From 5842a55b3103d3f09751eb7b3b049415197debad Mon Sep 17 00:00:00 2001
From: Lunny Xiao <xiaolunwen@gmail.com>
Date: Fri, 24 Sep 2021 19:32:56 +0800
Subject: [PATCH] Move login related structs and functions to models/login
 (#17093)

* Move login related structs and functions to models/login

* Fix test

* Fix lint

* Fix lint

* Fix lint of windows

* Fix lint

* Fix test

* Fix test

* Only load necessary fixtures when preparing unit tests envs

* Fix lint

* Fix test

* Fix test

* Fix error log

* Fix error log

* Fix error log

* remove unnecessary change

* fix error log

* merge main branch
---
 .golangci.yml                                 |   1 -
 cmd/admin.go                                  |  21 +-
 cmd/admin_auth_ldap.go                        |  32 +--
 cmd/admin_auth_ldap_test.go                   | 242 ++++++++--------
 contrib/fixtures/fixture_generation.go        |   4 +-
 contrib/pr/checkout.go                        |   4 +-
 integrations/api_oauth2_apps_test.go          |  27 +-
 integrations/integration_test.go              |   4 +-
 models/access.go                              |   2 +-
 models/commit_status.go                       |  14 +-
 models/commit_status_test.go                  |   2 +-
 models/{ => db}/list_options.go               |  22 +-
 models/{ => db}/list_options_test.go          |   2 +-
 models/db/test_fixtures.go                    |   9 +-
 models/db/unit_tests.go                       |  24 +-
 models/error.go                               |  91 ------
 models/external_login_user.go                 |   3 +-
 models/gpg_key.go                             |   6 +-
 models/gpg_key_commit_verification.go         |   3 +-
 models/issue.go                               |   2 +-
 models/issue_comment.go                       |   4 +-
 models/issue_label.go                         |  12 +-
 models/issue_label_test.go                    |   8 +-
 models/issue_milestone.go                     |   4 +-
 models/issue_milestone_test.go                |   4 +-
 models/issue_reaction.go                      |   6 +-
 models/issue_stopwatch.go                     |   4 +-
 models/issue_test.go                          |   6 +-
 models/issue_tracked_time.go                  |   4 +-
 models/issue_watch.go                         |   6 +-
 models/issue_watch_test.go                    |   8 +-
 models/login/main_test.go                     |  21 ++
 models/login/oauth2.go                        |  70 +++++
 models/{ => login}/oauth2_application.go      |  31 +--
 models/{ => login}/oauth2_application_test.go |  10 +-
 models/{login_source.go => login/source.go}   | 263 ++++++++++--------
 .../source_test.go}                           |  10 +-
 models/migrations/migrations_test.go          |   5 +-
 models/notification.go                        |   4 +-
 models/oauth2.go                              |  27 --
 models/org.go                                 |   6 +-
 models/org_team.go                            |   8 +-
 models/org_test.go                            |   4 +-
 models/pull_list.go                           |   4 +-
 models/pull_sign.go                           |   3 +-
 models/pull_test.go                           |   4 +-
 models/release.go                             |   4 +-
 models/repo.go                                |   6 +-
 models/repo_collaboration.go                  |   8 +-
 models/repo_collaboration_test.go             |   2 +-
 models/repo_generate.go                       |   2 +-
 models/repo_list.go                           |   2 +-
 models/repo_list_test.go                      |  68 ++---
 models/repo_sign.go                           |   7 +-
 models/repo_transfer.go                       |   2 +-
 models/repo_unit.go                           |   3 +-
 models/repo_watch.go                          |   4 +-
 models/repo_watch_test.go                     |  20 +-
 models/review.go                              |   4 +-
 models/ssh_key.go                             |  27 +-
 models/ssh_key_deploy.go                      |   4 +-
 models/ssh_key_principals.go                  |   4 +-
 models/star.go                                |   4 +-
 models/star_test.go                           |   4 +-
 models/statistic.go                           |   7 +-
 models/token.go                               |   4 +-
 models/topic.go                               |   4 +-
 models/topic_test.go                          |   2 +-
 models/user.go                                |  35 +--
 models/user_mail.go                           |   4 +-
 models/user_mail_test.go                      |   4 +-
 models/user_test.go                           |  31 ++-
 models/webhook.go                             |   4 +-
 modules/convert/convert.go                    |   5 +-
 modules/gitgraph/graph_models.go              |   3 +-
 modules/indexer/issues/indexer.go             |   3 +-
 modules/migrations/gitea_uploader_test.go     |   6 +-
 modules/repository/adopt.go                   |  35 ++-
 modules/repository/repo.go                    |   6 +-
 routers/api/v1/admin/user.go                  |   9 +-
 routers/api/v1/repo/issue.go                  |   7 +-
 routers/api/v1/user/app.go                    |  17 +-
 routers/api/v1/user/gpg_key.go                |   3 +-
 routers/api/v1/user/star.go                   |   3 +-
 routers/api/v1/user/watch.go                  |   3 +-
 routers/api/v1/utils/utils.go                 |   6 +-
 routers/web/admin/auths.go                    |  82 +++---
 routers/web/admin/emails.go                   |   3 +-
 routers/web/admin/orgs.go                     |   3 +-
 routers/web/admin/repos.go                    |   3 +-
 routers/web/admin/users.go                    |  30 +-
 routers/web/events/events.go                  |   3 +-
 routers/web/explore/org.go                    |   3 +-
 routers/web/explore/repo.go                   |   3 +-
 routers/web/explore/user.go                   |   3 +-
 routers/web/org/home.go                       |   5 +-
 routers/web/org/org_labels.go                 |   2 +-
 routers/web/org/setting.go                    |   3 +-
 routers/web/repo/commit.go                    |   3 +-
 routers/web/repo/issue.go                     |  19 +-
 routers/web/repo/issue_label.go               |   4 +-
 routers/web/repo/milestone.go                 |   3 +-
 routers/web/repo/pull.go                      |   7 +-
 routers/web/repo/release.go                   |   3 +-
 routers/web/repo/setting.go                   |   3 +-
 routers/web/repo/view.go                      |   9 +-
 routers/web/user/auth.go                      |  21 +-
 routers/web/user/home.go                      |   5 +-
 routers/web/user/oauth.go                     |  29 +-
 routers/web/user/oauth_test.go                |   7 +-
 routers/web/user/profile.go                   |  11 +-
 routers/web/user/setting/applications.go      |   5 +-
 routers/web/user/setting/keys.go              |   7 +-
 routers/web/user/setting/oauth2.go            |  18 +-
 routers/web/user/setting/profile.go           |   5 +-
 routers/web/user/setting/security.go          |   5 +-
 services/auth/login_source.go                 |  41 +++
 services/auth/oauth2.go                       |   5 +-
 services/auth/signin.go                       |   7 +-
 .../auth/source/db/assert_interface_test.go   |   4 +-
 services/auth/source/db/source.go             |   9 +-
 .../auth/source/ldap/assert_interface_test.go |  14 +-
 services/auth/source/ldap/source.go           |   9 +-
 .../auth/source/ldap/source_authenticate.go   |  11 +-
 .../source/oauth2/assert_interface_test.go    |   8 +-
 services/auth/source/oauth2/init.go           |   4 +-
 services/auth/source/oauth2/providers.go      |   3 +-
 services/auth/source/oauth2/source.go         |   7 +-
 .../auth/source/pam/assert_interface_test.go  |   6 +-
 services/auth/source/pam/source.go            |   7 +-
 .../auth/source/pam/source_authenticate.go    |  11 +-
 .../auth/source/smtp/assert_interface_test.go |  12 +-
 services/auth/source/smtp/source.go           |   7 +-
 .../auth/source/smtp/source_authenticate.go   |  33 +--
 .../auth/source/sspi/assert_interface_test.go |   4 +-
 services/auth/source/sspi/source.go           |   3 +-
 services/auth/sspi_windows.go                 |   5 +-
 services/auth/sync.go                         |   3 +-
 services/externalaccount/user.go              |   3 +-
 services/pull/commit_status.go                |   3 +-
 services/pull/pull.go                         |   2 +-
 services/pull/review.go                       |   2 +-
 142 files changed, 1050 insertions(+), 907 deletions(-)
 rename models/{ => db}/list_options.go (78%)
 rename models/{ => db}/list_options_test.go (98%)
 create mode 100644 models/login/main_test.go
 create mode 100644 models/login/oauth2.go
 rename models/{ => login}/oauth2_application.go (96%)
 rename models/{ => login}/oauth2_application_test.go (96%)
 rename models/{login_source.go => login/source.go} (55%)
 rename models/{login_source_test.go => login/source_test.go} (86%)
 delete mode 100644 models/oauth2.go
 create mode 100644 services/auth/login_source.go

diff --git a/.golangci.yml b/.golangci.yml
index c3dd47ec29..2d66e01ffa 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -111,4 +111,3 @@ issues:
       linters:
         - staticcheck
       text: "svc.IsAnInteractiveSession is deprecated: Use IsWindowsService instead."
-
diff --git a/cmd/admin.go b/cmd/admin.go
index cfc297c474..099083ae91 100644
--- a/cmd/admin.go
+++ b/cmd/admin.go
@@ -14,6 +14,8 @@ import (
 	"text/tabwriter"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
@@ -21,6 +23,7 @@ import (
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/storage"
+	auth_service "code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 
 	"github.com/urfave/cli"
@@ -529,7 +532,7 @@ func runRepoSyncReleases(_ *cli.Context) error {
 	log.Trace("Synchronizing repository releases (this may take a while)")
 	for page := 1; ; page++ {
 		repos, count, err := models.SearchRepositoryByName(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				PageSize: models.RepositoryListDefaultPageSize,
 				Page:     page,
 			},
@@ -629,8 +632,8 @@ func runAddOauth(c *cli.Context) error {
 		return err
 	}
 
-	return models.CreateLoginSource(&models.LoginSource{
-		Type:     models.LoginOAuth2,
+	return login.CreateSource(&login.Source{
+		Type:     login.OAuth2,
 		Name:     c.String("name"),
 		IsActive: true,
 		Cfg:      parseOAuth2Config(c),
@@ -646,7 +649,7 @@ func runUpdateOauth(c *cli.Context) error {
 		return err
 	}
 
-	source, err := models.GetLoginSourceByID(c.Int64("id"))
+	source, err := login.GetSourceByID(c.Int64("id"))
 	if err != nil {
 		return err
 	}
@@ -705,7 +708,7 @@ func runUpdateOauth(c *cli.Context) error {
 	oAuth2Config.CustomURLMapping = customURLMapping
 	source.Cfg = oAuth2Config
 
-	return models.UpdateSource(source)
+	return login.UpdateSource(source)
 }
 
 func runListAuth(c *cli.Context) error {
@@ -713,7 +716,7 @@ func runListAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSources, err := models.LoginSources()
+	loginSources, err := login.Sources()
 
 	if err != nil {
 		return err
@@ -733,7 +736,7 @@ func runListAuth(c *cli.Context) error {
 	w := tabwriter.NewWriter(os.Stdout, c.Int("min-width"), c.Int("tab-width"), c.Int("padding"), padChar, flags)
 	fmt.Fprintf(w, "ID\tName\tType\tEnabled\n")
 	for _, source := range loginSources {
-		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, models.LoginNames[source.Type], source.IsActive)
+		fmt.Fprintf(w, "%d\t%s\t%s\t%t\n", source.ID, source.Name, source.Type.String(), source.IsActive)
 	}
 	w.Flush()
 
@@ -749,10 +752,10 @@ func runDeleteAuth(c *cli.Context) error {
 		return err
 	}
 
-	source, err := models.GetLoginSourceByID(c.Int64("id"))
+	source, err := login.GetSourceByID(c.Int64("id"))
 	if err != nil {
 		return err
 	}
 
-	return models.DeleteSource(source)
+	return auth_service.DeleteLoginSource(source)
 }
diff --git a/cmd/admin_auth_ldap.go b/cmd/admin_auth_ldap.go
index feeaf17661..e95e1d15c6 100644
--- a/cmd/admin_auth_ldap.go
+++ b/cmd/admin_auth_ldap.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"strings"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/urfave/cli"
@@ -17,9 +17,9 @@ import (
 type (
 	authService struct {
 		initDB             func() error
-		createLoginSource  func(loginSource *models.LoginSource) error
-		updateLoginSource  func(loginSource *models.LoginSource) error
-		getLoginSourceByID func(id int64) (*models.LoginSource, error)
+		createLoginSource  func(loginSource *login.Source) error
+		updateLoginSource  func(loginSource *login.Source) error
+		getLoginSourceByID func(id int64) (*login.Source, error)
 	}
 )
 
@@ -164,14 +164,14 @@ var (
 func newAuthService() *authService {
 	return &authService{
 		initDB:             initDB,
-		createLoginSource:  models.CreateLoginSource,
-		updateLoginSource:  models.UpdateSource,
-		getLoginSourceByID: models.GetLoginSourceByID,
+		createLoginSource:  login.CreateSource,
+		updateLoginSource:  login.UpdateSource,
+		getLoginSourceByID: login.GetSourceByID,
 	}
 }
 
 // parseLoginSource assigns values on loginSource according to command line flags.
-func parseLoginSource(c *cli.Context, loginSource *models.LoginSource) {
+func parseLoginSource(c *cli.Context, loginSource *login.Source) {
 	if c.IsSet("name") {
 		loginSource.Name = c.String("name")
 	}
@@ -269,7 +269,7 @@ func findLdapSecurityProtocolByName(name string) (ldap.SecurityProtocol, bool) {
 
 // getLoginSource gets the login source by its id defined in the command line flags.
 // It returns an error if the id is not set, does not match any source or if the source is not of expected type.
-func (a *authService) getLoginSource(c *cli.Context, loginType models.LoginType) (*models.LoginSource, error) {
+func (a *authService) getLoginSource(c *cli.Context, loginType login.Type) (*login.Source, error) {
 	if err := argsSet(c, "id"); err != nil {
 		return nil, err
 	}
@@ -280,7 +280,7 @@ func (a *authService) getLoginSource(c *cli.Context, loginType models.LoginType)
 	}
 
 	if loginSource.Type != loginType {
-		return nil, fmt.Errorf("Invalid authentication type. expected: %s, actual: %s", models.LoginNames[loginType], models.LoginNames[loginSource.Type])
+		return nil, fmt.Errorf("Invalid authentication type. expected: %s, actual: %s", loginType.String(), loginSource.Type.String())
 	}
 
 	return loginSource, nil
@@ -296,8 +296,8 @@ func (a *authService) addLdapBindDn(c *cli.Context) error {
 		return err
 	}
 
-	loginSource := &models.LoginSource{
-		Type:     models.LoginLDAP,
+	loginSource := &login.Source{
+		Type:     login.LDAP,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -318,7 +318,7 @@ func (a *authService) updateLdapBindDn(c *cli.Context) error {
 		return err
 	}
 
-	loginSource, err := a.getLoginSource(c, models.LoginLDAP)
+	loginSource, err := a.getLoginSource(c, login.LDAP)
 	if err != nil {
 		return err
 	}
@@ -341,8 +341,8 @@ func (a *authService) addLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSource := &models.LoginSource{
-		Type:     models.LoginDLDAP,
+	loginSource := &login.Source{
+		Type:     login.DLDAP,
 		IsActive: true, // active by default
 		Cfg: &ldap.Source{
 			Enabled: true, // always true
@@ -363,7 +363,7 @@ func (a *authService) updateLdapSimpleAuth(c *cli.Context) error {
 		return err
 	}
 
-	loginSource, err := a.getLoginSource(c, models.LoginDLDAP)
+	loginSource, err := a.getLoginSource(c, login.DLDAP)
 	if err != nil {
 		return err
 	}
diff --git a/cmd/admin_auth_ldap_test.go b/cmd/admin_auth_ldap_test.go
index 692b11e3f4..c26cbdaf39 100644
--- a/cmd/admin_auth_ldap_test.go
+++ b/cmd/admin_auth_ldap_test.go
@@ -7,7 +7,7 @@ package cmd
 import (
 	"testing"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 
 	"github.com/stretchr/testify/assert"
@@ -23,7 +23,7 @@ func TestAddLdapBindDn(t *testing.T) {
 	// Test cases
 	var cases = []struct {
 		args        []string
-		loginSource *models.LoginSource
+		loginSource *login.Source
 		errMsg      string
 	}{
 		// case 0
@@ -51,8 +51,8 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--synchronize-users",
 				"--page-size", "99",
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				Name:          "ldap (via Bind DN) source full",
 				IsActive:      false,
 				IsSyncEnabled: true,
@@ -91,8 +91,8 @@ func TestAddLdapBindDn(t *testing.T) {
 				"--user-filter", "(memberOf=cn=user-group,ou=example,dc=min-domain-bind,dc=org)",
 				"--email-attribute", "mail-bind min",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:     login.LDAP,
 				Name:     "ldap (via Bind DN) source min",
 				IsActive: true,
 				Cfg: &ldap.Source{
@@ -203,20 +203,20 @@ func TestAddLdapBindDn(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var createdLoginSource *models.LoginSource
+		var createdLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				createdLoginSource = loginSource
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call updateLoginSource", n)
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				assert.FailNow(t, "case %d: should not call getLoginSourceByID", n)
 				return nil, nil
 			},
@@ -247,7 +247,7 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 	// Test cases
 	var cases = []struct {
 		args        []string
-		loginSource *models.LoginSource
+		loginSource *login.Source
 		errMsg      string
 	}{
 		// case 0
@@ -271,8 +271,8 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--public-ssh-key-attribute", "publickey-simple full",
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source full",
 				IsActive: false,
 				Cfg: &ldap.Source{
@@ -307,8 +307,8 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 				"--email-attribute", "mail-simple min",
 				"--user-dn", "cn=%s,ou=Users,dc=min-domain-simple,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source min",
 				IsActive: true,
 				Cfg: &ldap.Source{
@@ -432,20 +432,20 @@ func TestAddLdapSimpleAuth(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var createdLoginSource *models.LoginSource
+		var createdLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				createdLoginSource = loginSource
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call updateLoginSource", n)
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				assert.FailNow(t, "case %d: should not call getLoginSourceByID", n)
 				return nil, nil
 			},
@@ -477,8 +477,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 	var cases = []struct {
 		args                []string
 		id                  int64
-		existingLoginSource *models.LoginSource
-		loginSource         *models.LoginSource
+		existingLoginSource *login.Source
+		loginSource         *login.Source
 		errMsg              string
 	}{
 		// case 0
@@ -507,15 +507,15 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--page-size", "99",
 			},
 			id: 23,
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: true,
 				Cfg: &ldap.Source{
 					Enabled: true,
 				},
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				Name:          "ldap (via Bind DN) source full",
 				IsActive:      false,
 				IsSyncEnabled: true,
@@ -548,8 +548,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg:  &ldap.Source{},
 			},
 		},
@@ -560,8 +560,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--name", "ldap (via Bind DN) source",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Name: "ldap (via Bind DN) source",
 				Cfg: &ldap.Source{
 					Name: "ldap (via Bind DN) source",
@@ -575,13 +575,13 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--not-active",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: true,
 				Cfg:      &ldap.Source{},
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:     login.LDAP,
 				IsActive: false,
 				Cfg:      &ldap.Source{},
 			},
@@ -593,8 +593,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "LDAPS",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SecurityProtocol: ldap.SecurityProtocol(1),
 				},
@@ -607,8 +607,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--skip-tls-verify",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SkipVerify: true,
 				},
@@ -621,8 +621,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--host", "ldap-server",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Host: "ldap-server",
 				},
@@ -635,8 +635,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--port", "389",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Port: 389,
 				},
@@ -649,8 +649,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--user-search-base", "ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					UserBase: "ou=Users,dc=domain,dc=org",
 				},
@@ -663,8 +663,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--user-filter", "(memberOf=cn=user-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					Filter: "(memberOf=cn=user-group,ou=example,dc=domain,dc=org)",
 				},
@@ -677,8 +677,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--admin-filter", "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 				},
@@ -691,8 +691,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--username-attribute", "uid",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeUsername: "uid",
 				},
@@ -705,8 +705,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--firstname-attribute", "givenName",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeName: "givenName",
 				},
@@ -719,8 +719,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--surname-attribute", "sn",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeSurname: "sn",
 				},
@@ -733,8 +733,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--email-attribute", "mail",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeMail: "mail",
 				},
@@ -747,8 +747,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--attributes-in-bind",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributesInBind: true,
 				},
@@ -761,8 +761,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--public-ssh-key-attribute", "publickey",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					AttributeSSHPublicKey: "publickey",
 				},
@@ -775,8 +775,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--bind-dn", "cn=readonly,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					BindDN: "cn=readonly,dc=domain,dc=org",
 				},
@@ -789,8 +789,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--bind-password", "secret",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					BindPassword: "secret",
 				},
@@ -803,8 +803,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--synchronize-users",
 			},
-			loginSource: &models.LoginSource{
-				Type:          models.LoginLDAP,
+			loginSource: &login.Source{
+				Type:          login.LDAP,
 				IsSyncEnabled: true,
 				Cfg:           &ldap.Source{},
 			},
@@ -816,8 +816,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"--id", "1",
 				"--page-size", "12",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginLDAP,
+			loginSource: &login.Source{
+				Type: login.LDAP,
 				Cfg: &ldap.Source{
 					SearchPageSize: 12,
 				},
@@ -845,8 +845,8 @@ func TestUpdateLdapBindDn(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type: models.LoginOAuth2,
+			existingLoginSource: &login.Source{
+				Type: login.OAuth2,
 				Cfg:  &ldap.Source{},
 			},
 			errMsg: "Invalid authentication type. expected: LDAP (via BindDN), actual: OAuth2",
@@ -855,28 +855,28 @@ func TestUpdateLdapBindDn(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var updatedLoginSource *models.LoginSource
+		var updatedLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call createLoginSource", n)
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				updatedLoginSource = loginSource
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
 				if c.existingLoginSource != nil {
 					return c.existingLoginSource, nil
 				}
-				return &models.LoginSource{
-					Type: models.LoginLDAP,
+				return &login.Source{
+					Type: login.LDAP,
 					Cfg:  &ldap.Source{},
 				}, nil
 			},
@@ -908,8 +908,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 	var cases = []struct {
 		args                []string
 		id                  int64
-		existingLoginSource *models.LoginSource
-		loginSource         *models.LoginSource
+		existingLoginSource *login.Source
+		loginSource         *login.Source
 		errMsg              string
 	}{
 		// case 0
@@ -935,8 +935,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--user-dn", "cn=%s,ou=Users,dc=full-domain-simple,dc=org",
 			},
 			id: 7,
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				Name:     "ldap (simple auth) source full",
 				IsActive: false,
 				Cfg: &ldap.Source{
@@ -964,8 +964,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg:  &ldap.Source{},
 			},
 		},
@@ -976,8 +976,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--name", "ldap (simple auth) source",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Name: "ldap (simple auth) source",
 				Cfg: &ldap.Source{
 					Name: "ldap (simple auth) source",
@@ -991,13 +991,13 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--not-active",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			existingLoginSource: &login.Source{
+				Type:     login.DLDAP,
 				IsActive: true,
 				Cfg:      &ldap.Source{},
 			},
-			loginSource: &models.LoginSource{
-				Type:     models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type:     login.DLDAP,
 				IsActive: false,
 				Cfg:      &ldap.Source{},
 			},
@@ -1009,8 +1009,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--security-protocol", "starttls",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					SecurityProtocol: ldap.SecurityProtocol(2),
 				},
@@ -1023,8 +1023,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--skip-tls-verify",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					SkipVerify: true,
 				},
@@ -1037,8 +1037,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--host", "ldap-server",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Host: "ldap-server",
 				},
@@ -1051,8 +1051,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--port", "987",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Port: 987,
 				},
@@ -1065,8 +1065,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-search-base", "ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					UserBase: "ou=Users,dc=domain,dc=org",
 				},
@@ -1079,8 +1079,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-filter", "(&(objectClass=posixAccount)(cn=%s))",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					Filter: "(&(objectClass=posixAccount)(cn=%s))",
 				},
@@ -1093,8 +1093,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--admin-filter", "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AdminFilter: "(memberOf=cn=admin-group,ou=example,dc=domain,dc=org)",
 				},
@@ -1107,8 +1107,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--username-attribute", "uid",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeUsername: "uid",
 				},
@@ -1121,8 +1121,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--firstname-attribute", "givenName",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeName: "givenName",
 				},
@@ -1135,8 +1135,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--surname-attribute", "sn",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeSurname: "sn",
 				},
@@ -1149,8 +1149,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--email-attribute", "mail",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 
 					AttributeMail: "mail",
@@ -1164,8 +1164,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--public-ssh-key-attribute", "publickey",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					AttributeSSHPublicKey: "publickey",
 				},
@@ -1178,8 +1178,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"--id", "1",
 				"--user-dn", "cn=%s,ou=Users,dc=domain,dc=org",
 			},
-			loginSource: &models.LoginSource{
-				Type: models.LoginDLDAP,
+			loginSource: &login.Source{
+				Type: login.DLDAP,
 				Cfg: &ldap.Source{
 					UserDN: "cn=%s,ou=Users,dc=domain,dc=org",
 				},
@@ -1207,8 +1207,8 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 				"ldap-test",
 				"--id", "1",
 			},
-			existingLoginSource: &models.LoginSource{
-				Type: models.LoginPAM,
+			existingLoginSource: &login.Source{
+				Type: login.PAM,
 				Cfg:  &ldap.Source{},
 			},
 			errMsg: "Invalid authentication type. expected: LDAP (simple auth), actual: PAM",
@@ -1217,28 +1217,28 @@ func TestUpdateLdapSimpleAuth(t *testing.T) {
 
 	for n, c := range cases {
 		// Mock functions.
-		var updatedLoginSource *models.LoginSource
+		var updatedLoginSource *login.Source
 		service := &authService{
 			initDB: func() error {
 				return nil
 			},
-			createLoginSource: func(loginSource *models.LoginSource) error {
+			createLoginSource: func(loginSource *login.Source) error {
 				assert.FailNow(t, "case %d: should not call createLoginSource", n)
 				return nil
 			},
-			updateLoginSource: func(loginSource *models.LoginSource) error {
+			updateLoginSource: func(loginSource *login.Source) error {
 				updatedLoginSource = loginSource
 				return nil
 			},
-			getLoginSourceByID: func(id int64) (*models.LoginSource, error) {
+			getLoginSourceByID: func(id int64) (*login.Source, error) {
 				if c.id != 0 {
 					assert.Equal(t, c.id, id, "case %d: wrong id", n)
 				}
 				if c.existingLoginSource != nil {
 					return c.existingLoginSource, nil
 				}
-				return &models.LoginSource{
-					Type: models.LoginDLDAP,
+				return &login.Source{
+					Type: login.DLDAP,
 					Cfg:  &ldap.Source{},
 				}, nil
 			},
diff --git a/contrib/fixtures/fixture_generation.go b/contrib/fixtures/fixture_generation.go
index 5408a005c6..5e7dd39a78 100644
--- a/contrib/fixtures/fixture_generation.go
+++ b/contrib/fixtures/fixture_generation.go
@@ -31,7 +31,9 @@ var (
 func main() {
 	pathToGiteaRoot := "."
 	fixturesDir = filepath.Join(pathToGiteaRoot, "models", "fixtures")
-	if err := db.CreateTestEngine(fixturesDir); err != nil {
+	if err := db.CreateTestEngine(db.FixturesOptions{
+		Dir: fixturesDir,
+	}); err != nil {
 		fmt.Printf("CreateTestEngine: %+v", err)
 		os.Exit(1)
 	}
diff --git a/contrib/pr/checkout.go b/contrib/pr/checkout.go
index cba6d4d372..d831ebdabd 100644
--- a/contrib/pr/checkout.go
+++ b/contrib/pr/checkout.go
@@ -101,7 +101,9 @@ func runPR() {
 	db.HasEngine = true
 	//x.ShowSQL(true)
 	err = db.InitFixtures(
-		path.Join(curDir, "models/fixtures/"),
+		db.FixturesOptions{
+			Dir: path.Join(curDir, "models/fixtures/"),
+		},
 	)
 	if err != nil {
 		fmt.Printf("Error initializing test database: %v\n", err)
diff --git a/integrations/api_oauth2_apps_test.go b/integrations/api_oauth2_apps_test.go
index 4cda41755a..6f0a46249f 100644
--- a/integrations/api_oauth2_apps_test.go
+++ b/integrations/api_oauth2_apps_test.go
@@ -11,6 +11,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	api "code.gitea.io/gitea/modules/structs"
 
 	"github.com/stretchr/testify/assert"
@@ -46,7 +47,7 @@ func testAPICreateOAuth2Application(t *testing.T) {
 	assert.Len(t, createdApp.ClientID, 36)
 	assert.NotEmpty(t, createdApp.Created)
 	assert.EqualValues(t, appBody.RedirectURIs[0], createdApp.RedirectURIs[0])
-	db.AssertExistsAndLoadBean(t, &models.OAuth2Application{UID: user.ID, Name: createdApp.Name})
+	db.AssertExistsAndLoadBean(t, &login.OAuth2Application{UID: user.ID, Name: createdApp.Name})
 }
 
 func testAPIListOAuth2Applications(t *testing.T) {
@@ -54,13 +55,13 @@ func testAPIListOAuth2Applications(t *testing.T) {
 	session := loginUser(t, user.Name)
 	token := getTokenForLoggedInUser(t, session)
 
