stages/prompt: field name (#4497)

* add prompt field name Signed-off-by: Jens Langhammer <jens@goauthentik.io> * remove numerical prefix Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix missing name Signed-off-by: Jens Langhammer <jens@goauthentik.io> * use text field Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add description label Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add migrate blueprint to remove old stages Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add task to remove unretrievable blueprints Signed-off-by: Jens Langhammer <jens@goauthentik.io> * lint Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix blueprint test paths Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix tests Signed-off-by: Jens Langhammer <jens@goauthentik.io> * actually fix tests Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix tests even more Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix fixtures Signed-off-by: Jens Langhammer <jens@goauthentik.io> Signed-off-by: Jens Langhammer <jens@goauthentik.io>
2023-01-24 12:23:22 +01:00
parent 9437e2d3ab
commit 53b65a9d1a
50 changed files with 468 additions and 219 deletions
--- a/blueprints/default/flow-default-user-settings-flow.yaml
+++ b/blueprints/default/flow-default-user-settings-flow.yaml
@ -0,0 +1,141 @@
+version: 1
+metadata:
+  name: Default - User settings flow
+entries:
+- attrs:
+    designation: stage_configuration
+    name: User settings
+    title: Update your info
+    authentication: require_authenticated
+  identifiers:
+    slug: default-user-settings-flow
+  model: authentik_flows.flow
+  id: flow
+- attrs:
+    order: 200
+    placeholder: |
+      try:
+          return user.username
+      except:
+          return ''
+    placeholder_expression: true
+    required: true
+    type: text
+    field_key: username
+    label: Username
+  identifiers:
+    name: default-user-settings-field-username
+  id: prompt-field-username
+  model: authentik_stages_prompt.prompt
+- attrs:
+    order: 201
+    placeholder: |
+      try:
+          return user.name
+      except:
+          return ''
+    placeholder_expression: true
+    required: true
+    type: text
+    field_key: name
+    label: Name
+  identifiers:
+    name: default-user-settings-field-name
+  id: prompt-field-name
+  model: authentik_stages_prompt.prompt
+- attrs:
+    order: 202
+    placeholder: |
+      try:
+          return user.email
+      except:
+          return ''
+    placeholder_expression: true
+    required: true
+    type: email
+    field_key: email
+    label: Email
+  identifiers:
+    name: default-user-settings-field-email
+  id: prompt-field-email
+  model: authentik_stages_prompt.prompt
+- attrs:
+    order: 203
+    placeholder: |
+      try:
+          return user.attributes.get("settings", {}).get("locale", "")
+      except:
+          return ''
+    placeholder_expression: true
+    required: true
+    type: ak-locale
+    field_key: attributes.settings.locale
+    label: Locale
+  identifiers:
+    name: default-user-settings-field-locale
+  id: prompt-field-locale
+  model: authentik_stages_prompt.prompt
+- attrs:
+    expression:  |
+      from authentik.lib.config import CONFIG
+      from authentik.core.models import (
+          USER_ATTRIBUTE_CHANGE_EMAIL,
+          USER_ATTRIBUTE_CHANGE_NAME,
+          USER_ATTRIBUTE_CHANGE_USERNAME
+      )
+      prompt_data = request.context.get("prompt_data")
+
+      if not request.user.group_attributes(request.http_request).get(
+          USER_ATTRIBUTE_CHANGE_EMAIL, CONFIG.y_bool("default_user_change_email", True)
+      ):
+          if prompt_data.get("email") != request.user.email:
+              ak_message("Not allowed to change email address.")
+              return False
+
+      if not request.user.group_attributes(request.http_request).get(
+          USER_ATTRIBUTE_CHANGE_NAME, CONFIG.y_bool("default_user_change_name", True)
+      ):
+          if prompt_data.get("name") != request.user.name:
+              ak_message("Not allowed to change name.")
+              return False
+
+      if not request.user.group_attributes(request.http_request).get(
+          USER_ATTRIBUTE_CHANGE_USERNAME, CONFIG.y_bool("default_user_change_username", True)
+      ):
+          if prompt_data.get("username") != request.user.username:
+              ak_message("Not allowed to change username.")
+              return False
+
+      return True
+  identifiers:
+    name: default-user-settings-authorization
+  id: default-user-settings-authorization
+  model: authentik_policies_expression.expressionpolicy
+- identifiers:
+    name: default-user-settings-write
+  attrs:
+    user_creation_mode: never_create
+  id: default-user-settings-write
+  model: authentik_stages_user_write.userwritestage
+- attrs:
+    fields:
+    - !KeyOf prompt-field-username
+    - !KeyOf prompt-field-name
+    - !KeyOf prompt-field-email
+    - !KeyOf prompt-field-locale
+    validation_policies:
+    - !KeyOf default-user-settings-authorization
+  identifiers:
+    name: default-user-settings
+  id: default-user-settings
+  model: authentik_stages_prompt.promptstage
+- identifiers:
+    order: 20
+    stage: !KeyOf default-user-settings
+    target: !KeyOf flow
+  model: authentik_flows.flowstagebinding
+- identifiers:
+    order: 100
+    stage: !KeyOf default-user-settings-write
+    target: !KeyOf flow
+  model: authentik_flows.flowstagebinding