

backend/internal/controller/user_controller.go

@@ -12,7 +12,7 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/middleware"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
-	"golang.org/x/time/rate"
+	"github.com/pocket-id/pocket-id/backend/internal/webauthn"
 )
 
 const defaultOneTimeAccessTokenDuration = 15 * time.Minute
@@ -21,7 +21,7 @@ const defaultOneTimeAccessTokenDuration = 15 * time.Minute
 // @Summary User management controller
 // @Description Initializes all user-related API endpoints
 // @Tags Users
-func NewUserController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, rateLimitMiddleware *middleware.RateLimitMiddleware, userService *service.UserService, oneTimeAccessService *service.OneTimeAccessService, webAuthnService *service.WebAuthnService, appConfigService *service.AppConfigService) {
+func NewUserController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, rateLimitMiddleware *middleware.RateLimitMiddleware, userService *service.UserService, oneTimeAccessService *service.OneTimeAccessService, webAuthnService *webauthn.Module, appConfigService *service.AppConfigService) {
 	uc := UserController{
 		userService:          userService,
 		oneTimeAccessService: oneTimeAccessService,
@@ -50,20 +50,20 @@ func NewUserController(group *gin.RouterGroup, authMiddleware *middleware.AuthMi
 	group.POST("/users/me/one-time-access-token", authMiddleware.WithAdminNotRequired().Add(), uc.createOwnOneTimeAccessTokenHandler)
 	group.POST("/users/:id/one-time-access-token", authMiddleware.Add(), uc.createAdminOneTimeAccessTokenHandler)
 	group.POST("/users/:id/one-time-access-email", authMiddleware.Add(), uc.RequestOneTimeAccessEmailAsAdminHandler)
-	group.POST("/one-time-access-token/:token", rateLimitMiddleware.Add(rate.Every(10*time.Second), 5), uc.exchangeOneTimeAccessTokenHandler)
-	group.POST("/one-time-access-email", rateLimitMiddleware.Add(rate.Every(10*time.Minute), 3), uc.RequestOneTimeAccessEmailAsUnauthenticatedUserHandler)
+	group.POST("/one-time-access-token/:token", rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessToken), uc.exchangeOneTimeAccessTokenHandler)
+	group.POST("/one-time-access-email", rateLimitMiddleware.Add(middleware.RateLimitOneTimeAccessEmail), uc.RequestOneTimeAccessEmailAsUnauthenticatedUserHandler)
 
 	group.DELETE("/users/:id/profile-picture", authMiddleware.Add(), uc.resetUserProfilePictureHandler)
 	group.DELETE("/users/me/profile-picture", authMiddleware.WithAdminNotRequired().Add(), uc.resetCurrentUserProfilePictureHandler)
 
-	group.POST("/users/me/send-email-verification", rateLimitMiddleware.Add(rate.Every(10*time.Minute), 3), authMiddleware.WithAdminNotRequired().Add(), uc.sendEmailVerificationHandler)
-	group.POST("/users/me/verify-email", rateLimitMiddleware.Add(rate.Every(10*time.Second), 5), authMiddleware.WithAdminNotRequired().Add(), uc.verifyEmailHandler)
+	group.POST("/users/me/send-email-verification", rateLimitMiddleware.Add(middleware.RateLimitSendEmailVerification), authMiddleware.WithAdminNotRequired().Add(), uc.sendEmailVerificationHandler)
+	group.POST("/users/me/verify-email", rateLimitMiddleware.Add(middleware.RateLimitVerifyEmail), authMiddleware.WithAdminNotRequired().Add(), uc.verifyEmailHandler)
 }
 
 type UserController struct {
 	userService          *service.UserService
 	oneTimeAccessService *service.OneTimeAccessService
-	webAuthnService      *service.WebAuthnService
+	webAuthnService      *webauthn.Module
 	appConfigService     *service.AppConfigService
 }
 
@@ -508,8 +508,15 @@ func (uc *UserController) RequestOneTimeAccessEmailAsAdminHandler(c *gin.Context
 // @Success 200 {object} dto.UserDto
 // @Router /api/one-time-access-token/{token} [post]
 func (uc *UserController) exchangeOneTimeAccessTokenHandler(c *gin.Context) {
+	loginCode := c.Param("token")
+	// reject invalid length login codes
+	if len(loginCode) != 6 && len(loginCode) != 16 {
+		_ = c.Error(&common.TokenInvalidOrExpiredError{})
+		return
+	}
+
 	deviceToken, _ := c.Cookie(cookie.DeviceTokenCookieName)
-	user, token, err := uc.oneTimeAccessService.ExchangeOneTimeAccessToken(c.Request.Context(), c.Param("token"), deviceToken, c.ClientIP(), c.Request.UserAgent())
+	user, token, err := uc.oneTimeAccessService.ExchangeOneTimeAccessToken(c.Request.Context(), loginCode, deviceToken, c.ClientIP(), c.Request.UserAgent())
 	if err != nil {
 		_ = c.Error(err)
 		return

backend/internal/controller/webauthn_controller.go

@@ -1,207 +0,0 @@
-package controller
-
-import (
-	"net/http"
-	"time"
-
-	"github.com/go-webauthn/webauthn/protocol"
-	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
-	"github.com/pocket-id/pocket-id/backend/internal/middleware"
-	"github.com/pocket-id/pocket-id/backend/internal/utils/cookie"
-
-	"github.com/gin-gonic/gin"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
-	"golang.org/x/time/rate"
-)
-
-func NewWebauthnController(group *gin.RouterGroup, authMiddleware *middleware.AuthMiddleware, rateLimitMiddleware *middleware.RateLimitMiddleware, webauthnService *service.WebAuthnService, appConfigService *service.AppConfigService) {
-	wc := &WebauthnController{webAuthnService: webauthnService, appConfigService: appConfigService}
-	group.GET("/webauthn/register/start", authMiddleware.WithAdminNotRequired().Add(), wc.beginRegistrationHandler)
-	group.POST("/webauthn/register/finish", authMiddleware.WithAdminNotRequired().Add(), wc.verifyRegistrationHandler)
-
-	group.GET("/webauthn/login/start", wc.beginLoginHandler)
-	group.POST("/webauthn/login/finish", rateLimitMiddleware.Add(rate.Every(10*time.Second), 5), wc.verifyLoginHandler)
-
-	group.POST("/webauthn/logout", authMiddleware.WithAdminNotRequired().Add(), wc.logoutHandler)
-
-	group.POST("/webauthn/reauthenticate", authMiddleware.WithAdminNotRequired().Add(), rateLimitMiddleware.Add(rate.Every(10*time.Second), 5), wc.reauthenticateHandler)
-
-	group.GET("/webauthn/credentials", authMiddleware.WithAdminNotRequired().Add(), wc.listCredentialsHandler)
-	group.PATCH("/webauthn/credentials/:id", authMiddleware.WithAdminNotRequired().Add(), wc.updateCredentialHandler)
-	group.DELETE("/webauthn/credentials/:id", authMiddleware.WithAdminNotRequired().Add(), wc.deleteCredentialHandler)
-}
-
-type WebauthnController struct {
-	webAuthnService  *service.WebAuthnService
-	appConfigService *service.AppConfigService
-}
-
-func (wc *WebauthnController) beginRegistrationHandler(c *gin.Context) {
-	userID := c.GetString("userID")
-	options, err := wc.webAuthnService.BeginRegistration(c.Request.Context(), userID)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	cookie.AddSessionIdCookie(c, int(options.Timeout.Seconds()), options.SessionID)
-	c.JSON(http.StatusOK, options.Response)
-}
-
-func (wc *WebauthnController) verifyRegistrationHandler(c *gin.Context) {
-	sessionID, err := c.Cookie(cookie.SessionIdCookieName)
-	if err != nil {
-		_ = c.Error(&common.MissingSessionIdError{})
-		return
-	}
-
-	userID := c.GetString("userID")
-	credential, err := wc.webAuthnService.VerifyRegistration(c.Request.Context(), sessionID, userID, c.Request, c.ClientIP())
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	var credentialDto dto.WebauthnCredentialDto
-	if err := dto.MapStruct(credential, &credentialDto); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, credentialDto)
-}
-
-func (wc *WebauthnController) beginLoginHandler(c *gin.Context) {
-	options, err := wc.webAuthnService.BeginLogin(c.Request.Context())
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	cookie.AddSessionIdCookie(c, int(options.Timeout.Seconds()), options.SessionID)
-	c.JSON(http.StatusOK, options.Response)
-}
-
-func (wc *WebauthnController) verifyLoginHandler(c *gin.Context) {
-	sessionID, err := c.Cookie(cookie.SessionIdCookieName)
-	if err != nil {
-		_ = c.Error(&common.MissingSessionIdError{})
-		return
-	}
-
-	credentialAssertionData, err := protocol.ParseCredentialRequestResponseBody(c.Request.Body)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	user, token, err := wc.webAuthnService.VerifyLogin(c.Request.Context(), sessionID, credentialAssertionData, c.ClientIP(), c.Request.UserAgent())
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	var userDto dto.UserDto
-	if err := dto.MapStruct(user, &userDto); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	maxAge := int(wc.appConfigService.GetDbConfig().SessionDuration.AsDurationMinutes().Seconds())
-	cookie.AddAccessTokenCookie(c, maxAge, token)
-
-	c.JSON(http.StatusOK, userDto)
-}
-
-func (wc *WebauthnController) listCredentialsHandler(c *gin.Context) {
-	userID := c.GetString("userID")
-	credentials, err := wc.webAuthnService.ListCredentials(c.Request.Context(), userID)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	var credentialDtos []dto.WebauthnCredentialDto
-	if err := dto.MapStructList(credentials, &credentialDtos); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, credentialDtos)
-}
-
-func (wc *WebauthnController) deleteCredentialHandler(c *gin.Context) {
-	userID := c.GetString("userID")
-	credentialID := c.Param("id")
-	clientIP := c.ClientIP()
-	userAgent := c.Request.UserAgent()
-
-	err := wc.webAuthnService.DeleteCredential(c.Request.Context(), userID, credentialID, clientIP, userAgent, userID)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.Status(http.StatusNoContent)
-}
-
-func (wc *WebauthnController) updateCredentialHandler(c *gin.Context) {
-	userID := c.GetString("userID")
-	credentialID := c.Param("id")
-
-	var input dto.WebauthnCredentialUpdateDto
-	if err := c.ShouldBindJSON(&input); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	credential, err := wc.webAuthnService.UpdateCredential(c.Request.Context(), userID, credentialID, input.Name)
-	if err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	var credentialDto dto.WebauthnCredentialDto
-	if err := dto.MapStruct(credential, &credentialDto); err != nil {
-		_ = c.Error(err)
-		return
-	}
-
-	c.JSON(http.StatusOK, credentialDto)
-}
-
-func (wc *WebauthnController) logoutHandler(c *gin.Context) {
-	cookie.AddAccessTokenCookie(c, 0, "")
-	c.Status(http.StatusNoContent)
-}
-
-func (wc *WebauthnController) reauthenticateHandler(c *gin.Context) {
-	sessionID, err := c.Cookie(cookie.SessionIdCookieName)
-	if err != nil {
-		_ = c.Error(&common.MissingSessionIdError{})
-		return
-	}
-
-	var token string
-
-	// Try to create a reauthentication token with WebAuthn
-	credentialAssertionData, err := protocol.ParseCredentialRequestResponseBody(c.Request.Body)
-	if err == nil {
-		token, err = wc.webAuthnService.CreateReauthenticationTokenWithWebauthn(c.Request.Context(), sessionID, credentialAssertionData)
-		if err != nil {
-			_ = c.Error(err)
-			return
-		}
-	} else {
-		// If WebAuthn fails, try to create a reauthentication token with the access token
-		accessToken, _ := c.Cookie(cookie.AccessTokenCookieName)
-		token, err = wc.webAuthnService.CreateReauthenticationTokenWithAccessToken(c.Request.Context(), accessToken)
-		if err != nil {
-			_ = c.Error(err)
-			return
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{"reauthenticationToken": token})
-}