-	existApp := db.AssertExistsAndLoadBean(t, &models.OAuth2Application{
+	existApp := db.AssertExistsAndLoadBean(t, &login.OAuth2Application{
 		UID:  user.ID,
 		Name: "test-app-1",
 		RedirectURIs: []string{
 			"http://www.google.com",
 		},
-	}).(*models.OAuth2Application)
+	}).(*login.OAuth2Application)
 
 	urlStr := fmt.Sprintf("/api/v1/user/applications/oauth2?token=%s", token)
 	req := NewRequest(t, "GET", urlStr)
@@ -75,7 +76,7 @@ func testAPIListOAuth2Applications(t *testing.T) {
 	assert.Len(t, expectedApp.ClientID, 36)
 	assert.Empty(t, expectedApp.ClientSecret)
 	assert.EqualValues(t, existApp.RedirectURIs[0], expectedApp.RedirectURIs[0])
-	db.AssertExistsAndLoadBean(t, &models.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
+	db.AssertExistsAndLoadBean(t, &login.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
 }
 
 func testAPIDeleteOAuth2Application(t *testing.T) {
@@ -83,16 +84,16 @@ func testAPIDeleteOAuth2Application(t *testing.T) {
 	session := loginUser(t, user.Name)
 	token := getTokenForLoggedInUser(t, session)
 
-	oldApp := db.AssertExistsAndLoadBean(t, &models.OAuth2Application{
+	oldApp := db.AssertExistsAndLoadBean(t, &login.OAuth2Application{
 		UID:  user.ID,
 		Name: "test-app-1",
-	}).(*models.OAuth2Application)
+	}).(*login.OAuth2Application)
 
 	urlStr := fmt.Sprintf("/api/v1/user/applications/oauth2/%d?token=%s", oldApp.ID, token)
 	req := NewRequest(t, "DELETE", urlStr)
 	session.MakeRequest(t, req, http.StatusNoContent)
 
-	db.AssertNotExistsBean(t, &models.OAuth2Application{UID: oldApp.UID, Name: oldApp.Name})
+	db.AssertNotExistsBean(t, &login.OAuth2Application{UID: oldApp.UID, Name: oldApp.Name})
 
 	// Delete again will return not found
 	req = NewRequest(t, "DELETE", urlStr)
@@ -104,13 +105,13 @@ func testAPIGetOAuth2Application(t *testing.T) {
 	session := loginUser(t, user.Name)
 	token := getTokenForLoggedInUser(t, session)
 
-	existApp := db.AssertExistsAndLoadBean(t, &models.OAuth2Application{
+	existApp := db.AssertExistsAndLoadBean(t, &login.OAuth2Application{
 		UID:  user.ID,
 		Name: "test-app-1",
 		RedirectURIs: []string{
 			"http://www.google.com",
 		},
-	}).(*models.OAuth2Application)
+	}).(*login.OAuth2Application)
 
 	urlStr := fmt.Sprintf("/api/v1/user/applications/oauth2/%d?token=%s", existApp.ID, token)
 	req := NewRequest(t, "GET", urlStr)
@@ -126,19 +127,19 @@ func testAPIGetOAuth2Application(t *testing.T) {
 	assert.Empty(t, expectedApp.ClientSecret)
 	assert.Len(t, expectedApp.RedirectURIs, 1)
 	assert.EqualValues(t, existApp.RedirectURIs[0], expectedApp.RedirectURIs[0])
-	db.AssertExistsAndLoadBean(t, &models.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
+	db.AssertExistsAndLoadBean(t, &login.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
 }
 
 func testAPIUpdateOAuth2Application(t *testing.T) {
 	user := db.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User)
 
-	existApp := db.AssertExistsAndLoadBean(t, &models.OAuth2Application{
+	existApp := db.AssertExistsAndLoadBean(t, &login.OAuth2Application{
 		UID:  user.ID,
 		Name: "test-app-1",
 		RedirectURIs: []string{
 			"http://www.google.com",
 		},
-	}).(*models.OAuth2Application)
+	}).(*login.OAuth2Application)
 
 	appBody := api.CreateOAuth2ApplicationOptions{
 		Name: "test-app-1",
@@ -160,5 +161,5 @@ func testAPIUpdateOAuth2Application(t *testing.T) {
 	assert.Len(t, expectedApp.RedirectURIs, 2)
 	assert.EqualValues(t, expectedApp.RedirectURIs[0], appBody.RedirectURIs[0])
 	assert.EqualValues(t, expectedApp.RedirectURIs[1], appBody.RedirectURIs[1])
-	db.AssertExistsAndLoadBean(t, &models.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
+	db.AssertExistsAndLoadBean(t, &login.OAuth2Application{ID: expectedApp.ID, Name: expectedApp.Name})
 }
diff --git a/integrations/integration_test.go b/integrations/integration_test.go
index fac36320cf..1429893270 100644
--- a/integrations/integration_test.go
+++ b/integrations/integration_test.go
@@ -113,7 +113,9 @@ func TestMain(m *testing.M) {
 	}
 
 	err := db.InitFixtures(
-		path.Join(filepath.Dir(setting.AppPath), "models/fixtures/"),
+		db.FixturesOptions{
+			Dir: filepath.Join(filepath.Dir(setting.AppPath), "models/fixtures/"),
+		},
 	)
 	if err != nil {
 		fmt.Printf("Error initializing test database: %v\n", err)
diff --git a/models/access.go b/models/access.go
index 88fbe8189f..560234aae8 100644
--- a/models/access.go
+++ b/models/access.go
@@ -225,7 +225,7 @@ func (repo *Repository) refreshAccesses(e db.Engine, accessMap map[int64]*userAc
 
 // refreshCollaboratorAccesses retrieves repository collaborations with their access modes.
 func (repo *Repository) refreshCollaboratorAccesses(e db.Engine, accessMap map[int64]*userAccess) error {
-	collaborators, err := repo.getCollaborators(e, ListOptions{})
+	collaborators, err := repo.getCollaborators(e, db.ListOptions{})
 	if err != nil {
 		return fmt.Errorf("getCollaborations: %v", err)
 	}
diff --git a/models/commit_status.go b/models/commit_status.go
index ada94667cc..a6ded049c3 100644
--- a/models/commit_status.go
+++ b/models/commit_status.go
@@ -163,7 +163,7 @@ func CalcCommitStatus(statuses []*CommitStatus) *CommitStatus {
 
 // CommitStatusOptions holds the options for query commit statuses
 type CommitStatusOptions struct {
-	ListOptions
+	db.ListOptions
 	State    string
 	SortType string
 }
@@ -178,7 +178,7 @@ func GetCommitStatuses(repo *Repository, sha string, opts *CommitStatusOptions)
 	}
 
 	countSession := listCommitStatusesStatement(repo, sha, opts)
-	countSession = setSessionPagination(countSession, opts)
+	countSession = db.SetSessionPagination(countSession, opts)
 	maxResults, err := countSession.Count(new(CommitStatus))
 	if err != nil {
 		log.Error("Count PRs: %v", err)
@@ -187,7 +187,7 @@ func GetCommitStatuses(repo *Repository, sha string, opts *CommitStatusOptions)
 
 	statuses := make([]*CommitStatus, 0, opts.PageSize)
 	findSession := listCommitStatusesStatement(repo, sha, opts)
-	findSession = setSessionPagination(findSession, opts)
+	findSession = db.SetSessionPagination(findSession, opts)
 	sortCommitStatusesSession(findSession, opts.SortType)
 	return statuses, maxResults, findSession.Find(&statuses)
 }
@@ -227,18 +227,18 @@ type CommitStatusIndex struct {
 }
 
 // GetLatestCommitStatus returns all statuses with a unique context for a given commit.
-func GetLatestCommitStatus(repoID int64, sha string, listOptions ListOptions) ([]*CommitStatus, error) {
+func GetLatestCommitStatus(repoID int64, sha string, listOptions db.ListOptions) ([]*CommitStatus, error) {
 	return getLatestCommitStatus(db.GetEngine(db.DefaultContext), repoID, sha, listOptions)
 }
 
-func getLatestCommitStatus(e db.Engine, repoID int64, sha string, listOptions ListOptions) ([]*CommitStatus, error) {
+func getLatestCommitStatus(e db.Engine, repoID int64, sha string, listOptions db.ListOptions) ([]*CommitStatus, error) {
 	ids := make([]int64, 0, 10)
 	sess := e.Table(&CommitStatus{}).
 		Where("repo_id = ?", repoID).And("sha = ?", sha).
 		Select("max( id ) as id").
 		GroupBy("context_hash").OrderBy("max( id ) desc")
 
-	sess = setSessionPagination(sess, &listOptions)
+	sess = db.SetSessionPagination(sess, &listOptions)
 
 	err := sess.Find(&ids)
 	if err != nil {
@@ -336,7 +336,7 @@ func ParseCommitsWithStatus(oldCommits []*SignCommit, repo *Repository) []*SignC
 		commit := &SignCommitWithStatuses{
 			SignCommit: c,
 		}
-		statuses, err := GetLatestCommitStatus(repo.ID, commit.ID.String(), ListOptions{})
+		statuses, err := GetLatestCommitStatus(repo.ID, commit.ID.String(), db.ListOptions{})
 		if err != nil {
 			log.Error("GetLatestCommitStatus: %v", err)
 		} else {
diff --git a/models/commit_status_test.go b/models/commit_status_test.go
index 0d8dbf2646..7f4709144c 100644
--- a/models/commit_status_test.go
+++ b/models/commit_status_test.go
@@ -19,7 +19,7 @@ func TestGetCommitStatuses(t *testing.T) {
 
 	sha1 := "1234123412341234123412341234123412341234"
 
-	statuses, maxResults, err := GetCommitStatuses(repo1, sha1, &CommitStatusOptions{ListOptions: ListOptions{Page: 1, PageSize: 50}})
+	statuses, maxResults, err := GetCommitStatuses(repo1, sha1, &CommitStatusOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 50}})
 	assert.NoError(t, err)
 	assert.Equal(t, int(maxResults), 5)
 	assert.Len(t, statuses, 5)
diff --git a/models/list_options.go b/models/db/list_options.go
similarity index 78%
rename from models/list_options.go
rename to models/db/list_options.go
index 25b9a05f16..f31febfe25 100644
--- a/models/list_options.go
+++ b/models/db/list_options.go
@@ -2,10 +2,9 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package db
 
 import (
-	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/setting"
 
 	"xorm.io/xorm"
@@ -17,22 +16,22 @@ type Paginator interface {
 	GetStartEnd() (start, end int)
 }
 
-// getPaginatedSession creates a paginated database session
-func getPaginatedSession(p Paginator) *xorm.Session {
+// GetPaginatedSession creates a paginated database session
+func GetPaginatedSession(p Paginator) *xorm.Session {
 	skip, take := p.GetSkipTake()
 
-	return db.GetEngine(db.DefaultContext).Limit(take, skip)
+	return x.Limit(take, skip)
 }
 
-// setSessionPagination sets pagination for a database session
-func setSessionPagination(sess *xorm.Session, p Paginator) *xorm.Session {
+// SetSessionPagination sets pagination for a database session
+func SetSessionPagination(sess *xorm.Session, p Paginator) *xorm.Session {
 	skip, take := p.GetSkipTake()
 
 	return sess.Limit(take, skip)
 }
 
-// setSessionPagination sets pagination for a database engine
-func setEnginePagination(e db.Engine, p Paginator) db.Engine {
+// SetEnginePagination sets pagination for a database engine
+func SetEnginePagination(e Engine, p Paginator) Engine {
 	skip, take := p.GetSkipTake()
 
 	return e.Limit(take, skip)
@@ -46,7 +45,7 @@ type ListOptions struct {
 
 // GetSkipTake returns the skip and take values
 func (opts *ListOptions) GetSkipTake() (skip, take int) {
-	opts.setDefaultValues()
+	opts.SetDefaultValues()
 	return (opts.Page - 1) * opts.PageSize, opts.PageSize
 }
 
@@ -57,7 +56,8 @@ func (opts *ListOptions) GetStartEnd() (start, end int) {
 	return
 }
 
-func (opts *ListOptions) setDefaultValues() {
+// SetDefaultValues sets default values
+func (opts *ListOptions) SetDefaultValues() {
 	if opts.PageSize <= 0 {
 		opts.PageSize = setting.API.DefaultPagingNum
 	}
diff --git a/models/list_options_test.go b/models/db/list_options_test.go
similarity index 98%
rename from models/list_options_test.go
rename to models/db/list_options_test.go
index 3145aa7c16..2c860afdfb 100644
--- a/models/list_options_test.go
+++ b/models/db/list_options_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package db
 
 import (
 	"testing"
diff --git a/models/db/test_fixtures.go b/models/db/test_fixtures.go
index 1727015133..2715b688ea 100644
--- a/models/db/test_fixtures.go
+++ b/models/db/test_fixtures.go
@@ -17,13 +17,18 @@ import (
 var fixtures *testfixtures.Loader
 
 // InitFixtures initialize test fixtures for a test database
-func InitFixtures(dir string, engine ...*xorm.Engine) (err error) {
+func InitFixtures(opts FixturesOptions, engine ...*xorm.Engine) (err error) {
 	e := x
 	if len(engine) == 1 {
 		e = engine[0]
 	}
 
-	testfiles := testfixtures.Directory(dir)
+	var testfiles func(*testfixtures.Loader) error
+	if opts.Dir != "" {
+		testfiles = testfixtures.Directory(opts.Dir)
+	} else {
+		testfiles = testfixtures.Files(opts.Files...)
+	}
 	dialect := "unknown"
 	switch e.Dialect().URI().DBType {
 	case schemas.POSTGRES:
diff --git a/models/db/unit_tests.go b/models/db/unit_tests.go
index 781f0ecca2..d81610df6b 100644
--- a/models/db/unit_tests.go
+++ b/models/db/unit_tests.go
@@ -44,11 +44,21 @@ func fatalTestError(fmtStr string, args ...interface{}) {
 
 // MainTest a reusable TestMain(..) function for unit tests that need to use a
 // test database. Creates the test database, and sets necessary settings.
-func MainTest(m *testing.M, pathToGiteaRoot string) {
+func MainTest(m *testing.M, pathToGiteaRoot string, fixtureFiles ...string) {
 	var err error
 	giteaRoot = pathToGiteaRoot
 	fixturesDir = filepath.Join(pathToGiteaRoot, "models", "fixtures")
-	if err = CreateTestEngine(fixturesDir); err != nil {
+
+	var opts FixturesOptions
+	if len(fixtureFiles) == 0 {
+		opts.Dir = fixturesDir
+	} else {
+		for _, f := range fixtureFiles {
+			opts.Files = append(opts.Files, filepath.Join(fixturesDir, f))
+		}
+	}
+
+	if err = CreateTestEngine(opts); err != nil {
 		fatalTestError("Error creating test engine: %v\n", err)
 	}
 
@@ -102,8 +112,14 @@ func MainTest(m *testing.M, pathToGiteaRoot string) {
 	os.Exit(exitStatus)
 }
 
+// FixturesOptions fixtures needs to be loaded options
+type FixturesOptions struct {
+	Dir   string
+	Files []string
+}
+
 // CreateTestEngine creates a memory database and loads the fixture data from fixturesDir
-func CreateTestEngine(fixturesDir string) error {
+func CreateTestEngine(opts FixturesOptions) error {
 	var err error
 	x, err = xorm.NewEngine("sqlite3", "file::memory:?cache=shared&_txlock=immediate")
 	if err != nil {
@@ -123,7 +139,7 @@ func CreateTestEngine(fixturesDir string) error {
 		e:       x,
 	}
 
-	return InitFixtures(fixturesDir)
+	return InitFixtures(opts)
 }
 
 // PrepareTestDatabase load test fixtures into test database
diff --git a/models/error.go b/models/error.go
index fd8f2771ae..956b240097 100644
--- a/models/error.go
+++ b/models/error.go
@@ -1836,58 +1836,6 @@ func (err ErrAttachmentNotExist) Error() string {
 	return fmt.Sprintf("attachment does not exist [id: %d, uuid: %s]", err.ID, err.UUID)
 }
 
-// .____                 .__           _________
-// |    |    ____   ____ |__| ____    /   _____/ ____  __ _________   ____  ____
-// |    |   /  _ \ / ___\|  |/    \   \_____  \ /  _ \|  |  \_  __ \_/ ___\/ __ \
-// |    |__(  <_> ) /_/  >  |   |  \  /        (  <_> )  |  /|  | \/\  \__\  ___/
-// |_______ \____/\___  /|__|___|  / /_______  /\____/|____/ |__|    \___  >___  >
-//         \/    /_____/         \/          \/                          \/    \/
-
-// ErrLoginSourceNotExist represents a "LoginSourceNotExist" kind of error.
-type ErrLoginSourceNotExist struct {
-	ID int64
-}
-
-// IsErrLoginSourceNotExist checks if an error is a ErrLoginSourceNotExist.
-func IsErrLoginSourceNotExist(err error) bool {
-	_, ok := err.(ErrLoginSourceNotExist)
-	return ok
-}
-
-func (err ErrLoginSourceNotExist) Error() string {
-	return fmt.Sprintf("login source does not exist [id: %d]", err.ID)
-}
-
-// ErrLoginSourceAlreadyExist represents a "LoginSourceAlreadyExist" kind of error.
-type ErrLoginSourceAlreadyExist struct {
-	Name string
-}
-
-// IsErrLoginSourceAlreadyExist checks if an error is a ErrLoginSourceAlreadyExist.
-func IsErrLoginSourceAlreadyExist(err error) bool {
-	_, ok := err.(ErrLoginSourceAlreadyExist)
-	return ok
-}
-
-func (err ErrLoginSourceAlreadyExist) Error() string {
-	return fmt.Sprintf("login source already exists [name: %s]", err.Name)
-}
-
-// ErrLoginSourceInUse represents a "LoginSourceInUse" kind of error.
-type ErrLoginSourceInUse struct {
-	ID int64
-}
-
-// IsErrLoginSourceInUse checks if an error is a ErrLoginSourceInUse.
-func IsErrLoginSourceInUse(err error) bool {
-	_, ok := err.(ErrLoginSourceInUse)
-	return ok
-}
-
-func (err ErrLoginSourceInUse) Error() string {
-	return fmt.Sprintf("login source is still used by some users [id: %d]", err.ID)
-}
-
 // ___________
 // \__    ___/___ _____    _____
 //   |    |_/ __ \\__  \  /     \
@@ -2159,42 +2107,3 @@ func (err ErrNotValidReviewRequest) Error() string {
 		err.UserID,
 		err.RepoID)
 }
-
-//  ________      _____          __  .__
-//  \_____  \    /  _  \  __ ___/  |_|  |__
-//   /   |   \  /  /_\  \|  |  \   __\  |  \
-//  /    |    \/    |    \  |  /|  | |   Y  \
-//  \_______  /\____|__  /____/ |__| |___|  /
-//          \/         \/                 \/
-
-// ErrOAuthClientIDInvalid will be thrown if client id cannot be found
-type ErrOAuthClientIDInvalid struct {
-	ClientID string
-}
-
-// IsErrOauthClientIDInvalid checks if an error is a ErrReviewNotExist.
-func IsErrOauthClientIDInvalid(err error) bool {
-	_, ok := err.(ErrOAuthClientIDInvalid)
-	return ok
-}
-
-// Error returns the error message
-func (err ErrOAuthClientIDInvalid) Error() string {
-	return fmt.Sprintf("Client ID invalid [Client ID: %s]", err.ClientID)
-}
-
-// ErrOAuthApplicationNotFound will be thrown if id cannot be found
-type ErrOAuthApplicationNotFound struct {
-	ID int64
-}
-
-// IsErrOAuthApplicationNotFound checks if an error is a ErrReviewNotExist.
-func IsErrOAuthApplicationNotFound(err error) bool {
-	_, ok := err.(ErrOAuthApplicationNotFound)
-	return ok
-}
-
-// Error returns the error message
-func (err ErrOAuthApplicationNotFound) Error() string {
-	return fmt.Sprintf("OAuth application not found [ID: %d]", err.ID)
-}
diff --git a/models/external_login_user.go b/models/external_login_user.go
index c6a4b71b53..6b023a4cb2 100644
--- a/models/external_login_user.go
+++ b/models/external_login_user.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/structs"
 
 	"github.com/markbates/goth"
@@ -106,7 +107,7 @@ func GetUserIDByExternalUserID(provider, userID string) (int64, error) {
 
 // UpdateExternalUser updates external user's information
 func UpdateExternalUser(user *User, gothUser goth.User) error {
-	loginSource, err := GetActiveOAuth2LoginSourceByName(gothUser.Provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
 	if err != nil {
 		return err
 	}
diff --git a/models/gpg_key.go b/models/gpg_key.go
index d8dd79c285..a62ed61966 100644
--- a/models/gpg_key.go
+++ b/models/gpg_key.go
@@ -62,14 +62,14 @@ func (key *GPGKey) AfterLoad(session *xorm.Session) {
 }
 
 // ListGPGKeys returns a list of public keys belongs to given user.
-func ListGPGKeys(uid int64, listOptions ListOptions) ([]*GPGKey, error) {
+func ListGPGKeys(uid int64, listOptions db.ListOptions) ([]*GPGKey, error) {
 	return listGPGKeys(db.GetEngine(db.DefaultContext), uid, listOptions)
 }
 
-func listGPGKeys(e db.Engine, uid int64, listOptions ListOptions) ([]*GPGKey, error) {
+func listGPGKeys(e db.Engine, uid int64, listOptions db.ListOptions) ([]*GPGKey, error) {
 	sess := e.Table(&GPGKey{}).Where("owner_id=? AND primary_key_id=''", uid)
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 	}
 
 	keys := make([]*GPGKey, 0, 2)
diff --git a/models/gpg_key_commit_verification.go b/models/gpg_key_commit_verification.go
index a4c7d70285..f508303a09 100644
--- a/models/gpg_key_commit_verification.go
+++ b/models/gpg_key_commit_verification.go
@@ -9,6 +9,7 @@ import (
 	"hash"
 	"strings"
 
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -156,7 +157,7 @@ func ParseCommitWithSignature(c *git.Commit) *CommitVerification {
 
 	// Now try to associate the signature with the committer, if present
 	if committer.ID != 0 {
-		keys, err := ListGPGKeys(committer.ID, ListOptions{})
+		keys, err := ListGPGKeys(committer.ID, db.ListOptions{})
 		if err != nil { // Skipping failed to get gpg keys of user
 			log.Error("ListGPGKeys: %v", err)
 			return &CommitVerification{
diff --git a/models/issue.go b/models/issue.go
index cafd996ac5..b8c7053b2d 100644
--- a/models/issue.go
+++ b/models/issue.go
@@ -1122,7 +1122,7 @@ func GetIssuesByIDs(issueIDs []int64) ([]*Issue, error) {
 
 // IssuesOptions represents options of an issue.
 type IssuesOptions struct {
-	ListOptions
+	db.ListOptions
 	RepoIDs            []int64 // include all repos if empty
 	AssigneeID         int64
 	PosterID           int64
diff --git a/models/issue_comment.go b/models/issue_comment.go
index d8f8e36df2..01e41814a4 100644
--- a/models/issue_comment.go
+++ b/models/issue_comment.go
@@ -964,7 +964,7 @@ func getCommentByID(e db.Engine, id int64) (*Comment, error) {
 
 // FindCommentsOptions describes the conditions to Find comments
 type FindCommentsOptions struct {
-	ListOptions
+	db.ListOptions
 	RepoID   int64
 	IssueID  int64
 	ReviewID int64
@@ -1012,7 +1012,7 @@ func findComments(e db.Engine, opts *FindCommentsOptions) ([]*Comment, error) {
 	}
 
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 	}
 
 	// WARNING: If you change this order you will need to fix createCodeComment
diff --git a/models/issue_label.go b/models/issue_label.go
index 87d7eb9221..293b7140f7 100644
--- a/models/issue_label.go
+++ b/models/issue_label.go
@@ -447,7 +447,7 @@ func GetLabelsInRepoByIDs(repoID int64, labelIDs []int64) ([]*Label, error) {
 		Find(&labels)
 }
 
-func getLabelsByRepoID(e db.Engine, repoID int64, sortType string, listOptions ListOptions) ([]*Label, error) {
+func getLabelsByRepoID(e db.Engine, repoID int64, sortType string, listOptions db.ListOptions) ([]*Label, error) {
 	if repoID <= 0 {
 		return nil, ErrRepoLabelNotExist{0, repoID}
 	}
@@ -466,14 +466,14 @@ func getLabelsByRepoID(e db.Engine, repoID int64, sortType string, listOptions L
 	}
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 	}
 
 	return labels, sess.Find(&labels)
 }
 
 // GetLabelsByRepoID returns all labels that belong to given repository by ID.
-func GetLabelsByRepoID(repoID int64, sortType string, listOptions ListOptions) ([]*Label, error) {
+func GetLabelsByRepoID(repoID int64, sortType string, listOptions db.ListOptions) ([]*Label, error) {
 	return getLabelsByRepoID(db.GetEngine(db.DefaultContext), repoID, sortType, listOptions)
 }
 
@@ -564,7 +564,7 @@ func GetLabelsInOrgByIDs(orgID int64, labelIDs []int64) ([]*Label, error) {
 		Find(&labels)
 }
 
-func getLabelsByOrgID(e db.Engine, orgID int64, sortType string, listOptions ListOptions) ([]*Label, error) {
+func getLabelsByOrgID(e db.Engine, orgID int64, sortType string, listOptions db.ListOptions) ([]*Label, error) {
 	if orgID <= 0 {
 		return nil, ErrOrgLabelNotExist{0, orgID}
 	}
@@ -583,14 +583,14 @@ func getLabelsByOrgID(e db.Engine, orgID int64, sortType string, listOptions Lis
 	}
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 	}
 
 	return labels, sess.Find(&labels)
 }
 
 // GetLabelsByOrgID returns all labels that belong to given organization by ID.
-func GetLabelsByOrgID(orgID int64, sortType string, listOptions ListOptions) ([]*Label, error) {
+func GetLabelsByOrgID(orgID int64, sortType string, listOptions db.ListOptions) ([]*Label, error) {
 	return getLabelsByOrgID(db.GetEngine(db.DefaultContext), orgID, sortType, listOptions)
 }
 
diff --git a/models/issue_label_test.go b/models/issue_label_test.go
index 384965b846..93807a326f 100644
--- a/models/issue_label_test.go
+++ b/models/issue_label_test.go
@@ -123,7 +123,7 @@ func TestGetLabelsInRepoByIDs(t *testing.T) {
 func TestGetLabelsByRepoID(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 	testSuccess := func(repoID int64, sortType string, expectedIssueIDs []int64) {
-		labels, err := GetLabelsByRepoID(repoID, sortType, ListOptions{})
+		labels, err := GetLabelsByRepoID(repoID, sortType, db.ListOptions{})
 		assert.NoError(t, err)
 		assert.Len(t, labels, len(expectedIssueIDs))
 		for i, label := range labels {
@@ -214,7 +214,7 @@ func TestGetLabelsInOrgByIDs(t *testing.T) {
 func TestGetLabelsByOrgID(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 	testSuccess := func(orgID int64, sortType string, expectedIssueIDs []int64) {
-		labels, err := GetLabelsByOrgID(orgID, sortType, ListOptions{})
+		labels, err := GetLabelsByOrgID(orgID, sortType, db.ListOptions{})
 		assert.NoError(t, err)
 		assert.Len(t, labels, len(expectedIssueIDs))
 		for i, label := range labels {
@@ -227,10 +227,10 @@ func TestGetLabelsByOrgID(t *testing.T) {
 	testSuccess(3, "default", []int64{3, 4})
 
 	var err error
-	_, err = GetLabelsByOrgID(0, "leastissues", ListOptions{})
+	_, err = GetLabelsByOrgID(0, "leastissues", db.ListOptions{})
 	assert.True(t, IsErrOrgLabelNotExist(err))
 
-	_, err = GetLabelsByOrgID(-1, "leastissues", ListOptions{})
+	_, err = GetLabelsByOrgID(-1, "leastissues", db.ListOptions{})
 	assert.True(t, IsErrOrgLabelNotExist(err))
 }
 
diff --git a/models/issue_milestone.go b/models/issue_milestone.go
index fb6ced5b41..3898e5b397 100644
--- a/models/issue_milestone.go
+++ b/models/issue_milestone.go
@@ -378,7 +378,7 @@ func (milestones MilestoneList) getMilestoneIDs() []int64 {
 
 // GetMilestonesOption contain options to get milestones
 type GetMilestonesOption struct {
-	ListOptions
+	db.ListOptions
 	RepoID   int64
 	State    api.StateType
 	Name     string
@@ -413,7 +413,7 @@ func GetMilestones(opts GetMilestonesOption) (MilestoneList, int64, error) {
 	sess := db.GetEngine(db.DefaultContext).Where(opts.toCond())
 
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, &opts)
+		sess = db.SetSessionPagination(sess, &opts)
 	}
 
 	switch opts.SortType {
diff --git a/models/issue_milestone_test.go b/models/issue_milestone_test.go
index 519b65715d..099fe47c7c 100644
--- a/models/issue_milestone_test.go
+++ b/models/issue_milestone_test.go
@@ -102,7 +102,7 @@ func TestGetMilestones(t *testing.T) {
 	test := func(sortType string, sortCond func(*Milestone) int) {
 		for _, page := range []int{0, 1} {
 			milestones, _, err := GetMilestones(GetMilestonesOption{
-				ListOptions: ListOptions{
+				ListOptions: db.ListOptions{
 					Page:     page,
 					PageSize: setting.UI.IssuePagingNum,
 				},
@@ -119,7 +119,7 @@ func TestGetMilestones(t *testing.T) {
 			assert.True(t, sort.IntsAreSorted(values))
 
 			milestones, _, err = GetMilestones(GetMilestonesOption{
-				ListOptions: ListOptions{
+				ListOptions: db.ListOptions{
 					Page:     page,
 					PageSize: setting.UI.IssuePagingNum,
 				},
diff --git a/models/issue_reaction.go b/models/issue_reaction.go
index 4e49add5c2..423eb8b96c 100644
--- a/models/issue_reaction.go
+++ b/models/issue_reaction.go
@@ -35,7 +35,7 @@ func init() {
 
