release: 2024.2.4

security: fix CVE-2024-37905 (#10230)

Co-authored-by: Jens L <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2024.2.2
+current_version = 2024.2.4
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?

.github/ISSUE_TEMPLATE/question.md

@@ -9,7 +9,7 @@ assignees: ""
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 
-**Relevant info**
+**Relevant infos**
 i.e. Version of other software you're using, specifics of your setup
 
 **Screenshots**

.github/dependabot.yml

@@ -52,10 +52,6 @@ updates:
       esbuild:
         patterns:
           - "@esbuild/*"
-      rollup:
-        patterns:
-          - "@rollup/*"
-          - "rollup-*"
   - package-ecosystem: npm
     directory: "/tests/wdio"
     schedule:

.github/workflows/ci-main.yml

@@ -7,6 +7,8 @@ on:
       - main
       - next
       - version-*
+    paths-ignore:
+      - website/**
   pull_request:
     branches:
       - main
@@ -26,7 +28,10 @@ jobs:
           - bandit
           - black
           - codespell
+          - isort
           - pending-migrations
+          # - pylint
+          - pyright
           - ruff
     runs-on: ubuntu-latest
     steps:

.github/workflows/ci-website.yml

@@ -48,6 +48,7 @@ jobs:
       matrix:
         job:
           - build
+          - build-docs-only
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.vscode/extensions.json

@@ -10,7 +10,8 @@
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
         "ms-python.black-formatter",
-        "charliermarsh.ruff",
+        "ms-python.isort",
+        "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
         "ms-python.black-formatter",

Dockerfile

@@ -14,10 +14,9 @@ RUN --mount=type=bind,target=/work/website/package.json,src=./website/package.js
 
 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
-COPY ./schema.yml /work/
 COPY ./SECURITY.md /work/
 
-RUN npm run build-bundled
+RUN npm run build-docs-only
 
 # Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
@@ -38,7 +37,7 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 RUN npm run build
 
 # Stage 3: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS go-builder
+FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.0-bookworm AS go-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -151,7 +150,7 @@ COPY --from=go-builder /go/authentik /bin/authentik
 COPY --from=python-deps /ak-root/venv /ak-root/venv
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/build/ /website/help/
+COPY --from=website-builder /work/website/help/ /website/help/
 COPY --from=geoip /usr/share/GeoIP /geoip
 
 USER 1000

Makefile

@@ -59,12 +59,15 @@ test: ## Run the server tests and produce a coverage report (locally)
 	coverage report
 
 lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
+	isort $(PY_SOURCES)
 	black $(PY_SOURCES)
-	ruff check --fix $(PY_SOURCES)
+	ruff --fix $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
 lint: ## Lint the python and golang sources
 	bandit -r $(PY_SOURCES) -x node_modules
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
 core-install:
@@ -246,6 +249,9 @@ ci--meta-debug:
 	python -V
 	node --version
 
+ci-pylint: ci--meta-debug
+	pylint $(PY_SOURCES)
+
 ci-black: ci--meta-debug
 	black --check $(PY_SOURCES)
 
@@ -255,8 +261,14 @@ ci-ruff: ci--meta-debug
 ci-codespell: ci--meta-debug
 	codespell $(CODESPELL_ARGS) -s
 
+ci-isort: ci--meta-debug
+	isort --check $(PY_SOURCES)
+
 ci-bandit: ci--meta-debug
 	bandit -r $(PY_SOURCES)
 
+ci-pyright: ci--meta-debug
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

authentik/__init__.py

@@ -1,12 +1,13 @@
 """authentik root module"""
 
 from os import environ
+from typing import Optional
 
-__version__ = "2024.2.2"
+__version__ = "2024.2.4"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 
-def get_build_hash(fallback: str | None = None) -> str:
+def get_build_hash(fallback: Optional[str] = None) -> str:
     """Get build hash"""
     build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
     return fallback if build_hash == "" and fallback else build_hash

authentik/admin/api/version.py

@@ -10,7 +10,7 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from authentik import __version__, get_build_hash
-from authentik.admin.tasks import VERSION_CACHE_KEY, VERSION_NULL, update_latest_version
+from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
 from authentik.core.api.utils import PassiveSerializer
 
 
@@ -19,7 +19,6 @@ class VersionSerializer(PassiveSerializer):
 
     version_current = SerializerMethodField()
     version_latest = SerializerMethodField()
-    version_latest_valid = SerializerMethodField()
     build_hash = SerializerMethodField()
     outdated = SerializerMethodField()
 
@@ -39,10 +38,6 @@ class VersionSerializer(PassiveSerializer):
             return __version__
         return version_in_cache
 
-    def get_version_latest_valid(self, _) -> bool:
-        """Check if latest version is valid"""
-        return cache.get(VERSION_CACHE_KEY) != VERSION_NULL
-
     def get_outdated(self, instance) -> bool:
         """Check if we're running the latest version"""
         return parse(self.get_version_current(instance)) < parse(self.get_version_latest(instance))

authentik/admin/tasks.py

@@ -18,7 +18,6 @@ from authentik.lib.utils.http import get_http_session
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
-VERSION_NULL = "0.0.0"
 VERSION_CACHE_KEY = "authentik_latest_version"
 VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
 # Chop of the first ^ because we want to search the entire string
@@ -56,7 +55,7 @@ def clear_update_notifications():
 def update_latest_version(self: SystemTask):
     """Update latest version info"""
     if CONFIG.get_bool("disable_update_check"):
-        cache.set(VERSION_CACHE_KEY, VERSION_NULL, VERSION_CACHE_TIMEOUT)
+        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskStatus.WARNING, "Version check disabled.")
         return
     try:
@@ -83,7 +82,7 @@ def update_latest_version(self: SystemTask):
                 event_dict["message"] = f"Changelog: {match.group()}"
             Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
     except (RequestException, IndexError) as exc:
-        cache.set(VERSION_CACHE_KEY, VERSION_NULL, VERSION_CACHE_TIMEOUT)
+        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_error(exc)
 
 

authentik/api/apps.py

@@ -18,7 +18,7 @@ class AuthentikAPIConfig(AppConfig):
 