backend/internal/controller/well_known_controller.go

@@ -84,15 +84,20 @@ func (wkc *WellKnownController) computeOIDCConfiguration() ([]byte, error) {
 		"device_authorization_endpoint":                  appUrl + "/api/oidc/device/authorize",
 		"jwks_uri":                                       internalAppUrl + "/.well-known/jwks.json",
 		"grant_types_supported":                          []string{service.GrantTypeAuthorizationCode, service.GrantTypeRefreshToken, service.GrantTypeDeviceCode, service.GrantTypeClientCredentials},
-		"scopes_supported":                               []string{"openid", "profile", "email", "groups"},
-		"claims_supported":                               []string{"sub", "given_name", "family_name", "name", "email", "email_verified", "preferred_username", "picture", "groups"},
+		"scopes_supported":                               []string{"openid", "profile", "email", "groups", "offline_access"},
+		"claims_supported":                               []string{"sub", "given_name", "family_name", "name", "display_name", "email", "email_verified", "preferred_username", "picture", "groups", "auth_time", "amr"},
 		"response_types_supported":                       []string{"code", "id_token"},
 		"subject_types_supported":                        []string{"public"},
 		"id_token_signing_alg_values_supported":          []string{alg.String()},
 		"authorization_response_iss_parameter_supported": true,
 		"code_challenge_methods_supported":               []string{"plain", "S256"},
-		"prompt_values_supported":                        []string{"none", "login", "consent"},
+		"request_parameter_supported":                    true,
+		"request_uri_parameter_supported":                false,
+		"request_object_signing_alg_values_supported":    []string{"none"},
+		"prompt_values_supported":                        []string{"none", "login", "consent", "select_account"},
 		"token_endpoint_auth_methods_supported":          []string{"client_secret_basic", "client_secret_post", "none"},
+		"pushed_authorization_request_endpoint":          internalAppUrl + "/api/oidc/par",
+		"require_pushed_authorization_requests":          false,
 	}
 	return json.Marshal(config)
 }

backend/internal/dto/dto_normalize.go

@@ -1,7 +1,6 @@
 package dto
 
 import (
-	"net/http"
 	"reflect"
 
 	"github.com/gin-gonic/gin"
@@ -73,22 +72,3 @@ loop:
 func ShouldBindWithNormalizedJSON(ctx *gin.Context, obj any) error {
 	return ctx.ShouldBindWith(obj, binding.JSON)
 }
-
-type NormalizerJSONBinding struct{}
-
-func (NormalizerJSONBinding) Name() string {
-	return "json"
-}
-
-func (NormalizerJSONBinding) Bind(req *http.Request, obj any) error {
-	// Use the default JSON binder
-	err := binding.JSON.Bind(req, obj)
-	if err != nil {
-		return err
-	}
-
-	// Perform normalization
-	Normalize(obj)
-
-	return nil
-}

backend/internal/dto/oidc_dto.go

@@ -5,6 +5,7 @@ import datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
 type OidcClientMetaDataDto struct {
 	ID                       string  `json:"id"`
 	Name                     string  `json:"name"`
+	Description              string  `json:"description"`
 	HasLogo                  bool    `json:"hasLogo"`
 	HasDarkLogo              bool    `json:"hasDarkLogo"`
 	LaunchURL                *string `json:"launchURL"`
@@ -13,12 +14,15 @@ type OidcClientMetaDataDto struct {
 
 type OidcClientDto struct {
 	OidcClientMetaDataDto
-	CallbackURLs       []string                 `json:"callbackURLs"`
-	LogoutCallbackURLs []string                 `json:"logoutCallbackURLs"`
-	IsPublic           bool                     `json:"isPublic"`
-	PkceEnabled        bool                     `json:"pkceEnabled"`
-	Credentials        OidcClientCredentialsDto `json:"credentials"`
-	IsGroupRestricted  bool                     `json:"isGroupRestricted"`
+	CallbackURLs                        []string                 `json:"callbackURLs"`
+	LogoutCallbackURLs                  []string                 `json:"logoutCallbackURLs"`
+	IsPublic                            bool                     `json:"isPublic"`
+	PkceEnabled                         bool                     `json:"pkceEnabled"`
+	RequiresPushedAuthorizationRequests bool                     `json:"requiresPushedAuthorizationRequests"`
+	SkipConsent                         bool                     `json:"skipConsent"`
+	Credentials                         OidcClientCredentialsDto `json:"credentials"`
+	IsGroupRestricted                   bool                     `json:"isGroupRestricted"`
+	PkceSupported                       bool                     `json:"pkceSupported,omitempty"`
 }
 
 type OidcClientWithAllowedUserGroupsDto struct {
@@ -32,19 +36,22 @@ type OidcClientWithAllowedGroupsCountDto struct {
 }
 
 type OidcClientUpdateDto struct {
-	Name                     string                   `json:"name" binding:"required,max=50" unorm:"nfc"`
-	CallbackURLs             []string                 `json:"callbackURLs" binding:"omitempty,dive,callback_url_pattern"`
-	LogoutCallbackURLs       []string                 `json:"logoutCallbackURLs" binding:"omitempty,dive,callback_url_pattern"`
-	IsPublic                 bool                     `json:"isPublic"`
-	PkceEnabled              bool                     `json:"pkceEnabled"`
-	RequiresReauthentication bool                     `json:"requiresReauthentication"`
-	Credentials              OidcClientCredentialsDto `json:"credentials"`
-	LaunchURL                *string                  `json:"launchURL" binding:"omitempty,url"`
-	HasLogo                  bool                     `json:"hasLogo"`
-	HasDarkLogo              bool                     `json:"hasDarkLogo"`
-	LogoURL                  *string                  `json:"logoUrl"`
-	DarkLogoURL              *string                  `json:"darkLogoUrl"`
-	IsGroupRestricted        bool                     `json:"isGroupRestricted"`
+	Name                                string                   `json:"name" binding:"required,max=50" unorm:"nfc"`
+	Description                         string                   `json:"description" binding:"omitempty,max=150" unorm:"nfc"`
+	CallbackURLs                        []string                 `json:"callbackURLs" binding:"omitempty,dive,callback_url_pattern"`
+	LogoutCallbackURLs                  []string                 `json:"logoutCallbackURLs" binding:"omitempty,dive,callback_url_pattern"`
+	IsPublic                            bool                     `json:"isPublic"`
+	PkceEnabled                         bool                     `json:"pkceEnabled"`
+	RequiresReauthentication            bool                     `json:"requiresReauthentication"`
+	RequiresPushedAuthorizationRequests bool                     `json:"requiresPushedAuthorizationRequests"`
+	SkipConsent                         bool                     `json:"skipConsent"`
+	Credentials                         OidcClientCredentialsDto `json:"credentials"`
+	LaunchURL                           *string                  `json:"launchURL" binding:"omitempty,url"`
+	HasLogo                             bool                     `json:"hasLogo"`
+	HasDarkLogo                         bool                     `json:"hasDarkLogo"`
+	LogoURL                             *string                  `json:"logoUrl"`
+	DarkLogoURL                         *string                  `json:"darkLogoUrl"`
+	IsGroupRestricted                   bool                     `json:"isGroupRestricted"`
 }
 
 type OidcClientCreateDto struct {
@@ -57,50 +64,11 @@ type OidcClientCredentialsDto struct {
 }
 
 type OidcClientFederatedIdentityDto struct {
-	Issuer   string `json:"issuer"`
-	Subject  string `json:"subject,omitempty"`
-	Audience string `json:"audience,omitempty"`
-	JWKS     string `json:"jwks,omitempty"`
-}
-
-type AuthorizeOidcClientRequestDto struct {
-	ClientID              string `json:"clientID" binding:"required"`
-	Scope                 string `json:"scope" binding:"required"`
-	CallbackURL           string `json:"callbackURL" binding:"omitempty,callback_url"`
-	Nonce                 string `json:"nonce"`
-	CodeChallenge         string `json:"codeChallenge"`
-	CodeChallengeMethod   string `json:"codeChallengeMethod"`
-	ReauthenticationToken string `json:"reauthenticationToken"`
-	Prompt                string `json:"prompt"`
-}
-
-type AuthorizeOidcClientResponseDto struct {
-	Code        string `json:"code"`
-	CallbackURL string `json:"callbackURL"`
-	Issuer      string `json:"issuer"`
-}
-
-type AuthorizationRequiredDto struct {
-	ClientID string `json:"clientID" binding:"required"`
-	Scope    string `json:"scope" binding:"required"`
-}
-
-type OidcCreateTokensDto struct {
-	GrantType           string `form:"grant_type" binding:"required"`
-	Code                string `form:"code"`
-	DeviceCode          string `form:"device_code"`
-	ClientID            string `form:"client_id"`
-	ClientSecret        string `form:"client_secret"`
-	CodeVerifier        string `form:"code_verifier"`
-	RefreshToken        string `form:"refresh_token"`
-	ClientAssertion     string `form:"client_assertion"`
-	ClientAssertionType string `form:"client_assertion_type"`
-	Resource            string `form:"resource"`
-}
-
-type OidcIntrospectDto struct {
-	Token    string `form:"token" binding:"required"`
-	ClientID string `form:"client_id"`
+	Issuer           string `json:"issuer"`
+	Subject          string `json:"subject,omitempty"`
+	Audience         string `json:"audience,omitempty"`
+	JWKS             string `json:"jwks,omitempty"`
+	ReplayProtection bool   `json:"replayProtection"`
 }
 
 type OidcUpdateAllowedUserGroupsDto struct {
@@ -114,36 +82,6 @@ type OidcLogoutDto struct {
 	State                 string `form:"state"`
 }
 
-type OidcTokenResponseDto struct {
-	AccessToken  string `json:"access_token"`
-	TokenType    string `json:"token_type"`
-	IdToken      string `json:"id_token,omitempty"`
-	RefreshToken string `json:"refresh_token,omitempty"`
-	ExpiresIn    int    `json:"expires_in"`
-}
-
-type OidcIntrospectionResponseDto struct {
-	Active     bool     `json:"active"`
-	TokenType  string   `json:"token_type,omitempty"`
-	Scope      string   `json:"scope,omitempty"`
-	Expiration int64    `json:"exp,omitempty"`
-	IssuedAt   int64    `json:"iat,omitempty"`
-	NotBefore  int64    `json:"nbf,omitempty"`
-	Subject    string   `json:"sub,omitempty"`
-	Audience   []string `json:"aud,omitempty"`
-	Issuer     string   `json:"iss,omitempty"`
-	Identifier string   `json:"jti,omitempty"`
-}
-
-type OidcDeviceAuthorizationRequestDto struct {
-	ClientID            string `form:"client_id" binding:"required"`
-	Scope               string `form:"scope" binding:"required"`
-	ClientSecret        string `form:"client_secret"`
-	ClientAssertion     string `form:"client_assertion"`
-	ClientAssertionType string `form:"client_assertion_type"`
-	Nonce               string `form:"nonce"`
-}
-
 type OidcDeviceAuthorizationResponseDto struct {
 	DeviceCode              string `json:"device_code"`
 	UserCode                string `json:"user_code"`
@@ -151,20 +89,20 @@ type OidcDeviceAuthorizationResponseDto struct {
 	VerificationURIComplete string `json:"verification_uri_complete"`
 	ExpiresIn               int    `json:"expires_in"`
 	Interval                int    `json:"interval"`
-	RequiresAuthorization   bool   `json:"requires_authorization"`
 }
 