 // FindReactionsOptions describes the conditions to Find reactions
 type FindReactionsOptions struct {
-	ListOptions
+	db.ListOptions
 	IssueID   int64
 	CommentID int64
 	UserID    int64
@@ -78,7 +78,7 @@ func FindCommentReactions(comment *Comment) (ReactionList, error) {
 }
 
 // FindIssueReactions returns a ReactionList of all reactions from an issue
-func FindIssueReactions(issue *Issue, listOptions ListOptions) (ReactionList, error) {
+func FindIssueReactions(issue *Issue, listOptions db.ListOptions) (ReactionList, error) {
 	return findReactions(db.GetEngine(db.DefaultContext), FindReactionsOptions{
 		ListOptions: listOptions,
 		IssueID:     issue.ID,
@@ -92,7 +92,7 @@ func findReactions(e db.Engine, opts FindReactionsOptions) ([]*Reaction, error)
 		In("reaction.`type`", setting.UI.Reactions).
 		Asc("reaction.issue_id", "reaction.comment_id", "reaction.created_unix", "reaction.id")
 	if opts.Page != 0 {
-		e = setEnginePagination(e, &opts)
+		e = db.SetEnginePagination(e, &opts)
 
 		reactions := make([]*Reaction, 0, opts.PageSize)
 		return reactions, e.Find(&reactions)
diff --git a/models/issue_stopwatch.go b/models/issue_stopwatch.go
index 157658e182..e8f19dd738 100644
--- a/models/issue_stopwatch.go
+++ b/models/issue_stopwatch.go
@@ -46,11 +46,11 @@ func getStopwatch(e db.Engine, userID, issueID int64) (sw *Stopwatch, exists boo
 }
 
 // GetUserStopwatches return list of all stopwatches of a user
-func GetUserStopwatches(userID int64, listOptions ListOptions) ([]*Stopwatch, error) {
+func GetUserStopwatches(userID int64, listOptions db.ListOptions) ([]*Stopwatch, error) {
 	sws := make([]*Stopwatch, 0, 8)
 	sess := db.GetEngine(db.DefaultContext).Where("stopwatch.user_id = ?", userID)
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 	}
 
 	err := sess.Find(&sws)
diff --git a/models/issue_test.go b/models/issue_test.go
index d5f6f36e9c..d726a24344 100644
--- a/models/issue_test.go
+++ b/models/issue_test.go
@@ -151,7 +151,7 @@ func TestIssues(t *testing.T) {
 			IssuesOptions{
 				RepoIDs:  []int64{1, 3},
 				SortType: "oldest",
-				ListOptions: ListOptions{
+				ListOptions: db.ListOptions{
 					Page:     1,
 					PageSize: 4,
 				},
@@ -161,7 +161,7 @@ func TestIssues(t *testing.T) {
 		{
 			IssuesOptions{
 				LabelIDs: []int64{1},
-				ListOptions: ListOptions{
+				ListOptions: db.ListOptions{
 					Page:     1,
 					PageSize: 4,
 				},
@@ -171,7 +171,7 @@ func TestIssues(t *testing.T) {
 		{
 			IssuesOptions{
 				LabelIDs: []int64{1, 2},
-				ListOptions: ListOptions{
+				ListOptions: db.ListOptions{
 					Page:     1,
 					PageSize: 4,
 				},
diff --git a/models/issue_tracked_time.go b/models/issue_tracked_time.go
index d024c6896f..79de891019 100644
--- a/models/issue_tracked_time.go
+++ b/models/issue_tracked_time.go
@@ -75,7 +75,7 @@ func (tl TrackedTimeList) LoadAttributes() (err error) {
 
 // FindTrackedTimesOptions represent the filters for tracked times. If an ID is 0 it will be ignored.
 type FindTrackedTimesOptions struct {
-	ListOptions
+	db.ListOptions
 	IssueID           int64
 	UserID            int64
 	RepositoryID      int64
@@ -118,7 +118,7 @@ func (opts *FindTrackedTimesOptions) toSession(e db.Engine) db.Engine {
 	sess = sess.Where(opts.toCond())
 
 	if opts.Page != 0 {
-		sess = setEnginePagination(sess, opts)
+		sess = db.SetEnginePagination(sess, opts)
 	}
 
 	return sess
diff --git a/models/issue_watch.go b/models/issue_watch.go
index cc1edcba1b..5bac406ad0 100644
--- a/models/issue_watch.go
+++ b/models/issue_watch.go
@@ -103,11 +103,11 @@ func getIssueWatchersIDs(e db.Engine, issueID int64, watching bool) ([]int64, er
 }
 
 // GetIssueWatchers returns watchers/unwatchers of a given issue
-func GetIssueWatchers(issueID int64, listOptions ListOptions) (IssueWatchList, error) {
+func GetIssueWatchers(issueID int64, listOptions db.ListOptions) (IssueWatchList, error) {
 	return getIssueWatchers(db.GetEngine(db.DefaultContext), issueID, listOptions)
 }
 
-func getIssueWatchers(e db.Engine, issueID int64, listOptions ListOptions) (IssueWatchList, error) {
+func getIssueWatchers(e db.Engine, issueID int64, listOptions db.ListOptions) (IssueWatchList, error) {
 	sess := e.
 		Where("`issue_watch`.issue_id = ?", issueID).
 		And("`issue_watch`.is_watching = ?", true).
@@ -116,7 +116,7 @@ func getIssueWatchers(e db.Engine, issueID int64, listOptions ListOptions) (Issu
 		Join("INNER", "`user`", "`user`.id = `issue_watch`.user_id")
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 		watches := make([]*IssueWatch, 0, listOptions.PageSize)
 		return watches, sess.Find(&watches)
 	}
diff --git a/models/issue_watch_test.go b/models/issue_watch_test.go
index f85e7cef59..139ed41cb6 100644
--- a/models/issue_watch_test.go
+++ b/models/issue_watch_test.go
@@ -43,22 +43,22 @@ func TestGetIssueWatch(t *testing.T) {
 func TestGetIssueWatchers(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
-	iws, err := GetIssueWatchers(1, ListOptions{})
+	iws, err := GetIssueWatchers(1, db.ListOptions{})
 	assert.NoError(t, err)
 	// Watcher is inactive, thus 0
 	assert.Len(t, iws, 0)
 
-	iws, err = GetIssueWatchers(2, ListOptions{})
+	iws, err = GetIssueWatchers(2, db.ListOptions{})
 	assert.NoError(t, err)
 	// Watcher is explicit not watching
 	assert.Len(t, iws, 0)
 
-	iws, err = GetIssueWatchers(5, ListOptions{})
+	iws, err = GetIssueWatchers(5, db.ListOptions{})
 	assert.NoError(t, err)
 	// Issue has no Watchers
 	assert.Len(t, iws, 0)
 
-	iws, err = GetIssueWatchers(7, ListOptions{})
+	iws, err = GetIssueWatchers(7, db.ListOptions{})
 	assert.NoError(t, err)
 	// Issue has one watcher
 	assert.Len(t, iws, 1)
diff --git a/models/login/main_test.go b/models/login/main_test.go
new file mode 100644
index 0000000000..ef4b5907bf
--- /dev/null
+++ b/models/login/main_test.go
@@ -0,0 +1,21 @@
+// Copyright 2020 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package login
+
+import (
+	"path/filepath"
+	"testing"
+
+	"code.gitea.io/gitea/models/db"
+)
+
+func TestMain(m *testing.M) {
+	db.MainTest(m, filepath.Join("..", ".."),
+		"login_source.yml",
+		"oauth2_application.yml",
+		"oauth2_authorization_code.yml",
+		"oauth2_grant.yml",
+	)
+}
diff --git a/models/login/oauth2.go b/models/login/oauth2.go
new file mode 100644
index 0000000000..45ab59dd78
--- /dev/null
+++ b/models/login/oauth2.go
@@ -0,0 +1,70 @@
+// Copyright 2017 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package login
+
+import (
+	"fmt"
+
+	"code.gitea.io/gitea/models/db"
+)
+
+//  ________      _____          __  .__
+//  \_____  \    /  _  \  __ ___/  |_|  |__
+//   /   |   \  /  /_\  \|  |  \   __\  |  \
+//  /    |    \/    |    \  |  /|  | |   Y  \
+//  \_______  /\____|__  /____/ |__| |___|  /
+//          \/         \/                 \/
+
+// ErrOAuthClientIDInvalid will be thrown if client id cannot be found
+type ErrOAuthClientIDInvalid struct {
+	ClientID string
+}
+
+// IsErrOauthClientIDInvalid checks if an error is a ErrReviewNotExist.
+func IsErrOauthClientIDInvalid(err error) bool {
+	_, ok := err.(ErrOAuthClientIDInvalid)
+	return ok
+}
+
+// Error returns the error message
+func (err ErrOAuthClientIDInvalid) Error() string {
+	return fmt.Sprintf("Client ID invalid [Client ID: %s]", err.ClientID)
+}
+
+// ErrOAuthApplicationNotFound will be thrown if id cannot be found
+type ErrOAuthApplicationNotFound struct {
+	ID int64
+}
+
+// IsErrOAuthApplicationNotFound checks if an error is a ErrReviewNotExist.
+func IsErrOAuthApplicationNotFound(err error) bool {
+	_, ok := err.(ErrOAuthApplicationNotFound)
+	return ok
+}
+
+// Error returns the error message
+func (err ErrOAuthApplicationNotFound) Error() string {
+	return fmt.Sprintf("OAuth application not found [ID: %d]", err.ID)
+}
+
+// GetActiveOAuth2ProviderLoginSources returns all actived LoginOAuth2 sources
+func GetActiveOAuth2ProviderLoginSources() ([]*Source, error) {
+	sources := make([]*Source, 0, 1)
+	if err := db.GetEngine(db.DefaultContext).Where("is_active = ? and type = ?", true, OAuth2).Find(&sources); err != nil {
+		return nil, err
+	}
+	return sources, nil
+}
+
+// GetActiveOAuth2LoginSourceByName returns a OAuth2 LoginSource based on the given name
+func GetActiveOAuth2LoginSourceByName(name string) (*Source, error) {
+	loginSource := new(Source)
+	has, err := db.GetEngine(db.DefaultContext).Where("name = ? and type = ? and is_active = ?", name, OAuth2, true).Get(loginSource)
+	if !has || err != nil {
+		return nil, err
+	}
+
+	return loginSource, nil
+}
diff --git a/models/oauth2_application.go b/models/login/oauth2_application.go
similarity index 96%
rename from models/oauth2_application.go
rename to models/login/oauth2_application.go
index 0fd2e38472..060bfe5bc3 100644
--- a/models/oauth2_application.go
+++ b/models/login/oauth2_application.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package login
 
 import (
 	"crypto/sha256"
@@ -23,19 +23,14 @@ import (
 
 // OAuth2Application represents an OAuth2 client (RFC 6749)
 type OAuth2Application struct {
-	ID   int64 `xorm:"pk autoincr"`
-	UID  int64 `xorm:"INDEX"`
-	User *User `xorm:"-"`
-
-	Name string
-
+	ID           int64 `xorm:"pk autoincr"`
+	UID          int64 `xorm:"INDEX"`
+	Name         string
 	ClientID     string `xorm:"unique"`
 	ClientSecret string
-
-	RedirectURIs []string `xorm:"redirect_uris JSON TEXT"`
-
-	CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
-	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
+	RedirectURIs []string           `xorm:"redirect_uris JSON TEXT"`
+	CreatedUnix  timeutil.TimeStamp `xorm:"INDEX created"`
+	UpdatedUnix  timeutil.TimeStamp `xorm:"INDEX updated"`
 }
 
 func init() {
@@ -57,14 +52,6 @@ func (app *OAuth2Application) PrimaryRedirectURI() string {
 	return app.RedirectURIs[0]
 }
 
-// LoadUser will load User by UID
-func (app *OAuth2Application) LoadUser() (err error) {
-	if app.User == nil {
-		app.User, err = GetUserByID(app.UID)
-	}
-	return
-}
-
 // ContainsRedirectURI checks if redirectURI is allowed for app
 func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
 	return util.IsStringInSlice(redirectURI, app.RedirectURIs, true)
@@ -276,13 +263,13 @@ func DeleteOAuth2Application(id, userid int64) error {
 }
 
 // ListOAuth2Applications returns a list of oauth2 applications belongs to given user.
-func ListOAuth2Applications(uid int64, listOptions ListOptions) ([]*OAuth2Application, int64, error) {
+func ListOAuth2Applications(uid int64, listOptions db.ListOptions) ([]*OAuth2Application, int64, error) {
 	sess := db.GetEngine(db.DefaultContext).
 		Where("uid=?", uid).
 		Desc("id")
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		apps := make([]*OAuth2Application, 0, listOptions.PageSize)
 		total, err := sess.FindAndCount(&apps)
diff --git a/models/oauth2_application_test.go b/models/login/oauth2_application_test.go
similarity index 96%
rename from models/oauth2_application_test.go
rename to models/login/oauth2_application_test.go
index b01ef967fc..cb064cef1b 100644
--- a/models/oauth2_application_test.go
+++ b/models/login/oauth2_application_test.go
@@ -2,12 +2,13 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package login
 
 import (
 	"testing"
 
 	"code.gitea.io/gitea/models/db"
+
 	"github.com/stretchr/testify/assert"
 )
 
@@ -69,13 +70,6 @@ func TestCreateOAuth2Application(t *testing.T) {
 	db.AssertExistsAndLoadBean(t, &OAuth2Application{Name: "newapp"})
 }
 
-func TestOAuth2Application_LoadUser(t *testing.T) {
-	assert.NoError(t, db.PrepareTestDatabase())
-	app := db.AssertExistsAndLoadBean(t, &OAuth2Application{ID: 1}).(*OAuth2Application)
-	assert.NoError(t, app.LoadUser())
-	assert.NotNil(t, app.User)
-}
-
 func TestOAuth2Application_TableName(t *testing.T) {
 	assert.Equal(t, "oauth2_application", new(OAuth2Application).TableName())
 }
diff --git a/models/login_source.go b/models/login/source.go
similarity index 55%
rename from models/login_source.go
rename to models/login/source.go
index e1f7a7e08e..1001d49b51 100644
--- a/models/login_source.go
+++ b/models/login/source.go
@@ -3,9 +3,10 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package login
 
 import (
+	"fmt"
 	"reflect"
 	"strconv"
 
@@ -17,43 +18,43 @@ import (
 	"xorm.io/xorm/convert"
 )
 
-// LoginType represents an login type.
-type LoginType int
+// Type represents an login type.
+type Type int
 
 // Note: new type must append to the end of list to maintain compatibility.
 const (
-	LoginNoType LoginType = iota
-	LoginPlain            // 1
-	LoginLDAP             // 2
-	LoginSMTP             // 3
-	LoginPAM              // 4
-	LoginDLDAP            // 5
-	LoginOAuth2           // 6
-	LoginSSPI             // 7
+	NoType Type = iota
+	Plain       // 1
+	LDAP        // 2
+	SMTP        // 3
+	PAM         // 4
+	DLDAP       // 5
+	OAuth2      // 6
+	SSPI        // 7
 )
 
 // String returns the string name of the LoginType
-func (typ LoginType) String() string {
-	return LoginNames[typ]
+func (typ Type) String() string {
+	return Names[typ]
 }
 
 // Int returns the int value of the LoginType
-func (typ LoginType) Int() int {
+func (typ Type) Int() int {
 	return int(typ)
 }
 
-// LoginNames contains the name of LoginType values.
-var LoginNames = map[LoginType]string{
-	LoginLDAP:   "LDAP (via BindDN)",
-	LoginDLDAP:  "LDAP (simple auth)", // Via direct bind
-	LoginSMTP:   "SMTP",
-	LoginPAM:    "PAM",
-	LoginOAuth2: "OAuth2",
-	LoginSSPI:   "SPNEGO with SSPI",
+// Names contains the name of LoginType values.
+var Names = map[Type]string{
+	LDAP:   "LDAP (via BindDN)",
+	DLDAP:  "LDAP (simple auth)", // Via direct bind
+	SMTP:   "SMTP",
+	PAM:    "PAM",
+	OAuth2: "OAuth2",
+	SSPI:   "SPNEGO with SSPI",
 }
 
-// LoginConfig represents login config as far as the db is concerned
-type LoginConfig interface {
+// Config represents login config as far as the db is concerned
+type Config interface {
 	convert.Conversion
 }
 
@@ -83,33 +84,33 @@ type RegisterableSource interface {
 	UnregisterSource() error
 }
 
-// LoginSourceSettable configurations can have their loginSource set on them
-type LoginSourceSettable interface {
-	SetLoginSource(*LoginSource)
+// SourceSettable configurations can have their loginSource set on them
+type SourceSettable interface {
+	SetLoginSource(*Source)
 }
 
-// RegisterLoginTypeConfig register a config for a provided type
-func RegisterLoginTypeConfig(typ LoginType, exemplar LoginConfig) {
+// RegisterTypeConfig register a config for a provided type
+func RegisterTypeConfig(typ Type, exemplar Config) {
 	if reflect.TypeOf(exemplar).Kind() == reflect.Ptr {
 		// Pointer:
-		registeredLoginConfigs[typ] = func() LoginConfig {
-			return reflect.New(reflect.ValueOf(exemplar).Elem().Type()).Interface().(LoginConfig)
+		registeredConfigs[typ] = func() Config {
+			return reflect.New(reflect.ValueOf(exemplar).Elem().Type()).Interface().(Config)
 		}
 		return
 	}
 
 	// Not a Pointer
-	registeredLoginConfigs[typ] = func() LoginConfig {
-		return reflect.New(reflect.TypeOf(exemplar)).Elem().Interface().(LoginConfig)
+	registeredConfigs[typ] = func() Config {
+		return reflect.New(reflect.TypeOf(exemplar)).Elem().Interface().(Config)
 	}
 }
 
-var registeredLoginConfigs = map[LoginType]func() LoginConfig{}
+var registeredConfigs = map[Type]func() Config{}
 
-// LoginSource represents an external way for authorizing users.
-type LoginSource struct {
+// Source represents an external way for authorizing users.
+type Source struct {
 	ID            int64 `xorm:"pk autoincr"`
-	Type          LoginType
+	Type          Type
 	Name          string             `xorm:"UNIQUE"`
 	IsActive      bool               `xorm:"INDEX NOT NULL DEFAULT false"`
 	IsSyncEnabled bool               `xorm:"INDEX NOT NULL DEFAULT false"`
@@ -119,8 +120,13 @@ type LoginSource struct {
 	UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
 }
 
+// TableName xorm will read the table name from this method
+func (Source) TableName() string {
+	return "login_source"
+}
+
 func init() {
-	db.RegisterModel(new(LoginSource))
+	db.RegisterModel(new(Source))
 }
 
 // Cell2Int64 converts a xorm.Cell type to int64,
@@ -137,82 +143,82 @@ func Cell2Int64(val xorm.Cell) int64 {
 }
 
 // BeforeSet is invoked from XORM before setting the value of a field of this object.
-func (source *LoginSource) BeforeSet(colName string, val xorm.Cell) {
+func (source *Source) BeforeSet(colName string, val xorm.Cell) {
 	if colName == "type" {
-		typ := LoginType(Cell2Int64(val))
-		constructor, ok := registeredLoginConfigs[typ]
+		typ := Type(Cell2Int64(val))
+		constructor, ok := registeredConfigs[typ]
 		if !ok {
 			return
 		}
 		source.Cfg = constructor()
-		if settable, ok := source.Cfg.(LoginSourceSettable); ok {
+		if settable, ok := source.Cfg.(SourceSettable); ok {
 			settable.SetLoginSource(source)
 		}
 	}
 }
 
 // TypeName return name of this login source type.
-func (source *LoginSource) TypeName() string {
-	return LoginNames[source.Type]
+func (source *Source) TypeName() string {
+	return Names[source.Type]
 }
 
 // IsLDAP returns true of this source is of the LDAP type.
-func (source *LoginSource) IsLDAP() bool {
-	return source.Type == LoginLDAP
+func (source *Source) IsLDAP() bool {
+	return source.Type == LDAP
 }
 
 // IsDLDAP returns true of this source is of the DLDAP type.
-func (source *LoginSource) IsDLDAP() bool {
-	return source.Type == LoginDLDAP
+func (source *Source) IsDLDAP() bool {
+	return source.Type == DLDAP
 }
 
 // IsSMTP returns true of this source is of the SMTP type.
-func (source *LoginSource) IsSMTP() bool {
-	return source.Type == LoginSMTP
+func (source *Source) IsSMTP() bool {
+	return source.Type == SMTP
 }
 
 // IsPAM returns true of this source is of the PAM type.
-func (source *LoginSource) IsPAM() bool {
-	return source.Type == LoginPAM
+func (source *Source) IsPAM() bool {
+	return source.Type == PAM
 }
 
 // IsOAuth2 returns true of this source is of the OAuth2 type.
-func (source *LoginSource) IsOAuth2() bool {
-	return source.Type == LoginOAuth2
+func (source *Source) IsOAuth2() bool {
+	return source.Type == OAuth2
 }
 
 // IsSSPI returns true of this source is of the SSPI type.
-func (source *LoginSource) IsSSPI() bool {
-	return source.Type == LoginSSPI
+func (source *Source) IsSSPI() bool {
+	return source.Type == SSPI
 }
 
 // HasTLS returns true of this source supports TLS.
-func (source *LoginSource) HasTLS() bool {
+func (source *Source) HasTLS() bool {
 	hasTLSer, ok := source.Cfg.(HasTLSer)
 	return ok && hasTLSer.HasTLS()
 }
 
 // UseTLS returns true of this source is configured to use TLS.
-func (source *LoginSource) UseTLS() bool {
+func (source *Source) UseTLS() bool {
 	useTLSer, ok := source.Cfg.(UseTLSer)
 	return ok && useTLSer.UseTLS()
 }
 
 // SkipVerify returns true if this source is configured to skip SSL
 // verification.
-func (source *LoginSource) SkipVerify() bool {
+func (source *Source) SkipVerify() bool {
 	skipVerifiable, ok := source.Cfg.(SkipVerifiable)
 	return ok && skipVerifiable.IsSkipVerify()
 }
 
-// CreateLoginSource inserts a LoginSource in the DB if not already
+// CreateSource inserts a LoginSource in the DB if not already
 // existing with the given name.
-func CreateLoginSource(source *LoginSource) error {
-	has, err := db.GetEngine(db.DefaultContext).Where("name=?", source.Name).Exist(new(LoginSource))
+func CreateSource(source *Source) error {
+	has, err := db.GetEngine(db.DefaultContext).Where("name=?", source.Name).Exist(new(Source))
 	if err != nil {
 		return err
 	} else if has {
-		return ErrLoginSourceAlreadyExist{source.Name}
+		return ErrSourceAlreadyExist{source.Name}
 	}
 	// Synchronization is only available with LDAP for now
 	if !source.IsLDAP() {
@@ -228,7 +234,7 @@ func CreateLoginSource(source *LoginSource) error {
 		return nil
 	}
 
-	if settable, ok := source.Cfg.(LoginSourceSettable); ok {
+	if settable, ok := source.Cfg.(SourceSettable); ok {
 		settable.SetLoginSource(source)
 	}
 
@@ -241,40 +247,40 @@ func CreateLoginSource(source *LoginSource) error {
 	if err != nil {
 		// remove the LoginSource in case of errors while registering configuration
 		if _, err := db.GetEngine(db.DefaultContext).Delete(source); err != nil {
-			log.Error("CreateLoginSource: Error while wrapOpenIDConnectInitializeError: %v", err)
+			log.Error("CreateSource: Error while wrapOpenIDConnectInitializeError: %v", err)
 		}
 	}
 	return err
 }
 
-// LoginSources returns a slice of all login sources found in DB.
-func LoginSources() ([]*LoginSource, error) {
-	auths := make([]*LoginSource, 0, 6)
+// Sources returns a slice of all login sources found in DB.
+func Sources() ([]*Source, error) {
+	auths := make([]*Source, 0, 6)
 	return auths, db.GetEngine(db.DefaultContext).Find(&auths)
 }
 
-// LoginSourcesByType returns all sources of the specified type
-func LoginSourcesByType(loginType LoginType) ([]*LoginSource, error) {
-	sources := make([]*LoginSource, 0, 1)
+// SourcesByType returns all sources of the specified type
+func SourcesByType(loginType Type) ([]*Source, error) {
+	sources := make([]*Source, 0, 1)
 	if err := db.GetEngine(db.DefaultContext).Where("type = ?", loginType).Find(&sources); err != nil {
 		return nil, err
 	}
 	return sources, nil
 }
 
-// AllActiveLoginSources returns all active sources
-func AllActiveLoginSources() ([]*LoginSource, error) {
-	sources := make([]*LoginSource, 0, 5)
+// AllActiveSources returns all active sources
+func AllActiveSources() ([]*Source, error) {
+	sources := make([]*Source, 0, 5)
 	if err := db.GetEngine(db.DefaultContext).Where("is_active = ?", true).Find(&sources); err != nil {
 		return nil, err
 	}
 	return sources, nil
 }
 
-// ActiveLoginSources returns all active sources of the specified type
-func ActiveLoginSources(loginType LoginType) ([]*LoginSource, error) {
-	sources := make([]*LoginSource, 0, 1)
-	if err := db.GetEngine(db.DefaultContext).Where("is_active = ? and type = ?", true, loginType).Find(&sources); err != nil {
+// ActiveSources returns all active sources of the specified type
+func ActiveSources(tp Type) ([]*Source, error) {
+	sources := make([]*Source, 0, 1)
+	if err := db.GetEngine(db.DefaultContext).Where("is_active = ? and type = ?", true, tp).Find(&sources); err != nil {
 		return nil, err
 	}
 	return sources, nil
@@ -286,19 +292,19 @@ func IsSSPIEnabled() bool {
 	if !db.HasEngine {
 		return false
 	}
-	sources, err := ActiveLoginSources(LoginSSPI)
+	sources, err := ActiveSources(SSPI)
 	if err != nil {
-		log.Error("ActiveLoginSources: %v", err)
+		log.Error("ActiveSources: %v", err)
 		return false
 	}
 	return len(sources) > 0
 }
 
-// GetLoginSourceByID returns login source by given ID.
-func GetLoginSourceByID(id int64) (*LoginSource, error) {
-	source := new(LoginSource)
+// GetSourceByID returns login source by given ID.
+func GetSourceByID(id int64) (*Source, error) {
+	source := new(Source)
 	if id == 0 {
-		source.Cfg = registeredLoginConfigs[LoginNoType]()
+		source.Cfg = registeredConfigs[NoType]()
 		// Set this source to active
 		// FIXME: allow disabling of db based password authentication in future
 		source.IsActive = true
@@ -309,18 +315,18 @@ func GetLoginSourceByID(id int64) (*LoginSource, error) {
 	if err != nil {
 		return nil, err
 	} else if !has {
-		return nil, ErrLoginSourceNotExist{id}
+		return nil, ErrSourceNotExist{id}
 	}
 	return source, nil
 }
 
-// UpdateSource updates a LoginSource record in DB.
-func UpdateSource(source *LoginSource) error {
-	var originalLoginSource *LoginSource
+// UpdateSource updates a Source record in DB.
+func UpdateSource(source *Source) error {
+	var originalLoginSource *Source
 	if source.IsOAuth2() {
 		// keep track of the original values so we can restore in case of errors while registering OAuth2 providers
 		var err error
-		if originalLoginSource, err = GetLoginSourceByID(source.ID); err != nil {
+		if originalLoginSource, err = GetSourceByID(source.ID); err != nil {
 			return err
 		}
 	}
@@ -334,7 +340,7 @@ func UpdateSource(source *LoginSource) error {
 		return nil
 	}
 
-	if settable, ok := source.Cfg.(LoginSourceSettable); ok {
+	if settable, ok := source.Cfg.(SourceSettable); ok {
 		settable.SetLoginSource(source)
 	}
 
@@ -353,34 +359,53 @@ func UpdateSource(source *LoginSource) error {
 	return err
 }
 
-// DeleteSource deletes a LoginSource record in DB.
-func DeleteSource(source *LoginSource) error {
-	count, err := db.GetEngine(db.DefaultContext).Count(&User{LoginSource: source.ID})
-	if err != nil {
-		return err
-	} else if count > 0 {
-		return ErrLoginSourceInUse{source.ID}
-	}
-
-	count, err = db.GetEngine(db.DefaultContext).Count(&ExternalLoginUser{LoginSourceID: source.ID})
-	if err != nil {
-		return err
-	} else if count > 0 {
-		return ErrLoginSourceInUse{source.ID}
-	}
-
-	if registerableSource, ok := source.Cfg.(RegisterableSource); ok {
-		if err := registerableSource.UnregisterSource(); err != nil {
-			return err
-		}
-	}
-
-	_, err = db.GetEngine(db.DefaultContext).ID(source.ID).Delete(new(LoginSource))
-	return err
-}
-
-// CountLoginSources returns number of login sources.
-func CountLoginSources() int64 {
-	count, _ := db.GetEngine(db.DefaultContext).Count(new(LoginSource))
+// CountSources returns number of login sources.
+func CountSources() int64 {
+	count, _ := db.GetEngine(db.DefaultContext).Count(new(Source))
 	return count
 }
+
+// ErrSourceNotExist represents a "SourceNotExist" kind of error.
+type ErrSourceNotExist struct {
+	ID int64
+}
+
+// IsErrSourceNotExist checks if an error is a ErrSourceNotExist.
+func IsErrSourceNotExist(err error) bool {
+	_, ok := err.(ErrSourceNotExist)
+	return ok
+}
+
+func (err ErrSourceNotExist) Error() string {
+	return fmt.Sprintf("login source does not exist [id: %d]", err.ID)
+}
+
+// ErrSourceAlreadyExist represents a "SourceAlreadyExist" kind of error.
+type ErrSourceAlreadyExist struct {
+	Name string
+}
+
+// IsErrSourceAlreadyExist checks if an error is a ErrSourceAlreadyExist.
+func IsErrSourceAlreadyExist(err error) bool {
+	_, ok := err.(ErrSourceAlreadyExist)
+	return ok
+}
+
+func (err ErrSourceAlreadyExist) Error() string {
+	return fmt.Sprintf("login source already exists [name: %s]", err.Name)
+}
+
+// ErrSourceInUse represents a "SourceInUse" kind of error.
+type ErrSourceInUse struct {
+	ID int64
+}
+
+// IsErrSourceInUse checks if an error is a ErrSourceInUse.
+func IsErrSourceInUse(err error) bool {
+	_, ok := err.(ErrSourceInUse)
+	return ok
+}
+
+func (err ErrSourceInUse) Error() string {
+	return fmt.Sprintf("login source is still used by some users [id: %d]", err.ID)
+}
diff --git a/models/login_source_test.go b/models/login/source_test.go
similarity index 86%
rename from models/login_source_test.go
rename to models/login/source_test.go
index ea1812238f..d98609037c 100644
--- a/models/login_source_test.go
+++ b/models/login/source_test.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a MIT-style
 // license that can be found in the LICENSE file.
 