         # Class is defined here as it needs to be created early enough that drf-spectacular will
         # find it, but also won't cause any import issues
-
+        # pylint: disable=unused-variable
         class TokenSchema(OpenApiAuthenticationExtension):
             """Auth schema"""
 

authentik/api/authentication.py

@@ -1,7 +1,7 @@
 """API Authentication"""
 
 from hmac import compare_digest
-from typing import Any
+from typing import Any, Optional
 
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
@@ -17,7 +17,7 @@ from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> str | None:
+def validate_auth(header: bytes) -> Optional[str]:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -32,7 +32,7 @@ def validate_auth(header: bytes) -> str | None:
     return auth_credentials
 
 
-def bearer_auth(raw_header: bytes) -> User | None:
+def bearer_auth(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     user = auth_user_lookup(raw_header)
     if not user:
@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> User | None:
     return user
 
 
-def auth_user_lookup(raw_header: bytes) -> User | None:
+def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     from authentik.providers.oauth2.models import AccessToken
 
@@ -75,7 +75,7 @@ def auth_user_lookup(raw_header: bytes) -> User | None:
     raise AuthenticationFailed("Token invalid/expired")
 
 
-def token_secret_key(value: str) -> User | None:
+def token_secret_key(value: str) -> Optional[User]:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST

authentik/api/tests/test_auth.py

@@ -25,17 +25,17 @@ class TestAPIAuth(TestCase):
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth(b"foo bar")
+            bearer_auth("foo bar".encode())
 
     def test_invalid_empty(self):
         """Test invalid type"""
-        self.assertIsNone(bearer_auth(b"Bearer "))
-        self.assertIsNone(bearer_auth(b""))
+        self.assertIsNone(bearer_auth("Bearer ".encode()))
+        self.assertIsNone(bearer_auth("".encode()))
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
-            auth = b64encode(b":abc").decode()
+            auth = b64encode(":abc".encode()).decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
     def test_bearer_valid(self):

authentik/api/tests/test_viewsets.py

@@ -1,6 +1,6 @@
 """authentik API Modelviewset tests"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.test import TestCase
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -26,6 +26,6 @@ def viewset_tester_factory(test_viewset: type[ModelViewSet]) -> Callable:
 
 
 for _, viewset, _ in router.registry:
-    if not issubclass(viewset, ModelViewSet | ReadOnlyModelViewSet):
+    if not issubclass(viewset, (ModelViewSet, ReadOnlyModelViewSet)):
         continue
     setattr(TestModelViewSets, f"test_viewset_{viewset.__name__}", viewset_tester_factory(viewset))

authentik/api/v3/urls.py

@@ -33,7 +33,7 @@ for _authentik_app in get_apps():
             app_name=_authentik_app.name,
         )
         continue
-    urls: list = api_urls.api_urlpatterns
+    urls: list = getattr(api_urls, "api_urlpatterns")
     for url in urls:
         if isinstance(url, URLPattern):
             _other_urls.append(url)

authentik/blueprints/api.py

@@ -52,9 +52,7 @@ class BlueprintInstanceSerializer(ModelSerializer):
         valid, logs = Importer.from_string(content, context).validate()
         if not valid:
             text_logs = "\n".join([x["event"] for x in logs])
-            raise ValidationError(
-                _("Failed to validate blueprint: {logs}".format_map({"logs": text_logs}))
-            )
+            raise ValidationError(_("Failed to validate blueprint: %(logs)s" % {"logs": text_logs}))
         return content
 
     def validate(self, attrs: dict) -> dict:

authentik/blueprints/apps.py

@@ -1,6 +1,5 @@
 """authentik Blueprints app"""
 
-from collections.abc import Callable
 from importlib import import_module
 from inspect import ismethod
 
@@ -14,8 +13,8 @@ class ManagedAppConfig(AppConfig):
 
     logger: BoundLogger
 
-    RECONCILE_GLOBAL_CATEGORY: str = "global"
-    RECONCILE_TENANT_CATEGORY: str = "tenant"
+    RECONCILE_GLOBAL_PREFIX: str = "reconcile_global_"
+    RECONCILE_TENANT_PREFIX: str = "reconcile_tenant_"
 
     def __init__(self, app_name: str, *args, **kwargs) -> None:
         super().__init__(app_name, *args, **kwargs)
@@ -23,8 +22,8 @@ class ManagedAppConfig(AppConfig):
 
     def ready(self) -> None:
         self.import_related()
-        self._reconcile_global()
-        self._reconcile_tenant()
+        self.reconcile_global()
+        self.reconcile_tenant()
         return super().ready()
 
     def import_related(self):
@@ -52,8 +51,7 @@ class ManagedAppConfig(AppConfig):
             meth = getattr(self, meth_name)
             if not ismethod(meth):
                 continue
-            category = getattr(meth, "_authentik_managed_reconcile", None)
-            if category != prefix:
+            if not meth_name.startswith(prefix):
                 continue
             name = meth_name.replace(prefix, "")
             try:
@@ -63,19 +61,7 @@ class ManagedAppConfig(AppConfig):
             except (DatabaseError, ProgrammingError, InternalError) as exc:
                 self.logger.warning("Failed to run reconcile", name=name, exc=exc)
 
-    @staticmethod
-    def reconcile_tenant(func: Callable):
-        """Mark a function to be called on startup (for each tenant)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_TENANT_CATEGORY
-        return func
-
-    @staticmethod
-    def reconcile_global(func: Callable):
-        """Mark a function to be called on startup (globally)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_GLOBAL_CATEGORY
-        return func
-
-    def _reconcile_tenant(self) -> None:
+    def reconcile_tenant(self) -> None:
         """reconcile ourselves for tenanted methods"""
         from authentik.tenants.models import Tenant
 
@@ -86,9 +72,9 @@ class ManagedAppConfig(AppConfig):
             return
         for tenant in tenants:
             with tenant:
-                self._reconcile(self.RECONCILE_TENANT_CATEGORY)
+                self._reconcile(self.RECONCILE_TENANT_PREFIX)
 