-type OidcDeviceTokenRequestDto struct {
-	GrantType    string `form:"grant_type" binding:"required,eq=urn:ietf:params:oauth:grant-type:device_code"`
-	DeviceCode   string `form:"device_code" binding:"required"`
-	ClientID     string `form:"client_id"`
-	ClientSecret string `form:"client_secret"`
+type ScopeInfoDto struct {
+	Key         string `json:"key"`
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
 }
 
 type DeviceCodeInfoDto struct {
-	Scope                 string                `json:"scope"`
-	AuthorizationRequired bool                  `json:"authorizationRequired"`
-	Client                OidcClientMetaDataDto `json:"client"`
+	Scope                    []string              `json:"scope"`
+	ScopeInfo                []ScopeInfoDto        `json:"scopeInfo"`
+	AuthorizationRequired    bool                  `json:"authorizationRequired"`
+	ReauthenticationRequired bool                  `json:"reauthenticationRequired"`
+	Client                   OidcClientMetaDataDto `json:"client"`
 }
 
 type AuthorizedOidcClientDto struct {

backend/internal/dto/signup_dto.go

@@ -1,9 +0,0 @@
-package dto
-
-type SignUpDto struct {
-	Username  string  `json:"username" binding:"required,username,min=1,max=50" unorm:"nfc"`
-	Email     *string `json:"email" binding:"omitempty,email" unorm:"nfc"`
-	FirstName string  `json:"firstName" binding:"max=50" unorm:"nfc"`
-	LastName  string  `json:"lastName" binding:"max=50" unorm:"nfc"`
-	Token     string  `json:"token"`
-}

backend/internal/dto/signup_token_dto.go

@@ -1,22 +0,0 @@
-package dto
-
-import (
-	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
-	"github.com/pocket-id/pocket-id/backend/internal/utils"
-)
-
-type SignupTokenCreateDto struct {
-	TTL          utils.JSONDuration `json:"ttl" binding:"required,ttl"`
-	UsageLimit   int                `json:"usageLimit" binding:"required,min=1,max=100"`
-	UserGroupIDs []string           `json:"userGroupIds"`
-}
-
-type SignupTokenDto struct {
-	ID         string                `json:"id"`
-	Token      string                `json:"token"`
-	ExpiresAt  datatype.DateTime     `json:"expiresAt"`
-	UsageLimit int                   `json:"usageLimit"`
-	UsageCount int                   `json:"usageCount"`
-	UserGroups []UserGroupMinimalDto `json:"userGroups"`
-	CreatedAt  datatype.DateTime     `json:"createdAt"`
-}

backend/internal/dto/validations.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/ory/fosite"
 	"github.com/pocket-id/pocket-id/backend/internal/utils"
 
 	"github.com/gin-gonic/gin/binding"
@@ -47,6 +48,9 @@ func init() {
 		"callback_url_pattern": func(fl validator.FieldLevel) bool {
 			return ValidateCallbackURLPattern(fl.Field().String())
 		},
+		"resource_uri": func(fl validator.FieldLevel) bool {
+			return ValidateResourceURI(fl.Field().String())
+		},
 	}
 	for k, v := range validators {
 		err := engine.RegisterValidation(k, v)
@@ -66,6 +70,27 @@ func ValidateClientID(clientID string) bool {
 	return validateClientIDRegex.MatchString(clientID)
 }
 
+// isActiveContentScheme reports whether the URL scheme can carry executable content, so it must never be accepted where a URL might later be rendered as a link
+func isActiveContentScheme(scheme string) bool {
+	switch strings.ToLower(scheme) {
+	case "javascript", "data":
+		return true
+	default:
+		return false
+	}
+}
+
+// ValidateResourceURI validates RFC 8707 resource identifiers
+func ValidateResourceURI(str string) bool {
+	if !fosite.IsValidResourceIndicatorURI(str) {
+		return false
+	}
+
+	// Reject active-content schemes so a resource identifier can never carry executable content if it is ever surfaced as a link
+	u, _ := url.Parse(str)
+	return !isActiveContentScheme(u.Scheme)
+}
+
 // ValidateCallbackURL validates the input callback URL
 func ValidateCallbackURL(str string) bool {
 	// Ensure the URL is a valid one and that the protocol is not "javascript:" or "data:"
@@ -74,16 +99,10 @@ func ValidateCallbackURL(str string) bool {
 		return false
 	}
 
-	switch strings.ToLower(u.Scheme) {
-	case "javascript", "data":
-		return false
-	default:
-		return true
-	}
+	return !isActiveContentScheme(u.Scheme)
 }
 
-// ValidateCallbackURLPattern validates callback URL patterns, with support for wildcards
+// ValidateCallbackURLPattern validates callback URL patterns, with support for wildcards.
 func ValidateCallbackURLPattern(raw string) bool {
-	err := utils.ValidateCallbackURLPattern(raw)
-	return err == nil
+	return utils.ValidateCallbackURLPattern(raw) == nil
 }

backend/internal/dto/validations_test.go

@@ -58,6 +58,35 @@ func TestValidateClientID(t *testing.T) {
 	}
 }
 
+func TestValidateResourceURI(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected bool
+	}{
+		{"valid https URI", "https://api.example.com", true},
+		{"valid custom scheme URI", "api://PocketID", true},
+		{"valid URN", "urn:my-app", true},
+		{"valid query component", "https://api.example.com?tenant=1", true},
+		{"invalid relative path", "/foo", false},
+		{"invalid plain string", "foo", false},
+		{"invalid fragment", "https://api.example.com#tokens", false},
+		{"invalid empty fragment", "https://api.example.com#", false},
+		{"invalid unescaped path space", "https://api.example.com/a b", false},
+		{"invalid unescaped opaque space", "urn:my app", false},
+		{"invalid malformed URI", "http://[::1", false},
+		{"invalid javascript scheme", "javascript:alert(1)", false},
+		{"invalid data scheme", "data:text/html,<script>alert(1)</script>", false},
+		{"empty", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, ValidateResourceURI(tt.input))
+		})
+	}
+}
+
 func TestValidateCallbackURL(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -82,3 +111,26 @@ func TestValidateCallbackURL(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateCallbackURLPattern(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected bool
+	}{
+		{"valid exact URL", "https://example.com/callback", true},
+		{"valid wildcard URL", "https://*.example.com/callback", true},
+		{"valid custom scheme", "pocketid://callback", true},
+		{"valid global wildcard", "*", true},
+		{"invalid relative URL", "/callback", false},
+		{"invalid malformed URL", "http://[::1", false},
+		{"rejects javascript scheme", "javascript:alert(1)", false},
+		{"rejects data scheme", "data:text/html;base64,PGgxPkhlbGxvPC9oMT4=", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, ValidateCallbackURLPattern(tt.input))
+		})
+	}
+}

backend/internal/instanceid/instanceid.go

@@ -0,0 +1,50 @@
+package instanceid
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+)
+
+// Load the instance ID for the Pocket ID cluster from the "kv" table
+// If no instance ID exists yet, a new one is generated and persisted atomically
+func Load(parentCtx context.Context, db *gorm.DB) (string, error) {
+	// Candidate value used only if there's no instance ID stored yet
+	newInstanceID := uuid.NewString()
+
+	// We use a raw query because gorm can't build it for us in this atomic way
+	// The syntax is valid for both SQLite and Postgres
+	var value string
+	ctx, cancel := context.WithTimeout(parentCtx, 10*time.Second)
+	defer cancel()
+	err := db.
+		WithContext(ctx).
+		Raw(
+			`INSERT INTO kv (key, value)
+			VALUES ('instance_id', ?)
+			ON CONFLICT (key) DO UPDATE SET
+				value = CASE
+					WHEN kv.value = '' THEN excluded.value
+					ELSE kv.value
+				END
+			RETURNING value`,
+			newInstanceID,
+		).
+		Scan(&value).
+		Error
+	if err != nil {
+		return "", fmt.Errorf("failed to load instance ID from the database: %w", err)
+	}
+
+	// We should have an instance ID now
+	// This case should never happen
+	if value == "" {
+		return "", errors.New("retrieved instance ID is unexpectedly empty")
+	}
+
+	return value, nil
+}