-package models
+package login
 
 import (
 	"strings"
@@ -36,13 +36,13 @@ func (source *TestSource) ToDB() ([]byte, error) {
 func TestDumpLoginSource(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
-	loginSourceSchema, err := db.TableInfo(new(LoginSource))
+	loginSourceSchema, err := db.TableInfo(new(Source))
 	assert.NoError(t, err)
 
-	RegisterLoginTypeConfig(LoginOAuth2, new(TestSource))
+	RegisterTypeConfig(OAuth2, new(TestSource))
 
-	CreateLoginSource(&LoginSource{
-		Type:     LoginOAuth2,
+	CreateSource(&Source{
+		Type:     OAuth2,
 		Name:     "TestSource",
 		IsActive: false,
 		Cfg: &TestSource{
diff --git a/models/migrations/migrations_test.go b/models/migrations/migrations_test.go
index fffc44be12..78624f1e27 100644
--- a/models/migrations/migrations_test.go
+++ b/models/migrations/migrations_test.go
@@ -241,7 +241,10 @@ func prepareTestEnv(t *testing.T, skip int, syncModels ...interface{}) (*xorm.En
 
 	if _, err := os.Stat(fixturesDir); err == nil {
 		t.Logf("initializing fixtures from: %s", fixturesDir)
-		if err := db.InitFixtures(fixturesDir, x); err != nil {
+		if err := db.InitFixtures(
+			db.FixturesOptions{
+				Dir: fixturesDir,
+			}, x); err != nil {
 			t.Errorf("error whilst initializing fixtures from %s: %v", fixturesDir, err)
 			return x, deferFn
 		}
diff --git a/models/notification.go b/models/notification.go
index af24a6cf5a..bcbe8b0988 100644
--- a/models/notification.go
+++ b/models/notification.go
@@ -74,7 +74,7 @@ func init() {
 
 // FindNotificationOptions represent the filters for notifications. If an ID is 0 it will be ignored.
 type FindNotificationOptions struct {
-	ListOptions
+	db.ListOptions
 	UserID            int64
 	RepoID            int64
 	IssueID           int64
@@ -115,7 +115,7 @@ func (opts *FindNotificationOptions) ToCond() builder.Cond {
 func (opts *FindNotificationOptions) ToSession(e db.Engine) *xorm.Session {
 	sess := e.Where(opts.ToCond())
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 	}
 	return sess
 }
diff --git a/models/oauth2.go b/models/oauth2.go
deleted file mode 100644
index 7fdd5309fb..0000000000
--- a/models/oauth2.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2017 The Gitea Authors. All rights reserved.
-// Use of this source code is governed by a MIT-style
-// license that can be found in the LICENSE file.
-
-package models
-
-import "code.gitea.io/gitea/models/db"
-
-// GetActiveOAuth2ProviderLoginSources returns all actived LoginOAuth2 sources
-func GetActiveOAuth2ProviderLoginSources() ([]*LoginSource, error) {
-	sources := make([]*LoginSource, 0, 1)
-	if err := db.GetEngine(db.DefaultContext).Where("is_active = ? and type = ?", true, LoginOAuth2).Find(&sources); err != nil {
-		return nil, err
-	}
-	return sources, nil
-}
-
-// GetActiveOAuth2LoginSourceByName returns a OAuth2 LoginSource based on the given name
-func GetActiveOAuth2LoginSourceByName(name string) (*LoginSource, error) {
-	loginSource := new(LoginSource)
-	has, err := db.GetEngine(db.DefaultContext).Where("name = ? and type = ? and is_active = ?", name, LoginOAuth2, true).Get(loginSource)
-	if !has || err != nil {
-		return nil, err
-	}
-
-	return loginSource, nil
-}
diff --git a/models/org.go b/models/org.go
index bc6c47fd45..94939d2c74 100644
--- a/models/org.go
+++ b/models/org.go
@@ -78,7 +78,7 @@ func (org *User) GetMembers() (err error) {
 
 // FindOrgMembersOpts represensts find org members conditions
 type FindOrgMembersOpts struct {
-	ListOptions
+	db.ListOptions
 	OrgID      int64
 	PublicOnly bool
 }
@@ -574,7 +574,7 @@ func GetOrgUsersByUserID(uid int64, opts *SearchOrganizationsOptions) ([]*OrgUse
 	}
 
 	if opts.PageSize != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 	}
 
 	err := sess.
@@ -594,7 +594,7 @@ func getOrgUsersByOrgID(e db.Engine, opts *FindOrgMembersOpts) ([]*OrgUser, erro
 		sess.And("is_public = ?", true)
 	}
 	if opts.ListOptions.PageSize > 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 
 		ous := make([]*OrgUser, 0, opts.PageSize)
 		return ous, sess.Find(&ous)
diff --git a/models/org_team.go b/models/org_team.go
index 7ca715bb78..fc6a5f2c3b 100644
--- a/models/org_team.go
+++ b/models/org_team.go
@@ -47,7 +47,7 @@ func init() {
 
 // SearchTeamOptions holds the search options
 type SearchTeamOptions struct {
-	ListOptions
+	db.ListOptions
 	UserID      int64
 	Keyword     string
 	OrgID       int64
@@ -56,7 +56,7 @@ type SearchTeamOptions struct {
 
 // SearchMembersOptions holds the search options
 type SearchMembersOptions struct {
-	ListOptions
+	db.ListOptions
 }
 
 // SearchTeam search for teams. Caller is responsible to check permissions.
@@ -176,7 +176,7 @@ func (t *Team) GetRepositories(opts *SearchTeamOptions) error {
 		return t.getRepositories(db.GetEngine(db.DefaultContext))
 	}
 
-	return t.getRepositories(getPaginatedSession(opts))
+	return t.getRepositories(db.GetPaginatedSession(opts))
 }
 
 func (t *Team) getMembers(e db.Engine) (err error) {
@@ -190,7 +190,7 @@ func (t *Team) GetMembers(opts *SearchMembersOptions) (err error) {
 		return t.getMembers(db.GetEngine(db.DefaultContext))
 	}
 
-	return t.getMembers(getPaginatedSession(opts))
+	return t.getMembers(db.GetPaginatedSession(opts))
 }
 
 // AddMember adds new membership of the team to the organization,
diff --git a/models/org_test.go b/models/org_test.go
index 75dfc4262d..2df89b2afc 100644
--- a/models/org_test.go
+++ b/models/org_test.go
@@ -399,7 +399,7 @@ func TestGetOrgUsersByOrgID(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
 	orgUsers, err := GetOrgUsersByOrgID(&FindOrgMembersOpts{
-		ListOptions: ListOptions{},
+		ListOptions: db.ListOptions{},
 		OrgID:       3,
 		PublicOnly:  false,
 	})
@@ -420,7 +420,7 @@ func TestGetOrgUsersByOrgID(t *testing.T) {
 	}
 
 	orgUsers, err = GetOrgUsersByOrgID(&FindOrgMembersOpts{
-		ListOptions: ListOptions{},
+		ListOptions: db.ListOptions{},
 		OrgID:       db.NonexistentID,
 		PublicOnly:  false,
 	})
diff --git a/models/pull_list.go b/models/pull_list.go
index 57e2f9c85f..57ef210213 100644
--- a/models/pull_list.go
+++ b/models/pull_list.go
@@ -17,7 +17,7 @@ import (
 
 // PullRequestsOptions holds the options for PRs
 type PullRequestsOptions struct {
-	ListOptions
+	db.ListOptions
 	State       string
 	SortType    string
 	Labels      []string
@@ -101,7 +101,7 @@ func PullRequests(baseRepoID int64, opts *PullRequestsOptions) ([]*PullRequest,
 		log.Error("listPullRequestStatement: %v", err)
 		return nil, maxResults, err
 	}
-	findSession = setSessionPagination(findSession, opts)
+	findSession = db.SetSessionPagination(findSession, opts)
 	prs := make([]*PullRequest, 0, opts.PageSize)
 	return prs, maxResults, findSession.Find(&prs)
 }
diff --git a/models/pull_sign.go b/models/pull_sign.go
index e7cf4ab666..2e7cbff48b 100644
--- a/models/pull_sign.go
+++ b/models/pull_sign.go
@@ -5,6 +5,7 @@
 package models
 
 import (
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -35,7 +36,7 @@ Loop:
 		case always:
 			break Loop
 		case pubkey:
-			keys, err := ListGPGKeys(u.ID, ListOptions{})
+			keys, err := ListGPGKeys(u.ID, db.ListOptions{})
 			if err != nil {
 				return false, "", nil, err
 			}
diff --git a/models/pull_test.go b/models/pull_test.go
index 6543d0ec96..2b7ef2f664 100644
--- a/models/pull_test.go
+++ b/models/pull_test.go
@@ -56,7 +56,7 @@ func TestPullRequest_LoadHeadRepo(t *testing.T) {
 func TestPullRequestsNewest(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 	prs, count, err := PullRequests(1, &PullRequestsOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page: 1,
 		},
 		State:    "open",
@@ -75,7 +75,7 @@ func TestPullRequestsNewest(t *testing.T) {
 func TestPullRequestsOldest(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 	prs, count, err := PullRequests(1, &PullRequestsOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page: 1,
 		},
 		State:    "open",
diff --git a/models/release.go b/models/release.go
index d6b629cfe8..4624791b8f 100644
--- a/models/release.go
+++ b/models/release.go
@@ -177,7 +177,7 @@ func GetReleaseByID(id int64) (*Release, error) {
 
 // FindReleasesOptions describes the conditions to Find releases
 type FindReleasesOptions struct {
-	ListOptions
+	db.ListOptions
 	IncludeDrafts bool
 	IncludeTags   bool
 	IsPreRelease  util.OptionalBool
@@ -214,7 +214,7 @@ func GetReleasesByRepoID(repoID int64, opts FindReleasesOptions) ([]*Release, er
 		Where(opts.toConds(repoID))
 
 	if opts.PageSize != 0 {
-		sess = setSessionPagination(sess, &opts.ListOptions)
+		sess = db.SetSessionPagination(sess, &opts.ListOptions)
 	}
 
 	rels := make([]*Release, 0, opts.PageSize)
diff --git a/models/repo.go b/models/repo.go
index ae149f467d..efd78c6042 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -1772,7 +1772,7 @@ func GetUserRepositories(opts *SearchRepoOptions) ([]*Repository, int64, error)
 
 	sess.Where(cond).OrderBy(opts.OrderBy.String())
 	repos := make([]*Repository, 0, opts.PageSize)
-	return repos, count, setSessionPagination(sess, opts).Find(&repos)
+	return repos, count, db.SetSessionPagination(sess, opts).Find(&repos)
 }
 
 // GetUserMirrorRepositories returns a list of mirror repositories of given user.
@@ -2057,13 +2057,13 @@ func CopyLFS(ctx context.Context, newRepo, oldRepo *Repository) error {
 }
 
 // GetForks returns all the forks of the repository
-func (repo *Repository) GetForks(listOptions ListOptions) ([]*Repository, error) {
+func (repo *Repository) GetForks(listOptions db.ListOptions) ([]*Repository, error) {
 	if listOptions.Page == 0 {
 		forks := make([]*Repository, 0, repo.NumForks)
 		return forks, db.GetEngine(db.DefaultContext).Find(&forks, &Repository{ForkID: repo.ID})
 	}
 
-	sess := getPaginatedSession(&listOptions)
+	sess := db.GetPaginatedSession(&listOptions)
 	forks := make([]*Repository, 0, listOptions.PageSize)
 	return forks, sess.Find(&forks, &Repository{ForkID: repo.ID})
 }
diff --git a/models/repo_collaboration.go b/models/repo_collaboration.go
index 08d2062dbb..08360c102d 100644
--- a/models/repo_collaboration.go
+++ b/models/repo_collaboration.go
@@ -64,13 +64,13 @@ func (repo *Repository) AddCollaborator(u *User) error {
 	return sess.Commit()
 }
 
-func (repo *Repository) getCollaborations(e db.Engine, listOptions ListOptions) ([]*Collaboration, error) {
+func (repo *Repository) getCollaborations(e db.Engine, listOptions db.ListOptions) ([]*Collaboration, error) {
 	if listOptions.Page == 0 {
 		collaborations := make([]*Collaboration, 0, 8)
 		return collaborations, e.Find(&collaborations, &Collaboration{RepoID: repo.ID})
 	}
 
-	e = setEnginePagination(e, &listOptions)
+	e = db.SetEnginePagination(e, &listOptions)
 
 	collaborations := make([]*Collaboration, 0, listOptions.PageSize)
 	return collaborations, e.Find(&collaborations, &Collaboration{RepoID: repo.ID})
@@ -82,7 +82,7 @@ type Collaborator struct {
 	Collaboration *Collaboration
 }
 
-func (repo *Repository) getCollaborators(e db.Engine, listOptions ListOptions) ([]*Collaborator, error) {
+func (repo *Repository) getCollaborators(e db.Engine, listOptions db.ListOptions) ([]*Collaborator, error) {
 	collaborations, err := repo.getCollaborations(e, listOptions)
 	if err != nil {
 		return nil, fmt.Errorf("getCollaborations: %v", err)
@@ -103,7 +103,7 @@ func (repo *Repository) getCollaborators(e db.Engine, listOptions ListOptions) (
 }
 
 // GetCollaborators returns the collaborators for a repository
-func (repo *Repository) GetCollaborators(listOptions ListOptions) ([]*Collaborator, error) {
+func (repo *Repository) GetCollaborators(listOptions db.ListOptions) ([]*Collaborator, error) {
 	return repo.getCollaborators(db.GetEngine(db.DefaultContext), listOptions)
 }
 
diff --git a/models/repo_collaboration_test.go b/models/repo_collaboration_test.go
index 5a3ffef5fa..326fb4dbf7 100644
--- a/models/repo_collaboration_test.go
+++ b/models/repo_collaboration_test.go
@@ -30,7 +30,7 @@ func TestRepository_GetCollaborators(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 	test := func(repoID int64) {
 		repo := db.AssertExistsAndLoadBean(t, &Repository{ID: repoID}).(*Repository)
-		collaborators, err := repo.GetCollaborators(ListOptions{})
+		collaborators, err := repo.GetCollaborators(db.ListOptions{})
 		assert.NoError(t, err)
 		expectedLen, err := db.GetEngine(db.DefaultContext).Count(&Collaboration{RepoID: repoID})
 		assert.NoError(t, err)
diff --git a/models/repo_generate.go b/models/repo_generate.go
index cb8bf45184..650da711a3 100644
--- a/models/repo_generate.go
+++ b/models/repo_generate.go
@@ -151,7 +151,7 @@ func GenerateAvatar(ctx context.Context, templateRepo, generateRepo *Repository)
 
 // GenerateIssueLabels generates issue labels from a template repository
 func GenerateIssueLabels(ctx context.Context, templateRepo, generateRepo *Repository) error {
-	templateLabels, err := getLabelsByRepoID(db.GetEngine(ctx), templateRepo.ID, "", ListOptions{})
+	templateLabels, err := getLabelsByRepoID(db.GetEngine(ctx), templateRepo.ID, "", db.ListOptions{})
 	if err != nil {
 		return err
 	}
diff --git a/models/repo_list.go b/models/repo_list.go
index 7179114f46..6804a997c8 100644
--- a/models/repo_list.go
+++ b/models/repo_list.go
@@ -135,7 +135,7 @@ func (repos MirrorRepositoryList) LoadAttributes() error {
 
 // SearchRepoOptions holds the search options
 type SearchRepoOptions struct {
-	ListOptions
+	db.ListOptions
 	Actor           *User
 	Keyword         string
 	OwnerID         int64
diff --git a/models/repo_list_test.go b/models/repo_list_test.go
index a1fd454c10..3c30cad564 100644
--- a/models/repo_list_test.go
+++ b/models/repo_list_test.go
@@ -18,7 +18,7 @@ func TestSearchRepository(t *testing.T) {
 
 	// test search public repository on explore page
 	repos, count, err := SearchRepositoryByName(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -33,7 +33,7 @@ func TestSearchRepository(t *testing.T) {
 	assert.Equal(t, int64(1), count)
 
 	repos, count, err = SearchRepositoryByName(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -47,7 +47,7 @@ func TestSearchRepository(t *testing.T) {
 
 	// test search private repository on explore page
 	repos, count, err = SearchRepositoryByName(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -63,7 +63,7 @@ func TestSearchRepository(t *testing.T) {
 	assert.Equal(t, int64(1), count)
 
 	repos, count, err = SearchRepositoryByName(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -85,7 +85,7 @@ func TestSearchRepository(t *testing.T) {
 
 	// Test search within description
 	repos, count, err = SearchRepository(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -102,7 +102,7 @@ func TestSearchRepository(t *testing.T) {
 
 	// Test NOT search within description
 	repos, count, err = SearchRepository(&SearchRepoOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     1,
 			PageSize: 10,
 		},
@@ -122,142 +122,142 @@ func TestSearchRepository(t *testing.T) {
 	}{
 		{
 			name:  "PublicRepositoriesByName",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{PageSize: 10}, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{PageSize: 10}, Collaborate: util.OptionalBoolFalse},
 			count: 7,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesByName",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 1, PageSize: 10}, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 1, PageSize: 10}, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesByNameWithPagesizeLimitFirstPage",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 1, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 1, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesByNameWithPagesizeLimitSecondPage",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 2, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 2, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesByNameWithPagesizeLimitThirdPage",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 3, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 3, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesByNameWithPagesizeLimitFourthPage",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 3, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 3, PageSize: 5}, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "PublicRepositoriesOfUser",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Collaborate: util.OptionalBoolFalse},
 			count: 2,
 		},
 		{
 			name:  "PublicRepositoriesOfUser2",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Collaborate: util.OptionalBoolFalse},
 			count: 0,
 		},
 		{
 			name:  "PublicRepositoriesOfUser3",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Collaborate: util.OptionalBoolFalse},
 			count: 2,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUser",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 4,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUser2",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 0,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUser3",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 4,
 		},
 		{
 			name:  "PublicRepositoriesOfUserIncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15},
 			count: 5,
 		},
 		{
 			name:  "PublicRepositoriesOfUser2IncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 18},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 18},
 			count: 1,
 		},
 		{
 			name:  "PublicRepositoriesOfUser3IncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 20},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 20},
 			count: 3,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUserIncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true},
 			count: 9,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUser2IncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true},
 			count: 4,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfUser3IncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Private: true},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 20, Private: true},
 			count: 7,
 		},
 		{
 			name:  "PublicRepositoriesOfOrganization",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, Collaborate: util.OptionalBoolFalse},
 			count: 1,
 		},
 		{
 			name:  "PublicAndPrivateRepositoriesOfOrganization",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, Private: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, Private: true, Collaborate: util.OptionalBoolFalse},
 			count: 2,
 		},
 		{
 			name:  "AllPublic/PublicRepositoriesByName",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{PageSize: 10}, AllPublic: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{PageSize: 10}, AllPublic: true, Collaborate: util.OptionalBoolFalse},
 			count: 7,
 		},
 		{
 			name:  "AllPublic/PublicAndPrivateRepositoriesByName",
-			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: ListOptions{Page: 1, PageSize: 10}, Private: true, AllPublic: true, Collaborate: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{Keyword: "big_test_", ListOptions: db.ListOptions{Page: 1, PageSize: 10}, Private: true, AllPublic: true, Collaborate: util.OptionalBoolFalse},
 			count: 14,
 		},
 		{
 			name:  "AllPublic/PublicRepositoriesOfUserIncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, AllPublic: true, Template: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, AllPublic: true, Template: util.OptionalBoolFalse},
 			count: 28,
 		},
 		{
 			name:  "AllPublic/PublicAndPrivateRepositoriesOfUserIncludingCollaborative",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, AllPublic: true, AllLimited: true, Template: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, AllPublic: true, AllLimited: true, Template: util.OptionalBoolFalse},
 			count: 33,
 		},
 		{
 			name:  "AllPublic/PublicAndPrivateRepositoriesOfUserIncludingCollaborativeByName",
-			opts:  &SearchRepoOptions{Keyword: "test", ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, AllPublic: true},
+			opts:  &SearchRepoOptions{Keyword: "test", ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 15, Private: true, AllPublic: true},
 			count: 15,
 		},
 		{
 			name:  "AllPublic/PublicAndPrivateRepositoriesOfUser2IncludingCollaborativeByName",
-			opts:  &SearchRepoOptions{Keyword: "test", ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true, AllPublic: true},
+			opts:  &SearchRepoOptions{Keyword: "test", ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 18, Private: true, AllPublic: true},
 			count: 13,
 		},
 		{
 			name:  "AllPublic/PublicRepositoriesOfOrganization",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, AllPublic: true, Collaborate: util.OptionalBoolFalse, Template: util.OptionalBoolFalse},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, OwnerID: 17, AllPublic: true, Collaborate: util.OptionalBoolFalse, Template: util.OptionalBoolFalse},
 			count: 28,
 		},
 		{
 			name:  "AllTemplates",
-			opts:  &SearchRepoOptions{ListOptions: ListOptions{Page: 1, PageSize: 10}, Template: util.OptionalBoolTrue},
+			opts:  &SearchRepoOptions{ListOptions: db.ListOptions{Page: 1, PageSize: 10}, Template: util.OptionalBoolTrue},
 			count: 2,
 		},
 	}
diff --git a/models/repo_sign.go b/models/repo_sign.go
index be9309ed4e..ae0895df76 100644
--- a/models/repo_sign.go
+++ b/models/repo_sign.go
@@ -7,6 +7,7 @@ package models
 import (
 	"strings"
 
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/process"
@@ -120,7 +121,7 @@ Loop:
 		case always:
 			break Loop
 		case pubkey:
-			keys, err := ListGPGKeys(u.ID, ListOptions{})
+			keys, err := ListGPGKeys(u.ID, db.ListOptions{})
 			if err != nil {
 				return false, "", nil, err
 			}
@@ -156,7 +157,7 @@ Loop:
 		case always:
 			break Loop
 		case pubkey:
-			keys, err := ListGPGKeys(u.ID, ListOptions{})
+			keys, err := ListGPGKeys(u.ID, db.ListOptions{})
 			if err != nil {
 				return false, "", nil, err
 			}
@@ -209,7 +210,7 @@ Loop:
 		case always:
 			break Loop
 		case pubkey:
-			keys, err := ListGPGKeys(u.ID, ListOptions{})
+			keys, err := ListGPGKeys(u.ID, db.ListOptions{})
 			if err != nil {
 				return false, "", nil, err
 			}
diff --git a/models/repo_transfer.go b/models/repo_transfer.go
index e3eb756eb4..fe50c1cc04 100644
--- a/models/repo_transfer.go
+++ b/models/repo_transfer.go
@@ -266,7 +266,7 @@ func TransferOwnership(doer *User, newOwnerName string, repo *Repository) (err e
 	}
 
 	// Remove redundant collaborators.
-	collaborators, err := repo.getCollaborators(sess, ListOptions{})
+	collaborators, err := repo.getCollaborators(sess, db.ListOptions{})
 	if err != nil {
 		return fmt.Errorf("getCollaborators: %v", err)
 	}
diff --git a/models/repo_unit.go b/models/repo_unit.go
index c35312be60..7061119bd8 100644
--- a/models/repo_unit.go
+++ b/models/repo_unit.go
@@ -8,6 +8,7 @@ import (
 	"fmt"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/timeutil"
 
@@ -153,7 +154,7 @@ func (cfg *PullRequestsConfig) AllowedMergeStyleCount() int {
 func (r *RepoUnit) BeforeSet(colName string, val xorm.Cell) {
 	switch colName {
 	case "type":
-		switch UnitType(Cell2Int64(val)) {
+		switch UnitType(login.Cell2Int64(val)) {
 		case UnitTypeCode, UnitTypeReleases, UnitTypeWiki, UnitTypeProjects:
 			r.Config = new(UnitConfig)
 		case UnitTypeExternalWiki:
diff --git a/models/repo_watch.go b/models/repo_watch.go
index d3720fe857..b37d47874e 100644
--- a/models/repo_watch.go
+++ b/models/repo_watch.go
@@ -165,12 +165,12 @@ func getRepoWatchersIDs(e db.Engine, repoID int64) ([]int64, error) {
 }
 
 // GetWatchers returns range of users watching given repository.
-func (repo *Repository) GetWatchers(opts ListOptions) ([]*User, error) {
+func (repo *Repository) GetWatchers(opts db.ListOptions) ([]*User, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("watch.repo_id=?", repo.ID).
 		Join("LEFT", "watch", "`user`.id=`watch`.user_id").
 		And("`watch`.mode<>?", RepoWatchModeDont)
 	if opts.Page > 0 {
-		sess = setSessionPagination(sess, &opts)
+		sess = db.SetSessionPagination(sess, &opts)
 		users := make([]*User, 0, opts.PageSize)
 
 		return users, sess.Find(&users)
diff --git a/models/repo_watch_test.go b/models/repo_watch_test.go
index 1a94b8ad30..52222af2ca 100644
--- a/models/repo_watch_test.go
+++ b/models/repo_watch_test.go
@@ -60,7 +60,7 @@ func TestRepository_GetWatchers(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
 	repo := db.AssertExistsAndLoadBean(t, &Repository{ID: 1}).(*Repository)
-	watchers, err := repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err := repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, repo.NumWatches)
 	for _, watcher := range watchers {
@@ -68,7 +68,7 @@ func TestRepository_GetWatchers(t *testing.T) {
 	}
 
 	repo = db.AssertExistsAndLoadBean(t, &Repository{ID: 9}).(*Repository)
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, 0)
 }
@@ -114,7 +114,7 @@ func TestWatchIfAuto(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
 	repo := db.AssertExistsAndLoadBean(t, &Repository{ID: 1}).(*Repository)
-	watchers, err := repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err := repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, repo.NumWatches)
 
@@ -124,13 +124,13 @@ func TestWatchIfAuto(t *testing.T) {
 
 	// Must not add watch
 	assert.NoError(t, WatchIfAuto(8, 1, true))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
 	// Should not add watch
 	assert.NoError(t, WatchIfAuto(10, 1, true))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
@@ -138,31 +138,31 @@ func TestWatchIfAuto(t *testing.T) {
 
 	// Must not add watch
 	assert.NoError(t, WatchIfAuto(8, 1, true))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
 	// Should not add watch
 	assert.NoError(t, WatchIfAuto(12, 1, false))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
 	// Should add watch
 	assert.NoError(t, WatchIfAuto(12, 1, true))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount+1)
 
 	// Should remove watch, inhibit from adding auto
 	assert.NoError(t, WatchRepo(12, 1, false))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 
 	// Must not add watch
 	assert.NoError(t, WatchIfAuto(12, 1, true))
-	watchers, err = repo.GetWatchers(ListOptions{Page: 1})
+	watchers, err = repo.GetWatchers(db.ListOptions{Page: 1})
 	assert.NoError(t, err)
 	assert.Len(t, watchers, prevCount)
 }
diff --git a/models/review.go b/models/review.go
index 3f81c39b2f..5b12e6ffa2 100644
--- a/models/review.go
+++ b/models/review.go
@@ -172,7 +172,7 @@ func GetReviewByID(id int64) (*Review, error) {
 
 // FindReviewOptions represent possible filters to find reviews
 type FindReviewOptions struct {
-	ListOptions
+	db.ListOptions
 	Type         ReviewType
 	IssueID      int64
 	ReviewerID   int64
@@ -200,7 +200,7 @@ func findReviews(e db.Engine, opts FindReviewOptions) ([]*Review, error) {
 	reviews := make([]*Review, 0, 10)
 	sess := e.Where(opts.toCond())
 	if opts.Page > 0 {
-		sess = setSessionPagination(sess, &opts)
+		sess = db.SetSessionPagination(sess, &opts)
 	}
 	return reviews, sess.
 		Asc("created_unix").
diff --git a/models/ssh_key.go b/models/ssh_key.go
index 41016537eb..c08fb72e75 100644
--- a/models/ssh_key.go
+++ b/models/ssh_key.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
@@ -197,10 +198,10 @@ func SearchPublicKey(uid int64, fingerprint string) ([]*PublicKey, error) {
 }
 