-    def _reconcile_global(self) -> None:
+    def reconcile_global(self) -> None:
         """
         reconcile ourselves for global methods.
         Used for signals, tasks, etc. Database queries should not be made in here.
@@ -96,7 +82,7 @@ class ManagedAppConfig(AppConfig):
         from django_tenants.utils import get_public_schema_name, schema_context
 
         with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
+            self._reconcile(self.RECONCILE_GLOBAL_PREFIX)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -107,13 +93,11 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def load_blueprints_v1_tasks(self):
+    def reconcile_global_load_blueprints_v1_tasks(self):
         """Load v1 tasks"""
         self.import_module("authentik.blueprints.v1.tasks")
 
-    @ManagedAppConfig.reconcile_tenant
-    def blueprints_discovery(self):
+    def reconcile_tenant_blueprints_discovery(self):
         """Run blueprint discovery"""
         from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
 

authentik/blueprints/models.py

@@ -71,19 +71,6 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
-    class Meta:
-        verbose_name = _("Blueprint Instance")
-        verbose_name_plural = _("Blueprint Instances")
-        unique_together = (
-            (
-                "name",
-                "path",
-            ),
-        )
-
-    def __str__(self) -> str:
-        return f"Blueprint Instance {self.name}"
-
     def retrieve_oci(self) -> str:
         """Get blueprint from an OCI registry"""
         client = BlueprintOCIClient(self.path.replace(OCI_PREFIX, "https://"))
@@ -102,7 +89,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")
             with full_path.open("r", encoding="utf-8") as _file:
                 return _file.read()
-        except OSError as exc:
+        except (IOError, OSError) as exc:
             raise BlueprintRetrievalFailed(exc) from exc
 
     def retrieve(self) -> str:
@@ -118,3 +105,16 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
         from authentik.blueprints.api import BlueprintInstanceSerializer
 
         return BlueprintInstanceSerializer
+
+    def __str__(self) -> str:
+        return f"Blueprint Instance {self.name}"
+
+    class Meta:
+        verbose_name = _("Blueprint Instance")
+        verbose_name_plural = _("Blueprint Instances")
+        unique_together = (
+            (
+                "name",
+                "path",
+            ),
+        )

authentik/blueprints/tests/__init__.py

@@ -1,7 +1,7 @@
 """Blueprint helpers"""
 
-from collections.abc import Callable
 from functools import wraps
+from typing import Callable
 
 from django.apps import apps
 

authentik/blueprints/tests/test_packaged.py

@@ -1,7 +1,7 @@
 """test packaged blueprints"""
 
-from collections.abc import Callable
 from pathlib import Path
+from typing import Callable
 
 from django.test import TransactionTestCase
 

authentik/blueprints/tests/test_serializer_models.py

@@ -1,6 +1,6 @@
 """authentik managed models tests"""
 
-from collections.abc import Callable
+from typing import Callable, Type
 
 from django.apps import apps
 from django.test import TestCase
@@ -14,7 +14,7 @@ class TestModels(TestCase):
     """Test Models"""
 
 
-def serializer_tester_factory(test_model: type[SerializerModel]) -> Callable:
+def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
     """Test serializer"""
 
     def tester(self: TestModels):

authentik/blueprints/tests/test_v1_tasks.py

@@ -54,7 +54,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
             file.seek(0)
             file_hash = sha512(file.read().encode()).hexdigest()
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
             self.assertEqual(instance.last_applied_hash, file_hash)
             self.assertEqual(
@@ -82,7 +82,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint = BlueprintInstance.objects.filter(name="foo").first()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -107,7 +107,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint.refresh_from_db()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -149,7 +149,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 instance.status,
                 BlueprintInstanceStatus.UNKNOWN,
             )
-            apply_blueprint(instance.pk)
+            apply_blueprint(instance.pk)  # pylint: disable=no-value-for-parameter
             instance.refresh_from_db()
             self.assertEqual(instance.last_applied_hash, "")
             self.assertEqual(

authentik/blueprints/v1/common.py

@@ -1,14 +1,13 @@
 """transfer common classes"""
 
 from collections import OrderedDict
-from collections.abc import Iterable, Mapping
 from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
 from functools import reduce
 from operator import ixor
 from os import getenv
-from typing import Any, Literal, Union
+from typing import Any, Iterable, Literal, Mapping, Optional, Union
 from uuid import UUID
 
 from deepmerge import always_merger
@@ -46,7 +45,7 @@ def get_attrs(obj: SerializerModel) -> dict[str, Any]:
 class BlueprintEntryState:
     """State of a single instance"""
 
-    instance: Model | None = None
+    instance: Optional[Model] = None
 
 
 class BlueprintEntryDesiredState(Enum):
@@ -68,9 +67,9 @@ class BlueprintEntry:
     )
     conditions: list[Any] = field(default_factory=list)
     identifiers: dict[str, Any] = field(default_factory=dict)
-    attrs: dict[str, Any] | None = field(default_factory=dict)
+    attrs: Optional[dict[str, Any]] = field(default_factory=dict)
 
-    id: str | None = None
+    id: Optional[str] = None
 
     _state: BlueprintEntryState = field(default_factory=BlueprintEntryState)
 
@@ -93,10 +92,10 @@ class BlueprintEntry:
             attrs=all_attrs,
         )
 
-    def get_tag_context(
+    def _get_tag_context(
         self,
         depth: int = 0,
-        context_tag_type: type["YAMLTagContext"] | tuple["YAMLTagContext", ...] | None = None,
+        context_tag_type: Optional[type["YAMLTagContext"] | tuple["YAMLTagContext", ...]] = None,
     ) -> "YAMLTagContext":
         """Get a YAMLTagContext object located at a certain depth in the tag tree"""
         if depth < 0:
@@ -109,8 +108,8 @@ class BlueprintEntry:
 
         try:
             return contexts[-(depth + 1)]
-        except IndexError as exc:
-            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}") from exc
+        except IndexError:
+            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}")
 
     def tag_resolver(self, value: Any, blueprint: "Blueprint") -> Any:
         """Check if we have any special tags that need handling"""
@@ -171,7 +170,7 @@ class Blueprint:
     entries: list[BlueprintEntry] = field(default_factory=list)
     context: dict = field(default_factory=dict)
 