backend/internal/instanceid/instanceid_test.go

@@ -0,0 +1,190 @@
+package instanceid
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+
+	"github.com/pocket-id/pocket-id/backend/internal/model"
+	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
+)
+
+// readInstanceID returns the value stored in the kv table under the "instance_id" key, together with the number of rows that match (to detect duplicates)
+func readInstanceID(t *testing.T, db *gorm.DB) (value string, count int) {
+	t.Helper()
+	var rows []model.KV
+	err := db.Where("key = ?", "instance_id").Find(&rows).Error
+	require.NoError(t, err)
+	if len(rows) == 0 {
+		return "", 0
+	}
+	require.NotNil(t, rows[0].Value, "instance_id value should not be NULL")
+	return *rows[0].Value, len(rows)
+}
+
+func TestLoad(t *testing.T) {
+	t.Run("generates and persists a new instance ID when none exists", func(t *testing.T) {
+		db := testutils.NewDatabaseForTest(t)
+
+		id, err := Load(t.Context(), db)
+		require.NoError(t, err)
+		require.NotEmpty(t, id)
+
+		// The generated ID should be a valid UUID
+		_, err = uuid.Parse(id)
+		require.NoError(t, err, "generated instance ID should be a valid UUID")
+
+		// The value should have been persisted in the kv table
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, id, stored)
+	})
+
+	t.Run("returns the existing instance ID on subsequent calls", func(t *testing.T) {
+		db := testutils.NewDatabaseForTest(t)
+
+		first, err := Load(t.Context(), db)
+		require.NoError(t, err)
+		require.NotEmpty(t, first)
+
+		// A second call must return the same ID and must not create a duplicate row
+		second, err := Load(t.Context(), db)
+		require.NoError(t, err)
+		require.Equal(t, first, second)
+
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, first, stored)
+	})
+
+	t.Run("returns an instance ID that was already stored", func(t *testing.T) {
+		db := testutils.NewDatabaseForTest(t)
+
+		// Seed an instance ID directly in the database, e.g. as written by the migration that moved it out of the app config table
+		existing := "existing-instance-id"
+		err := db.Create(&model.KV{Key: "instance_id", Value: &existing}).Error
+		require.NoError(t, err)
+
+		id, err := Load(t.Context(), db)
+		require.NoError(t, err)
+		require.Equal(t, existing, id)
+
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, existing, stored)
+	})
+
+	t.Run("concurrent calls without an existing instance ID converge on a single value", func(t *testing.T) {
+		// This needs a database that allows concurrent access, so the goroutines race
+		db := testutils.NewConcurrentDatabaseForTest(t)
+
+		const parallel = 25
+
+		// Each goroutine writes to its own index, so no locking is needed to collect the results
+		ids := make([]string, parallel)
+		loadErrs := make([]error, parallel)
+
+		// The start channel is a barrier so all goroutines race their Load call at once
+		start := make(chan struct{})
+
+		var wg sync.WaitGroup
+		wg.Add(parallel)
+		for i := range parallel {
+			go func() {
+				defer wg.Done()
+				<-start
+				ids[i], loadErrs[i] = Load(t.Context(), db)
+			}()
+		}
+		close(start)
+		wg.Wait()
+
+		// No concurrent call should have failed
+		for i, err := range loadErrs {
+			require.NoErrorf(t, err, "goroutine %d errored", i)
+		}
+
+		// Every goroutine must have observed the same, non-empty instance ID, meaning only one of them actually generated and persisted a value
+		first := ids[0]
+		require.NotEmpty(t, first)
+		for _, id := range ids {
+			require.Equal(t, first, id)
+		}
+
+		// Only a single row must have been persisted, and it must match the shared value
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, first, stored)
+	})
+}
+
+// TestMigrateFromAppConfig validates the database migration that moves the instance ID out of the legacy app_config_variables table and into the kv table
+// The value used to be stored as an app config variable under the "instanceId" key
+func TestMigrateFromAppConfig(t *testing.T) {
+	// Version of the migration right before "20260708130000_move_instance_id_to_kv", which performs the move
+	// We seed the legacy table right after this version, so the following migration has data to operate on
+	const versionBeforeMove uint = 20260708120000
+
+	// seedAppConfigInstanceID inserts a legacy "instanceId" row into the app_config_variables table
+	seedAppConfigInstanceID := func(value string) func(t *testing.T, db *gorm.DB) {
+		return func(t *testing.T, db *gorm.DB) {
+			t.Helper()
+			err := db.Exec(`INSERT INTO app_config_variables ("key", "value") VALUES ('instanceId', ?)`, value).Error
+			require.NoError(t, err)
+		}
+	}
+
+	// countLegacyInstanceID returns the number of "instanceId" rows left in the app_config_variables table
+	countLegacyInstanceID := func(t *testing.T, db *gorm.DB) int64 {
+		t.Helper()
+		var count int64
+		err := db.Table("app_config_variables").Where(`"key" = ?`, "instanceId").Count(&count).Error
+		require.NoError(t, err)
+		return count
+	}
+
+	t.Run("moves an existing instance ID from app_config_variables into the kv table", func(t *testing.T) {
+		legacyID := uuid.NewString()
+		db := testutils.NewDatabaseForTestWithMigrationSeed(t, versionBeforeMove, seedAppConfigInstanceID(legacyID))
+
+		// The migration should have copied the value into the kv table under the "instance_id" key
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, legacyID, stored)
+
+		// The legacy row must have been removed from app_config_variables
+		require.Zero(t, countLegacyInstanceID(t, db))
+
+		// Load must return the migrated value without generating a new one
+		id, err := Load(t.Context(), db)
+		require.NoError(t, err)
+		require.Equal(t, legacyID, id)
+
+		stored, count = readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, legacyID, stored)
+	})
+
+	t.Run("keeps the existing kv value when both tables have an instance ID", func(t *testing.T) {
+		legacyID := uuid.NewString()
+		db := testutils.NewDatabaseForTestWithMigrationSeed(t, versionBeforeMove, func(t *testing.T, db *gorm.DB) {
+			t.Helper()
+			// An instance ID is already present in the kv table before the move runs
+			err := db.Exec(`INSERT INTO kv ("key", "value") VALUES ('instance_id', ?)`, "kv-instance-id").Error
+			require.NoError(t, err)
+			// And a different value lingers in the legacy app_config_variables table
+			seedAppConfigInstanceID(legacyID)(t, db)
+		})
+
+		// The migration must not clobber the value already stored in the kv table
+		stored, count := readInstanceID(t, db)
+		require.Equal(t, 1, count)
+		require.Equal(t, "kv-instance-id", stored)
+
+		// The legacy row must still be removed regardless of the conflict
+		require.Zero(t, countLegacyInstanceID(t, db))
+	})
+}

backend/internal/job/analytics_job.go

@@ -5,35 +5,72 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"time"
 
 	backoff "github.com/cenkalti/backoff/v5"
-	"github.com/go-co-op/gocron/v2"
+	"github.com/italypaleale/francis/builtin/cronjob"
 
 	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
 )
 
 const heartbeatUrl = "https://analytics.pocket-id.org/heartbeat"
 
-func (s *Scheduler) RegisterAnalyticsJob(ctx context.Context, appConfig *service.AppConfigService, httpClient *http.Client) error {
+// GetAnalyticsJob returns the CronJob actor
+func GetAnalyticsJob(httpClient *http.Client, instanceID string) (*cronjob.CronJob, error) {
 	// Skip if analytics are disabled or not in production environment
 	if common.EnvConfig.AnalyticsDisabled || !common.EnvConfig.AppEnv.IsProduction() {
-		return nil
+		return nil, nil
 	}
 
-	// Send every 24 hours
-	jobs := &AnalyticsJob{
-		appConfig:  appConfig,
+	job := &AnalyticsJob{
 		httpClient: httpClient,
 	}
-	return s.RegisterJob(ctx, "SendHeartbeat", gocron.DurationJob(24*time.Hour), jobs.sendHeartbeat, service.RegisterJobOpts{RunImmediately: true})
+	err := job.createBody(instanceID)
+	if err != nil {
+		return nil, fmt.Errorf("error pre-computing request body: %w", err)
+	}
+
+	// Create the built-in actor
+	cj, err := cronjob.New(
+		"Analytics",
+		cronjob.WithJob(job.sendHeartbeat),
+		// Run every 24 hours
+		cronjob.WithInterval(24*time.Hour),
+		// Run immediately upon registration too
+		cronjob.WithImmediate(),
+		cronjob.WithLogger(slog.Default()),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error creating Analytics job: %w", err)
+	}
+
+	return cj, nil
 }
 
 type AnalyticsJob struct {
-	appConfig  *service.AppConfigService
 	httpClient *http.Client
+	body       []byte
+}
+
+// createBody pre-computes the body for all requests
+func (j *AnalyticsJob) createBody(instanceID string) error {
+	body, err := json.Marshal(struct {
+		Version    string `json:"version"`
+		InstanceID string `json:"instance_id"`
+	}{
+		Version:    common.Version,
+		InstanceID: instanceID,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to marshal heartbeat body: %w", err)
+	}
+
+	// Set the body in the object
+	j.body = body
+
+	return nil
 }
 
 // sendHeartbeat sends a heartbeat to the analytics service
@@ -43,23 +80,13 @@ func (j *AnalyticsJob) sendHeartbeat(parentCtx context.Context) error {
 		return nil
 	}
 
-	body, err := json.Marshal(struct {
-		Version    string `json:"version"`
-		InstanceID string `json:"instance_id"`
-	}{
-		Version:    common.Version,
-		InstanceID: j.appConfig.GetDbConfig().InstanceID.Value,
-	})
-	if err != nil {
-		return fmt.Errorf("failed to marshal heartbeat body: %w", err)
-	}
-
-	_, err = backoff.Retry(
+	// Use a backoff to retry
+	_, err := backoff.Retry(
 		parentCtx,
 		func() (struct{}, error) {
 			ctx, cancel := context.WithTimeout(parentCtx, 20*time.Second)
 			defer cancel()
-			req, err := http.NewRequestWithContext(ctx, http.MethodPost, heartbeatUrl, bytes.NewReader(body))
+			req, err := http.NewRequestWithContext(ctx, http.MethodPost, heartbeatUrl, bytes.NewReader(j.body))
 			if err != nil {
 				return struct{}{}, fmt.Errorf("failed to create request: %w", err)
 			}
@@ -77,7 +104,6 @@ func (j *AnalyticsJob) sendHeartbeat(parentCtx context.Context) error {
 		backoff.WithBackOff(backoff.NewExponentialBackOff()),
 		backoff.WithMaxTries(3),
 	)
-
 	if err != nil {
 		return fmt.Errorf("heartbeat request failed: %w", err)
 	}

backend/internal/job/api_key_expiry_job.go

@@ -7,18 +7,22 @@ import (
 
 	"github.com/go-co-op/gocron/v2"
 
+	"github.com/pocket-id/pocket-id/backend/internal/apikey"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/utils/email"
 )
 
 type ApiKeyEmailJobs struct {
-	apiKeyService    *service.ApiKeyService
+	apiKeyModule     *apikey.Module
 	appConfigService *service.AppConfigService
+	emailService     *service.EmailService
 }
 
-func (s *Scheduler) RegisterApiKeyExpiryJob(ctx context.Context, apiKeyService *service.ApiKeyService, appConfigService *service.AppConfigService) error {
+func (s *Scheduler) RegisterApiKeyExpiryJob(ctx context.Context, apiKeyModule *apikey.Module, appConfigService *service.AppConfigService, emailService *service.EmailService) error {
 	jobs := &ApiKeyEmailJobs{
-		apiKeyService:    apiKeyService,
+		apiKeyModule:     apiKeyModule,
 		appConfigService: appConfigService,
+		emailService:     emailService,
 	}
 
 	// Send every day at midnight
@@ -31,7 +35,7 @@ func (j *ApiKeyEmailJobs) checkAndNotifyExpiringApiKeys(ctx context.Context) err
 		return nil
 	}
 
-	apiKeys, err := j.apiKeyService.ListExpiringApiKeys(ctx, 7)
+	apiKeys, err := j.apiKeyModule.ListExpiringApiKeys(ctx, 7)
 	if err != nil {
 		return fmt.Errorf("failed to list expiring API keys: %w", err)
 	}
@@ -40,13 +44,29 @@ func (j *ApiKeyEmailJobs) checkAndNotifyExpiringApiKeys(ctx context.Context) err
 		if key.User.Email == nil {
 			continue
 		}
-		err = j.apiKeyService.SendApiKeyExpiringSoonEmail(ctx, key)
+
+		err = service.SendEmail(ctx, j.emailService, email.Address{
+			Name:  key.User.FullName(),
+			Email: *key.User.Email,
+		}, service.ApiKeyExpiringSoonTemplate, &service.ApiKeyExpiringSoonTemplateData{
+			Name:       key.User.FirstName,
+			ApiKeyName: key.Name,
+			ExpiresAt:  key.ExpiresAt.ToTime(),
+		})
 		if err != nil {
 			slog.ErrorContext(ctx, "Failed to send expiring API key notification email",
 				slog.String("key", key.ID),
 				slog.String("user", key.User.ID),
 				slog.Any("error", err),
 			)
+			continue
+		}
+
+		if err = j.apiKeyModule.MarkExpirationEmailSent(ctx, key.ID); err != nil {
+			slog.ErrorContext(ctx, "Failed to record that the expiration email was sent",
+				slog.String("key", key.ID),
+				slog.Any("error", err),
+			)
 		}
 	}
 	return nil

backend/internal/job/db_cleanup_job.go

@@ -13,7 +13,10 @@ import (
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/model"
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
+	"github.com/pocket-id/pocket-id/backend/internal/oidc"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/usersignup"
+	"github.com/pocket-id/pocket-id/backend/internal/webauthn"
 )
 
 func (s *Scheduler) RegisterDbCleanupJobs(ctx context.Context, db *gorm.DB) error {
@@ -34,8 +37,9 @@ func (s *Scheduler) RegisterDbCleanupJobs(ctx context.Context, db *gorm.DB) erro
 		s.RegisterJob(ctx, "ClearOneTimeAccessTokens", jobDefWithJitter(24*time.Hour), jobs.clearOneTimeAccessTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearSignupTokens", jobDefWithJitter(24*time.Hour), jobs.clearSignupTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearEmailVerificationTokens", jobDefWithJitter(24*time.Hour), jobs.clearEmailVerificationTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
-		s.RegisterJob(ctx, "ClearOidcAuthorizationCodes", jobDefWithJitter(24*time.Hour), jobs.clearOidcAuthorizationCodes, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
-		s.RegisterJob(ctx, "ClearOidcRefreshTokens", jobDefWithJitter(24*time.Hour), jobs.clearOidcRefreshTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
+		s.RegisterJob(ctx, "ClearOAuth2Sessions", jobDefWithJitter(24*time.Hour), jobs.clearOAuth2Sessions, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
+		s.RegisterJob(ctx, "ClearOAuth2JTIs", jobDefWithJitter(24*time.Hour), jobs.clearOAuth2JTIs, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
+		s.RegisterJob(ctx, "ClearInteractionSessions", jobDefWithJitter(24*time.Hour), jobs.clearInteractionSessions, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearReauthenticationTokens", jobDefWithJitter(24*time.Hour), jobs.clearReauthenticationTokens, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 		s.RegisterJob(ctx, "ClearAuditLogs", jobDefWithJitter(24*time.Hour), jobs.clearAuditLogs, service.RegisterJobOpts{RunImmediately: true, BackOff: newBackOff()}),
 	)
@@ -45,16 +49,14 @@ type DbCleanupJobs struct {
 	db *gorm.DB
 }
 