 // ListPublicKeys returns a list of public keys belongs to given user.
-func ListPublicKeys(uid int64, listOptions ListOptions) ([]*PublicKey, error) {
+func ListPublicKeys(uid int64, listOptions db.ListOptions) ([]*PublicKey, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("owner_id = ? AND type != ?", uid, KeyTypePrincipal)
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		keys := make([]*PublicKey, 0, listOptions.PageSize)
 		return keys, sess.Find(&keys)
@@ -255,7 +256,7 @@ func deletePublicKeys(e db.Engine, keyIDs ...int64) error {
 
 // PublicKeysAreExternallyManaged returns whether the provided KeyID represents an externally managed Key
 func PublicKeysAreExternallyManaged(keys []*PublicKey) ([]bool, error) {
-	sources := make([]*LoginSource, 0, 5)
+	sources := make([]*login.Source, 0, 5)
 	externals := make([]bool, len(keys))
 keyloop:
 	for i, key := range keys {
@@ -264,7 +265,7 @@ keyloop:
 			continue keyloop
 		}
 
-		var source *LoginSource
+		var source *login.Source
 
 	sourceloop:
 		for _, s := range sources {
@@ -276,11 +277,11 @@ keyloop:
 
 		if source == nil {
 			var err error
-			source, err = GetLoginSourceByID(key.LoginSourceID)
+			source, err = login.GetSourceByID(key.LoginSourceID)
 			if err != nil {
-				if IsErrLoginSourceNotExist(err) {
+				if login.IsErrSourceNotExist(err) {
 					externals[i] = false
-					sources[i] = &LoginSource{
+					sources[i] = &login.Source{
 						ID: key.LoginSourceID,
 					}
 					continue keyloop
@@ -289,7 +290,7 @@ keyloop:
 			}
 		}
 
-		if sshKeyProvider, ok := source.Cfg.(SSHKeyProvider); ok && sshKeyProvider.ProvidesSSHKeys() {
+		if sshKeyProvider, ok := source.Cfg.(login.SSHKeyProvider); ok && sshKeyProvider.ProvidesSSHKeys() {
 			// Disable setting SSH keys for this user
 			externals[i] = true
 		}
@@ -307,14 +308,14 @@ func PublicKeyIsExternallyManaged(id int64) (bool, error) {
 	if key.LoginSourceID == 0 {
 		return false, nil
 	}
-	source, err := GetLoginSourceByID(key.LoginSourceID)
+	source, err := login.GetSourceByID(key.LoginSourceID)
 	if err != nil {
-		if IsErrLoginSourceNotExist(err) {
+		if login.IsErrSourceNotExist(err) {
 			return false, nil
 		}
 		return false, err
 	}
-	if sshKeyProvider, ok := source.Cfg.(SSHKeyProvider); ok && sshKeyProvider.ProvidesSSHKeys() {
+	if sshKeyProvider, ok := source.Cfg.(login.SSHKeyProvider); ok && sshKeyProvider.ProvidesSSHKeys() {
 		// Disable setting SSH keys for this user
 		return true, nil
 	}
@@ -387,7 +388,7 @@ func deleteKeysMarkedForDeletion(keys []string) (bool, error) {
 }
 
 // AddPublicKeysBySource add a users public keys. Returns true if there are changes.
-func AddPublicKeysBySource(usr *User, s *LoginSource, sshPublicKeys []string) bool {
+func AddPublicKeysBySource(usr *User, s *login.Source, sshPublicKeys []string) bool {
 	var sshKeysNeedUpdate bool
 	for _, sshKey := range sshPublicKeys {
 		var err error
@@ -425,7 +426,7 @@ func AddPublicKeysBySource(usr *User, s *LoginSource, sshPublicKeys []string) bo
 }
 
 // SynchronizePublicKeys updates a users public keys. Returns true if there are changes.
-func SynchronizePublicKeys(usr *User, s *LoginSource, sshPublicKeys []string) bool {
+func SynchronizePublicKeys(usr *User, s *login.Source, sshPublicKeys []string) bool {
 	var sshKeysNeedUpdate bool
 
 	log.Trace("synchronizePublicKeys[%s]: Handling Public SSH Key synchronization for user %s", s.Name, usr.Name)
diff --git a/models/ssh_key_deploy.go b/models/ssh_key_deploy.go
index 3b9a168280..34cf03e925 100644
--- a/models/ssh_key_deploy.go
+++ b/models/ssh_key_deploy.go
@@ -271,7 +271,7 @@ func deleteDeployKey(sess db.Engine, doer *User, id int64) error {
 
 // ListDeployKeysOptions are options for ListDeployKeys
 type ListDeployKeysOptions struct {
-	ListOptions
+	db.ListOptions
 	RepoID      int64
 	KeyID       int64
 	Fingerprint string
@@ -300,7 +300,7 @@ func listDeployKeys(e db.Engine, opts *ListDeployKeysOptions) ([]*DeployKey, err
 	sess := e.Where(opts.toCond())
 
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 
 		keys := make([]*DeployKey, 0, opts.PageSize)
 		return keys, sess.Find(&keys)
diff --git a/models/ssh_key_principals.go b/models/ssh_key_principals.go
index 383693e14e..44b2ee0bb4 100644
--- a/models/ssh_key_principals.go
+++ b/models/ssh_key_principals.go
@@ -112,10 +112,10 @@ func CheckPrincipalKeyString(user *User, content string) (_ string, err error) {
 }
 
 // ListPrincipalKeys returns a list of principals belongs to given user.
-func ListPrincipalKeys(uid int64, listOptions ListOptions) ([]*PublicKey, error) {
+func ListPrincipalKeys(uid int64, listOptions db.ListOptions) ([]*PublicKey, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("owner_id = ? AND type = ?", uid, KeyTypePrincipal)
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		keys := make([]*PublicKey, 0, listOptions.PageSize)
 		return keys, sess.Find(&keys)
diff --git a/models/star.go b/models/star.go
index ad583f1998..ee7791513d 100644
--- a/models/star.go
+++ b/models/star.go
@@ -74,11 +74,11 @@ func isStaring(e db.Engine, userID, repoID int64) bool {
 }
 
 // GetStargazers returns the users that starred the repo.
-func (repo *Repository) GetStargazers(opts ListOptions) ([]*User, error) {
+func (repo *Repository) GetStargazers(opts db.ListOptions) ([]*User, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("star.repo_id = ?", repo.ID).
 		Join("LEFT", "star", "`user`.id = star.uid")
 	if opts.Page > 0 {
-		sess = setSessionPagination(sess, &opts)
+		sess = db.SetSessionPagination(sess, &opts)
 
 		users := make([]*User, 0, opts.PageSize)
 		return users, sess.Find(&users)
diff --git a/models/star_test.go b/models/star_test.go
index c0c0a607be..326da8a861 100644
--- a/models/star_test.go
+++ b/models/star_test.go
@@ -34,7 +34,7 @@ func TestRepository_GetStargazers(t *testing.T) {
 	// repo with stargazers
 	assert.NoError(t, db.PrepareTestDatabase())
 	repo := db.AssertExistsAndLoadBean(t, &Repository{ID: 4}).(*Repository)
-	gazers, err := repo.GetStargazers(ListOptions{Page: 0})
+	gazers, err := repo.GetStargazers(db.ListOptions{Page: 0})
 	assert.NoError(t, err)
 	if assert.Len(t, gazers, 1) {
 		assert.Equal(t, int64(2), gazers[0].ID)
@@ -45,7 +45,7 @@ func TestRepository_GetStargazers2(t *testing.T) {
 	// repo with stargazers
 	assert.NoError(t, db.PrepareTestDatabase())
 	repo := db.AssertExistsAndLoadBean(t, &Repository{ID: 3}).(*Repository)
-	gazers, err := repo.GetStargazers(ListOptions{Page: 0})
+	gazers, err := repo.GetStargazers(db.ListOptions{Page: 0})
 	assert.NoError(t, err)
 	assert.Len(t, gazers, 0)
 }
diff --git a/models/statistic.go b/models/statistic.go
index d192a971f5..43b1afbc48 100644
--- a/models/statistic.go
+++ b/models/statistic.go
@@ -4,7 +4,10 @@
 
 package models
 
-import "code.gitea.io/gitea/models/db"
+import (
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
+)
 
 // Statistic contains the database statistics
 type Statistic struct {
@@ -52,7 +55,7 @@ func GetStatistic() (stats Statistic) {
 	stats.Counter.Follow, _ = db.GetEngine(db.DefaultContext).Count(new(Follow))
 	stats.Counter.Mirror, _ = db.GetEngine(db.DefaultContext).Count(new(Mirror))
 	stats.Counter.Release, _ = db.GetEngine(db.DefaultContext).Count(new(Release))
-	stats.Counter.LoginSource = CountLoginSources()
+	stats.Counter.LoginSource = login.CountSources()
 	stats.Counter.Webhook, _ = db.GetEngine(db.DefaultContext).Count(new(Webhook))
 	stats.Counter.Milestone, _ = db.GetEngine(db.DefaultContext).Count(new(Milestone))
 	stats.Counter.Label, _ = db.GetEngine(db.DefaultContext).Count(new(Label))
diff --git a/models/token.go b/models/token.go
index 48ae795424..07d013ac8e 100644
--- a/models/token.go
+++ b/models/token.go
@@ -147,7 +147,7 @@ func AccessTokenByNameExists(token *AccessToken) (bool, error) {
 
 // ListAccessTokensOptions contain filter options
 type ListAccessTokensOptions struct {
-	ListOptions
+	db.ListOptions
 	Name   string
 	UserID int64
 }
@@ -163,7 +163,7 @@ func ListAccessTokens(opts ListAccessTokensOptions) ([]*AccessToken, error) {
 	sess = sess.Desc("id")
 
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, &opts)
+		sess = db.SetSessionPagination(sess, &opts)
 
 		tokens := make([]*AccessToken, 0, opts.PageSize)
 		return tokens, sess.Find(&tokens)
diff --git a/models/topic.go b/models/topic.go
index cf563e9b11..6eb8c67b8d 100644
--- a/models/topic.go
+++ b/models/topic.go
@@ -164,7 +164,7 @@ func removeTopicsFromRepo(e db.Engine, repoID int64) error {
 
 // FindTopicOptions represents the options when fdin topics
 type FindTopicOptions struct {
-	ListOptions
+	db.ListOptions
 	RepoID  int64
 	Keyword string
 }
@@ -189,7 +189,7 @@ func FindTopics(opts *FindTopicOptions) ([]*Topic, int64, error) {
 		sess.Join("INNER", "repo_topic", "repo_topic.topic_id = topic.id")
 	}
 	if opts.PageSize != 0 && opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 	}
 	topics := make([]*Topic, 0, 10)
 	total, err := sess.Desc("topic.repo_count").FindAndCount(&topics)
diff --git a/models/topic_test.go b/models/topic_test.go
index 9f6352e7e7..b069deaba3 100644
--- a/models/topic_test.go
+++ b/models/topic_test.go
@@ -23,7 +23,7 @@ func TestAddTopic(t *testing.T) {
 	assert.Len(t, topics, totalNrOfTopics)
 
 	topics, total, err := FindTopics(&FindTopicOptions{
-		ListOptions: ListOptions{Page: 1, PageSize: 2},
+		ListOptions: db.ListOptions{Page: 1, PageSize: 2},
 	})
 	assert.NoError(t, err)
 	assert.Len(t, topics, 2)
diff --git a/models/user.go b/models/user.go
index fc5d417d36..fb40a0acc8 100644
--- a/models/user.go
+++ b/models/user.go
@@ -21,6 +21,7 @@ import (
 	"unicode/utf8"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
@@ -106,7 +107,7 @@ type User struct {
 	// is to change his/her password after registration.
 	MustChangePassword bool `xorm:"NOT NULL DEFAULT false"`
 
-	LoginType   LoginType
+	LoginType   login.Type
 	LoginSource int64 `xorm:"NOT NULL DEFAULT 0"`
 	LoginName   string
 	Type        UserType
@@ -169,7 +170,7 @@ func init() {
 
 // SearchOrganizationsOptions options to filter organizations
 type SearchOrganizationsOptions struct {
-	ListOptions
+	db.ListOptions
 	All bool
 }
 
@@ -241,12 +242,12 @@ func GetAllUsers() ([]*User, error) {
 
 // IsLocal returns true if user login type is LoginPlain.
 func (u *User) IsLocal() bool {
-	return u.LoginType <= LoginPlain
+	return u.LoginType <= login.Plain
 }
 
 // IsOAuth2 returns true if user login type is LoginOAuth2.
 func (u *User) IsOAuth2() bool {
-	return u.LoginType == LoginOAuth2
+	return u.LoginType == login.OAuth2
 }
 
 // HasForkedRepo checks if user has already forked a repository with given ID.
@@ -331,13 +332,13 @@ func (u *User) GenerateEmailActivateCode(email string) string {
 }
 
 // GetFollowers returns range of user's followers.
-func (u *User) GetFollowers(listOptions ListOptions) ([]*User, error) {
+func (u *User) GetFollowers(listOptions db.ListOptions) ([]*User, error) {
 	sess := db.GetEngine(db.DefaultContext).
 		Where("follow.follow_id=?", u.ID).
 		Join("LEFT", "follow", "`user`.id=follow.user_id")
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		users := make([]*User, 0, listOptions.PageSize)
 		return users, sess.Find(&users)
@@ -353,13 +354,13 @@ func (u *User) IsFollowing(followID int64) bool {
 }
 
 // GetFollowing returns range of user's following.
-func (u *User) GetFollowing(listOptions ListOptions) ([]*User, error) {
+func (u *User) GetFollowing(listOptions db.ListOptions) ([]*User, error) {
 	sess := db.GetEngine(db.DefaultContext).
 		Where("follow.user_id=?", u.ID).
 		Join("LEFT", "follow", "`user`.id=follow.follow_id")
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		users := make([]*User, 0, listOptions.PageSize)
 		return users, sess.Find(&users)
@@ -542,7 +543,7 @@ func (u *User) GetOrganizationCount() (int64, error) {
 }
 
 // GetRepositories returns repositories that user owns, including private repositories.
-func (u *User) GetRepositories(listOpts ListOptions, names ...string) (err error) {
+func (u *User) GetRepositories(listOpts db.ListOptions, names ...string) (err error) {
 	u.Repos, _, err = GetUserRepositories(&SearchRepoOptions{Actor: u, Private: true, ListOptions: listOpts, LowerNames: names})
 	return err
 }
@@ -1252,7 +1253,7 @@ func deleteUser(e db.Engine, u *User) error {
 	// ***** END: PublicKey *****
 
 	// ***** START: GPGPublicKey *****
-	keys, err := listGPGKeys(e, u.ID, ListOptions{})
+	keys, err := listGPGKeys(e, u.ID, db.ListOptions{})
 	if err != nil {
 		return fmt.Errorf("ListGPGKeys: %v", err)
 	}
@@ -1488,7 +1489,7 @@ func GetUserIDsByNames(names []string, ignoreNonExistent bool) ([]int64, error)
 }
 
 // GetUsersBySource returns a list of Users for a login source
-func GetUsersBySource(s *LoginSource) ([]*User, error) {
+func GetUsersBySource(s *login.Source) ([]*User, error) {
 	var users []*User
 	err := db.GetEngine(db.DefaultContext).Where("login_type = ? AND login_source = ?", s.Type, s.ID).Find(&users)
 	return users, err
@@ -1592,7 +1593,7 @@ func GetUser(user *User) (bool, error) {
 
 // SearchUserOptions contains the options for searching
 type SearchUserOptions struct {
-	ListOptions
+	db.ListOptions
 	Keyword       string
 	Type          UserType
 	UID           int64
@@ -1675,7 +1676,7 @@ func SearchUsers(opts *SearchUserOptions) (users []*User, _ int64, _ error) {
 
 	sess := db.GetEngine(db.DefaultContext).Where(cond).OrderBy(opts.OrderBy.String())
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 	}
 
 	users = make([]*User, 0, opts.PageSize)
@@ -1683,7 +1684,7 @@ func SearchUsers(opts *SearchUserOptions) (users []*User, _ int64, _ error) {
 }
 
 // GetStarredRepos returns the repos starred by a particular user
-func GetStarredRepos(userID int64, private bool, listOptions ListOptions) ([]*Repository, error) {
+func GetStarredRepos(userID int64, private bool, listOptions db.ListOptions) ([]*Repository, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("star.uid=?", userID).
 		Join("LEFT", "star", "`repository`.id=`star`.repo_id")
 	if !private {
@@ -1691,7 +1692,7 @@ func GetStarredRepos(userID int64, private bool, listOptions ListOptions) ([]*Re
 	}
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		repos := make([]*Repository, 0, listOptions.PageSize)
 		return repos, sess.Find(&repos)
@@ -1702,7 +1703,7 @@ func GetStarredRepos(userID int64, private bool, listOptions ListOptions) ([]*Re
 }
 
 // GetWatchedRepos returns the repos watched by a particular user
-func GetWatchedRepos(userID int64, private bool, listOptions ListOptions) ([]*Repository, int64, error) {
+func GetWatchedRepos(userID int64, private bool, listOptions db.ListOptions) ([]*Repository, int64, error) {
 	sess := db.GetEngine(db.DefaultContext).Where("watch.user_id=?", userID).
 		And("`watch`.mode<>?", RepoWatchModeDont).
 		Join("LEFT", "watch", "`repository`.id=`watch`.repo_id")
@@ -1711,7 +1712,7 @@ func GetWatchedRepos(userID int64, private bool, listOptions ListOptions) ([]*Re
 	}
 
 	if listOptions.Page != 0 {
-		sess = setSessionPagination(sess, &listOptions)
+		sess = db.SetSessionPagination(sess, &listOptions)
 
 		repos := make([]*Repository, 0, listOptions.PageSize)
 		total, err := sess.FindAndCount(&repos)
diff --git a/models/user_mail.go b/models/user_mail.go
index 51d34d2682..caa931788d 100644
--- a/models/user_mail.go
+++ b/models/user_mail.go
@@ -301,7 +301,7 @@ const (
 
 // SearchEmailOptions are options to search e-mail addresses for the admin panel
 type SearchEmailOptions struct {
-	ListOptions
+	db.ListOptions
 	Keyword     string
 	SortType    SearchEmailOrderBy
 	IsPrimary   util.OptionalBool
@@ -357,7 +357,7 @@ func SearchEmails(opts *SearchEmailOptions) ([]*SearchEmailResult, int64, error)
 		orderby = SearchEmailOrderByEmail.String()
 	}
 
-	opts.setDefaultValues()
+	opts.SetDefaultValues()
 
 	emails := make([]*SearchEmailResult, 0, opts.PageSize)
 	err = db.GetEngine(db.DefaultContext).Table("email_address").
diff --git a/models/user_mail_test.go b/models/user_mail_test.go
index 22e5f786bf..384f28b7bf 100644
--- a/models/user_mail_test.go
+++ b/models/user_mail_test.go
@@ -189,7 +189,7 @@ func TestListEmails(t *testing.T) {
 
 	// Must find all users and their emails
 	opts := &SearchEmailOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: 10000,
 		},
 	}
@@ -241,7 +241,7 @@ func TestListEmails(t *testing.T) {
 
 	// Must find more than one page, but retrieve only one
 	opts = &SearchEmailOptions{
-		ListOptions: ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: 5,
 			Page:     1,
 		},
diff --git a/models/user_test.go b/models/user_test.go
index 6c616a60a9..bf796a8c62 100644
--- a/models/user_test.go
+++ b/models/user_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/structs"
 	"code.gitea.io/gitea/modules/util"
@@ -18,6 +19,14 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func TestOAuth2Application_LoadUser(t *testing.T) {
+	assert.NoError(t, db.PrepareTestDatabase())
+	app := db.AssertExistsAndLoadBean(t, &login.OAuth2Application{ID: 1}).(*login.OAuth2Application)
+	user, err := GetUserByID(app.UID)
+	assert.NoError(t, err)
+	assert.NotNil(t, user)
+}
+
 func TestUserIsPublicMember(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
@@ -116,19 +125,19 @@ func TestSearchUsers(t *testing.T) {
 		testSuccess(opts, expectedOrgIDs)
 	}
 
-	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 1, PageSize: 2}},
+	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 1, PageSize: 2}},
 		[]int64{3, 6})
 
-	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 2, PageSize: 2}},
+	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 2, PageSize: 2}},
 		[]int64{7, 17})
 
-	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 3, PageSize: 2}},
+	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 3, PageSize: 2}},
 		[]int64{19, 25})
 
-	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 4, PageSize: 2}},
+	testOrgSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 4, PageSize: 2}},
 		[]int64{26})
 
-	testOrgSuccess(&SearchUserOptions{ListOptions: ListOptions{Page: 5, PageSize: 2}},
+	testOrgSuccess(&SearchUserOptions{ListOptions: db.ListOptions{Page: 5, PageSize: 2}},
 		[]int64{})
 
 	// test users
@@ -137,20 +146,20 @@ func TestSearchUsers(t *testing.T) {
 		testSuccess(opts, expectedUserIDs)
 	}
 
-	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}},
+	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 1}},
 		[]int64{1, 2, 4, 5, 8, 9, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 27, 28, 29, 30})
 
-	testUserSuccess(&SearchUserOptions{ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolFalse},
+	testUserSuccess(&SearchUserOptions{ListOptions: db.ListOptions{Page: 1}, IsActive: util.OptionalBoolFalse},
 		[]int64{9})
 
-	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
+	testUserSuccess(&SearchUserOptions{OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
 		[]int64{1, 2, 4, 5, 8, 10, 11, 12, 13, 14, 15, 16, 18, 20, 21, 24, 28, 29, 30})
 
-	testUserSuccess(&SearchUserOptions{Keyword: "user1", OrderBy: "id ASC", ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
+	testUserSuccess(&SearchUserOptions{Keyword: "user1", OrderBy: "id ASC", ListOptions: db.ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
 		[]int64{1, 10, 11, 12, 13, 14, 15, 16, 18})
 
 	// order by name asc default
-	testUserSuccess(&SearchUserOptions{Keyword: "user1", ListOptions: ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
+	testUserSuccess(&SearchUserOptions{Keyword: "user1", ListOptions: db.ListOptions{Page: 1}, IsActive: util.OptionalBoolTrue},
 		[]int64{1, 10, 11, 12, 13, 14, 15, 16, 18})
 }
 
@@ -407,7 +416,7 @@ func TestAddLdapSSHPublicKeys(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
 	user := db.AssertExistsAndLoadBean(t, &User{ID: 2}).(*User)
-	s := &LoginSource{ID: 1}
+	s := &login.Source{ID: 1}
 
 	testCases := []struct {
 		keyString   string
diff --git a/models/webhook.go b/models/webhook.go
index 034b37263a..9d04f8f5e4 100644
--- a/models/webhook.go
+++ b/models/webhook.go
@@ -397,7 +397,7 @@ func GetWebhookByOrgID(orgID, id int64) (*Webhook, error) {
 
 // ListWebhookOptions are options to filter webhooks on ListWebhooksByOpts
 type ListWebhookOptions struct {
-	ListOptions
+	db.ListOptions
 	RepoID   int64
 	OrgID    int64
 	IsActive util.OptionalBool
@@ -421,7 +421,7 @@ func listWebhooksByOpts(e db.Engine, opts *ListWebhookOptions) ([]*Webhook, erro
 	sess := e.Where(opts.toCond())
 
 	if opts.Page != 0 {
-		sess = setSessionPagination(sess, opts)
+		sess = db.SetSessionPagination(sess, opts)
 		webhooks := make([]*Webhook, 0, opts.PageSize)
 		err := sess.Find(&webhooks)
 		return webhooks, err
diff --git a/modules/convert/convert.go b/modules/convert/convert.go
index 404786ec9c..3c309a82f8 100644
--- a/modules/convert/convert.go
+++ b/modules/convert/convert.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/structs"
@@ -338,8 +339,8 @@ func ToTopicResponse(topic *models.Topic) *api.TopicResponse {
 	}
 }
 
-// ToOAuth2Application convert from models.OAuth2Application to api.OAuth2Application
-func ToOAuth2Application(app *models.OAuth2Application) *api.OAuth2Application {
+// ToOAuth2Application convert from login.OAuth2Application to api.OAuth2Application
+func ToOAuth2Application(app *login.OAuth2Application) *api.OAuth2Application {
 	return &api.OAuth2Application{
 		ID:           app.ID,
 		Name:         app.Name,
diff --git a/modules/gitgraph/graph_models.go b/modules/gitgraph/graph_models.go
index ec47f0ad84..86bd8cb237 100644
--- a/modules/gitgraph/graph_models.go
+++ b/modules/gitgraph/graph_models.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
 )
@@ -114,7 +115,7 @@ func (graph *Graph) LoadAndProcessCommits(repository *models.Repository, gitRepo
 
 		_ = models.CalculateTrustStatus(c.Verification, repository, &keyMap)
 
-		statuses, err := models.GetLatestCommitStatus(repository.ID, c.Commit.ID.String(), models.ListOptions{})
+		statuses, err := models.GetLatestCommitStatus(repository.ID, c.Commit.ID.String(), db.ListOptions{})
 		if err != nil {
 			log.Error("GetLatestCommitStatus: %v", err)
 		} else {
diff --git a/modules/indexer/issues/indexer.go b/modules/indexer/issues/indexer.go
index 676b6686ea..4e133b4dd3 100644
--- a/modules/indexer/issues/indexer.go
+++ b/modules/indexer/issues/indexer.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/queue"
@@ -241,7 +242,7 @@ func populateIssueIndexer(ctx context.Context) {
 		default:
 		}
 		repos, _, err := models.SearchRepositoryByName(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{Page: page, PageSize: models.RepositoryListDefaultPageSize},
+			ListOptions: db.ListOptions{Page: page, PageSize: models.RepositoryListDefaultPageSize},
 			OrderBy:     models.SearchOrderByID,
 			Private:     true,
 			Collaborate: util.OptionalBoolFalse,
diff --git a/modules/migrations/gitea_uploader_test.go b/modules/migrations/gitea_uploader_test.go
index 73293f1f85..b8b947961f 100644
--- a/modules/migrations/gitea_uploader_test.go
+++ b/modules/migrations/gitea_uploader_test.go
@@ -69,12 +69,12 @@ func TestGiteaUploadRepo(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Empty(t, milestones)
 
-	labels, err := models.GetLabelsByRepoID(repo.ID, "", models.ListOptions{})
+	labels, err := models.GetLabelsByRepoID(repo.ID, "", db.ListOptions{})
 	assert.NoError(t, err)
 	assert.Len(t, labels, 12)
 
 	releases, err := models.GetReleasesByRepoID(repo.ID, models.FindReleasesOptions{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: 10,
 			Page:     0,
 		},
@@ -84,7 +84,7 @@ func TestGiteaUploadRepo(t *testing.T) {
 	assert.Len(t, releases, 8)
 
 	releases, err = models.GetReleasesByRepoID(repo.ID, models.FindReleasesOptions{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: 10,
 			Page:     0,
 		},
diff --git a/modules/repository/adopt.go b/modules/repository/adopt.go
index daefee9c74..c5c059f471 100644
--- a/modules/repository/adopt.go
+++ b/modules/repository/adopt.go
@@ -122,7 +122,7 @@ func DeleteUnadoptedRepository(doer, u *models.User, repoName string) error {
 }
 
 // ListUnadoptedRepositories lists all the unadopted repositories that match the provided query
-func ListUnadoptedRepositories(query string, opts *models.ListOptions) ([]string, int, error) {
+func ListUnadoptedRepositories(query string, opts *db.ListOptions) ([]string, int, error) {
 	globUser, _ := glob.Compile("*")
 	globRepo, _ := glob.Compile("*")
 
@@ -165,10 +165,13 @@ func ListUnadoptedRepositories(query string, opts *models.ListOptions) ([]string
 
