Move login related structs and functions to models/login (#17093)

* Move login related structs and functions to models/login

* Fix test

* Fix lint

* Fix lint

* Fix lint of windows

* Fix lint

* Fix test

* Fix test

* Only load necessary fixtures when preparing unit tests envs

* Fix lint

* Fix test

* Fix test

* Fix error log

* Fix error log

* Fix error log

* remove unnecessary change

* fix error log

* merge main branch

3 files changed, 149 insertions, 146 deletions

diff --git a/cmd/admin.go b/cmd/admin.go
index cfc297c474..099083ae91 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -14,6 +14,8 @@ import (
 	"text/tabwriter"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
@@ -21,6 +23,7 @@ import (
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/storage"
+	auth_service "code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 
 	"github.com/urfave/cli"
@@ -529,7 +532,7 @@ func runRepoSyncReleases(_ *cli.Context) error {
 	log.Trace("Synchronizing repository releases (this may take a while)")
 	for page := 1; ; page++ {
 		repos, count, err := models.SearchRepositoryByName(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				PageSize: models.RepositoryListDefaultPageSize,
 				Page:     page,
 			},
@@ -629,8 +632,8 @@ func runAddOauth(c *cli.Context) error {
 		return err
 	}
 
-	return models.CreateLoginSource(&models.LoginSource{
-		Type:     models.LoginOAuth2,
+	return login.CreateSource(&login.Source{
+		Type:     login.OAuth2,
 		Name:     c.String("name"),
 		IsActive: true,
 		Cfg:      parseOAuth2Config(c),
@@ -646,7 +649,7 @@ func runUpdateOauth(c *cli.Context) error {
 		return err
 	}
 
-	source, err := models.GetLoginSourceByID(c.Int64("id"))
+	source, err := login.GetSourceByID(c.Int64("id"))
 	if err != nil {
 		return err
 	}
@@ -705,7 +708,7 @@ func runUpdateOauth(c *cli.Context) error {
 	oAuth2Config.CustomURLMapping = customURLMapping
 	source.Cfg = oAuth2Config
 
-	return models.UpdateSource(source)
+	return login.UpdateSource(source)
 }
 
 func runListAuth(c *cli.Context) error {
@@ -713,7 +716,7 @@ func runListAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSources, err := models.LoginSources()
+	loginSources, err := login.Sources()
 
 	if err != nil {
 		return err
@@ -733,7 +736,7 @@ func runListAuth(c *cli.Context) error {
 	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
 	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
 	for _, source := range loginSources {
-		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, models.LoginNames[source.Type], source.IsActive)
+		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
 	}
 	w.Flush()
 
@@ -749,10 +752,10 @@ func runDeleteAuth(c *cli.Context) error {
 		return err
 	}
 
-	source, err := models.GetLoginSourceByID(c.Int64("id"))
+	source, err := login.GetSourceByID(c.Int64("id"))
 	if err != nil {
 		return err
 	}
 
-	return models.DeleteSource(source)
+	return auth_service.DeleteLoginSource(source)
 }
diff --git a/cmd/admin_auth_ldap.go b/cmd/admin_auth_ldap.go
index feeaf17661..e95e1d15c6 100644
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/urfave/cli"
@@ -17,9 +17,9 @@ import (
 type (
 	authService struct {
 		initDB             func() error
-		createLoginSource  func(loginSource *models.LoginSource) error
-		updateLoginSource  func(loginSource *models.LoginSource) error
-		getLoginSourceByID func(id int64) (*models.LoginSource, error)
+		createLoginSource  func(loginSource *login.Source) error
+		updateLoginSource  func(loginSource *login.Source) error
+		getLoginSourceByID func(id int64) (*login.Source, error)
 	}
 )
 