-// ClearWebauthnSessions deletes WebAuthn sessions that have expired
+// clearWebauthnSessions deletes expired WebAuthn challenge sessions.
 func (j *DbCleanupJobs) clearWebauthnSessions(ctx context.Context) error {
-	st := j.db.
-		WithContext(ctx).
-		Delete(&model.WebauthnSession{}, "expires_at < ?", datatype.DateTime(time.Now()))
-	if st.Error != nil {
-		return fmt.Errorf("failed to clean expired WebAuthn sessions: %w", st.Error)
+	count, err := webauthn.CleanupExpiredSessions(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean expired WebAuthn sessions: %w", err)
 	}
 
-	slog.InfoContext(ctx, "Cleaned expired WebAuthn sessions", slog.Int64("count", st.RowsAffected))
+	slog.InfoContext(ctx, "Cleaned expired WebAuthn sessions", slog.Int64("count", count))
 
 	return nil
 }
@@ -73,59 +75,63 @@ func (j *DbCleanupJobs) clearOneTimeAccessTokens(ctx context.Context) error {
 	return nil
 }
 
-// ClearSignupTokens deletes signup tokens that have expired
+// clearSignupTokens deletes signup tokens that have expired
 func (j *DbCleanupJobs) clearSignupTokens(ctx context.Context) error {
-	// Delete tokens that are expired OR have reached their usage limit
-	st := j.db.
-		WithContext(ctx).
-		Delete(&model.SignupToken{}, "expires_at < ?", datatype.DateTime(time.Now()))
-	if st.Error != nil {
-		return fmt.Errorf("failed to clean expired tokens: %w", st.Error)
+	count, err := usersignup.CleanupExpiredSignupTokens(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean expired signup tokens: %w", err)
 	}
 
-	slog.InfoContext(ctx, "Cleaned expired tokens", slog.Int64("count", st.RowsAffected))
+	slog.InfoContext(ctx, "Cleaned expired signup tokens", slog.Int64("count", count))
 
 	return nil
 }
 
-// ClearOidcAuthorizationCodes deletes OIDC authorization codes that have expired
-func (j *DbCleanupJobs) clearOidcAuthorizationCodes(ctx context.Context) error {
-	st := j.db.
-		WithContext(ctx).
-		Delete(&model.OidcAuthorizationCode{}, "expires_at < ?", datatype.DateTime(time.Now()))
-	if st.Error != nil {
-		return fmt.Errorf("failed to clean expired OIDC authorization codes: %w", st.Error)
+// clearOAuth2Sessions deletes expired and invalidated OAuth2 sessions.
+func (j *DbCleanupJobs) clearOAuth2Sessions(ctx context.Context) error {
+	count, err := oidc.CleanupExpiredOAuth2Sessions(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean OAuth2 sessions: %w", err)
 	}
 
-	slog.InfoContext(ctx, "Cleaned expired OIDC authorization codes", slog.Int64("count", st.RowsAffected))
+	slog.InfoContext(ctx, "Cleaned OAuth2 sessions", slog.Int64("count", count))
 
 	return nil
 }
 
-// ClearOidcAuthorizationCodes deletes OIDC authorization codes that have expired
-func (j *DbCleanupJobs) clearOidcRefreshTokens(ctx context.Context) error {
-	st := j.db.
-		WithContext(ctx).
-		Delete(&model.OidcRefreshToken{}, "expires_at < ?", datatype.DateTime(time.Now()))
-	if st.Error != nil {
-		return fmt.Errorf("failed to clean expired OIDC refresh tokens: %w", st.Error)
+// clearOAuth2JTIs deletes expired JWT IDs used for client assertion replay protection.
+func (j *DbCleanupJobs) clearOAuth2JTIs(ctx context.Context) error {
+	count, err := oidc.CleanupExpiredClientAssertionJTIs(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean OAuth2 client assertion JTIs: %w", err)
 	}
 
-	slog.InfoContext(ctx, "Cleaned expired OIDC refresh tokens", slog.Int64("count", st.RowsAffected))
+	slog.InfoContext(ctx, "Cleaned OAuth2 client assertion JTIs", slog.Int64("count", count))
 
 	return nil
 }
 
-// ClearReauthenticationTokens deletes reauthentication tokens that have expired
+// clearInteractionSessions deletes abandoned OIDC interaction sessions.
+func (j *DbCleanupJobs) clearInteractionSessions(ctx context.Context) error {
+	count, err := oidc.CleanupAbandonedInteractionSessions(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean interaction sessions: %w", err)
+	}
+
+	slog.InfoContext(ctx, "Cleaned interaction sessions", slog.Int64("count", count))
+
+	return nil
+}
+
+// clearReauthenticationTokens deletes expired reauthentication tokens.
+// What counts as expired is owned by the webauthn module.
 func (j *DbCleanupJobs) clearReauthenticationTokens(ctx context.Context) error {
-	st := j.db.
-		WithContext(ctx).
-		Delete(&model.ReauthenticationToken{}, "expires_at < ?", datatype.DateTime(time.Now()))
-	if st.Error != nil {
-		return fmt.Errorf("failed to clean expired reauthentication tokens: %w", st.Error)
+	count, err := webauthn.CleanupExpiredReauthenticationTokens(ctx, j.db)
+	if err != nil {
+		return fmt.Errorf("failed to clean expired reauthentication tokens: %w", err)
 	}
 
-	slog.InfoContext(ctx, "Cleaned expired reauthentication tokens", slog.Int64("count", st.RowsAffected))
+	slog.InfoContext(ctx, "Cleaned expired reauthentication tokens", slog.Int64("count", count))
 
 	return nil
 }

backend/internal/job/file_cleanup_job.go

@@ -2,37 +2,56 @@ package job
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log/slog"
 	"path"
 	"strings"
 	"time"
 
-	"github.com/go-co-op/gocron/v2"
+	"github.com/italypaleale/francis/builtin/cronjob"
 	"gorm.io/gorm"
 
 	"github.com/pocket-id/pocket-id/backend/internal/model"
-	"github.com/pocket-id/pocket-id/backend/internal/service"
 	"github.com/pocket-id/pocket-id/backend/internal/storage"
 )
 
-func (s *Scheduler) RegisterFileCleanupJobs(ctx context.Context, db *gorm.DB, fileStorage storage.FileStorage) error {
-	jobs := &FileCleanupJobs{db: db, fileStorage: fileStorage}
-
-	var errs []error
-	errs = append(errs,
-		s.RegisterJob(ctx, "ClearUnusedDefaultProfilePictures", gocron.DurationJob(24*time.Hour), jobs.clearUnusedDefaultProfilePictures, service.RegisterJobOpts{}),
-	)
-
-	// Only necessary for file system storage
-	if fileStorage.Type() == storage.TypeFileSystem {
-		errs = append(errs,
-			s.RegisterJob(ctx, "ClearOrphanedTempFiles", gocron.DurationJob(12*time.Hour), jobs.clearOrphanedTempFiles, service.RegisterJobOpts{RunImmediately: true}),
-		)
+// GetFileCleanupJobs returns the CronJob actors
+func GetFileCleanupJobs(db *gorm.DB, fileStorage storage.FileStorage) (cjs []*cronjob.CronJob, err error) {
+	job := &FileCleanupJobs{
+		db:          db,
+		fileStorage: fileStorage,
 	}
 
-	return errors.Join(errs...)
+	// Create the built-in actor for the ClearUnusedDefaultProfilePictures job
+	cj, err := cronjob.New(
+		"ClearUnusedDefaultProfilePictures",
+		cronjob.WithJob(job.clearUnusedDefaultProfilePictures),
+		// Run every 24 hours
+		cronjob.WithInterval(24*time.Hour),
+		cronjob.WithLogger(slog.Default()),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error creating ClearUnusedDefaultProfilePictures job: %w", err)
+	}
+	cjs = append(cjs, cj)
+
+	// Create the built-in actor for the ClearOrphanedTempFiles job
+	// Only necessary for file system storage
+	if fileStorage.Type() == storage.TypeFileSystem {
+		cj, err := cronjob.New(
+			"ClearOrphanedTempFiles",
+			cronjob.WithJob(job.clearOrphanedTempFiles),
+			// Run every 12 hours
+			cronjob.WithInterval(12*time.Hour),
+			cronjob.WithLogger(slog.Default()),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("error creating ClearOrphanedTempFiles job: %w", err)
+		}
+		cjs = append(cjs, cj)
+	}
+
+	return cjs, nil
 }
 
 type FileCleanupJobs struct {
@@ -91,7 +110,7 @@ func (j *FileCleanupJobs) clearUnusedDefaultProfilePictures(ctx context.Context)
 func (j *FileCleanupJobs) clearOrphanedTempFiles(ctx context.Context) error {
 	const minAge = 10 * time.Minute
 