 			// Clean up old repoNamesToCheck
 			if len(repoNamesToCheck) > 0 {
-				repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{Actor: ctxUser, Private: true, ListOptions: models.ListOptions{
-					Page:     1,
-					PageSize: opts.PageSize,
-				}, LowerNames: repoNamesToCheck})
+				repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{
+					Actor:   ctxUser,
+					Private: true,
+					ListOptions: db.ListOptions{
+						Page:     1,
+						PageSize: opts.PageSize,
+					}, LowerNames: repoNamesToCheck})
 				if err != nil {
 					return err
 				}
@@ -219,10 +222,13 @@ func ListUnadoptedRepositories(query string, opts *models.ListOptions) ([]string
 		if count < end {
 			repoNamesToCheck = append(repoNamesToCheck, name)
 			if len(repoNamesToCheck) >= opts.PageSize {
-				repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{Actor: ctxUser, Private: true, ListOptions: models.ListOptions{
-					Page:     1,
-					PageSize: opts.PageSize,
-				}, LowerNames: repoNamesToCheck})
+				repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{
+					Actor:   ctxUser,
+					Private: true,
+					ListOptions: db.ListOptions{
+						Page:     1,
+						PageSize: opts.PageSize,
+					}, LowerNames: repoNamesToCheck})
 				if err != nil {
 					return err
 				}
@@ -254,10 +260,13 @@ func ListUnadoptedRepositories(query string, opts *models.ListOptions) ([]string
 	}
 
 	if len(repoNamesToCheck) > 0 {
-		repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{Actor: ctxUser, Private: true, ListOptions: models.ListOptions{
-			Page:     1,
-			PageSize: opts.PageSize,
-		}, LowerNames: repoNamesToCheck})
+		repos, _, err := models.GetUserRepositories(&models.SearchRepoOptions{
+			Actor:   ctxUser,
+			Private: true,
+			ListOptions: db.ListOptions{
+				Page:     1,
+				PageSize: opts.PageSize,
+			}, LowerNames: repoNamesToCheck})
 		if err != nil {
 			return nil, 0, err
 		}
diff --git a/modules/repository/repo.go b/modules/repository/repo.go
index ee970fd711..6b40a894fb 100644
--- a/modules/repository/repo.go
+++ b/modules/repository/repo.go
@@ -224,7 +224,11 @@ func CleanUpMigrateInfo(repo *models.Repository) (*models.Repository, error) {
 // SyncReleasesWithTags synchronizes release table with repository tags
 func SyncReleasesWithTags(repo *models.Repository, gitRepo *git.Repository) error {
 	existingRelTags := make(map[string]struct{})
-	opts := models.FindReleasesOptions{IncludeDrafts: true, IncludeTags: true, ListOptions: models.ListOptions{PageSize: 50}}
+	opts := models.FindReleasesOptions{
+		IncludeDrafts: true,
+		IncludeTags:   true,
+		ListOptions:   db.ListOptions{PageSize: 50},
+	}
 	for page := 1; ; page++ {
 		opts.Page = page
 		rels, err := models.GetReleasesByRepoID(repo.ID, opts)
diff --git a/routers/api/v1/admin/user.go b/routers/api/v1/admin/user.go
index e5a75da759..2d585b6040 100644
--- a/routers/api/v1/admin/user.go
+++ b/routers/api/v1/admin/user.go
@@ -11,6 +11,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	"code.gitea.io/gitea/modules/log"
@@ -27,12 +28,12 @@ func parseLoginSource(ctx *context.APIContext, u *models.User, sourceID int64, l
 		return
 	}
 
-	source, err := models.GetLoginSourceByID(sourceID)
+	source, err := login.GetSourceByID(sourceID)
 	if err != nil {
-		if models.IsErrLoginSourceNotExist(err) {
+		if login.IsErrSourceNotExist(err) {
 			ctx.Error(http.StatusUnprocessableEntity, "", err)
 		} else {
-			ctx.Error(http.StatusInternalServerError, "GetLoginSourceByID", err)
+			ctx.Error(http.StatusInternalServerError, "login.GetSourceByID", err)
 		}
 		return
 	}
@@ -74,7 +75,7 @@ func CreateUser(ctx *context.APIContext) {
 		Passwd:             form.Password,
 		MustChangePassword: true,
 		IsActive:           true,
-		LoginType:          models.LoginPlain,
+		LoginType:          login.Plain,
 	}
 	if form.MustChangePassword != nil {
 		u.MustChangePassword = *form.MustChangePassword
diff --git a/routers/api/v1/repo/issue.go b/routers/api/v1/repo/issue.go
index c576d18e5f..7b97a5683a 100644
--- a/routers/api/v1/repo/issue.go
+++ b/routers/api/v1/repo/issue.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
@@ -226,7 +227,7 @@ func SearchIssues(ctx *context.APIContext) {
 	// This would otherwise return all issues if no issues were found by the search.
 	if len(keyword) == 0 || len(issueIDs) > 0 || len(includedLabelNames) > 0 || len(includedMilestones) > 0 {
 		issuesOpt := &models.IssuesOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				Page:     ctx.FormInt("page"),
 				PageSize: limit,
 			},
@@ -261,7 +262,7 @@ func SearchIssues(ctx *context.APIContext) {
 			return
 		}
 
-		issuesOpt.ListOptions = models.ListOptions{
+		issuesOpt.ListOptions = db.ListOptions{
 			Page: -1,
 		}
 		if filteredCount, err = models.CountIssues(issuesOpt); err != nil {
@@ -470,7 +471,7 @@ func ListIssues(ctx *context.APIContext) {
 			return
 		}
 
-		issuesOpt.ListOptions = models.ListOptions{
+		issuesOpt.ListOptions = db.ListOptions{
 			Page: -1,
 		}
 		if filteredCount, err = models.CountIssues(issuesOpt); err != nil {
diff --git a/routers/api/v1/user/app.go b/routers/api/v1/user/app.go
index f0f7cb4159..bf45bf4dd5 100644
--- a/routers/api/v1/user/app.go
+++ b/routers/api/v1/user/app.go
@@ -12,6 +12,7 @@ import (
 	"strconv"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	api "code.gitea.io/gitea/modules/structs"
@@ -212,7 +213,7 @@ func CreateOauth2Application(ctx *context.APIContext) {
 
 	data := web.GetForm(ctx).(*api.CreateOAuth2ApplicationOptions)
 
-	app, err := models.CreateOAuth2Application(models.CreateOAuth2ApplicationOptions{
+	app, err := login.CreateOAuth2Application(login.CreateOAuth2ApplicationOptions{
 		Name:         data.Name,
 		UserID:       ctx.User.ID,
 		RedirectURIs: data.RedirectURIs,
@@ -251,7 +252,7 @@ func ListOauth2Applications(ctx *context.APIContext) {
 	//   "200":
 	//     "$ref": "#/responses/OAuth2ApplicationList"
 
-	apps, total, err := models.ListOAuth2Applications(ctx.User.ID, utils.GetListOptions(ctx))
+	apps, total, err := login.ListOAuth2Applications(ctx.User.ID, utils.GetListOptions(ctx))
 	if err != nil {
 		ctx.Error(http.StatusInternalServerError, "ListOAuth2Applications", err)
 		return
@@ -287,8 +288,8 @@ func DeleteOauth2Application(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 	appID := ctx.ParamsInt64(":id")
-	if err := models.DeleteOAuth2Application(appID, ctx.User.ID); err != nil {
-		if models.IsErrOAuthApplicationNotFound(err) {
+	if err := login.DeleteOAuth2Application(appID, ctx.User.ID); err != nil {
+		if login.IsErrOAuthApplicationNotFound(err) {
 			ctx.NotFound()
 		} else {
 			ctx.Error(http.StatusInternalServerError, "DeleteOauth2ApplicationByID", err)
@@ -319,9 +320,9 @@ func GetOauth2Application(ctx *context.APIContext) {
 	//   "404":
 	//     "$ref": "#/responses/notFound"
 	appID := ctx.ParamsInt64(":id")
-	app, err := models.GetOAuth2ApplicationByID(appID)
+	app, err := login.GetOAuth2ApplicationByID(appID)
 	if err != nil {
-		if models.IsErrOauthClientIDInvalid(err) || models.IsErrOAuthApplicationNotFound(err) {
+		if login.IsErrOauthClientIDInvalid(err) || login.IsErrOAuthApplicationNotFound(err) {
 			ctx.NotFound()
 		} else {
 			ctx.Error(http.StatusInternalServerError, "GetOauth2ApplicationByID", err)
@@ -362,14 +363,14 @@ func UpdateOauth2Application(ctx *context.APIContext) {
 
 	data := web.GetForm(ctx).(*api.CreateOAuth2ApplicationOptions)
 
-	app, err := models.UpdateOAuth2Application(models.UpdateOAuth2ApplicationOptions{
+	app, err := login.UpdateOAuth2Application(login.UpdateOAuth2ApplicationOptions{
 		Name:         data.Name,
 		UserID:       ctx.User.ID,
 		ID:           appID,
 		RedirectURIs: data.RedirectURIs,
 	})
 	if err != nil {
-		if models.IsErrOauthClientIDInvalid(err) || models.IsErrOAuthApplicationNotFound(err) {
+		if login.IsErrOauthClientIDInvalid(err) || login.IsErrOAuthApplicationNotFound(err) {
 			ctx.NotFound()
 		} else {
 			ctx.Error(http.StatusInternalServerError, "UpdateOauth2ApplicationByID", err)
diff --git a/routers/api/v1/user/gpg_key.go b/routers/api/v1/user/gpg_key.go
index f32d60d038..9066268bba 100644
--- a/routers/api/v1/user/gpg_key.go
+++ b/routers/api/v1/user/gpg_key.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	api "code.gitea.io/gitea/modules/structs"
@@ -16,7 +17,7 @@ import (
 	"code.gitea.io/gitea/routers/api/v1/utils"
 )
 
-func listGPGKeys(ctx *context.APIContext, uid int64, listOptions models.ListOptions) {
+func listGPGKeys(ctx *context.APIContext, uid int64, listOptions db.ListOptions) {
 	keys, err := models.ListGPGKeys(uid, listOptions)
 	if err != nil {
 		ctx.Error(http.StatusInternalServerError, "ListGPGKeys", err)
diff --git a/routers/api/v1/user/star.go b/routers/api/v1/user/star.go
index 8ee1676856..f067722bfa 100644
--- a/routers/api/v1/user/star.go
+++ b/routers/api/v1/user/star.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	api "code.gitea.io/gitea/modules/structs"
@@ -17,7 +18,7 @@ import (
 
 // getStarredRepos returns the repos that the user with the specified userID has
 // starred
-func getStarredRepos(user *models.User, private bool, listOptions models.ListOptions) ([]*api.Repository, error) {
+func getStarredRepos(user *models.User, private bool, listOptions db.ListOptions) ([]*api.Repository, error) {
 	starredRepos, err := models.GetStarredRepos(user.ID, private, listOptions)
 	if err != nil {
 		return nil, err
diff --git a/routers/api/v1/user/watch.go b/routers/api/v1/user/watch.go
index f32ce73598..3c6f8b3070 100644
--- a/routers/api/v1/user/watch.go
+++ b/routers/api/v1/user/watch.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	api "code.gitea.io/gitea/modules/structs"
@@ -15,7 +16,7 @@ import (
 )
 
 // getWatchedRepos returns the repos that the user with the specified userID is watching
-func getWatchedRepos(user *models.User, private bool, listOptions models.ListOptions) ([]*api.Repository, int64, error) {
+func getWatchedRepos(user *models.User, private bool, listOptions db.ListOptions) ([]*api.Repository, int64, error) {
 	watchedRepos, total, err := models.GetWatchedRepos(user.ID, private, listOptions)
 	if err != nil {
 		return nil, 0, err
diff --git a/routers/api/v1/utils/utils.go b/routers/api/v1/utils/utils.go
index 81f5086c96..7564857115 100644
--- a/routers/api/v1/utils/utils.go
+++ b/routers/api/v1/utils/utils.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 )
@@ -60,8 +60,8 @@ func prepareQueryArg(ctx *context.APIContext, name string) (value string, err er
 }
 
 // GetListOptions returns list options using the page and limit parameters
-func GetListOptions(ctx *context.APIContext) models.ListOptions {
-	return models.ListOptions{
+func GetListOptions(ctx *context.APIContext) db.ListOptions {
+	return db.ListOptions{
 		Page:     ctx.FormInt("page"),
 		PageSize: convert.ToCorrectPageSize(ctx.FormInt("limit")),
 	}
diff --git a/routers/web/admin/auths.go b/routers/web/admin/auths.go
index 2937190a1f..1b005e5c7b 100644
--- a/routers/web/admin/auths.go
+++ b/routers/web/admin/auths.go
@@ -11,6 +11,7 @@ import (
 	"regexp"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/auth/pam"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
@@ -18,6 +19,7 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/modules/web"
+	auth_service "code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 	pamService "code.gitea.io/gitea/services/auth/source/pam"
@@ -46,13 +48,13 @@ func Authentications(ctx *context.Context) {
 	ctx.Data["PageIsAdminAuthentications"] = true
 
 	var err error
-	ctx.Data["Sources"], err = models.LoginSources()
+	ctx.Data["Sources"], err = login.Sources()
 	if err != nil {
-		ctx.ServerError("LoginSources", err)
+		ctx.ServerError("login.Sources", err)
 		return
 	}
 
-	ctx.Data["Total"] = models.CountLoginSources()
+	ctx.Data["Total"] = login.CountSources()
 	ctx.HTML(http.StatusOK, tplAuths)
 }
 
@@ -64,14 +66,14 @@ type dropdownItem struct {
 var (
 	authSources = func() []dropdownItem {
 		items := []dropdownItem{
-			{models.LoginNames[models.LoginLDAP], models.LoginLDAP},
-			{models.LoginNames[models.LoginDLDAP], models.LoginDLDAP},
-			{models.LoginNames[models.LoginSMTP], models.LoginSMTP},
-			{models.LoginNames[models.LoginOAuth2], models.LoginOAuth2},
-			{models.LoginNames[models.LoginSSPI], models.LoginSSPI},
+			{login.LDAP.String(), login.LDAP},
+			{login.DLDAP.String(), login.DLDAP},
+			{login.SMTP.String(), login.SMTP},
+			{login.OAuth2.String(), login.OAuth2},
+			{login.SSPI.String(), login.SSPI},
 		}
 		if pam.Supported {
-			items = append(items, dropdownItem{models.LoginNames[models.LoginPAM], models.LoginPAM})
+			items = append(items, dropdownItem{login.Names[login.PAM], login.PAM})
 		}
 		return items
 	}()
@@ -89,8 +91,8 @@ func NewAuthSource(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminAuthentications"] = true
 
-	ctx.Data["type"] = models.LoginLDAP
-	ctx.Data["CurrentTypeName"] = models.LoginNames[models.LoginLDAP]
+	ctx.Data["type"] = login.LDAP
+	ctx.Data["CurrentTypeName"] = login.Names[login.LDAP]
 	ctx.Data["CurrentSecurityProtocol"] = ldap.SecurityProtocolNames[ldap.SecurityProtocolUnencrypted]
 	ctx.Data["smtp_auth"] = "PLAIN"
 	ctx.Data["is_active"] = true
@@ -217,7 +219,7 @@ func NewAuthSourcePost(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminAuthentications"] = true
 
-	ctx.Data["CurrentTypeName"] = models.LoginNames[models.LoginType(form.Type)]
+	ctx.Data["CurrentTypeName"] = login.Type(form.Type).String()
 	ctx.Data["CurrentSecurityProtocol"] = ldap.SecurityProtocolNames[ldap.SecurityProtocol(form.SecurityProtocol)]
 	ctx.Data["AuthSources"] = authSources
 	ctx.Data["SecurityProtocols"] = securityProtocols
@@ -233,28 +235,28 @@ func NewAuthSourcePost(ctx *context.Context) {
 
 	hasTLS := false
 	var config convert.Conversion
-	switch models.LoginType(form.Type) {
-	case models.LoginLDAP, models.LoginDLDAP:
+	switch login.Type(form.Type) {
+	case login.LDAP, login.DLDAP:
 		config = parseLDAPConfig(form)
 		hasTLS = ldap.SecurityProtocol(form.SecurityProtocol) > ldap.SecurityProtocolUnencrypted
-	case models.LoginSMTP:
+	case login.SMTP:
 		config = parseSMTPConfig(form)
 		hasTLS = true
-	case models.LoginPAM:
+	case login.PAM:
 		config = &pamService.Source{
 			ServiceName: form.PAMServiceName,
 			EmailDomain: form.PAMEmailDomain,
 		}
-	case models.LoginOAuth2:
+	case login.OAuth2:
 		config = parseOAuth2Config(form)
-	case models.LoginSSPI:
+	case login.SSPI:
 		var err error
 		config, err = parseSSPIConfig(ctx, form)
 		if err != nil {
 			ctx.RenderWithErr(err.Error(), tplAuthNew, form)
 			return
 		}
-		existing, err := models.LoginSourcesByType(models.LoginSSPI)
+		existing, err := login.SourcesByType(login.SSPI)
 		if err != nil || len(existing) > 0 {
 			ctx.Data["Err_Type"] = true
 			ctx.RenderWithErr(ctx.Tr("admin.auths.login_source_of_type_exist"), tplAuthNew, form)
@@ -271,18 +273,18 @@ func NewAuthSourcePost(ctx *context.Context) {
 		return
 	}
 
-	if err := models.CreateLoginSource(&models.LoginSource{
-		Type:          models.LoginType(form.Type),
+	if err := login.CreateSource(&login.Source{
+		Type:          login.Type(form.Type),
 		Name:          form.Name,
 		IsActive:      form.IsActive,
 		IsSyncEnabled: form.IsSyncEnabled,
 		Cfg:           config,
 	}); err != nil {
-		if models.IsErrLoginSourceAlreadyExist(err) {
+		if login.IsErrSourceAlreadyExist(err) {
 			ctx.Data["Err_Name"] = true
-			ctx.RenderWithErr(ctx.Tr("admin.auths.login_source_exist", err.(models.ErrLoginSourceAlreadyExist).Name), tplAuthNew, form)
+			ctx.RenderWithErr(ctx.Tr("admin.auths.login_source_exist", err.(login.ErrSourceAlreadyExist).Name), tplAuthNew, form)
 		} else {
-			ctx.ServerError("CreateSource", err)
+			ctx.ServerError("login.CreateSource", err)
 		}
 		return
 	}
@@ -304,9 +306,9 @@ func EditAuthSource(ctx *context.Context) {
 	oauth2providers := oauth2.GetOAuth2Providers()
 	ctx.Data["OAuth2Providers"] = oauth2providers
 
-	source, err := models.GetLoginSourceByID(ctx.ParamsInt64(":authid"))
+	source, err := login.GetSourceByID(ctx.ParamsInt64(":authid"))
 	if err != nil {
-		ctx.ServerError("GetLoginSourceByID", err)
+		ctx.ServerError("login.GetSourceByID", err)
 		return
 	}
 	ctx.Data["Source"] = source
@@ -339,9 +341,9 @@ func EditAuthSourcePost(ctx *context.Context) {
 	oauth2providers := oauth2.GetOAuth2Providers()
 	ctx.Data["OAuth2Providers"] = oauth2providers
 
-	source, err := models.GetLoginSourceByID(ctx.ParamsInt64(":authid"))
+	source, err := login.GetSourceByID(ctx.ParamsInt64(":authid"))
 	if err != nil {
-		ctx.ServerError("GetLoginSourceByID", err)
+		ctx.ServerError("login.GetSourceByID", err)
 		return
 	}
 	ctx.Data["Source"] = source
@@ -353,19 +355,19 @@ func EditAuthSourcePost(ctx *context.Context) {
 	}
 
 	var config convert.Conversion
-	switch models.LoginType(form.Type) {
-	case models.LoginLDAP, models.LoginDLDAP:
+	switch login.Type(form.Type) {
+	case login.LDAP, login.DLDAP:
 		config = parseLDAPConfig(form)
-	case models.LoginSMTP:
+	case login.SMTP:
 		config = parseSMTPConfig(form)
-	case models.LoginPAM:
+	case login.PAM:
 		config = &pamService.Source{
 			ServiceName: form.PAMServiceName,
 			EmailDomain: form.PAMEmailDomain,
 		}
-	case models.LoginOAuth2:
+	case login.OAuth2:
 		config = parseOAuth2Config(form)
-	case models.LoginSSPI:
+	case login.SSPI:
 		config, err = parseSSPIConfig(ctx, form)
 		if err != nil {
 			ctx.RenderWithErr(err.Error(), tplAuthEdit, form)
@@ -380,7 +382,7 @@ func EditAuthSourcePost(ctx *context.Context) {
 	source.IsActive = form.IsActive
 	source.IsSyncEnabled = form.IsSyncEnabled
 	source.Cfg = config
-	if err := models.UpdateSource(source); err != nil {
+	if err := login.UpdateSource(source); err != nil {
 		if models.IsErrOpenIDConnectInitialize(err) {
 			ctx.Flash.Error(err.Error(), true)
 			ctx.HTML(http.StatusOK, tplAuthEdit)
@@ -397,17 +399,17 @@ func EditAuthSourcePost(ctx *context.Context) {
 
 // DeleteAuthSource response for deleting an auth source
 func DeleteAuthSource(ctx *context.Context) {
-	source, err := models.GetLoginSourceByID(ctx.ParamsInt64(":authid"))
+	source, err := login.GetSourceByID(ctx.ParamsInt64(":authid"))
 	if err != nil {
-		ctx.ServerError("GetLoginSourceByID", err)
+		ctx.ServerError("login.GetSourceByID", err)
 		return
 	}
 
-	if err = models.DeleteSource(source); err != nil {
-		if models.IsErrLoginSourceInUse(err) {
+	if err = auth_service.DeleteLoginSource(source); err != nil {
+		if login.IsErrSourceInUse(err) {
 			ctx.Flash.Error(ctx.Tr("admin.auths.still_in_used"))
 		} else {
-			ctx.Flash.Error(fmt.Sprintf("DeleteSource: %v", err))
+			ctx.Flash.Error(fmt.Sprintf("DeleteLoginSource: %v", err))
 		}
 		ctx.JSON(http.StatusOK, map[string]interface{}{
 			"redirect": setting.AppSubURL + "/admin/auths/" + ctx.Params(":authid"),
diff --git a/routers/web/admin/emails.go b/routers/web/admin/emails.go
index 017d696e20..5cbe70020b 100644
--- a/routers/web/admin/emails.go
+++ b/routers/web/admin/emails.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -28,7 +29,7 @@ func Emails(ctx *context.Context) {
 	ctx.Data["PageIsAdminEmails"] = true
 
 	opts := &models.SearchEmailOptions{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: setting.UI.Admin.UserPagingNum,
 			Page:     ctx.FormInt("page"),
 		},
diff --git a/routers/web/admin/orgs.go b/routers/web/admin/orgs.go
index a2b3ed1bcc..df3118b60f 100644
--- a/routers/web/admin/orgs.go
+++ b/routers/web/admin/orgs.go
@@ -7,6 +7,7 @@ package admin
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -27,7 +28,7 @@ func Organizations(ctx *context.Context) {
 	explore.RenderUserSearch(ctx, &models.SearchUserOptions{
 		Actor: ctx.User,
 		Type:  models.UserTypeOrganization,
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: setting.UI.Admin.OrgPagingNum,
 		},
 		Visible: []structs.VisibleType{structs.VisibleTypePublic, structs.VisibleTypeLimited, structs.VisibleTypePrivate},
diff --git a/routers/web/admin/repos.go b/routers/web/admin/repos.go
index 4c3f2ad614..2f4d182af8 100644
--- a/routers/web/admin/repos.go
+++ b/routers/web/admin/repos.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -68,7 +69,7 @@ func UnadoptedRepos(ctx *context.Context) {
 	ctx.Data["PageIsAdmin"] = true
 	ctx.Data["PageIsAdminRepositories"] = true
 
-	opts := models.ListOptions{
+	opts := db.ListOptions{
 		PageSize: setting.UI.Admin.UserPagingNum,
 		Page:     ctx.FormInt("page"),
 	}
diff --git a/routers/web/admin/users.go b/routers/web/admin/users.go
index acccc516bb..2556cae3a8 100644
--- a/routers/web/admin/users.go
+++ b/routers/web/admin/users.go
@@ -12,6 +12,8 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -39,7 +41,7 @@ func Users(ctx *context.Context) {
 	explore.RenderUserSearch(ctx, &models.SearchUserOptions{
 		Actor: ctx.User,
 		Type:  models.UserTypeIndividual,
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: setting.UI.Admin.UserPagingNum,
 		},
 		SearchByEmail: true,
@@ -56,9 +58,9 @@ func NewUser(ctx *context.Context) {
 
 	ctx.Data["login_type"] = "0-0"
 
-	sources, err := models.LoginSources()
+	sources, err := login.Sources()
 	if err != nil {
-		ctx.ServerError("LoginSources", err)
+		ctx.ServerError("login.Sources", err)
 		return
 	}
 	ctx.Data["Sources"] = sources
@@ -75,9 +77,9 @@ func NewUserPost(ctx *context.Context) {
 	ctx.Data["PageIsAdminUsers"] = true
 	ctx.Data["DefaultUserVisibilityMode"] = setting.Service.DefaultUserVisibilityMode
 
-	sources, err := models.LoginSources()
+	sources, err := login.Sources()
 	if err != nil {
-		ctx.ServerError("LoginSources", err)
+		ctx.ServerError("login.Sources", err)
 		return
 	}
 	ctx.Data["Sources"] = sources
@@ -94,19 +96,19 @@ func NewUserPost(ctx *context.Context) {
 		Email:     form.Email,
 		Passwd:    form.Password,
 		IsActive:  true,
-		LoginType: models.LoginPlain,
+		LoginType: login.Plain,
 	}
 
 	if len(form.LoginType) > 0 {
 		fields := strings.Split(form.LoginType, "-")
 		if len(fields) == 2 {
 			lType, _ := strconv.ParseInt(fields[0], 10, 0)
-			u.LoginType = models.LoginType(lType)
+			u.LoginType = login.Type(lType)
 			u.LoginSource, _ = strconv.ParseInt(fields[1], 10, 64)
 			u.LoginName = form.LoginName
 		}
 	}
-	if u.LoginType == models.LoginNoType || u.LoginType == models.LoginPlain {
+	if u.LoginType == login.NoType || u.LoginType == login.Plain {
 		if len(form.Password) < setting.MinPasswordLength {
 			ctx.Data["Err_Password"] = true
 			ctx.RenderWithErr(ctx.Tr("auth.password_too_short", setting.MinPasswordLength), tplUserNew, &form)
@@ -176,18 +178,18 @@ func prepareUserInfo(ctx *context.Context) *models.User {
 	ctx.Data["User"] = u
 
 	if u.LoginSource > 0 {
-		ctx.Data["LoginSource"], err = models.GetLoginSourceByID(u.LoginSource)
+		ctx.Data["LoginSource"], err = login.GetSourceByID(u.LoginSource)
 		if err != nil {
-			ctx.ServerError("GetLoginSourceByID", err)
+			ctx.ServerError("login.GetSourceByID", err)
 			return nil
 		}
 	} else {
-		ctx.Data["LoginSource"] = &models.LoginSource{}
+		ctx.Data["LoginSource"] = &login.Source{}
 	}
 
-	sources, err := models.LoginSources()
+	sources, err := login.Sources()
 	if err != nil {
-		ctx.ServerError("LoginSources", err)
+		ctx.ServerError("login.Sources", err)
 		return nil
 	}
 	ctx.Data["Sources"] = sources
@@ -247,7 +249,7 @@ func EditUserPost(ctx *context.Context) {
 
 		if u.LoginSource != loginSource {
 			u.LoginSource = loginSource
-			u.LoginType = models.LoginType(loginType)
+			u.LoginType = login.Type(loginType)
 		}
 	}
 
diff --git a/routers/web/events/events.go b/routers/web/events/events.go
index a630d9c224..974aa755d1 100644
--- a/routers/web/events/events.go
+++ b/routers/web/events/events.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
 	"code.gitea.io/gitea/modules/eventsource"
@@ -93,7 +94,7 @@ loop:
 			go unregister()
 			break loop
 		case <-stopwatchTimer.C:
-			sws, err := models.GetUserStopwatches(ctx.User.ID, models.ListOptions{})
+			sws, err := models.GetUserStopwatches(ctx.User.ID, db.ListOptions{})
 			if err != nil {
 				log.Error("Unable to GetUserStopwatches: %v", err)
 				continue
diff --git a/routers/web/explore/org.go b/routers/web/explore/org.go
index 470e0eb853..d005cfa503 100644
--- a/routers/web/explore/org.go
+++ b/routers/web/explore/org.go
@@ -6,6 +6,7 @@ package explore
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -33,7 +34,7 @@ func Organizations(ctx *context.Context) {
 	RenderUserSearch(ctx, &models.SearchUserOptions{
 		Actor:       ctx.User,
 		Type:        models.UserTypeOrganization,
-		ListOptions: models.ListOptions{PageSize: setting.UI.ExplorePagingNum},
+		ListOptions: db.ListOptions{PageSize: setting.UI.ExplorePagingNum},
 		Visible:     visibleTypes,
 	}, tplExploreOrganizations)
 }
diff --git a/routers/web/explore/repo.go b/routers/web/explore/repo.go
index dfc6261b33..78035037e5 100644
--- a/routers/web/explore/repo.go
+++ b/routers/web/explore/repo.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -77,7 +78,7 @@ func RenderRepoSearch(ctx *context.Context, opts *RepoSearchOptions) {
 	ctx.Data["TopicOnly"] = topicOnly
 
 	repos, count, err = models.SearchRepository(&models.SearchRepoOptions{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     page,
 			PageSize: opts.PageSize,
 		},
diff --git a/routers/web/explore/user.go b/routers/web/explore/user.go
index aeaaf92c12..4ddb90132d 100644
--- a/routers/web/explore/user.go
+++ b/routers/web/explore/user.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -99,7 +100,7 @@ func Users(ctx *context.Context) {
 	RenderUserSearch(ctx, &models.SearchUserOptions{
 		Actor:       ctx.User,
 		Type:        models.UserTypeIndividual,
-		ListOptions: models.ListOptions{PageSize: setting.UI.ExplorePagingNum},
+		ListOptions: db.ListOptions{PageSize: setting.UI.ExplorePagingNum},
 		IsActive:    util.OptionalBoolTrue,
 		Visible:     []structs.VisibleType{structs.VisibleTypePublic, structs.VisibleTypeLimited, structs.VisibleTypePrivate},
 	}, tplExploreUsers)
diff --git a/routers/web/org/home.go b/routers/web/org/home.go
index f682dc5cb6..89bd12a18f 100644
--- a/routers/web/org/home.go
+++ b/routers/web/org/home.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/markup"
@@ -91,7 +92,7 @@ func Home(ctx *context.Context) {
 		err   error
 	)
 	repos, count, err = models.SearchRepository(&models.SearchRepoOptions{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			PageSize: setting.UI.User.RepoPagingNum,
 			Page:     page,
 		},
@@ -110,7 +111,7 @@ func Home(ctx *context.Context) {
 	var opts = &models.FindOrgMembersOpts{
 		OrgID:       org.ID,
 		PublicOnly:  true,
-		ListOptions: models.ListOptions{Page: 1, PageSize: 25},
+		ListOptions: db.ListOptions{Page: 1, PageSize: 25},
 	}
 
 	if ctx.User != nil {
diff --git a/routers/web/org/org_labels.go b/routers/web/org/org_labels.go
index 13728a31b3..5079d9baa7 100644
--- a/routers/web/org/org_labels.go
+++ b/routers/web/org/org_labels.go
@@ -16,7 +16,7 @@ import (
 