-    metadata: BlueprintMetadata | None = field(default=None)
+    metadata: Optional[BlueprintMetadata] = field(default=None)
 
 
 class YAMLTag:
@@ -219,7 +218,7 @@ class Env(YAMLTag):
     """Lookup environment variable with optional default"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -238,7 +237,7 @@ class Context(YAMLTag):
     """Lookup key from instance context"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -282,7 +281,7 @@ class Format(YAMLTag):
         try:
             return self.format_string % tuple(args)
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Find(YAMLTag):
@@ -367,7 +366,7 @@ class Condition(YAMLTag):
             comparator = self._COMPARATORS[self.mode.upper()]
             return comparator(tuple(bool(x) for x in args))
         except (TypeError, KeyError) as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class If(YAMLTag):
@@ -399,7 +398,7 @@ class If(YAMLTag):
                 blueprint,
             )
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Enumerate(YAMLTag, YAMLTagContext):
@@ -413,7 +412,9 @@ class Enumerate(YAMLTag, YAMLTagContext):
         "SEQ": (list, lambda a, b: [*a, b]),
         "MAP": (
             dict,
-            lambda a, b: always_merger.merge(a, {b[0]: b[1]} if isinstance(b, tuple | list) else b),
+            lambda a, b: always_merger.merge(
+                a, {b[0]: b[1]} if isinstance(b, (tuple, list)) else b
+            ),
         ),
     }
 
@@ -455,7 +456,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         try:
             output_class, add_fn = self._OUTPUT_BODIES[self.output_body.upper()]
         except KeyError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
         result = output_class()
 
@@ -483,13 +484,13 @@ class EnumeratedItem(YAMLTag):
 
     _SUPPORTED_CONTEXT_TAGS = (Enumerate,)
 
-    def __init__(self, _loader: "BlueprintLoader", node: ScalarNode) -> None:
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
         super().__init__()
         self.depth = int(node.value)
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         try:
-            context_tag: Enumerate = entry.get_tag_context(
+            context_tag: Enumerate = entry._get_tag_context(
                 depth=self.depth,
                 context_tag_type=EnumeratedItem._SUPPORTED_CONTEXT_TAGS,
             )
@@ -499,11 +500,9 @@ class EnumeratedItem(YAMLTag):
                     f"{self.__class__.__name__} tags are only usable "
                     f"inside an {Enumerate.__name__} tag",
                     entry,
-                ) from exc
+                )
 
-            raise EntryInvalidError.from_entry(
-                f"{self.__class__.__name__} tag: {exc}", entry
-            ) from exc
+            raise EntryInvalidError.from_entry(f"{self.__class__.__name__} tag: {exc}", entry)
 
         return context_tag.get_context(entry, blueprint)
 
@@ -516,8 +515,8 @@ class Index(EnumeratedItem):
 
         try:
             return context[0]
-        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+        except IndexError:  # pragma: no cover
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class Value(EnumeratedItem):
@@ -528,8 +527,8 @@ class Value(EnumeratedItem):
 
         try:
             return context[1]
-        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+        except IndexError:  # pragma: no cover
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class BlueprintDumper(SafeDumper):
@@ -583,13 +582,13 @@ class BlueprintLoader(SafeLoader):
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
 
-    entry_model: str | None
-    entry_id: str | None
-    validation_error: ValidationError | None
-    serializer: Serializer | None = None
+    entry_model: Optional[str]
+    entry_id: Optional[str]
+    validation_error: Optional[ValidationError]
+    serializer: Optional[Serializer] = None
 
     def __init__(
-        self, *args: object, validation_error: ValidationError | None = None, **kwargs
+        self, *args: object, validation_error: Optional[ValidationError] = None, **kwargs
     ) -> None:
         super().__init__(*args)
         self.entry_model = None

authentik/blueprints/v1/exporter.py

@@ -1,6 +1,6 @@
 """Blueprint exporter"""
 
-from collections.abc import Iterable
+from typing import Iterable
 from uuid import UUID
 
 from django.apps import apps
@@ -59,7 +59,7 @@ class Exporter:
         blueprint = Blueprint()
         self._pre_export(blueprint)
         blueprint.metadata = BlueprintMetadata(
-            name=_("authentik Export - {date}".format_map({"date": str(now())})),
+            name=_("authentik Export - %(date)s" % {"date": str(now())}),
             labels={
                 LABEL_AUTHENTIK_GENERATED: "true",
             },

authentik/blueprints/v1/importer.py

@@ -2,7 +2,7 @@
 
 from contextlib import contextmanager
 from copy import deepcopy
-from typing import Any
+from typing import Any, Optional
 
 from dacite.config import Config
 from dacite.core import from_dict
@@ -62,7 +62,7 @@ SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry"
 def excluded_models() -> list[type[Model]]:
     """Return a list of all excluded models that shouldn't be exposed via API
     or other means (internal only, base classes, non-used objects, etc)"""
-
+    # pylint: disable=imported-auth-user
     from django.contrib.auth.models import Group as DjangoGroup
     from django.contrib.auth.models import User as DjangoUser
 
@@ -101,7 +101,7 @@ def excluded_models() -> list[type[Model]]:
 
 def is_model_allowed(model: type[Model]) -> bool:
     """Check if model is allowed"""
-    return model not in excluded_models() and issubclass(model, SerializerModel | BaseMetaModel)
+    return model not in excluded_models() and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 class DoRollback(SentryIgnoredException):
@@ -125,7 +125,7 @@ class Importer:
     logger: BoundLogger
     _import: Blueprint
 
-    def __init__(self, blueprint: Blueprint, context: dict | None = None):
+    def __init__(self, blueprint: Blueprint, context: Optional[dict] = None):
         self.__pk_map: dict[Any, Model] = {}
         self._import = blueprint
         self.logger = get_logger()
@@ -168,7 +168,7 @@ class Importer:
         for key, value in attrs.items():
             try:
                 if isinstance(value, dict):
-                    for _, _inner_key in enumerate(value):
+                    for idx, _inner_key in enumerate(value):
                         value[_inner_key] = updater(value[_inner_key])
                 elif isinstance(value, list):
                     for idx, _inner_value in enumerate(value):
@@ -197,7 +197,8 @@ class Importer:
 
         return main_query | sub_query
 
-    def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer | None:
+    # pylint: disable-msg=too-many-locals
+    def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
         """Validate a single entry"""
         if not entry.check_all_conditions_match(self._import):
             self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
@@ -368,7 +369,7 @@ class Importer:
                     self.__pk_map[entry.identifiers["pk"]] = instance.pk
                 entry._state = BlueprintEntryState(instance)
             elif state == BlueprintEntryDesiredState.ABSENT:
-                instance: Model | None = serializer.instance
+                instance: Optional[Model] = serializer.instance
                 if instance.pk:
                     instance.delete()
                     self.logger.debug("deleted model", mode=instance)