-	var deleted int
+	deleted := 0
 	err := j.fileStorage.Walk(ctx, "/", func(p storage.ObjectInfo) error {
 		// Only temp files
 		if !strings.HasSuffix(p.Path, "-tmp") {
@@ -110,7 +129,6 @@ func (j *FileCleanupJobs) clearOrphanedTempFiles(ctx context.Context) error {
 		deleted++
 		return nil
 	})
-
 	if err != nil {
 		return fmt.Errorf("failed to scan storage: %w", err)
 	}

backend/internal/job/scheduler.go

@@ -10,8 +10,10 @@ import (
 	backoff "github.com/cenkalti/backoff/v5"
 	"github.com/go-co-op/gocron/v2"
 	"github.com/google/uuid"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/tracing"
 )
 
 type Scheduler struct {
@@ -65,52 +67,17 @@ func (s *Scheduler) Run(ctx context.Context) error {
 }
 
 func (s *Scheduler) RegisterJob(ctx context.Context, name string, def gocron.JobDefinition, jobFn func(ctx context.Context) error, opts service.RegisterJobOpts) error {
+	// Wrap the job in a handler that adds tracing and logging
+	jobFn = jobWithObservability(name, jobFn)
+
 	// If a BackOff strategy is provided, wrap the job with retry logic
 	if opts.BackOff != nil {
-		origJob := jobFn
-		jobFn = func(ctx context.Context) error {
-			_, err := backoff.Retry(
-				ctx,
-				func() (struct{}, error) {
-					return struct{}{}, origJob(ctx)
-				},
-				backoff.WithBackOff(opts.BackOff),
-				backoff.WithNotify(func(err error, d time.Duration) {
-					slog.WarnContext(ctx, "Job failed, retrying",
-						slog.String("name", name),
-						slog.Any("error", err),
-						slog.Duration("retryIn", d),
-					)
-				}),
-			)
-			return err
-		}
+		jobFn = jobWithBackOff(jobFn, opts.BackOff)
 	}
 
 	jobOptions := []gocron.JobOption{
 		gocron.WithContext(ctx),
 		gocron.WithName(name),
-		gocron.WithEventListeners(
-			gocron.BeforeJobRuns(func(jobID uuid.UUID, jobName string) {
-				slog.Info("Starting job",
-					slog.String("name", name),
-					slog.String("id", jobID.String()),
-				)
-			}),
-			gocron.AfterJobRuns(func(jobID uuid.UUID, jobName string) {
-				slog.Info("Job run successfully",
-					slog.String("name", name),
-					slog.String("id", jobID.String()),
-				)
-			}),
-			gocron.AfterJobRunsWithError(func(jobID uuid.UUID, jobName string, err error) {
-				slog.Error("Job failed with error",
-					slog.String("name", name),
-					slog.String("id", jobID.String()),
-					slog.Any("error", err),
-				)
-			}),
-		),
 	}
 
 	if opts.RunImmediately {
@@ -120,7 +87,6 @@ func (s *Scheduler) RegisterJob(ctx context.Context, name string, def gocron.Job
 	jobOptions = append(jobOptions, opts.ExtraOptions...)
 
 	_, err := s.scheduler.NewJob(def, gocron.NewTask(jobFn), jobOptions...)
-
 	if err != nil {
 		return fmt.Errorf("failed to register job %q: %w", name, err)
 	}
@@ -128,6 +94,76 @@ func (s *Scheduler) RegisterJob(ctx context.Context, name string, def gocron.Job
 	return nil
 }
 
+type (
+	jobNameKey struct{}
+	jobIDKey   struct{}
+	jobFn      = func(ctx context.Context) error
+)
+
+func jobWithObservability(jobName string, job jobFn) jobFn {
+	return func(ctx context.Context) error {
+		// Generate a random job ID
+		jobID := uuid.NewString()
+
+		// Save in the context
+		ctx = context.WithValue(ctx, jobNameKey{}, jobName)
+		ctx = context.WithValue(ctx, jobIDKey{}, jobID)
+
+		// Create a new context with the span
+		var err error
+		ctx, span := tracing.Start(ctx, "pocketid.job."+jobName,
+			trace.WithSpanKind(trace.SpanKindInternal),
+			trace.WithAttributes(
+				tracing.JobID(jobID),
+			),
+		)
+		defer tracing.End(span, err)
+
+		// Log the start
+		logger := slog.With(
+			slog.String("name", jobName),
+			slog.String("jobID", jobID),
+		)
+		start := time.Now()
+		logger.InfoContext(ctx, "Starting job")
+
+		// Run the job
+		err = job(ctx)
+		d := time.Since(start)
+		if err != nil {
+			logger.ErrorContext(ctx, "Job failed", slog.Any("error", err), slog.Duration("duration", d))
+			return err
+		}
+
+		logger.InfoContext(ctx, "Job run successfully", slog.Duration("duration", d))
+		return nil
+	}
+}
+
+func jobWithBackOff(job jobFn, bo backoff.BackOff) jobFn {
+	return func(ctx context.Context) error {
+		jobName, _ := (ctx.Value(jobNameKey{})).(string)
+		jobID, _ := (ctx.Value(jobIDKey{})).(string)
+
+		_, err := backoff.Retry(
+			ctx,
+			func() (struct{}, error) {
+				return struct{}{}, job(ctx)
+			},
+			backoff.WithBackOff(bo),
+			backoff.WithNotify(func(err error, d time.Duration) {
+				slog.WarnContext(ctx, "Job failed, retrying",
+					slog.String("name", jobName),
+					slog.String("jobID", jobID),
+					slog.Any("error", err),
+					slog.Duration("retryIn", d),
+				)
+			}),
+		)
+		return err
+	}
+}
+
 func jobDefWithJitter(interval time.Duration) gocron.JobDefinition {
 	const jitter = 5 * time.Minute
 

backend/internal/middleware/api_key_auth.go

@@ -2,19 +2,20 @@ package middleware
 
 import (
 	"github.com/gin-gonic/gin"
+	"github.com/pocket-id/pocket-id/backend/internal/apikey"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 )
 
 type ApiKeyAuthMiddleware struct {
-	apiKeyService *service.ApiKeyService
-	jwtService    *service.JwtService
+	apiKeyModule *apikey.Module
+	jwtService   *service.JwtService
 }
 
-func NewApiKeyAuthMiddleware(apiKeyService *service.ApiKeyService, jwtService *service.JwtService) *ApiKeyAuthMiddleware {
+func NewApiKeyAuthMiddleware(apiKeyModule *apikey.Module, jwtService *service.JwtService) *ApiKeyAuthMiddleware {
 	return &ApiKeyAuthMiddleware{
-		apiKeyService: apiKeyService,
-		jwtService:    jwtService,
+		apiKeyModule: apiKeyModule,
+		jwtService:   jwtService,
 	}
 }
 
@@ -36,7 +37,7 @@ func (m *ApiKeyAuthMiddleware) Add(adminRequired bool) gin.HandlerFunc {
 func (m *ApiKeyAuthMiddleware) Verify(c *gin.Context, adminRequired bool) (userID string, isAdmin bool, err error) {
 	apiKey := c.GetHeader("X-API-Key")
 
-	user, err := m.apiKeyService.ValidateApiKey(c.Request.Context(), apiKey)
+	user, err := m.apiKeyModule.ValidateApiKey(c.Request.Context(), apiKey)
 	if err != nil {
 		return "", false, &common.NotSignedInError{}
 	}

backend/internal/middleware/auth_middleware.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 
 	"github.com/gin-gonic/gin"
+	"github.com/pocket-id/pocket-id/backend/internal/apikey"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
 )
@@ -22,12 +23,12 @@ type AuthOptions struct {
 }
 
 func NewAuthMiddleware(
-	apiKeyService *service.ApiKeyService,
+	apiKeyModule *apikey.Module,
 	userService *service.UserService,
 	jwtService *service.JwtService,
 ) *AuthMiddleware {
 	return &AuthMiddleware{
-		apiKeyMiddleware: NewApiKeyAuthMiddleware(apiKeyService, jwtService),
+		apiKeyMiddleware: NewApiKeyAuthMiddleware(apiKeyModule, jwtService),
 		jwtMiddleware:    NewJwtAuthMiddleware(jwtService, userService),
 		options: AuthOptions{
 			AdminRequired:   true,
@@ -74,11 +75,12 @@ func (m *AuthMiddleware) WithApiKeyAuthDisabled() *AuthMiddleware {
 
 func (m *AuthMiddleware) Add() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		userID, isAdmin, authenticationMethod, err := m.jwtMiddleware.Verify(c, m.options.AdminRequired)
+		userID, isAdmin, authenticationMethod, authenticationTime, err := m.jwtMiddleware.Verify(c, m.options.AdminRequired)
 		if err == nil {
 			c.Set("userID", userID)
 			c.Set("userIsAdmin", isAdmin)
 			c.Set("authenticationMethod", authenticationMethod)
+			c.Set("authenticationTime", authenticationTime)
 			if c.IsAborted() {
 				return
 			}

backend/internal/middleware/auth_middleware_test.go

@@ -11,11 +11,13 @@ import (
 	"github.com/stretchr/testify/require"
 	"gorm.io/gorm"
 
+	"github.com/pocket-id/pocket-id/backend/internal/apikey"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
-	"github.com/pocket-id/pocket-id/backend/internal/dto"
+	"github.com/pocket-id/pocket-id/backend/internal/instanceid"
 	"github.com/pocket-id/pocket-id/backend/internal/model"
 	datatype "github.com/pocket-id/pocket-id/backend/internal/model/types"
 	"github.com/pocket-id/pocket-id/backend/internal/service"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
 	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
 )
 
@@ -34,24 +36,30 @@ func TestWithApiKeyAuthDisabled(t *testing.T) {
 	appConfigService, err := service.NewAppConfigService(t.Context(), db)
 	require.NoError(t, err)
 
-	jwtService, err := service.NewJwtService(t.Context(), db, appConfigService)
+	instanceID, err := instanceid.Load(t.Context(), db)
+	require.NoError(t, err)
+
+	jwtService, err := service.NewJwtService(t.Context(), db, instanceID, appConfigService)
 	require.NoError(t, err)
 
 	userService := service.NewUserService(db, jwtService, nil, nil, appConfigService, nil, nil, nil, nil)
-	apiKeyService, err := service.NewApiKeyService(t.Context(), db, nil)
+	apiKeyModule, err := apikey.New(t.Context(), apikey.Dependencies{DB: db})
 	require.NoError(t, err)
 
-	authMiddleware := NewAuthMiddleware(apiKeyService, userService, jwtService)
+	authMiddleware := NewAuthMiddleware(apiKeyModule, userService, jwtService)
 
 	user := createUserForAuthMiddlewareTest(t, db)
 	jwtToken, err := jwtService.GenerateAccessToken(user, "")
 	require.NoError(t, err)
 
-	_, apiKeyToken, err := apiKeyService.CreateApiKey(t.Context(), user.ID, dto.ApiKeyCreateDto{
+	apiKeyToken := "middleware-test-api-key-raw-token"
+	apiKeyRecord := apikey.ApiKey{
 		Name:      "Middleware API Key",
+		Key:       utils.CreateSha256Hash(apiKeyToken),
+		UserID:    user.ID,
 		ExpiresAt: datatype.DateTime(time.Now().Add(24 * time.Hour)),
-	})
-	require.NoError(t, err)
+	}
+	require.NoError(t, db.Create(&apiKeyRecord).Error)
 
 	router := gin.New()
 	router.Use(NewErrorHandlerMiddleware().Add())
@@ -88,10 +96,9 @@ func TestWithApiKeyAuthDisabled(t *testing.T) {
 func createUserForAuthMiddlewareTest(t *testing.T, db *gorm.DB) model.User {
 	t.Helper()
 
-	email := "auth@example.com"
 	user := model.User{
 		Username:    "auth-user",
-		Email:       &email,
+		Email:       new("auth@example.com"),
 		FirstName:   "Auth",
 		LastName:    "User",
 		DisplayName: "Auth User",

backend/internal/middleware/cors.go

@@ -43,7 +43,7 @@ func isCorsPath(path string) bool {
 	switch path {
 	case "/api/oidc/token",
 		"/api/oidc/userinfo",
-		"/oidc/end-session",
+		"/api/oidc/end-session",
 		"/api/oidc/introspect",
 		"/.well-known/jwks.json",
 		"/.well-known/openid-configuration":

backend/internal/middleware/csp_middleware.go

@@ -1,10 +1,8 @@
 package middleware
 
 import (
-	"crypto/rand"
-	"encoding/base64"
-
 	"github.com/gin-gonic/gin"
+	"github.com/pocket-id/pocket-id/backend/internal/utils"
 )
 