@@ -164,14 +164,14 @@ var (
 func newAuthService() *authService {
 	return &authService{
 		initDB:             initDB,
-		createLoginSource:  models.CreateLoginSource,
-		updateLoginSource:  models.UpdateSource,
-		getLoginSourceByID: models.GetLoginSourceByID,
+		createLoginSource:  login.CreateSource,
+		updateLoginSource:  login.UpdateSource,
+		getLoginSourceByID: login.GetSourceByID,
 	}
 }
 
 // parseLoginSource assigns values on loginSource according to command line flags.
-func parseLoginSource(c *cli.Context, loginSource *models.LoginSource) {
+func parseLoginSource(c *cli.Context, loginSource *login.Source) {
 	if c.IsSet("name") {
 		loginSource.Name = c.String("name")
 	}
@@ -269,7 +269,7 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {
 
 // getLoginSource gets the login source by its id defined in the command line flags.
 // It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getLoginSource(c *cli.Context, loginType models.LoginType) (*models.LoginSource, error) {
+func (a *authService) getLoginSource(c *cli.Context, loginType login.Type) (*login.Source, error) {
 	if err := argsSet(c, "id"); err != nil {
 		return nil, err
 	}
@@ -280,7 +280,7 @@ func (a *authService) getLoginSource(c *cli.Context, loginType models.LoginType)
 	}
 
 	if loginSource.Type != loginType {
-		return nil, fmt.Errorf("Invalid authentication type. expected: %s, actual: %s", models.LoginNames[loginType], models.LoginNames[loginSource.Type])
+		return nil, fmt.Errorf("Invalid authentication type. expected: %s, actual: %s", loginType.String(), loginSource.Type.String())
 	}
 
 	return loginSource, nil
@@ -296,8 +296,8 @@ func (a *authService) addLdapBindDn(c *cli.Context) error {
 		return err
 	}
 
-	loginSource := &models.LoginSource{
-		Type:     models.LoginLDAP,
+	loginSource := &login.Source{
+		Type:     login.LDAP,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -318,7 +318,7 @@ func (a *authService) updateLdapBindDn(c *cli.Context) error {
 		return err
 	}
 