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -43,7 +43,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
             LOGGER.info("Blueprint does not exist, but not required")
             return MetaResult()
         LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
-
+        # pylint: disable=no-value-for-parameter
         apply_blueprint(str(self.blueprint_instance.pk))
         return MetaResult()
 

authentik/blueprints/v1/meta/registry.py

@@ -8,15 +8,15 @@ from rest_framework.serializers import Serializer
 class BaseMetaModel(Model):
     """Base models"""
 
-    class Meta:
-        abstract = True
-
     @staticmethod
     def serializer() -> Serializer:
         """Serializer similar to SerializerModel, but as a static method since
         this is an abstract model"""
         raise NotImplementedError
 
+    class Meta:
+        abstract = True
+
 
 class MetaResult:
     """Result returned by Meta Models' serializers. Empty class but we can't return none as

authentik/blueprints/v1/tasks.py

@@ -4,6 +4,7 @@ from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
 from sys import platform
+from typing import Optional
 
 from dacite.core import from_dict
 from django.db import DatabaseError, InternalError, ProgrammingError
@@ -49,14 +50,14 @@ class BlueprintFile:
     version: int
     hash: str
     last_m: int
-    meta: BlueprintMetadata | None = field(default=None)
+    meta: Optional[BlueprintMetadata] = field(default=None)
 
 
 def start_blueprint_watcher():
     """Start blueprint watcher, if it's not running already."""
     # This function might be called twice since it's called on celery startup
-
-    global _file_watcher_started  # noqa: PLW0603
+    # pylint: disable=global-statement
+    global _file_watcher_started
     if _file_watcher_started:
         return
     observer = Observer()
@@ -125,7 +126,7 @@ def blueprints_find() -> list[BlueprintFile]:
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
             continue
-        with open(path, encoding="utf-8") as blueprint_file:
+        with open(path, "r", encoding="utf-8") as blueprint_file:
             try:
                 raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
             except YAMLError as exc:
@@ -149,7 +150,7 @@ def blueprints_find() -> list[BlueprintFile]:
     throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: SystemTask, path: str | None = None):
+def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
@@ -196,7 +197,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 def apply_blueprint(self: SystemTask, instance_pk: str):
     """Apply single blueprint"""
     self.save_on_success = False
-    instance: BlueprintInstance | None = None
+    instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
         if not instance or not instance.enabled:
@@ -224,10 +225,10 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         instance.last_applied = now()
         self.set_status(TaskStatus.SUCCESSFUL)
     except (
-        OSError,
         DatabaseError,
         ProgrammingError,
         InternalError,
+        IOError,
         BlueprintRetrievalFailed,
         EntryInvalidError,
     ) as exc:

authentik/brands/api.py

@@ -46,7 +46,6 @@ class BrandSerializer(ModelSerializer):
         fields = [
             "brand_uuid",
             "domain",
-            "origin",
             "default",
             "branding_title",
             "branding_logo",
@@ -57,7 +56,6 @@ class BrandSerializer(ModelSerializer):
             "flow_unenrollment",
             "flow_user_settings",
             "flow_device_code",
-            "default_application",
             "web_certificate",
             "attributes",
         ]

authentik/brands/middleware.py

@@ -1,17 +1,12 @@
 """Inject brand into current request"""
 
-from collections.abc import Callable
-from typing import TYPE_CHECKING
+from typing import Callable
 
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
 from django.utils.translation import activate
 
 from authentik.brands.utils import get_brand_for_request
-from authentik.lib.config import CONFIG
-
-if TYPE_CHECKING:
-    from authentik.brands.models import Brand
 
 
 class BrandMiddleware:
@@ -25,46 +20,8 @@ class BrandMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "brand"):
             brand = get_brand_for_request(request)
-            request.brand = brand
+            setattr(request, "brand", brand)
             locale = brand.default_locale
             if locale != "":
                 activate(locale)
         return self.get_response(request)
-
-
-class BrandHeaderMiddleware:
-    """Add headers from currently active brand"""
-
-    get_response: Callable[[HttpRequest], HttpResponse]
-    default_csp_elements: dict[str, list[str]] = {}
-
-    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
-        self.get_response = get_response
-        self.default_csp_elements = {
-            "style-src": ["'self'", "'unsafe-inline'"],  # Required due to Lit/ShadowDOM
-            "script-src": ["'self'", "'unsafe-inline'"],  # Required for generated scripts
-            "img-src": ["https:", "http:", "data:"],
-            "default-src": ["'self'"],
-            "object-src": ["'none'"],
-            "connect-src": ["'self'"],
-        }
-        if CONFIG.get_bool("error_reporting.enabled"):
-            self.default_csp_elements["connect-src"].append(
-                # Required for sentry (TODO: Dynamic)
-                "https://authentik.error-reporting.a7k.io"
-            )
-            if CONFIG.get_bool("debug"):
-                # Also allow spotlight sidecar connection
-                self.default_csp_elements["connect-src"].append("http://localhost:8969")
-
-    def get_csp(self, request: HttpRequest) -> str:
-        brand: "Brand" = request.brand
-        elements = self.default_csp_elements.copy()
-        if brand.origin != "":
-            elements["frame-ancestors"] = [brand.origin]
-        return ";".join(f"{attr} {" ".join(value)}" for attr, value in elements.items())
-
-    def __call__(self, request: HttpRequest) -> HttpResponse:
-        response = self.get_response(request)
-        response.headers["Content-Security-Policy"] = self.get_csp(request)
-        return response

authentik/brands/migrations/0006_brand_default_application.py

@@ -1,26 +0,0 @@
-# Generated by Django 5.0.3 on 2024-03-21 15:42
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_brands", "0005_tenantuuid_to_branduuid"),
-        ("authentik_core", "0033_alter_user_options"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="brand",
-            name="default_application",
-            field=models.ForeignKey(
-                default=None,
-                help_text="When set, external users will be redirected to this application after authenticating.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_DEFAULT,
-                to="authentik_core.application",
-            ),
-        ),
-    ]