 // RetrieveLabels find all the labels of an organization
 func RetrieveLabels(ctx *context.Context) {
-	labels, err := models.GetLabelsByOrgID(ctx.Org.Organization.ID, ctx.FormString("sort"), models.ListOptions{})
+	labels, err := models.GetLabelsByOrgID(ctx.Org.Organization.ID, ctx.FormString("sort"), db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("RetrieveLabels.GetLabels", err)
 		return
diff --git a/routers/web/org/setting.go b/routers/web/org/setting.go
index 7e6fc5bf4c..277ff9d973 100644
--- a/routers/web/org/setting.go
+++ b/routers/web/org/setting.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -103,7 +104,7 @@ func SettingsPost(ctx *context.Context) {
 
 	// update forks visibility
 	if visibilityChanged {
-		if err := org.GetRepositories(models.ListOptions{Page: 1, PageSize: org.NumRepos}); err != nil {
+		if err := org.GetRepositories(db.ListOptions{Page: 1, PageSize: org.NumRepos}); err != nil {
 			ctx.ServerError("GetRepositories", err)
 			return
 		}
diff --git a/routers/web/repo/commit.go b/routers/web/repo/commit.go
index 810581640c..61435527da 100644
--- a/routers/web/repo/commit.go
+++ b/routers/web/repo/commit.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/charset"
 	"code.gitea.io/gitea/modules/context"
@@ -287,7 +288,7 @@ func Diff(ctx *context.Context) {
 		commitID = commit.ID.String()
 	}
 
-	statuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, commitID, models.ListOptions{})
+	statuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, commitID, db.ListOptions{})
 	if err != nil {
 		log.Error("GetLatestCommitStatus: %v", err)
 	}
diff --git a/routers/web/repo/issue.go b/routers/web/repo/issue.go
index 013286f2de..7498830d94 100644
--- a/routers/web/repo/issue.go
+++ b/routers/web/repo/issue.go
@@ -16,6 +16,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/convert"
@@ -216,7 +217,7 @@ func issues(ctx *context.Context, milestoneID, projectID int64, isPullOption uti
 		issues = []*models.Issue{}
 	} else {
 		issues, err = models.Issues(&models.IssuesOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				Page:     pager.Paginater.Current(),
 				PageSize: setting.UI.IssuePagingNum,
 			},
@@ -278,14 +279,14 @@ func issues(ctx *context.Context, milestoneID, projectID int64, isPullOption uti
 		return
 	}
 
-	labels, err := models.GetLabelsByRepoID(repo.ID, "", models.ListOptions{})
+	labels, err := models.GetLabelsByRepoID(repo.ID, "", db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetLabelsByRepoID", err)
 		return
 	}
 
 	if repo.Owner.IsOrganization() {
-		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), models.ListOptions{})
+		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{})
 		if err != nil {
 			ctx.ServerError("GetLabelsByOrgID", err)
 			return
@@ -645,14 +646,14 @@ func RetrieveRepoMetas(ctx *context.Context, repo *models.Repository, isPull boo
 		return nil
 	}
 
-	labels, err := models.GetLabelsByRepoID(repo.ID, "", models.ListOptions{})
+	labels, err := models.GetLabelsByRepoID(repo.ID, "", db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetLabelsByRepoID", err)
 		return nil
 	}
 	ctx.Data["Labels"] = labels
 	if repo.Owner.IsOrganization() {
-		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), models.ListOptions{})
+		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{})
 		if err != nil {
 			return nil
 		}
@@ -735,10 +736,10 @@ func setTemplateIfExists(ctx *context.Context, ctxDataKey string, possibleDirs [
 			ctx.Data[issueTemplateTitleKey] = meta.Title
 			ctx.Data[ctxDataKey] = templateBody
 			labelIDs := make([]string, 0, len(meta.Labels))
-			if repoLabels, err := models.GetLabelsByRepoID(ctx.Repo.Repository.ID, "", models.ListOptions{}); err == nil {
+			if repoLabels, err := models.GetLabelsByRepoID(ctx.Repo.Repository.ID, "", db.ListOptions{}); err == nil {
 				ctx.Data["Labels"] = repoLabels
 				if ctx.Repo.Owner.IsOrganization() {
-					if orgLabels, err := models.GetLabelsByOrgID(ctx.Repo.Owner.ID, ctx.FormString("sort"), models.ListOptions{}); err == nil {
+					if orgLabels, err := models.GetLabelsByOrgID(ctx.Repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{}); err == nil {
 						ctx.Data["OrgLabels"] = orgLabels
 						repoLabels = append(repoLabels, orgLabels...)
 					}
@@ -1164,7 +1165,7 @@ func ViewIssue(ctx *context.Context) {
 	for i := range issue.Labels {
 		labelIDMark[issue.Labels[i].ID] = true
 	}
-	labels, err := models.GetLabelsByRepoID(repo.ID, "", models.ListOptions{})
+	labels, err := models.GetLabelsByRepoID(repo.ID, "", db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetLabelsByRepoID", err)
 		return
@@ -1172,7 +1173,7 @@ func ViewIssue(ctx *context.Context) {
 	ctx.Data["Labels"] = labels
 
 	if repo.Owner.IsOrganization() {
-		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), models.ListOptions{})
+		orgLabels, err := models.GetLabelsByOrgID(repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{})
 		if err != nil {
 			ctx.ServerError("GetLabelsByOrgID", err)
 			return
diff --git a/routers/web/repo/issue_label.go b/routers/web/repo/issue_label.go
index 0ce5114485..b97f57175b 100644
--- a/routers/web/repo/issue_label.go
+++ b/routers/web/repo/issue_label.go
@@ -54,7 +54,7 @@ func InitializeLabels(ctx *context.Context) {
 
 // RetrieveLabels find all the labels of a repository and organization
 func RetrieveLabels(ctx *context.Context) {
-	labels, err := models.GetLabelsByRepoID(ctx.Repo.Repository.ID, ctx.FormString("sort"), models.ListOptions{})
+	labels, err := models.GetLabelsByRepoID(ctx.Repo.Repository.ID, ctx.FormString("sort"), db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("RetrieveLabels.GetLabels", err)
 		return
@@ -67,7 +67,7 @@ func RetrieveLabels(ctx *context.Context) {
 	ctx.Data["Labels"] = labels
 
 	if ctx.Repo.Owner.IsOrganization() {
-		orgLabels, err := models.GetLabelsByOrgID(ctx.Repo.Owner.ID, ctx.FormString("sort"), models.ListOptions{})
+		orgLabels, err := models.GetLabelsByOrgID(ctx.Repo.Owner.ID, ctx.FormString("sort"), db.ListOptions{})
 		if err != nil {
 			ctx.ServerError("GetLabelsByOrgID", err)
 			return
diff --git a/routers/web/repo/milestone.go b/routers/web/repo/milestone.go
index 80f1eb5231..21e1fb2eab 100644
--- a/routers/web/repo/milestone.go
+++ b/routers/web/repo/milestone.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/markup"
@@ -59,7 +60,7 @@ func Milestones(ctx *context.Context) {
 	}
 
 	miles, total, err := models.GetMilestones(models.GetMilestonesOption{
-		ListOptions: models.ListOptions{
+		ListOptions: db.ListOptions{
 			Page:     page,
 			PageSize: setting.UI.IssuePagingNum,
 		},
diff --git a/routers/web/repo/pull.go b/routers/web/repo/pull.go
index 6b369195de..c370e7f04d 100644
--- a/routers/web/repo/pull.go
+++ b/routers/web/repo/pull.go
@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
@@ -335,7 +336,7 @@ func PrepareMergedViewPullInfo(ctx *context.Context, issue *models.Issue) *git.C
 
 	if len(compareInfo.Commits) != 0 {
 		sha := compareInfo.Commits[0].ID.String()
-		commitStatuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, sha, models.ListOptions{})
+		commitStatuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, sha, db.ListOptions{})
 		if err != nil {
 			ctx.ServerError("GetLatestCommitStatus", err)
 			return nil
@@ -389,7 +390,7 @@ func PrepareViewPullInfo(ctx *context.Context, issue *models.Issue) *git.Compare
 			ctx.ServerError(fmt.Sprintf("GetRefCommitID(%s)", pull.GetGitRefName()), err)
 			return nil
 		}
-		commitStatuses, err := models.GetLatestCommitStatus(repo.ID, sha, models.ListOptions{})
+		commitStatuses, err := models.GetLatestCommitStatus(repo.ID, sha, db.ListOptions{})
 		if err != nil {
 			ctx.ServerError("GetLatestCommitStatus", err)
 			return nil
@@ -478,7 +479,7 @@ func PrepareViewPullInfo(ctx *context.Context, issue *models.Issue) *git.Compare
 		return nil
 	}
 
-	commitStatuses, err := models.GetLatestCommitStatus(repo.ID, sha, models.ListOptions{})
+	commitStatuses, err := models.GetLatestCommitStatus(repo.ID, sha, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetLatestCommitStatus", err)
 		return nil
diff --git a/routers/web/repo/release.go b/routers/web/repo/release.go
index 0603f0ee97..df1fd745d8 100644
--- a/routers/web/repo/release.go
+++ b/routers/web/repo/release.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -83,7 +84,7 @@ func releasesOrTags(ctx *context.Context, isTagList bool) {
 		ctx.Data["PageIsTagList"] = false
 	}
 
-	listOptions := models.ListOptions{
+	listOptions := db.ListOptions{
 		Page:     ctx.FormInt("page"),
 		PageSize: ctx.FormInt("limit"),
 	}
diff --git a/routers/web/repo/setting.go b/routers/web/repo/setting.go
index ed82c2eeb5..e71a5bf482 100644
--- a/routers/web/repo/setting.go
+++ b/routers/web/repo/setting.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/git"
@@ -768,7 +769,7 @@ func Collaboration(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repo.settings")
 	ctx.Data["PageIsSettingsCollaboration"] = true
 
-	users, err := ctx.Repo.Repository.GetCollaborators(models.ListOptions{})
+	users, err := ctx.Repo.Repository.GetCollaborators(db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetCollaborators", err)
 		return
diff --git a/routers/web/repo/view.go b/routers/web/repo/view.go
index addde15de1..c0a35bcb4f 100644
--- a/routers/web/repo/view.go
+++ b/routers/web/repo/view.go
@@ -18,6 +18,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/cache"
 	"code.gitea.io/gitea/modules/charset"
@@ -377,7 +378,7 @@ func renderDirectory(ctx *context.Context, treeLink string) {
 
 	ctx.Data["LatestCommitUser"] = models.ValidateCommitWithEmail(latestCommit)
 
-	statuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, ctx.Repo.Commit.ID.String(), models.ListOptions{})
+	statuses, err := models.GetLatestCommitStatus(ctx.Repo.Repository.ID, ctx.Repo.Commit.ID.String(), db.ListOptions{})
 	if err != nil {
 		log.Error("GetLatestCommitStatus: %v", err)
 	}
@@ -758,7 +759,7 @@ func renderCode(ctx *context.Context) {
 }
 
 // RenderUserCards render a page show users according the input template
-func RenderUserCards(ctx *context.Context, total int, getter func(opts models.ListOptions) ([]*models.User, error), tpl base.TplName) {
+func RenderUserCards(ctx *context.Context, total int, getter func(opts db.ListOptions) ([]*models.User, error), tpl base.TplName) {
 	page := ctx.FormInt("page")
 	if page <= 0 {
 		page = 1
@@ -766,7 +767,7 @@ func RenderUserCards(ctx *context.Context, total int, getter func(opts models.Li
 	pager := context.NewPagination(total, models.ItemsPerPage, page, 5)
 	ctx.Data["Page"] = pager
 
-	items, err := getter(models.ListOptions{
+	items, err := getter(db.ListOptions{
 		Page:     pager.Paginater.Current(),
 		PageSize: models.ItemsPerPage,
 	})
@@ -801,7 +802,7 @@ func Forks(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("repos.forks")
 
 	// TODO: need pagination
-	forks, err := ctx.Repo.Repository.GetForks(models.ListOptions{})
+	forks, err := ctx.Repo.Repository.GetForks(db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("GetForks", err)
 		return
diff --git a/routers/web/user/auth.go b/routers/web/user/auth.go
index 9785ca68d5..733ace81b0 100644
--- a/routers/web/user/auth.go
+++ b/routers/web/user/auth.go
@@ -14,6 +14,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/eventsource"
@@ -147,7 +148,7 @@ func SignIn(ctx *context.Context) {
 	ctx.Data["SignInLink"] = setting.AppSubURL + "/user/login"
 	ctx.Data["PageIsSignIn"] = true
 	ctx.Data["PageIsLogin"] = true
-	ctx.Data["EnableSSPI"] = models.IsSSPIEnabled()
+	ctx.Data["EnableSSPI"] = login.IsSSPIEnabled()
 
 	ctx.HTML(http.StatusOK, tplSignIn)
 }
@@ -167,7 +168,7 @@ func SignInPost(ctx *context.Context) {
 	ctx.Data["SignInLink"] = setting.AppSubURL + "/user/login"
 	ctx.Data["PageIsSignIn"] = true
 	ctx.Data["PageIsLogin"] = true
-	ctx.Data["EnableSSPI"] = models.IsSSPIEnabled()
+	ctx.Data["EnableSSPI"] = login.IsSSPIEnabled()
 
 	if ctx.HasError() {
 		ctx.HTML(http.StatusOK, tplSignIn)
@@ -573,7 +574,7 @@ func handleSignInFull(ctx *context.Context, u *models.User, remember bool, obeyR
 func SignInOAuth(ctx *context.Context) {
 	provider := ctx.Params(":provider")
 
-	loginSource, err := models.GetActiveOAuth2LoginSourceByName(provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(provider)
 	if err != nil {
 		ctx.ServerError("SignIn", err)
 		return
@@ -608,7 +609,7 @@ func SignInOAuthCallback(ctx *context.Context) {
 	provider := ctx.Params(":provider")
 
 	// first look if the provider is still active
-	loginSource, err := models.GetActiveOAuth2LoginSourceByName(provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(provider)
 	if err != nil {
 		ctx.ServerError("SignIn", err)
 		return
@@ -653,7 +654,7 @@ func SignInOAuthCallback(ctx *context.Context) {
 				FullName:    gothUser.Name,
 				Email:       gothUser.Email,
 				IsActive:    !setting.OAuth2Client.RegisterEmailConfirm,
-				LoginType:   models.LoginOAuth2,
+				LoginType:   login.OAuth2,
 				LoginSource: loginSource.ID,
 				LoginName:   gothUser.UserID,
 			}
@@ -711,7 +712,7 @@ func updateAvatarIfNeed(url string, u *models.User) {
 	}
 }
 
-func handleOAuth2SignIn(ctx *context.Context, source *models.LoginSource, u *models.User, gothUser goth.User) {
+func handleOAuth2SignIn(ctx *context.Context, source *login.Source, u *models.User, gothUser goth.User) {
 	updateAvatarIfNeed(gothUser.AvatarURL, u)
 
 	needs2FA := false
@@ -785,7 +786,7 @@ func handleOAuth2SignIn(ctx *context.Context, source *models.LoginSource, u *mod
 
 // OAuth2UserLoginCallback attempts to handle the callback from the OAuth2 provider and if successful
 // login the user
-func oAuth2UserLoginCallback(loginSource *models.LoginSource, request *http.Request, response http.ResponseWriter) (*models.User, goth.User, error) {
+func oAuth2UserLoginCallback(loginSource *login.Source, request *http.Request, response http.ResponseWriter) (*models.User, goth.User, error) {
 	gothUser, err := loginSource.Cfg.(*oauth2.Source).Callback(request, response)
 	if err != nil {
 		if err.Error() == "securecookie: the value is too long" {
@@ -797,7 +798,7 @@ func oAuth2UserLoginCallback(loginSource *models.LoginSource, request *http.Requ
 
 	user := &models.User{
 		LoginName:   gothUser.UserID,
-		LoginType:   models.LoginOAuth2,
+		LoginType:   login.OAuth2,
 		LoginSource: loginSource.ID,
 	}
 
@@ -1068,7 +1069,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
 		}
 	}
 
-	loginSource, err := models.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
 	if err != nil {
 		ctx.ServerError("CreateUser", err)
 	}
@@ -1078,7 +1079,7 @@ func LinkAccountPostRegister(ctx *context.Context) {
 		Email:       form.Email,
 		Passwd:      form.Password,
 		IsActive:    !(setting.Service.RegisterEmailConfirm || setting.Service.RegisterManualConfirm),
-		LoginType:   models.LoginOAuth2,
+		LoginType:   login.OAuth2,
 		LoginSource: loginSource.ID,
 		LoginName:   gothUser.UserID,
 	}
diff --git a/routers/web/user/home.go b/routers/web/user/home.go
index bb75558dc8..2f1fca4527 100644
--- a/routers/web/user/home.go
+++ b/routers/web/user/home.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	issue_indexer "code.gitea.io/gitea/modules/indexer/issues"
@@ -846,7 +847,7 @@ func repoIDMap(ctxUser *models.User, issueCountByRepo map[int64]int64, unitType
 
 // ShowSSHKeys output all the ssh keys of user by uid
 func ShowSSHKeys(ctx *context.Context, uid int64) {
-	keys, err := models.ListPublicKeys(uid, models.ListOptions{})
+	keys, err := models.ListPublicKeys(uid, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("ListPublicKeys", err)
 		return
@@ -862,7 +863,7 @@ func ShowSSHKeys(ctx *context.Context, uid int64) {
 
 // ShowGPGKeys output all the public GPG keys of user by uid
 func ShowGPGKeys(ctx *context.Context, uid int64) {
-	keys, err := models.ListGPGKeys(uid, models.ListOptions{})
+	keys, err := models.ListGPGKeys(uid, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("ListGPGKeys", err)
 		return
diff --git a/routers/web/user/oauth.go b/routers/web/user/oauth.go
index cec6a92bbe..d9fc5eeaf9 100644
--- a/routers/web/user/oauth.go
+++ b/routers/web/user/oauth.go
@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/json"
@@ -115,7 +116,7 @@ type AccessTokenResponse struct {
 	IDToken      string    `json:"id_token,omitempty"`
 }
 
-func newAccessTokenResponse(grant *models.OAuth2Grant, serverKey, clientKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
+func newAccessTokenResponse(grant *login.OAuth2Grant, serverKey, clientKey oauth2.JWTSigningKey) (*AccessTokenResponse, *AccessTokenError) {
 	if setting.OAuth2.InvalidateRefreshTokens {
 		if err := grant.IncreaseCounter(); err != nil {
 			return nil, &AccessTokenError{
@@ -162,7 +163,7 @@ func newAccessTokenResponse(grant *models.OAuth2Grant, serverKey, clientKey oaut
 	// generate OpenID Connect id_token
 	signedIDToken := ""
 	if grant.ScopeContains("openid") {
-		app, err := models.GetOAuth2ApplicationByID(grant.ApplicationID)
+		app, err := login.GetOAuth2ApplicationByID(grant.ApplicationID)
 		if err != nil {
 			return nil, &AccessTokenError{
 				ErrorCode:        AccessTokenErrorCodeInvalidRequest,
@@ -268,9 +269,9 @@ func IntrospectOAuth(ctx *context.Context) {
 	token, err := oauth2.ParseToken(form.Token, oauth2.DefaultSigningKey)
 	if err == nil {
 		if token.Valid() == nil {
-			grant, err := models.GetOAuth2GrantByID(token.GrantID)
+			grant, err := login.GetOAuth2GrantByID(token.GrantID)
 			if err == nil && grant != nil {
-				app, err := models.GetOAuth2ApplicationByID(grant.ApplicationID)
+				app, err := login.GetOAuth2ApplicationByID(grant.ApplicationID)
 				if err == nil && app != nil {
 					response.Active = true
 					response.Scope = grant.Scope
@@ -299,9 +300,9 @@ func AuthorizeOAuth(ctx *context.Context) {
 		return
 	}
 
-	app, err := models.GetOAuth2ApplicationByClientID(form.ClientID)
+	app, err := login.GetOAuth2ApplicationByClientID(form.ClientID)
 	if err != nil {
-		if models.IsErrOauthClientIDInvalid(err) {
+		if login.IsErrOauthClientIDInvalid(err) {
 			handleAuthorizeError(ctx, AuthorizeError{
 				ErrorCode:        ErrorCodeUnauthorizedClient,
 				ErrorDescription: "Client ID not registered",
@@ -312,8 +313,10 @@ func AuthorizeOAuth(ctx *context.Context) {
 		ctx.ServerError("GetOAuth2ApplicationByClientID", err)
 		return
 	}
-	if err := app.LoadUser(); err != nil {
-		ctx.ServerError("LoadUser", err)
+
+	user, err := models.GetUserByID(app.UID)
+	if err != nil {
+		ctx.ServerError("GetUserByID", err)
 		return
 	}
 
@@ -406,7 +409,7 @@ func AuthorizeOAuth(ctx *context.Context) {
 	ctx.Data["State"] = form.State
 	ctx.Data["Scope"] = form.Scope
 	ctx.Data["Nonce"] = form.Nonce
-	ctx.Data["ApplicationUserLink"] = "<a href=\"" + html.EscapeString(setting.AppURL) + html.EscapeString(url.PathEscape(app.User.LowerName)) + "\">@" + html.EscapeString(app.User.Name) + "</a>"
+	ctx.Data["ApplicationUserLink"] = "<a href=\"" + html.EscapeString(setting.AppURL) + html.EscapeString(url.PathEscape(user.LowerName)) + "\">@" + html.EscapeString(user.Name) + "</a>"
 	ctx.Data["ApplicationRedirectDomainHTML"] = "<strong>" + html.EscapeString(form.RedirectURI) + "</strong>"
 	// TODO document SESSION <=> FORM
 	err = ctx.Session.Set("client_id", app.ClientID)
@@ -443,7 +446,7 @@ func GrantApplicationOAuth(ctx *context.Context) {
 		ctx.Error(http.StatusBadRequest)
 		return
 	}
-	app, err := models.GetOAuth2ApplicationByClientID(form.ClientID)
+	app, err := login.GetOAuth2ApplicationByClientID(form.ClientID)
 	if err != nil {
 		ctx.ServerError("GetOAuth2ApplicationByClientID", err)
 		return
@@ -581,7 +584,7 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, server
 		return
 	}
 	// get grant before increasing counter
-	grant, err := models.GetOAuth2GrantByID(token.GrantID)
+	grant, err := login.GetOAuth2GrantByID(token.GrantID)
 	if err != nil || grant == nil {
 		handleAccessTokenError(ctx, AccessTokenError{
 			ErrorCode:        AccessTokenErrorCodeInvalidGrant,
@@ -608,7 +611,7 @@ func handleRefreshToken(ctx *context.Context, form forms.AccessTokenForm, server
 }
 
 func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, serverKey, clientKey oauth2.JWTSigningKey) {
-	app, err := models.GetOAuth2ApplicationByClientID(form.ClientID)
+	app, err := login.GetOAuth2ApplicationByClientID(form.ClientID)
 	if err != nil {
 		handleAccessTokenError(ctx, AccessTokenError{
 			ErrorCode:        AccessTokenErrorCodeInvalidClient,
@@ -630,7 +633,7 @@ func handleAuthorizationCode(ctx *context.Context, form forms.AccessTokenForm, s
 		})
 		return
 	}
-	authorizationCode, err := models.GetOAuth2AuthorizationByCode(form.Code)
+	authorizationCode, err := login.GetOAuth2AuthorizationByCode(form.Code)
 	if err != nil || authorizationCode == nil {
 		handleAccessTokenError(ctx, AccessTokenError{
 			ErrorCode:        AccessTokenErrorCodeUnauthorizedClient,
diff --git a/routers/web/user/oauth_test.go b/routers/web/user/oauth_test.go
index 09abf1ee2a..27d339b778 100644
--- a/routers/web/user/oauth_test.go
+++ b/routers/web/user/oauth_test.go
@@ -9,13 +9,14 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 
 	"github.com/golang-jwt/jwt"
 	"github.com/stretchr/testify/assert"
 )
 
-func createAndParseToken(t *testing.T, grant *models.OAuth2Grant) *oauth2.OIDCToken {
+func createAndParseToken(t *testing.T, grant *login.OAuth2Grant) *oauth2.OIDCToken {
 	signingKey, err := oauth2.CreateJWTSigningKey("HS256", make([]byte, 32))
 	assert.NoError(t, err)
 	assert.NotNil(t, signingKey)
@@ -42,7 +43,7 @@ func createAndParseToken(t *testing.T, grant *models.OAuth2Grant) *oauth2.OIDCTo
 func TestNewAccessTokenResponse_OIDCToken(t *testing.T) {
 	assert.NoError(t, db.PrepareTestDatabase())
 
-	grants, err := models.GetOAuth2GrantsByUserID(3)
+	grants, err := login.GetOAuth2GrantsByUserID(3)
 	assert.NoError(t, err)
 	assert.Len(t, grants, 1)
 
@@ -58,7 +59,7 @@ func TestNewAccessTokenResponse_OIDCToken(t *testing.T) {
 	assert.False(t, oidcToken.EmailVerified)
 
 	user := db.AssertExistsAndLoadBean(t, &models.User{ID: 5}).(*models.User)
-	grants, err = models.GetOAuth2GrantsByUserID(user.ID)
+	grants, err = login.GetOAuth2GrantsByUserID(user.ID)
 	assert.NoError(t, err)
 	assert.Len(t, grants, 1)
 
diff --git a/routers/web/user/profile.go b/routers/web/user/profile.go
index 9ecdc2345c..d64d5621de 100644
--- a/routers/web/user/profile.go
+++ b/routers/web/user/profile.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/markup"
 	"code.gitea.io/gitea/modules/markup/markdown"
@@ -192,7 +193,7 @@ func Profile(ctx *context.Context) {
 	ctx.Data["Keyword"] = keyword
 	switch tab {
 	case "followers":
-		items, err := ctxUser.GetFollowers(models.ListOptions{
+		items, err := ctxUser.GetFollowers(db.ListOptions{
 			PageSize: setting.UI.User.RepoPagingNum,
 			Page:     page,
 		})
@@ -204,7 +205,7 @@ func Profile(ctx *context.Context) {
 
 		total = ctxUser.NumFollowers
 	case "following":
-		items, err := ctxUser.GetFollowing(models.ListOptions{
+		items, err := ctxUser.GetFollowing(db.ListOptions{
 			PageSize: setting.UI.User.RepoPagingNum,
 			Page:     page,
 		})
@@ -229,7 +230,7 @@ func Profile(ctx *context.Context) {
 	case "stars":
 		ctx.Data["PageIsProfileStarList"] = true
 		repos, count, err = models.SearchRepository(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				PageSize: setting.UI.User.RepoPagingNum,
 				Page:     page,
 			},
@@ -260,7 +261,7 @@ func Profile(ctx *context.Context) {
 		}
 	case "watching":
 		repos, count, err = models.SearchRepository(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				PageSize: setting.UI.User.RepoPagingNum,
 				Page:     page,
 			},
@@ -281,7 +282,7 @@ func Profile(ctx *context.Context) {
 		total = int(count)
 	default:
 		repos, count, err = models.SearchRepository(&models.SearchRepoOptions{
-			ListOptions: models.ListOptions{
+			ListOptions: db.ListOptions{
 				PageSize: setting.UI.User.RepoPagingNum,
 				Page:     page,
 			},
diff --git a/routers/web/user/setting/applications.go b/routers/web/user/setting/applications.go
index 5e208afafe..9976337bfa 100644
--- a/routers/web/user/setting/applications.go
+++ b/routers/web/user/setting/applications.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -92,12 +93,12 @@ func loadApplicationsData(ctx *context.Context) {
 	ctx.Data["Tokens"] = tokens
 	ctx.Data["EnableOAuth2"] = setting.OAuth2.Enable
 	if setting.OAuth2.Enable {
-		ctx.Data["Applications"], err = models.GetOAuth2ApplicationsByUserID(ctx.User.ID)
+		ctx.Data["Applications"], err = login.GetOAuth2ApplicationsByUserID(ctx.User.ID)
 		if err != nil {
 			ctx.ServerError("GetOAuth2ApplicationsByUserID", err)
 			return
 		}
-		ctx.Data["Grants"], err = models.GetOAuth2GrantsByUserID(ctx.User.ID)
+		ctx.Data["Grants"], err = login.GetOAuth2GrantsByUserID(ctx.User.ID)
 		if err != nil {
 			ctx.ServerError("GetOAuth2GrantsByUserID", err)
 			return
diff --git a/routers/web/user/setting/keys.go b/routers/web/user/setting/keys.go
index 24b9a9e205..bb7a50841b 100644
--- a/routers/web/user/setting/keys.go
+++ b/routers/web/user/setting/keys.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -233,7 +234,7 @@ func DeleteKey(ctx *context.Context) {
 }
 
 func loadKeysData(ctx *context.Context) {
-	keys, err := models.ListPublicKeys(ctx.User.ID, models.ListOptions{})
+	keys, err := models.ListPublicKeys(ctx.User.ID, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("ListPublicKeys", err)
 		return
@@ -247,7 +248,7 @@ func loadKeysData(ctx *context.Context) {
 	}
 	ctx.Data["ExternalKeys"] = externalKeys
 