 // CspMiddleware sets a Content Security Policy header and, when possible,
@@ -15,39 +13,16 @@ func NewCspMiddleware() *CspMiddleware { return &CspMiddleware{} }
 
 // GetCSPNonce returns the CSP nonce generated for this request, if any.
 func GetCSPNonce(c *gin.Context) string {
-	if v, ok := c.Get("csp_nonce"); ok {
-		if s, ok := v.(string); ok {
-			return s
-		}
-	}
-	return ""
+	return utils.GetCSPNonce(c)
 }
 
 func (m *CspMiddleware) Add() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		// Generate a random base64 nonce for this request
-		nonce := generateNonce()
-		c.Set("csp_nonce", nonce)
+		nonce := utils.GenerateCSPNonce()
+		utils.SetCSPNonce(c, nonce)
+		c.Writer.Header().Set("Content-Security-Policy", utils.BuildCSP(nonce))
 
-		csp := "default-src 'self'; " +
-			"base-uri 'self'; " +
-			"object-src 'none'; " +
-			"frame-ancestors 'none'; " +
-			"form-action 'self'; " +
-			"img-src * blob:;" +
-			"font-src 'self'; " +
-			"style-src 'self' 'unsafe-inline'; " +
-			"script-src 'self' 'nonce-" + nonce + "'"
-
-		c.Writer.Header().Set("Content-Security-Policy", csp)
 		c.Next()
 	}
 }
-
-func generateNonce() string {
-	b := make([]byte, 16)
-	if _, err := rand.Read(b); err != nil {
-		return "" // if generation fails, return empty; policy will omit nonce
-	}
-	return base64.RawURLEncoding.EncodeToString(b)
-}

backend/internal/middleware/error_handler.go

@@ -23,7 +23,6 @@ func (m *ErrorHandlerMiddleware) Add() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		c.Next()
 		for _, err := range c.Errors {
-
 			// Check for record not found errors
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				errorResponse(c, http.StatusNotFound, "Record not found")
@@ -39,30 +38,56 @@ func (m *ErrorHandlerMiddleware) Add() gin.HandlerFunc {
 			}
 
 			// Check for slice validation errors
-			var sliceValidationErrors binding.SliceValidationError
-			if errors.As(err, &sliceValidationErrors) {
-				if errors.As(sliceValidationErrors[0], &validationErrors) {
+			svErr, ok := errors.AsType[binding.SliceValidationError](err)
+			if ok {
+				if errors.As(svErr[0], &validationErrors) {
 					message := handleValidationError(validationErrors)
 					errorResponse(c, http.StatusBadRequest, message)
 					return
 				}
 			}
 
-			var appErr common.AppError
-			if errors.As(err, &appErr) {
+			// AppError with description
+			appDescErr, ok := errors.AsType[common.AppErrorDescription](err)
+			if ok {
+				errorResponseWithDescription(c, appDescErr.HttpStatusCode(), appDescErr.Error(), appDescErr.Description())
+				return
+			}
+
+			// AppError (without description)
+			appErr, ok := errors.AsType[common.AppError](err)
+			if ok {
 				errorResponse(c, appErr.HttpStatusCode(), appErr.Error())
 				return
 			}
 
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Something went wrong"})
+			c.JSON(http.StatusInternalServerError, errorResponseBody{
+				Error: "Something went wrong",
+			})
 		}
 	}
 }
 
+type errorResponseBody struct {
+	Error            string `json:"error"`
+	ErrorDescription string `json:"error_description,omitempty"`
+}
+
 func errorResponse(c *gin.Context, statusCode int, message string) {
 	// Capitalize the first letter of the message
 	message = strings.ToUpper(message[:1]) + message[1:]
-	c.JSON(statusCode, gin.H{"error": message})
+	c.JSON(statusCode, errorResponseBody{
+		Error: message,
+	})
+}
+
+func errorResponseWithDescription(c *gin.Context, statusCode int, message string, description string) {
+	// Capitalize the first letter of the message
+	message = strings.ToUpper(message[:1]) + message[1:]
+	c.JSON(statusCode, errorResponseBody{
+		Error:            message,
+		ErrorDescription: description,
+	})
 }
 
 func handleValidationError(validationErrors validator.ValidationErrors) string {
@@ -80,6 +105,8 @@ func handleValidationError(validationErrors validator.ValidationErrors) string {
 			errorMessage = fmt.Sprintf("%s must only contain letters, numbers, underscores, dots, hyphens, and '@' symbols and not start or end with a special character", fieldName)
 		case "url":
 			errorMessage = fmt.Sprintf("%s must be a valid URL", fieldName)
+		case "resource_uri":
+			errorMessage = fmt.Sprintf("%s must be an absolute URI without whitespace or a fragment", fieldName)
 		case "min":
 			errorMessage = fmt.Sprintf("%s must be at least %s characters long", fieldName, ve.Param())
 		case "max":

backend/internal/middleware/head_middleware.go

@@ -16,7 +16,7 @@ type headWriter struct {
 
 func (w *headWriter) Write(b []byte) (int, error) {
 	w.size += len(b)
-	return w.size, nil
+	return len(b), nil
 }
 
 func HeadMiddleware() gin.HandlerFunc {

backend/internal/middleware/jwt_auth.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"strings"
+	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/pocket-id/pocket-id/backend/internal/common"
@@ -20,7 +21,7 @@ func NewJwtAuthMiddleware(jwtService *service.JwtService, userService *service.U
 
 func (m *JwtAuthMiddleware) Add(adminRequired bool) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		userID, isAdmin, authenticationMethod, err := m.Verify(c, adminRequired)
+		userID, isAdmin, authenticationMethod, authenticationTime, err := m.Verify(c, adminRequired)
 		if err != nil {
 			c.Abort()
 			_ = c.Error(err)
@@ -30,11 +31,12 @@ func (m *JwtAuthMiddleware) Add(adminRequired bool) gin.HandlerFunc {
 		c.Set("userID", userID)
 		c.Set("userIsAdmin", isAdmin)
 		c.Set("authenticationMethod", authenticationMethod)
+		c.Set("authenticationTime", authenticationTime)
 		c.Next()
 	}
 }
 
-func (m *JwtAuthMiddleware) Verify(c *gin.Context, adminRequired bool) (subject string, isAdmin bool, authenticationMethod string, err error) {
+func (m *JwtAuthMiddleware) Verify(c *gin.Context, adminRequired bool) (subject string, isAdmin bool, authenticationMethod string, authenticationTime time.Time, err error) {
 	// Extract the token from the cookie
 	accessToken, err := c.Cookie(cookie.AccessTokenCookieName)
 	if err != nil {
@@ -42,37 +44,38 @@ func (m *JwtAuthMiddleware) Verify(c *gin.Context, adminRequired bool) (subject
 		var ok bool
 		_, accessToken, ok = strings.Cut(c.GetHeader("Authorization"), " ")
 		if !ok || accessToken == "" {
-			return "", false, "", &common.NotSignedInError{}
+			return "", false, "", time.Time{}, &common.NotSignedInError{}
 		}
 	}
 
 	token, err := m.jwtService.VerifyAccessToken(accessToken)
 	if err != nil {
-		return "", false, "", &common.NotSignedInError{}
+		return "", false, "", time.Time{}, &common.NotSignedInError{}
 	}
-	authenticationMethod, err = service.GetAuthenticationMethod(token)
+	authenticationMethod, err = m.jwtService.GetAuthenticationMethod(token)
 	if err != nil {
-		return "", false, "", &common.NotSignedInError{}
+		return "", false, "", time.Time{}, &common.NotSignedInError{}
 	}
+	authenticationTime, _ = token.IssuedAt()
 
 	subject, ok := token.Subject()
 	if !ok {
 		_ = c.Error(&common.TokenInvalidError{})
-		return "", false, "", &common.TokenInvalidError{}
+		return "", false, "", time.Time{}, &common.TokenInvalidError{}
 	}
 
 	user, err := m.userService.GetUser(c, subject)
 	if err != nil {
-		return "", false, "", &common.NotSignedInError{}
+		return "", false, "", time.Time{}, &common.NotSignedInError{}
 	}
 
 	if user.Disabled {
-		return "", false, "", &common.UserDisabledError{}
+		return "", false, "", time.Time{}, &common.UserDisabledError{}
 	}
 
 	if adminRequired && !user.IsAdmin {
-		return "", false, "", &common.MissingPermissionError{}
+		return "", false, "", time.Time{}, &common.MissingPermissionError{}
 	}
 
-	return subject, user.IsAdmin, authenticationMethod, nil
+	return subject, user.IsAdmin, authenticationMethod, authenticationTime, nil
 }

backend/internal/middleware/rate_limit.go

@@ -1,47 +1,116 @@
 package middleware
 
 import (
-	"sync"
+	"context"
+	"errors"
+	"log/slog"
+	"math"
+	"net"
+	"net/http"
+	"strconv"
 	"time"
 
-	"github.com/pocket-id/pocket-id/backend/internal/common"
-
 	"github.com/gin-gonic/gin"
-	"golang.org/x/time/rate"
+	"github.com/italypaleale/francis/builtin/ratelimit"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
 )
 
-type RateLimitMiddleware struct{}
+// Rate-limit policy names
+// Each constant names a limiter registered on the actor host and is the value passed to Add to select that limiter
+const (
+	RateLimitAPI                    = "api"
+	RateLimitSignup                 = "signup"
+	RateLimitWebauthnLogin          = "webauthn-login"
+	RateLimitWebauthnReauthenticate = "webauthn-reauthenticate"
+	RateLimitOneTimeAccessToken     = "one-time-access-token"
+	RateLimitOneTimeAccessEmail     = "one-time-access-email"
+	RateLimitSendEmailVerification  = "send-email-verification"
+	RateLimitVerifyEmail            = "verify-email"
+	RateLimitInternal               = "internal"
+)
 
-func NewRateLimitMiddleware() *RateLimitMiddleware {
-	return &RateLimitMiddleware{}
+// RateLimitPolicy is the configuration for a single rate-limit actor
+// Each policy maps to one Francis rate-limit actor type and requests are keyed by client IP, so every IP is limited independently and per-route limits stay isolated from each other
+type RateLimitPolicy struct {
+	// Name must be unique across policies and must not contain '/'
+	Name string
+	// Rate is the number of calls admitted per Per window
+	Rate int
+	// Per is the window the rate applies over
+	Per time.Duration
+	// Burst is the token bucket's capacity, i.e. how many calls may be admitted instantly before throttling kicks in
+	Burst int
 }
 