authentik/brands/migrations/0007_brand_origin.py

@@ -1,21 +0,0 @@
-# Generated by Django 5.0.3 on 2024-03-26 14:17
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_brands", "0006_brand_default_application"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="brand",
-            name="origin",
-            field=models.TextField(
-                blank=True,
-                help_text="Origin domain that activates this brand. Can be left empty to not allow any origins.",
-            ),
-        ),
-    ]

authentik/brands/models.py

@@ -23,12 +23,6 @@ class Brand(SerializerModel):
             "Domain that activates this brand. Can be a superset, i.e. `a.b` for `aa.b` and `ba.b`"
         )
     )
-    origin = models.TextField(
-        help_text=_(
-            "Origin domain that activates this brand. Can be left empty to not allow any origins."
-        ),
-        blank=True,
-    )
     default = models.BooleanField(
         default=False,
     )
@@ -57,16 +51,6 @@ class Brand(SerializerModel):
         Flow, null=True, on_delete=models.SET_NULL, related_name="brand_device_code"
     )
 
-    default_application = models.ForeignKey(
-        "authentik_core.Application",
-        null=True,
-        default=None,
-        on_delete=models.SET_DEFAULT,
-        help_text=_(
-            "When set, external users will be redirected to this application after authenticating."
-        ),
-    )
-
     web_certificate = models.ForeignKey(
         CertificateKeyPair,
         null=True,
@@ -87,7 +71,7 @@ class Brand(SerializerModel):
         """Get default locale"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
             return ""

authentik/brands/utils.py

@@ -1,15 +1,11 @@
 """Brand utilities"""
 
 from typing import Any
-from urllib.parse import urlparse
 
 from django.db.models import F, Q
 from django.db.models import Value as V
-from django.http import HttpResponse
 from django.http.request import HttpRequest
-from django.utils.cache import patch_vary_headers
 from sentry_sdk.hub import Hub
-from structlog.stdlib import get_logger
 
 from authentik import get_full_version
 from authentik.brands.models import Brand
@@ -17,17 +13,13 @@ from authentik.tenants.models import Tenant
 
 _q_default = Q(default=True)
 DEFAULT_BRAND = Brand(domain="fallback")
-LOGGER = get_logger()
 
 
 def get_brand_for_request(request: HttpRequest) -> Brand:
     """Get brand object for current request"""
-    query = Q(host_domain__iendswith=F("domain"))
-    if "Origin" in request.headers:
-        query &= Q(Q(origin=request.headers.get("Origin", "")) | Q(origin=""))
     db_brands = (
         Brand.objects.annotate(host_domain=V(request.get_host()))
-        .filter(Q(query) | _q_default)
+        .filter(Q(host_domain__iendswith=F("domain")) | _q_default)
         .order_by("default")
     )
     brands = list(db_brands.all())
@@ -50,46 +42,3 @@ def context_processor(request: HttpRequest) -> dict[str, Any]:
         "sentry_trace": trace,
         "version": get_full_version(),
     }
-
-
-def cors_allow(request: HttpRequest, response: HttpResponse, *allowed_origins: str):
-    """Add headers to permit CORS requests from allowed_origins, with or without credentials,
-    with any headers."""
-    origin = request.META.get("HTTP_ORIGIN")
-    if not origin:
-        return response
-
-    # OPTIONS requests don't have an authorization header -> hence
-    # we can't extract the provider this request is for
-    # so for options requests we allow the calling origin without checking
-    allowed = request.method == "OPTIONS"
-    received_origin = urlparse(origin)
-    for allowed_origin in allowed_origins:
-        url = urlparse(allowed_origin)
-        if (
-            received_origin.scheme == url.scheme
-            and received_origin.hostname == url.hostname
-            and received_origin.port == url.port
-        ):
-            allowed = True
-    if not allowed:
-        LOGGER.warning(
-            "CORS: Origin is not an allowed origin",
-            requested=received_origin,
-            allowed=allowed_origins,
-        )
-        return response
-
-    # From the CORS spec: The string "*" cannot be used for a resource that supports credentials.
-    response["Access-Control-Allow-Origin"] = origin
-    patch_vary_headers(response, ["Origin"])
-    response["Access-Control-Allow-Credentials"] = "true"
-
-    if request.method == "OPTIONS":
-        if "HTTP_ACCESS_CONTROL_REQUEST_HEADERS" in request.META:
-            response["Access-Control-Allow-Headers"] = request.META[
-                "HTTP_ACCESS_CONTROL_REQUEST_HEADERS"
-            ]
-        response["Access-Control-Allow-Methods"] = "GET, POST, OPTIONS"
-
-    return response

authentik/core/api/applications.py

@@ -1,8 +1,8 @@
 """Application API Views"""
 
-from collections.abc import Iterator
 from copy import copy
 from datetime import timedelta
+from typing import Iterator, Optional
 
 from django.core.cache import cache
 from django.db.models import QuerySet
@@ -37,7 +37,7 @@ from authentik.lib.utils.file import (
 )
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
-from authentik.policies.types import CACHE_PREFIX, PolicyResult
+from authentik.policies.types import PolicyResult
 from authentik.rbac.decorators import permission_required
 from authentik.rbac.filters import ObjectFilter
 
@@ -46,7 +46,7 @@ LOGGER = get_logger()
 
 def user_app_cache_key(user_pk: str) -> str:
     """Cache key where application list for user is saved"""
-    return f"{CACHE_PREFIX}/app_access/{user_pk}"
+    return f"goauthentik.io/core/app_access/{user_pk}"
 
 
 class ApplicationSerializer(ModelSerializer):
@@ -60,7 +60,7 @@ class ApplicationSerializer(ModelSerializer):
 
     meta_icon = ReadOnlyField(source="get_meta_icon")
 