-	loginSource, err := a.getLoginSource(c, models.LoginLDAP)
+	loginSource, err := a.getLoginSource(c, login.LDAP)
 	if err != nil {
 		return err
 	}
@@ -341,8 +341,8 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSource := &models.LoginSource{
-		Type:     models.LoginDLDAP,
+	loginSource := &login.Source{
+		Type:     login.DLDAP,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -363,7 +363,7 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSource, err := a.getLoginSource(c, models.LoginDLDAP)
+	loginSource, err := a.getLoginSource(c, login.DLDAP)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/admin_auth_ldap_test.go b/cmd/admin_auth_ldap_test.go
index 692b11e3f4..c26cbdaf39 100644
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -7,7 +7,7 @@ package cmd
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/stretchr/testify/assert"
@@ -23,7 +23,7 @@ func TestAddLdapBindDn(t *testing.T) {
 	// Test cases
 	var cases = []struct {
 		args        []string
-		loginSource *models.LoginSource
+		loginSource *login.Source
 		errMsg      string
 	}{
 		// case 0
@@ -51,8 +51,8 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--synchronize-users",
 				"--page-size", "99",
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				Name:          "ldap (via Bind DN) source full",
 				IsActive:      false,
 				IsSyncEnabled: true,
@@ -91,8 +91,8 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--user-filter", "(memberOf=cn=user-group,ou=example,dc=min-domain-bind,dc=org)",
 				"--email-attribute", "mail-bind min",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:     login.LDAP,
 				Name:     "ldap (via Bind DN) source min",
 				IsActive: true,
 				Cfg: &ldap.Source{
@@ -203,20 +203,20 @@ func TestAddLdapBindDn(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var createdLoginSource *models.LoginSource
+		var createdLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				createdLoginSource = loginSource
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call updateLoginSource", n)
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				assert.FailNow(t, "case %d: should not call getLoginSourceByID", n)
 				return nil, nil
 			},
@@ -247,7 +247,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 	// Test cases
 	var cases = []struct {
 		args        []string
-		loginSource *models.LoginSource
+		loginSource *login.Source
 		errMsg      string
 	}{
 		// case 0
@@ -271,8 +271,8 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--public-ssh-key-attribute", "publickey-simple full",
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source full",
 				IsActive: false,
 				Cfg: &ldap.Source{
@@ -307,8 +307,8 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--email-attribute", "mail-simple min",
 				"--user-dn", "cn=%s,ou=Users,dc=min-domain-simple,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source min",
 				IsActive: true,
 				Cfg: &ldap.Source{
@@ -432,20 +432,20 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var createdLoginSource *models.LoginSource
+		var createdLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				createdLoginSource = loginSource
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call updateLoginSource", n)
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				assert.FailNow(t, "case %d: should not call getLoginSourceByID", n)
 				return nil, nil
 			},
@@ -477,8 +477,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 	var cases = []struct {
 		args                []string
 		id                  int64
-		existingLoginSource *models.LoginSource
-		loginSource         *models.LoginSource
+		existingLoginSource *login.Source
+		loginSource         *login.Source
 		errMsg              string
 	}{
 		// case 0
@@ -507,15 +507,15 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--page-size", "99",
 			},
 			id: 23,
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: true,
 				Cfg: &ldap.Source{
 					Enabled: true,
 				},
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				Name:          "ldap (via Bind DN) source full",
 				IsActive:      false,
 				IsSyncEnabled: true,
@@ -548,8 +548,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg:  &ldap.Source{},
 			},
 		},
@@ -560,8 +560,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--name", "ldap (via Bind DN) source",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Name: "ldap (via Bind DN) source",
 				Cfg: &ldap.Source{
 					Name: "ldap (via Bind DN) source",
@@ -575,13 +575,13 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--not-active",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: true,
 				Cfg:      &ldap.Source{},
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: false,
 				Cfg:      &ldap.Source{},
 			},
@@ -593,8 +593,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "LDAPS",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SecurityProtocol: ldap.SecurityProtocol(1),
 				},
@@ -607,8 +607,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--skip-tls-verify",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SkipVerify: true,
 				},
@@ -621,8 +621,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--host", "ldap-server",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Host: "ldap-server",
 				},
@@ -635,8 +635,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--port", "389",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Port: 389,
 				},
@@ -649,8 +649,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--user-search-base", "ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					UserBase: "ou=Users,dc=domain,dc=org",
 				},
@@ -663,8 +663,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--user-filter", "(memberOf=cn=user-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Filter: "(memberOf=cn=user-group,ou=example,dc=domain,dc=org)",
 				},
@@ -677,8 +677,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--admin-filter", "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 				},
@@ -691,8 +691,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--username-attribute", "uid",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeUsername: "uid",
 				},
@@ -705,8 +705,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--firstname-attribute", "givenName",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeName: "givenName",
 				},
@@ -719,8 +719,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--surname-attribute", "sn",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeSurname: "sn",
 				},