-func (m *RateLimitMiddleware) Add(limit rate.Limit, burst int) gin.HandlerFunc {
+// RateLimitPolicies returns the configuration for every rate-limit policy
+// The slice is built on each call so the policies are not retained at the package level, and the actor host registers one limiter per entry
+func RateLimitPolicies() []RateLimitPolicy {
+	return []RateLimitPolicy{
+		{Name: RateLimitAPI, Rate: 100, Per: time.Second, Burst: 300},
+		{Name: RateLimitSignup, Rate: 2, Per: time.Minute, Burst: 10},
+		{Name: RateLimitWebauthnLogin, Rate: 1, Per: 5 * time.Second, Burst: 10},
+		{Name: RateLimitWebauthnReauthenticate, Rate: 1, Per: 10 * time.Second, Burst: 5},
+		{Name: RateLimitOneTimeAccessToken, Rate: 1, Per: 10 * time.Second, Burst: 5},
+		{Name: RateLimitOneTimeAccessEmail, Rate: 2, Per: 10 * time.Minute, Burst: 5},
+		{Name: RateLimitSendEmailVerification, Rate: 2, Per: 10 * time.Minute, Burst: 1},
+		{Name: RateLimitVerifyEmail, Rate: 1, Per: 10 * time.Second, Burst: 5},
+		{Name: RateLimitInternal, Rate: 20, Per: time.Second, Burst: 20},
+	}
+}
+
+type RateLimitMiddleware struct {
+	services map[string]*ratelimit.RateLimitService
+}
+
+func NewRateLimitMiddleware(services map[string]*ratelimit.RateLimitService) *RateLimitMiddleware {
+	return &RateLimitMiddleware{
+		services: services,
+	}
+}
+
+func (m *RateLimitMiddleware) Add(policy string) gin.HandlerFunc {
 	if common.EnvConfig.DisableRateLimiting {
 		return func(c *gin.Context) {
 			c.Next()
 		}
 	}
 
-	// Map to store the rate limiters per IP
-	var clients = make(map[string]*client)
-	var mu sync.Mutex
-
-	// Start the cleanup routine
-	go cleanupClients(&mu, clients)
+	// A missing service means the policy was never registered on the actor host, which is a development-time errror
+	svc := m.services[policy]
+	if svc == nil {
+		return func(c *gin.Context) {
+			c.AbortWithStatus(http.StatusInternalServerError)
+		}
+	}
 
 	return func(c *gin.Context) {
 		ip := c.ClientIP()
 
 		// Skip rate limiting for localhost and test environment
 		// If the client ip is localhost the request comes from the frontend
-		if ip == "" || ip == "127.0.0.1" || ip == "::1" || common.EnvConfig.AppEnv.IsTest() {
+		if common.EnvConfig.AppEnv == common.AppEnvTest || net.ParseIP(ip).IsLoopback() {
 			c.Next()
 			return
 		}
 
-		limiter := getLimiter(ip, limit, burst, &mu, clients)
-		if !limiter.Allow() {
+		// Allow is a non-blocking token-bucket check keyed by client IP: it consumes a slot and reports whether the call is admitted right now
+		allowed, retryAfter, err := svc.Allow(c.Request.Context(), ip)
+		if err != nil {
+			// Fail open so a limiter error does not turn away otherwise-valid traffic
+			if !errors.Is(err, context.Canceled) {
+				// A cancelled context just means the client went away, so it is not worth logging
+				slog.WarnContext(c.Request.Context(), "Rate limiter unavailable, allowing request", slog.String("policy", policy), slog.Any("error", err))
+			}
+			c.Next()
+			return
+		}
+
+		if !allowed {
+			// Advertise when the caller may retry, mapping the limiter's delay onto a Retry-After header
+			if retryAfter > 0 {
+				c.Header("Retry-After", strconv.Itoa(int(math.Ceil(retryAfter.Seconds()))))
+			}
 			_ = c.Error(&common.TooManyRequestsError{})
 			c.Abort()
 			return
@@ -50,37 +119,3 @@ func (m *RateLimitMiddleware) Add(limit rate.Limit, burst int) gin.HandlerFunc {
 		c.Next()
 	}
 }
-
-type client struct {
-	limiter  *rate.Limiter
-	lastSeen time.Time
-}
-
-// Cleanup routine to remove stale clients that haven't been seen for a while
-func cleanupClients(mu *sync.Mutex, clients map[string]*client) {
-	for {
-		time.Sleep(time.Minute)
-		mu.Lock()
-		for ip, client := range clients {
-			if time.Since(client.lastSeen) > 3*time.Minute {
-				delete(clients, ip)
-			}
-		}
-		mu.Unlock()
-	}
-}
-
-// getLimiter retrieves the rate limiter for a given IP address, creating one if it doesn't exist
-func getLimiter(ip string, limit rate.Limit, burst int, mu *sync.Mutex, clients map[string]*client) *rate.Limiter {
-	mu.Lock()
-	defer mu.Unlock()
-
-	if client, exists := clients[ip]; exists {
-		client.lastSeen = time.Now()
-		return client.limiter
-	}
-
-	limiter := rate.NewLimiter(limit, burst)
-	clients[ip] = &client{limiter: limiter, lastSeen: time.Now()}
-	return limiter
-}

backend/internal/middleware/rate_limit_test.go

@@ -0,0 +1,148 @@
+package middleware
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/italypaleale/francis/builtin/ratelimit"
+	"github.com/italypaleale/francis/host/local"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pocket-id/pocket-id/backend/internal/common"
+	testutils "github.com/pocket-id/pocket-id/backend/internal/utils/testing"
+)
+
+// startRateLimitServices registers one rate-limit actor per policy on an in-memory test actor host and returns the bound services keyed by policy name
+func startRateLimitServices(t *testing.T, policies ...RateLimitPolicy) map[string]*ratelimit.RateLimitService {
+	t.Helper()
+
+	limiters := make(map[string]*ratelimit.RateLimit, len(policies))
+	h := testutils.NewActorHostForTest(t, func(t *testing.T, h *local.Host) {
+		for _, p := range policies {
+			rl, err := ratelimit.New(p.Name, ratelimit.WithRate(p.Rate), ratelimit.WithPer(p.Per), ratelimit.WithBurst(p.Burst))
+			require.NoError(t, err)
+			limiters[p.Name] = rl
+
+			err = h.RegisterBuiltInActor(rl)
+			require.NoError(t, err)
+		}
+	})
+
+	services := make(map[string]*ratelimit.RateLimitService, len(limiters))
+	svc := h.Service()
+	for name, rl := range limiters {
+		services[name] = rl.Service(svc)
+	}
+	return services
+}
+
+// newRateLimitRouter builds a gin engine that runs the rate-limit middleware for the given policy on GET /test
+// Trusted proxies are disabled so ClientIP resolves to the request's RemoteAddr, and the error handler turns the middleware's error into a 429 response
+func newRateLimitRouter(t *testing.T, services map[string]*ratelimit.RateLimitService, policy string) *gin.Engine {
+	t.Helper()
+
+	r := gin.New()
+
+	err := r.SetTrustedProxies(nil)
+	require.NoError(t, err)
+
+	r.Use(NewErrorHandlerMiddleware().Add())
+
+	mw := NewRateLimitMiddleware(services)
+	r.GET("/test", mw.Add(policy), func(c *gin.Context) {
+		c.String(http.StatusOK, "ok")
+	})
+
+	return r
+}
+
+// doRateLimitRequest sends a GET /test request as the given client IP and returns the response recorder
+func doRateLimitRequest(ctx context.Context, r *gin.Engine, ip string) *httptest.ResponseRecorder {
+	req := httptest.NewRequestWithContext(ctx, http.MethodGet, "/test", nil)
+	req.RemoteAddr = net.JoinHostPort(ip, "12345")
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+	return w
+}
+
+func TestRateLimitMiddleware(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	// The middleware reads the global config, so restore it after the test
+	originalEnvConfig := common.EnvConfig
+	t.Cleanup(func() {
+		common.EnvConfig = originalEnvConfig
+	})
+
+	common.EnvConfig.AppEnv = common.AppEnvProduction
+	common.EnvConfig.DisableRateLimiting = false
+
+	// A slow refill (one token per hour) with a burst of 2 means the first two calls for a key are admitted and the third is rejected, with no refill during the test
+	const policy = "test-limit"
+	services := startRateLimitServices(t, RateLimitPolicy{Name: policy, Rate: 1, Per: time.Hour, Burst: 2})
+
+	t.Run("rejects requests over the limit and sets Retry-After", func(t *testing.T) {
+		r := newRateLimitRouter(t, services, policy)
+		const ip = "203.0.113.1"
+
+		require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, ip).Code)
+		require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, ip).Code)
+
+		w := doRateLimitRequest(t.Context(), r, ip)
+		require.Equal(t, http.StatusTooManyRequests, w.Code)
+		assert.NotEmpty(t, w.Header().Get("Retry-After"), "a throttled response should advertise Retry-After")
+	})
+
+	t.Run("limits each client IP independently", func(t *testing.T) {
+		r := newRateLimitRouter(t, services, policy)
+
+		// Exhaust the budget for the first IP
+		require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, "203.0.113.2").Code)
+		require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, "203.0.113.2").Code)
+		require.Equal(t, http.StatusTooManyRequests, doRateLimitRequest(t.Context(), r, "203.0.113.2").Code)
+
+		// A different IP still has its full budget
+		require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, "203.0.113.3").Code)
+	})
+
+	t.Run("allows all requests when rate limiting is disabled", func(t *testing.T) {
+		common.EnvConfig.DisableRateLimiting = true
+		t.Cleanup(func() { common.EnvConfig.DisableRateLimiting = false })
+
+		r := newRateLimitRouter(t, services, policy)
+		for range 5 {
+			require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, "203.0.113.4").Code)
+		}
+	})
+
+	t.Run("skips rate limiting for loopback addresses", func(t *testing.T) {
+		r := newRateLimitRouter(t, services, policy)
+		for _, ip := range []string{"127.0.0.1", "::1"} {
+			for range 5 {
+				require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, ip).Code)
+			}
+		}
+	})
+
+	t.Run("skips rate limiting in the test environment", func(t *testing.T) {
+		common.EnvConfig.AppEnv = common.AppEnvTest
+		t.Cleanup(func() { common.EnvConfig.AppEnv = common.AppEnvProduction })
+
+		r := newRateLimitRouter(t, services, policy)
+		for range 5 {
+			require.Equal(t, http.StatusOK, doRateLimitRequest(t.Context(), r, "203.0.113.5").Code)
+		}
+	})
+
+	t.Run("fails with 500 when the policy is not registered", func(t *testing.T) {
+		// An unknown policy has no bound service, which is a configuration error surfaced as a 500
+		r := newRateLimitRouter(t, services, "does-not-exist")
+		require.Equal(t, http.StatusInternalServerError, doRateLimitRequest(t.Context(), r, "203.0.113.6").Code)
+	})
+}

backend/internal/model/app_config.go

@@ -44,8 +44,6 @@ type AppConfig struct {
 	AllowUserSignups          AppConfigVariable `key:"allowUserSignups,public"`    // Public
 	SignupDefaultUserGroupIDs AppConfigVariable `key:"signupDefaultUserGroupIDs"`
 	SignupDefaultCustomClaims AppConfigVariable `key:"signupDefaultCustomClaims"`
-	// Internal
-	InstanceID AppConfigVariable `key:"instanceId,internal"` // Internal
 	// Email
 	RequireUserEmail                           AppConfigVariable `key:"requireUserEmail,public"` // Public
 	SmtpHost                                   AppConfigVariable `key:"smtpHost"`

backend/internal/model/app_config_test.go

@@ -100,7 +100,7 @@ func TestAppConfigStructMatchesUpdateDto(t *testing.T) {
 
 	// Verify every AppConfig field has a matching DTO field with the same name
 	for fieldName, keyName := range appConfigFields {
-		if strings.HasSuffix(fieldName, "ImageType") || keyName == "instanceId" {
+		if strings.HasSuffix(fieldName, "ImageType") {
 			// Skip internal fields that shouldn't be in the DTO
 			continue
 		}