make extended login challenges not hardcoded

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

authentik/flows/challenge.py

@@ -60,18 +60,22 @@ class Challenge(PassiveSerializer):
     )
 
 
+class LoginChallenge(Challenge):
+    """Base class for extended login challenges"""
+
+
 class RedirectChallenge(Challenge):
     """Challenge type to redirect the client"""
 
-    to = CharField()
     component = CharField(default="xak-flow-redirect")
+    to = CharField()
 
 
 class ShellChallenge(Challenge):
     """challenge type to render HTML as-is"""
 
-    body = CharField()
     component = CharField(default="xak-flow-shell")
+    body = CharField()
 
 
 class WithUserInfoChallenge(Challenge):

authentik/sources/oauth/types/apple.py

@@ -107,7 +107,7 @@ class AppleType(SourceType):
 
     authorization_code_auth_method = AuthorizationCodeAuthMethod.POST_BODY
 
-    def login_challenge(self, source: OAuthSource, request: HttpRequest) -> Challenge:
+    def login_challenge(self, source: OAuthSource, request: HttpRequest) -> AppleLoginChallenge:
         """Pre-general all the things required for the JS SDK"""
         apple_client = AppleOAuthClient(
             source,