-    def get_launch_url(self, app: Application) -> str | None:
+    def get_launch_url(self, app: Application) -> Optional[str]:
         """Allow formatting of launch URL"""
         user = None
         if "request" in self.context:
@@ -100,6 +100,7 @@ class ApplicationSerializer(ModelSerializer):
 class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
+    # pylint: disable=no-member
     queryset = Application.objects.all().prefetch_related("provider")
     serializer_class = ApplicationSerializer
     search_fields = [
@@ -130,7 +131,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         return queryset
 
     def _get_allowed_applications(
-        self, pagined_apps: Iterator[Application], user: User | None = None
+        self, pagined_apps: Iterator[Application], user: Optional[User] = None
     ) -> list[Application]:
         applications = []
         request = self.request._request
@@ -168,7 +169,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             try:
                 for_user = User.objects.filter(pk=request.query_params.get("for_user")).first()
             except ValueError:
-                raise ValidationError({"for_user": "for_user must be numerical"}) from None
+                raise ValidationError({"for_user": "for_user must be numerical"})
             if not for_user:
                 raise ValidationError({"for_user": "User not found"})
         engine = PolicyEngine(application, for_user, request)
@@ -214,7 +215,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             return super().list(request)
 
         queryset = self._filter_queryset_for_list(self.get_queryset())
-        paginated_apps = self.paginate_queryset(queryset)
+        pagined_apps = self.paginate_queryset(queryset)
 
         if "for_user" in request.query_params:
             try:
@@ -228,18 +229,18 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
                     raise ValidationError({"for_user": "User not found"})
             except ValueError as exc:
                 raise ValidationError from exc
-            allowed_applications = self._get_allowed_applications(paginated_apps, user=for_user)
+            allowed_applications = self._get_allowed_applications(pagined_apps, user=for_user)
             serializer = self.get_serializer(allowed_applications, many=True)
             return self.get_paginated_response(serializer.data)
 
         allowed_applications = []
         if not should_cache:
-            allowed_applications = self._get_allowed_applications(paginated_apps)
+            allowed_applications = self._get_allowed_applications(pagined_apps)
         if should_cache:
             allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
             if not allowed_applications:
                 LOGGER.debug("Caching allowed application list")
-                allowed_applications = self._get_allowed_applications(paginated_apps)
+                allowed_applications = self._get_allowed_applications(pagined_apps)
                 cache.set(
                     user_app_cache_key(self.request.user.pk),
                     allowed_applications,

authentik/core/api/authenticated_sessions.py

@@ -1,6 +1,6 @@
 """AuthenticatedSessions API Viewset"""
 
-from typing import TypedDict
+from typing import Optional, TypedDict
 
 from django_filters.rest_framework import DjangoFilterBackend
 from guardian.utils import get_anonymous_user
@@ -72,11 +72,11 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         """Get parsed user agent"""
         return user_agent_parser.Parse(instance.last_user_agent)
 
-    def get_geo_ip(self, instance: AuthenticatedSession) -> GeoIPDict | None:  # pragma: no cover
+    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
         """Get GeoIP Data"""
         return GEOIP_CONTEXT_PROCESSOR.city_dict(instance.last_ip)
 
-    def get_asn(self, instance: AuthenticatedSession) -> ASNDict | None:  # pragma: no cover
+    def get_asn(self, instance: AuthenticatedSession) -> Optional[ASNDict]:  # pragma: no cover
         """Get ASN Data"""
         return ASN_CONTEXT_PROCESSOR.asn_dict(instance.last_ip)
 

authentik/core/api/groups.py

@@ -1,6 +1,7 @@
 """Groups API Viewset"""
 
 from json import loads
+from typing import Optional
 
 from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
@@ -58,7 +59,7 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
-    def validate_parent(self, parent: Group | None):
+    def validate_parent(self, parent: Optional[Group]):
         """Validate group parent (if set), ensuring the parent isn't itself"""
         if not self.instance or not parent:
             return parent
@@ -113,7 +114,7 @@ class GroupFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -139,6 +140,7 @@ class UserAccountSerializer(PassiveSerializer):
 class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
+    # pylint: disable=no-member
     queryset = Group.objects.all().select_related("parent").prefetch_related("users")
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]

authentik/core/api/propertymappings.py

@@ -146,7 +146,7 @@ class PropertyMappingViewSet(
             response_data["result"] = dumps(
                 sanitize_item(result), indent=(4 if format_result else None)
             )
-        except Exception as exc:
+        except Exception as exc:  # pylint: disable=broad-except
             response_data["result"] = str(exc)
             response_data["successful"] = False
         response = PropertyMappingTestResultSerializer(response_data)

authentik/core/api/sources.py

@@ -1,6 +1,6 @@
 """Source API Views"""
 
-from collections.abc import Iterable
+from typing import Iterable
 
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema

authentik/core/api/tokens.py

@@ -20,7 +20,7 @@ from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 from authentik.rbac.decorators import permission_required
@@ -36,6 +36,13 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
             self.fields["key"] = CharField(required=False)
 
+    def validate_user(self, user: User):
+        """Ensure user of token cannot be changed"""
+        if self.instance and self.instance.user_id:
+            if user.pk != self.instance.user_id:
+                raise ValidationError("User cannot be changed")
+        return user
+
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
         """Ensure only API or App password tokens are created."""
         request: Request = self.context.get("request")

authentik/core/api/transactional_applications.py

@@ -65,7 +65,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 raise ValidationError("Invalid provider model")
             self._provider_model = model
         except LookupError:
-            raise ValidationError("Invalid provider model") from None
+            raise ValidationError("Invalid provider model")
         return fq_model_name
 
     def validate(self, attrs: dict) -> dict:
@@ -106,7 +106,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 {
                     exc.entry_id: exc.validation_error.detail,
                 }
-            ) from None
+            )
         return blueprint
 
 

authentik/core/api/used_by.py

@@ -54,6 +54,7 @@ class UsedByMixin:
         responses={200: UsedBySerializer(many=True)},
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
+    # pylint: disable=too-many-locals
     def used_by(self, request: Request, *args, **kwargs) -> Response:
         """Get a list of all objects that use this object"""
         model: Model = self.get_object()

authentik/core/api/users.py

@@ -2,7 +2,7 @@
 
 from datetime import timedelta
 from json import loads
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth import update_session_auth_hash
 from django.contrib.sessions.backends.cache import KEY_PREFIX
@@ -142,7 +142,7 @@ class UserSerializer(ModelSerializer):
         self._set_password(instance, password)
         return instance
 