@@ -733,8 +733,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--email-attribute", "mail",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeMail: "mail",
 				},
@@ -747,8 +747,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--attributes-in-bind",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributesInBind: true,
 				},
@@ -761,8 +761,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--public-ssh-key-attribute", "publickey",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeSSHPublicKey: "publickey",
 				},
@@ -775,8 +775,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--bind-dn", "cn=readonly,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					BindDN: "cn=readonly,dc=domain,dc=org",
 				},
@@ -789,8 +789,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--bind-password", "secret",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					BindPassword: "secret",
 				},
@@ -803,8 +803,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--synchronize-users",
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				IsSyncEnabled: true,
 				Cfg:           &ldap.Source{},
 			},
@@ -816,8 +816,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--page-size", "12",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SearchPageSize: 12,
 				},
@@ -845,8 +845,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type: models.LoginOAuth2,
+			existingLoginSource: &login.Source{
+				Type: login.OAuth2,
 				Cfg:  &ldap.Source{},
 			},
 			errMsg: "Invalid authentication type. expected: LDAP (via BindDN), actual: OAuth2",
@@ -855,28 +855,28 @@ func TestUpdateLdapBindDn(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var updatedLoginSource *models.LoginSource
+		var updatedLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call createLoginSource", n)
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				updatedLoginSource = loginSource
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
 				if c.existingLoginSource != nil {
 					return c.existingLoginSource, nil
 				}
-				return &models.LoginSource{
-					Type: models.LoginLDAP,
+				return &login.Source{
+					Type: login.LDAP,
 					Cfg:  &ldap.Source{},
 				}, nil
 			},
@@ -908,8 +908,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 	var cases = []struct {
 		args                []string
 		id                  int64
-		existingLoginSource *models.LoginSource
-		loginSource         *models.LoginSource
+		existingLoginSource *login.Source
+		loginSource         *login.Source
 		errMsg              string
 	}{
 		// case 0
@@ -935,8 +935,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
 			id: 7,
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source full",
 				IsActive: false,
 				Cfg: &ldap.Source{
@@ -964,8 +964,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg:  &ldap.Source{},
 			},
 		},
@@ -976,8 +976,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--name", "ldap (simple auth) source",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Name: "ldap (simple auth) source",
 				Cfg: &ldap.Source{
 					Name: "ldap (simple auth) source",
@@ -991,13 +991,13 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--not-active",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.DLDAP,
 				IsActive: true,
 				Cfg:      &ldap.Source{},
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				IsActive: false,
 				Cfg:      &ldap.Source{},
 			},
@@ -1009,8 +1009,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "starttls",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					SecurityProtocol: ldap.SecurityProtocol(2),
 				},
@@ -1023,8 +1023,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--skip-tls-verify",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					SkipVerify: true,
 				},
@@ -1037,8 +1037,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--host", "ldap-server",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Host: "ldap-server",
 				},
@@ -1051,8 +1051,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--port", "987",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Port: 987,
 				},
@@ -1065,8 +1065,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-search-base", "ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					UserBase: "ou=Users,dc=domain,dc=org",
 				},
@@ -1079,8 +1079,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-filter", "(&(objectClass=posixAccount)(cn=%s))",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Filter: "(&(objectClass=posixAccount)(cn=%s))",
 				},
@@ -1093,8 +1093,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--admin-filter", "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 				},
@@ -1107,8 +1107,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--username-attribute", "uid",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeUsername: "uid",
 				},
@@ -1121,8 +1121,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--firstname-attribute", "givenName",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeName: "givenName",
 				},
@@ -1135,8 +1135,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--surname-attribute", "sn",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeSurname: "sn",
 				},
@@ -1149,8 +1149,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--email-attribute", "mail",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 
 					AttributeMail: "mail",
@@ -1164,8 +1164,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--public-ssh-key-attribute", "publickey",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeSSHPublicKey: "publickey",
 				},
@@ -1178,8 +1178,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-dn", "cn=%s,ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					UserDN: "cn=%s,ou=Users,dc=domain,dc=org",
 				},
@@ -1207,8 +1207,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type: models.LoginPAM,
+			existingLoginSource: &login.Source{
+				Type: login.PAM,
 				Cfg:  &ldap.Source{},
 			},
 			errMsg: "Invalid authentication type. expected: LDAP (simple auth), actual: PAM",
@@ -1217,28 +1217,28 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var updatedLoginSource *models.LoginSource
+		var updatedLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call createLoginSource", n)
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				updatedLoginSource = loginSource
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
 				if c.existingLoginSource != nil {
 					return c.existingLoginSource, nil
 				}
-				return &models.LoginSource{
-					Type: models.LoginDLDAP,
+				return &login.Source{
+					Type: login.DLDAP,
 					Cfg:  &ldap.Source{},
 				}, nil
 			},