-	gpgkeys, err := models.ListGPGKeys(ctx.User.ID, models.ListOptions{})
+	gpgkeys, err := models.ListGPGKeys(ctx.User.ID, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("ListGPGKeys", err)
 		return
@@ -258,7 +259,7 @@ func loadKeysData(ctx *context.Context) {
 	// generate a new aes cipher using the csrfToken
 	ctx.Data["TokenToSign"] = tokenToSign
 
-	principals, err := models.ListPrincipalKeys(ctx.User.ID, models.ListOptions{})
+	principals, err := models.ListPrincipalKeys(ctx.User.ID, db.ListOptions{})
 	if err != nil {
 		ctx.ServerError("ListPrincipalKeys", err)
 		return
diff --git a/routers/web/user/setting/oauth2.go b/routers/web/user/setting/oauth2.go
index 8de0720b51..0f338ab5d1 100644
--- a/routers/web/user/setting/oauth2.go
+++ b/routers/web/user/setting/oauth2.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"net/http"
 
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -34,7 +34,7 @@ func OAuthApplicationsPost(ctx *context.Context) {
 		return
 	}
 	// TODO validate redirect URI
-	app, err := models.CreateOAuth2Application(models.CreateOAuth2ApplicationOptions{
+	app, err := login.CreateOAuth2Application(login.CreateOAuth2ApplicationOptions{
 		Name:         form.Name,
 		RedirectURIs: []string{form.RedirectURI},
 		UserID:       ctx.User.ID,
@@ -67,7 +67,7 @@ func OAuthApplicationsEdit(ctx *context.Context) {
 	}
 	// TODO validate redirect URI
 	var err error
-	if ctx.Data["App"], err = models.UpdateOAuth2Application(models.UpdateOAuth2ApplicationOptions{
+	if ctx.Data["App"], err = login.UpdateOAuth2Application(login.UpdateOAuth2ApplicationOptions{
 		ID:           ctx.ParamsInt64("id"),
 		Name:         form.Name,
 		RedirectURIs: []string{form.RedirectURI},
@@ -85,9 +85,9 @@ func OAuthApplicationsRegenerateSecret(ctx *context.Context) {
 	ctx.Data["Title"] = ctx.Tr("settings")
 	ctx.Data["PageIsSettingsApplications"] = true
 
-	app, err := models.GetOAuth2ApplicationByID(ctx.ParamsInt64("id"))
+	app, err := login.GetOAuth2ApplicationByID(ctx.ParamsInt64("id"))
 	if err != nil {
-		if models.IsErrOAuthApplicationNotFound(err) {
+		if login.IsErrOAuthApplicationNotFound(err) {
 			ctx.NotFound("Application not found", err)
 			return
 		}
@@ -110,9 +110,9 @@ func OAuthApplicationsRegenerateSecret(ctx *context.Context) {
 
 // OAuth2ApplicationShow displays the given application
 func OAuth2ApplicationShow(ctx *context.Context) {
-	app, err := models.GetOAuth2ApplicationByID(ctx.ParamsInt64("id"))
+	app, err := login.GetOAuth2ApplicationByID(ctx.ParamsInt64("id"))
 	if err != nil {
-		if models.IsErrOAuthApplicationNotFound(err) {
+		if login.IsErrOAuthApplicationNotFound(err) {
 			ctx.NotFound("Application not found", err)
 			return
 		}
@@ -129,7 +129,7 @@ func OAuth2ApplicationShow(ctx *context.Context) {
 
 // DeleteOAuth2Application deletes the given oauth2 application
 func DeleteOAuth2Application(ctx *context.Context) {
-	if err := models.DeleteOAuth2Application(ctx.FormInt64("id"), ctx.User.ID); err != nil {
+	if err := login.DeleteOAuth2Application(ctx.FormInt64("id"), ctx.User.ID); err != nil {
 		ctx.ServerError("DeleteOAuth2Application", err)
 		return
 	}
@@ -147,7 +147,7 @@ func RevokeOAuth2Grant(ctx *context.Context) {
 		ctx.ServerError("RevokeOAuth2Grant", fmt.Errorf("user id or grant id is zero"))
 		return
 	}
-	if err := models.RevokeOAuth2Grant(ctx.FormInt64("id"), ctx.User.ID); err != nil {
+	if err := login.RevokeOAuth2Grant(ctx.FormInt64("id"), ctx.User.ID); err != nil {
 		ctx.ServerError("RevokeOAuth2Grant", err)
 		return
 	}
diff --git a/routers/web/user/setting/profile.go b/routers/web/user/setting/profile.go
index bd967af32b..d75149b8fc 100644
--- a/routers/web/user/setting/profile.go
+++ b/routers/web/user/setting/profile.go
@@ -15,6 +15,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/log"
@@ -235,7 +236,7 @@ func Repos(ctx *context.Context) {
 	ctx.Data["allowAdopt"] = ctx.IsUserSiteAdmin() || setting.Repository.AllowAdoptionOfUnadoptedRepositories
 	ctx.Data["allowDelete"] = ctx.IsUserSiteAdmin() || setting.Repository.AllowDeleteOfUnadoptedRepositories
 
-	opts := models.ListOptions{
+	opts := db.ListOptions{
 		PageSize: setting.UI.Admin.UserPagingNum,
 		Page:     ctx.FormInt("page"),
 	}
@@ -284,7 +285,7 @@ func Repos(ctx *context.Context) {
 			return
 		}
 
-		if err := ctxUser.GetRepositories(models.ListOptions{Page: 1, PageSize: setting.UI.Admin.UserPagingNum}, repoNames...); err != nil {
+		if err := ctxUser.GetRepositories(db.ListOptions{Page: 1, PageSize: setting.UI.Admin.UserPagingNum}, repoNames...); err != nil {
 			ctx.ServerError("GetRepositories", err)
 			return
 		}
diff --git a/routers/web/user/setting/security.go b/routers/web/user/setting/security.go
index 3406194015..d4abe84d96 100644
--- a/routers/web/user/setting/security.go
+++ b/routers/web/user/setting/security.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/context"
 	"code.gitea.io/gitea/modules/setting"
@@ -87,9 +88,9 @@ func loadSecurityData(ctx *context.Context) {
 	}
 
 	// map the provider display name with the LoginSource
-	sources := make(map[*models.LoginSource]string)
+	sources := make(map[*login.Source]string)
 	for _, externalAccount := range accountLinks {
-		if loginSource, err := models.GetLoginSourceByID(externalAccount.LoginSourceID); err == nil {
+		if loginSource, err := login.GetSourceByID(externalAccount.LoginSourceID); err == nil {
 			var providerDisplayName string
 
 			type DisplayNamed interface {
diff --git a/services/auth/login_source.go b/services/auth/login_source.go
new file mode 100644
index 0000000000..723dd2b1a5
--- /dev/null
+++ b/services/auth/login_source.go
@@ -0,0 +1,41 @@
+// Copyright 2021 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
+)
+
+// DeleteLoginSource deletes a LoginSource record in DB.
+func DeleteLoginSource(source *login.Source) error {
+	count, err := db.GetEngine(db.DefaultContext).Count(&models.User{LoginSource: source.ID})
+	if err != nil {
+		return err
+	} else if count > 0 {
+		return login.ErrSourceInUse{
+			ID: source.ID,
+		}
+	}
+
+	count, err = db.GetEngine(db.DefaultContext).Count(&models.ExternalLoginUser{LoginSourceID: source.ID})
+	if err != nil {
+		return err
+	} else if count > 0 {
+		return login.ErrSourceInUse{
+			ID: source.ID,
+		}
+	}
+
+	if registerableSource, ok := source.Cfg.(login.RegisterableSource); ok {
+		if err := registerableSource.UnregisterSource(); err != nil {
+			return err
+		}
+	}
+
+	_, err = db.GetEngine(db.DefaultContext).ID(source.ID).Delete(new(login.Source))
+	return err
+}
diff --git a/services/auth/oauth2.go b/services/auth/oauth2.go
index e79b640ce4..9b342f3458 100644
--- a/services/auth/oauth2.go
+++ b/services/auth/oauth2.go
@@ -12,6 +12,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/web/middleware"
@@ -35,8 +36,8 @@ func CheckOAuthAccessToken(accessToken string) int64 {
 		log.Trace("oauth2.ParseToken: %v", err)
 		return 0
 	}
-	var grant *models.OAuth2Grant
-	if grant, err = models.GetOAuth2GrantByID(token.GrantID); err != nil || grant == nil {
+	var grant *login.OAuth2Grant
+	if grant, err = login.GetOAuth2GrantByID(token.GrantID); err != nil || grant == nil {
 		return 0
 	}
 	if token.Type != oauth2.TypeAccessToken {
diff --git a/services/auth/signin.go b/services/auth/signin.go
index a7acb95ba2..a7ad029456 100644
--- a/services/auth/signin.go
+++ b/services/auth/signin.go
@@ -9,6 +9,7 @@ import (
 
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 
 	// Register the sources
@@ -21,7 +22,7 @@ import (
 )
 
 // UserSignIn validates user name and password.
-func UserSignIn(username, password string) (*models.User, *models.LoginSource, error) {
+func UserSignIn(username, password string) (*models.User, *login.Source, error) {
 	var user *models.User
 	if strings.Contains(username, "@") {
 		user = &models.User{Email: strings.ToLower(strings.TrimSpace(username))}
@@ -50,7 +51,7 @@ func UserSignIn(username, password string) (*models.User, *models.LoginSource, e
 	}
 
 	if hasUser {
-		source, err := models.GetLoginSourceByID(user.LoginSource)
+		source, err := login.GetSourceByID(user.LoginSource)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -78,7 +79,7 @@ func UserSignIn(username, password string) (*models.User, *models.LoginSource, e
 		return user, source, nil
 	}
 
-	sources, err := models.AllActiveLoginSources()
+	sources, err := login.AllActiveSources()
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/services/auth/source/db/assert_interface_test.go b/services/auth/source/db/assert_interface_test.go
index 2e0fa9ba22..a8b137ec48 100644
--- a/services/auth/source/db/assert_interface_test.go
+++ b/services/auth/source/db/assert_interface_test.go
@@ -5,7 +5,7 @@
 package db_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/db"
 )
@@ -15,7 +15,7 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
+	login.Config
 }
 
 var _ (sourceInterface) = &db.Source{}
diff --git a/services/auth/source/db/source.go b/services/auth/source/db/source.go
index 182c05f0df..2fedff3a7e 100644
--- a/services/auth/source/db/source.go
+++ b/services/auth/source/db/source.go
@@ -4,7 +4,10 @@
 
 package db
 
-import "code.gitea.io/gitea/models"
+import (
+	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
+)
 
 // Source is a password authentication service
 type Source struct{}
@@ -26,6 +29,6 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginNoType, &Source{})
-	models.RegisterLoginTypeConfig(models.LoginPlain, &Source{})
+	login.RegisterTypeConfig(login.NoType, &Source{})
+	login.RegisterTypeConfig(login.Plain, &Source{})
 }
diff --git a/services/auth/source/ldap/assert_interface_test.go b/services/auth/source/ldap/assert_interface_test.go
index a0425d2f76..c480119cd3 100644
--- a/services/auth/source/ldap/assert_interface_test.go
+++ b/services/auth/source/ldap/assert_interface_test.go
@@ -5,7 +5,7 @@
 package ldap_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/ldap"
 )
@@ -17,12 +17,12 @@ type sourceInterface interface {
 	auth.PasswordAuthenticator
 	auth.SynchronizableSource
 	auth.LocalTwoFASkipper
-	models.SSHKeyProvider
-	models.LoginConfig
-	models.SkipVerifiable
-	models.HasTLSer
-	models.UseTLSer
-	models.LoginSourceSettable
+	login.SSHKeyProvider
+	login.Config
+	login.SkipVerifiable
+	login.HasTLSer
+	login.UseTLSer
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &ldap.Source{}
diff --git a/services/auth/source/ldap/source.go b/services/auth/source/ldap/source.go
index d1228d41ae..82ff7313b2 100644
--- a/services/auth/source/ldap/source.go
+++ b/services/auth/source/ldap/source.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 	"code.gitea.io/gitea/modules/secret"
 	"code.gitea.io/gitea/modules/setting"
@@ -55,7 +56,7 @@ type Source struct {
 	SkipLocalTwoFA        bool   // Skip Local 2fa for users authenticated with this source
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up a LDAPConfig from serialized format.
@@ -109,11 +110,11 @@ func (source *Source) ProvidesSSHKeys() bool {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginLDAP, &Source{})
-	models.RegisterLoginTypeConfig(models.LoginDLDAP, &Source{})
+	login.RegisterTypeConfig(login.LDAP, &Source{})
+	login.RegisterTypeConfig(login.DLDAP, &Source{})
 }
diff --git a/services/auth/source/ldap/source_authenticate.go b/services/auth/source/ldap/source_authenticate.go
index 46478e6029..f302a9d583 100644
--- a/services/auth/source/ldap/source_authenticate.go
+++ b/services/auth/source/ldap/source_authenticate.go
@@ -9,16 +9,17 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/mailer"
 )
 
 // Authenticate queries if login/password is valid against the LDAP directory pool,
 // and create a local user if success when enabled.
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
-	sr := source.SearchEntry(login, password, source.loginSource.Type == models.LoginDLDAP)
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
+	sr := source.SearchEntry(userName, password, source.loginSource.Type == login.DLDAP)
 	if sr == nil {
 		// User not in LDAP, do nothing
-		return nil, models.ErrUserNotExist{Name: login}
+		return nil, models.ErrUserNotExist{Name: userName}
 	}
 
 	isAttributeSSHPublicKeySet := len(strings.TrimSpace(source.AttributeSSHPublicKey)) > 0
@@ -64,7 +65,7 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 
 	// Fallback.
 	if len(sr.Username) == 0 {
-		sr.Username = login
+		sr.Username = userName
 	}
 
 	if len(sr.Mail) == 0 {
@@ -78,7 +79,7 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		Email:        sr.Mail,
 		LoginType:    source.loginSource.Type,
 		LoginSource:  source.loginSource.ID,
-		LoginName:    login,
+		LoginName:    userName,
 		IsActive:     true,
 		IsAdmin:      sr.IsAdmin,
 		IsRestricted: sr.IsRestricted,
diff --git a/services/auth/source/oauth2/assert_interface_test.go b/services/auth/source/oauth2/assert_interface_test.go
index 4157427ff2..0a1986a3b2 100644
--- a/services/auth/source/oauth2/assert_interface_test.go
+++ b/services/auth/source/oauth2/assert_interface_test.go
@@ -5,7 +5,7 @@
 package oauth2_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/oauth2"
 )
@@ -14,9 +14,9 @@ import (
 // It tightly binds the interfaces and implementation without breaking go import cycles
 
 type sourceInterface interface {
-	models.LoginConfig
-	models.LoginSourceSettable
-	models.RegisterableSource
+	login.Config
+	login.SourceSettable
+	login.RegisterableSource
 	auth.PasswordAuthenticator
 }
 
diff --git a/services/auth/source/oauth2/init.go b/services/auth/source/oauth2/init.go
index be31503eef..343b24cf6f 100644
--- a/services/auth/source/oauth2/init.go
+++ b/services/auth/source/oauth2/init.go
@@ -8,8 +8,8 @@ import (
 	"net/http"
 	"sync"
 
-	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/models/db"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 
@@ -74,7 +74,7 @@ func ResetOAuth2() error {
 
 // initOAuth2LoginSources is used to load and register all active OAuth2 providers
 func initOAuth2LoginSources() error {
-	loginSources, _ := models.GetActiveOAuth2ProviderLoginSources()
+	loginSources, _ := login.GetActiveOAuth2ProviderLoginSources()
 	for _, source := range loginSources {
 		oauth2Source, ok := source.Cfg.(*Source)
 		if !ok {
diff --git a/services/auth/source/oauth2/providers.go b/services/auth/source/oauth2/providers.go
index 2196e30492..0fd57a8dbd 100644
--- a/services/auth/source/oauth2/providers.go
+++ b/services/auth/source/oauth2/providers.go
@@ -9,6 +9,7 @@ import (
 	"sort"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
 
@@ -87,7 +88,7 @@ func GetOAuth2Providers() []Provider {
 func GetActiveOAuth2Providers() ([]string, map[string]Provider, error) {
 	// Maybe also separate used and unused providers so we can force the registration of only 1 active provider for each type
 
-	loginSources, err := models.GetActiveOAuth2ProviderLoginSources()
+	loginSources, err := login.GetActiveOAuth2ProviderLoginSources()
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/services/auth/source/oauth2/source.go b/services/auth/source/oauth2/source.go
index 7b22383d7e..49bb9a0148 100644
--- a/services/auth/source/oauth2/source.go
+++ b/services/auth/source/oauth2/source.go
@@ -6,6 +6,7 @@ package oauth2
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -27,7 +28,7 @@ type Source struct {
 	SkipLocalTwoFA                bool
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up an OAuth2Config from serialized format.
@@ -41,10 +42,10 @@ func (source *Source) ToDB() ([]byte, error) {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginOAuth2, &Source{})
+	login.RegisterTypeConfig(login.OAuth2, &Source{})
 }
diff --git a/services/auth/source/pam/assert_interface_test.go b/services/auth/source/pam/assert_interface_test.go
index a0bebdf9c6..a151c2f52e 100644
--- a/services/auth/source/pam/assert_interface_test.go
+++ b/services/auth/source/pam/assert_interface_test.go
@@ -5,7 +5,7 @@
 package pam_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/pam"
 )
@@ -15,8 +15,8 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
-	models.LoginSourceSettable
+	login.Config
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &pam.Source{}
diff --git a/services/auth/source/pam/source.go b/services/auth/source/pam/source.go
index 75aa99e45f..0bfa7cdb06 100644
--- a/services/auth/source/pam/source.go
+++ b/services/auth/source/pam/source.go
@@ -6,6 +6,7 @@ package pam
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -22,7 +23,7 @@ type Source struct {
 	EmailDomain string
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up a PAMConfig from serialized format.
@@ -36,10 +37,10 @@ func (source *Source) ToDB() ([]byte, error) {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginPAM, &Source{})
+	login.RegisterTypeConfig(login.PAM, &Source{})
 }
diff --git a/services/auth/source/pam/source_authenticate.go b/services/auth/source/pam/source_authenticate.go
index 8241aed725..ad6fbb5cce 100644
--- a/services/auth/source/pam/source_authenticate.go
+++ b/services/auth/source/pam/source_authenticate.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/auth/pam"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/services/mailer"
@@ -18,11 +19,11 @@ import (
 
 // Authenticate queries if login/password is valid against the PAM,
 // and create a local user if success when enabled.
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
-	pamLogin, err := pam.Auth(source.ServiceName, login, password)
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
+	pamLogin, err := pam.Auth(source.ServiceName, userName, password)
 	if err != nil {
 		if strings.Contains(err.Error(), "Authentication failure") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		return nil, err
 	}
@@ -54,9 +55,9 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		Name:        username,
 		Email:       email,
 		Passwd:      password,
-		LoginType:   models.LoginPAM,
+		LoginType:   login.PAM,
 		LoginSource: source.loginSource.ID,
-		LoginName:   login, // This is what the user typed in
+		LoginName:   userName, // This is what the user typed in
 		IsActive:    true,
 	}
 
diff --git a/services/auth/source/smtp/assert_interface_test.go b/services/auth/source/smtp/assert_interface_test.go
index bc2042e069..d1c982472f 100644
--- a/services/auth/source/smtp/assert_interface_test.go
+++ b/services/auth/source/smtp/assert_interface_test.go
@@ -5,7 +5,7 @@
 package smtp_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth"
 	"code.gitea.io/gitea/services/auth/source/smtp"
 )
@@ -15,11 +15,11 @@ import (
 
 type sourceInterface interface {
 	auth.PasswordAuthenticator
-	models.LoginConfig
-	models.SkipVerifiable
-	models.HasTLSer
-	models.UseTLSer
-	models.LoginSourceSettable
+	login.Config
+	login.SkipVerifiable
+	login.HasTLSer
+	login.UseTLSer
+	login.SourceSettable
 }
 
 var _ (sourceInterface) = &smtp.Source{}
diff --git a/services/auth/source/smtp/source.go b/services/auth/source/smtp/source.go
index 39c9851ede..487375c304 100644
--- a/services/auth/source/smtp/source.go
+++ b/services/auth/source/smtp/source.go
@@ -6,6 +6,7 @@ package smtp
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -28,7 +29,7 @@ type Source struct {
 	DisableHelo    bool
 
 	// reference to the loginSource
-	loginSource *models.LoginSource
+	loginSource *login.Source
 }
 
 // FromDB fills up an SMTPConfig from serialized format.
@@ -57,10 +58,10 @@ func (source *Source) UseTLS() bool {
 }
 
 // SetLoginSource sets the related LoginSource
-func (source *Source) SetLoginSource(loginSource *models.LoginSource) {
+func (source *Source) SetLoginSource(loginSource *login.Source) {
 	source.loginSource = loginSource
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginSMTP, &Source{})
+	login.RegisterTypeConfig(login.SMTP, &Source{})
 }
diff --git a/services/auth/source/smtp/source_authenticate.go b/services/auth/source/smtp/source_authenticate.go
index cff64c69d2..f50baa56a2 100644
--- a/services/auth/source/smtp/source_authenticate.go
+++ b/services/auth/source/smtp/source_authenticate.go
@@ -11,31 +11,32 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/services/mailer"
 )
 
 // Authenticate queries if the provided login/password is authenticates against the SMTP server
 // Users will be autoregistered as required
-func (source *Source) Authenticate(user *models.User, login, password string) (*models.User, error) {
+func (source *Source) Authenticate(user *models.User, userName, password string) (*models.User, error) {
 	// Verify allowed domains.
 	if len(source.AllowedDomains) > 0 {
-		idx := strings.Index(login, "@")
+		idx := strings.Index(userName, "@")
 		if idx == -1 {
-			return nil, models.ErrUserNotExist{Name: login}
-		} else if !util.IsStringInSlice(login[idx+1:], strings.Split(source.AllowedDomains, ","), true) {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
+		} else if !util.IsStringInSlice(userName[idx+1:], strings.Split(source.AllowedDomains, ","), true) {
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 	}
 
 	var auth smtp.Auth
 	switch source.Auth {
 	case PlainAuthentication:
-		auth = smtp.PlainAuth("", login, password, source.Host)
+		auth = smtp.PlainAuth("", userName, password, source.Host)
 	case LoginAuthentication:
-		auth = &loginAuthenticator{login, password}
+		auth = &loginAuthenticator{userName, password}
 	case CRAMMD5Authentication:
-		auth = smtp.CRAMMD5Auth(login, password)
+		auth = smtp.CRAMMD5Auth(userName, password)
 	default:
 		return nil, errors.New("unsupported SMTP auth type")
 	}
@@ -46,11 +47,11 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		tperr, ok := err.(*textproto.Error)
 		if (ok && tperr.Code == 535) ||
 			strings.Contains(err.Error(), "Username and Password not accepted") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		if (ok && tperr.Code == 534) ||
 			strings.Contains(err.Error(), "Application-specific password required") {
-			return nil, models.ErrUserNotExist{Name: login}
+			return nil, models.ErrUserNotExist{Name: userName}
 		}
 		return nil, err
 	}
@@ -59,20 +60,20 @@ func (source *Source) Authenticate(user *models.User, login, password string) (*
 		return user, nil
 	}
 
-	username := login
-	idx := strings.Index(login, "@")
+	username := userName
+	idx := strings.Index(userName, "@")
 	if idx > -1 {
-		username = login[:idx]
+		username = userName[:idx]
 	}
 
 	user = &models.User{
 		LowerName:   strings.ToLower(username),
 		Name:        strings.ToLower(username),
-		Email:       login,
+		Email:       userName,
 		Passwd:      password,
-		LoginType:   models.LoginSMTP,
+		LoginType:   login.SMTP,
 		LoginSource: source.loginSource.ID,
-		LoginName:   login,
+		LoginName:   userName,
 		IsActive:    true,
 	}
 
diff --git a/services/auth/source/sspi/assert_interface_test.go b/services/auth/source/sspi/assert_interface_test.go
index 605a6ec6c5..1efa69c05b 100644
--- a/services/auth/source/sspi/assert_interface_test.go
+++ b/services/auth/source/sspi/assert_interface_test.go
@@ -5,7 +5,7 @@
 package sspi_test
 
 import (
-	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/services/auth/source/sspi"
 )
 
@@ -13,7 +13,7 @@ import (
 // It tightly binds the interfaces and implementation without breaking go import cycles
 
 type sourceInterface interface {
-	models.LoginConfig
+	login.Config
 }
 
 var _ (sourceInterface) = &sspi.Source{}
diff --git a/services/auth/source/sspi/source.go b/services/auth/source/sspi/source.go
index 58cb10de1d..68fd6a6079 100644
--- a/services/auth/source/sspi/source.go
+++ b/services/auth/source/sspi/source.go
@@ -6,6 +6,7 @@ package sspi
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/json"
 )
 
@@ -36,5 +37,5 @@ func (cfg *Source) ToDB() ([]byte, error) {
 }
 
 func init() {
-	models.RegisterLoginTypeConfig(models.LoginSSPI, &Source{})
+	login.RegisterTypeConfig(login.SSPI, &Source{})
 }
diff --git a/services/auth/sspi_windows.go b/services/auth/sspi_windows.go
index d7e0f55242..a4c39b0064 100644
--- a/services/auth/sspi_windows.go
+++ b/services/auth/sspi_windows.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/base"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -152,7 +153,7 @@ func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore,
 
 // getConfig retrieves the SSPI configuration from login sources
 func (s *SSPI) getConfig() (*sspi.Source, error) {
-	sources, err := models.ActiveLoginSources(models.LoginSSPI)
+	sources, err := login.ActiveSources(login.SSPI)
 	if err != nil {
 		return nil, err
 	}
@@ -248,7 +249,7 @@ func sanitizeUsername(username string, cfg *sspi.Source) string {
 // fails (or if negotiation should continue), which would prevent other authentication methods
 // to execute at all.
 func specialInit() {
-	if models.IsSSPIEnabled() {
+	if login.IsSSPIEnabled() {
 		Register(&SSPI{})
 	}
 }
diff --git a/services/auth/sync.go b/services/auth/sync.go
index a34b4d1d26..6d69650e5b 100644
--- a/services/auth/sync.go
+++ b/services/auth/sync.go
@@ -8,6 +8,7 @@ import (
 	"context"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/log"
 )
 
@@ -15,7 +16,7 @@ import (
 func SyncExternalUsers(ctx context.Context, updateExisting bool) error {
 	log.Trace("Doing: SyncExternalUsers")
 
-	ls, err := models.LoginSources()
+	ls, err := login.Sources()
 	if err != nil {
 		log.Error("SyncExternalUsers: %v", err)
 		return err
diff --git a/services/externalaccount/user.go b/services/externalaccount/user.go
index 45773fdb12..e43b3ca7c5 100644
--- a/services/externalaccount/user.go
+++ b/services/externalaccount/user.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/login"
 	"code.gitea.io/gitea/modules/structs"
 
 	"github.com/markbates/goth"
@@ -15,7 +16,7 @@ import (
 
 // LinkAccountToUser link the gothUser to the user
 func LinkAccountToUser(user *models.User, gothUser goth.User) error {
-	loginSource, err := models.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
+	loginSource, err := login.GetActiveOAuth2LoginSourceByName(gothUser.Provider)
 	if err != nil {
 		return err
 	}
diff --git a/services/pull/commit_status.go b/services/pull/commit_status.go
index c5c930ee0d..f1f351138b 100644
--- a/services/pull/commit_status.go
+++ b/services/pull/commit_status.go
@@ -7,6 +7,7 @@ package pull
 
 import (
 	"code.gitea.io/gitea/models"
+	"code.gitea.io/gitea/models/db"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/structs"
 
@@ -129,7 +130,7 @@ func GetPullRequestCommitStatusState(pr *models.PullRequest) (structs.CommitStat
 		return "", errors.Wrap(err, "LoadBaseRepo")
 	}
 
-	commitStatuses, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, models.ListOptions{})
+	commitStatuses, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, db.ListOptions{})
 	if err != nil {
 		return "", errors.Wrap(err, "GetLatestCommitStatus")
 	}
diff --git a/services/pull/pull.go b/services/pull/pull.go
index bd5551b6dc..f7e231379b 100644
--- a/services/pull/pull.go
+++ b/services/pull/pull.go
@@ -780,7 +780,7 @@ func getLastCommitStatus(gitRepo *git.Repository, pr *models.PullRequest) (statu
 		return nil, err
 	}
 
-	statusList, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, models.ListOptions{})
+	statusList, err := models.GetLatestCommitStatus(pr.BaseRepo.ID, sha, db.ListOptions{})
 	if err != nil {
 		return nil, err
 	}
diff --git a/services/pull/review.go b/services/pull/review.go
index f65314c45d..081b17cd83 100644
--- a/services/pull/review.go
+++ b/services/pull/review.go
@@ -138,7 +138,7 @@ func createCodeComment(doer *models.User, repo *models.Repository, issue *models
 				Line:     line,
 				TreePath: treePath,
 				Type:     models.CommentTypeCode,
-				ListOptions: models.ListOptions{
+				ListOptions: db.ListOptions{
 					PageSize: 1,
 					Page:     1,
 				},