-    def _set_password(self, instance: User, password: str | None):
+    def _set_password(self, instance: User, password: Optional[str]):
         """Set password of user if we're in a blueprint context, and if it's an empty
         string then use an unusable password"""
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context and password:
@@ -358,7 +358,7 @@ class UsersFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -397,14 +397,15 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     def get_queryset(self):  # pragma: no cover
         return User.objects.all().exclude_anonymous().prefetch_related("ak_groups")
 
-    def _create_recovery_link(self) -> tuple[str, Token]:
+    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
         """Create a recovery link (when the current brand has a recovery flow set),
         that can either be shown to an admin or sent to the user directly"""
         brand: Brand = self.request._request.brand
         # Check that there is a recovery flow, if not return an error
         flow = brand.flow_recovery
         if not flow:
-            raise ValidationError({"non_field_errors": "No recovery flow set."})
+            LOGGER.debug("No recovery flow set")
+            return None, None
         user: User = self.get_object()
         planner = FlowPlanner(flow)
         planner.allow_empty_flows = True
@@ -416,9 +417,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 },
             )
         except FlowNonApplicableException:
-            raise ValidationError(
-                {"non_field_errors": "Recovery flow not applicable to user"}
-            ) from None
+            LOGGER.warning("Recovery flow not applicable to user")
+            return None, None
         token, __ = FlowToken.objects.update_or_create(
             identifier=f"{user.uid}-password-reset",
             defaults={
@@ -563,13 +563,16 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @extend_schema(
         responses={
             "200": LinkSerializer(many=False),
+            "404": LinkSerializer(many=False),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         link, _ = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response({"link": ""}, status=404)
         return Response({"link": link})
 
     @permission_required("authentik_core.reset_user_password")
@@ -584,24 +587,27 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         ],
         responses={
             "204": OpenApiResponse(description="Successfully sent recover email"),
+            "404": OpenApiResponse(description="Bad request"),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery_email(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         for_user: User = self.get_object()
         if for_user.email == "":
             LOGGER.debug("User doesn't have an email address")
-            raise ValidationError({"non_field_errors": "User does not have an email address set."})
+            return Response(status=404)
         link, token = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response(status=404)
         # Lookup the email stage to assure the current user can access it
         stages = get_objects_for_user(
             request.user, "authentik_stages_email.view_emailstage"
         ).filter(pk=request.query_params.get("email_stage"))
         if not stages.exists():
             LOGGER.debug("Email stage does not exist/user has no permissions")
-            raise ValidationError({"non_field_errors": "Email stage does not exist."})
+            return Response(status=404)
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),

authentik/core/apps.py

@@ -14,16 +14,14 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def debug_worker_hook(self):
+    def reconcile_global_debug_worker_hook(self):
         """Dispatch startup tasks inline when debugging"""
         if settings.DEBUG:
             from authentik.root.celery import worker_ready_hook
 
             worker_ready_hook()
 
-    @ManagedAppConfig.reconcile_tenant
-    def source_inbuilt(self):
+    def reconcile_tenant_source_inbuilt(self):
         """Reconcile inbuilt source"""
         from authentik.core.models import Source
 

authentik/core/auth.py

@@ -1,6 +1,6 @@
 """Authenticate with tokens"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth.backends import ModelBackend
 from django.http.request import HttpRequest
@@ -16,15 +16,15 @@ class InbuiltBackend(ModelBackend):
     """Inbuilt backend"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> User | None:
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+    ) -> Optional[User]:
         user = super().authenticate(request, username=username, password=password, **kwargs)
         if not user:
             return None
         self.set_method("password", request)
         return user
 
-    def set_method(self, method: str, request: HttpRequest | None, **kwargs):
+    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
         """Set method data on current flow, if possbiel"""
         if not request:
             return
@@ -40,18 +40,18 @@ class TokenBackend(InbuiltBackend):
     """Authenticate with token"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> User | None:
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+    ) -> Optional[User]:
         try:
-
+            # pylint: disable=no-member
             user = User._default_manager.get_by_natural_key(username)
-
+        # pylint: disable=no-member
         except User.DoesNotExist:
             # Run the default password hasher once to reduce the timing
             # difference between an existing and a nonexistent user (#20760).
             User().set_password(password)
             return None
-
+        # pylint: disable=no-member
         tokens = Token.filter_not_expired(
             user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
         )

authentik/core/channels.py

@@ -38,6 +38,6 @@ class TokenOutpostMiddleware:
                 raise DenyConnection()
         except AuthenticationFailed as exc:
             LOGGER.warning("Failed to authenticate", exc=exc)
-            raise DenyConnection() from None
+            raise DenyConnection()
 
         scope["user"] = user

authentik/core/expression/evaluator.py

@@ -1,6 +1,6 @@
 """Property Mapping Evaluator"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.db.models import Model
 from django.http import HttpRequest
@@ -27,9 +27,9 @@ class PropertyMappingEvaluator(BaseEvaluator):
     def __init__(
         self,
         model: Model,
-        user: User | None = None,
-        request: HttpRequest | None = None,
-        dry_run: bool | None = False,
+        user: Optional[User] = None,
+        request: Optional[HttpRequest] = None,
+        dry_run: Optional[bool] = False,
         **kwargs,
     ):
         if hasattr(model, "name"):

authentik/core/management/commands/shell.py

@@ -16,8 +16,13 @@ from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
-BANNER_TEXT = f"""### authentik shell ({get_full_version()})
-### Node {platform.node()} | Arch {platform.machine()} | Python {platform.python_version()} """
+BANNER_TEXT = """### authentik shell ({authentik})
+### Node {node} | Arch {arch} | Python {python} """.format(
+    node=platform.node(),
+    python=platform.python_version(),
+    arch=platform.machine(),
+    authentik=get_full_version(),
+)
 
 
 class Command(BaseCommand):
@@ -81,7 +86,7 @@ class Command(BaseCommand):
 
         # If Python code has been passed, execute it and exit.
         if options["command"]:
-
+            # pylint: disable=exec-used
             exec(options["command"], namespace)  # nosec # noqa
             return
 
@@ -94,7 +99,7 @@ class Command(BaseCommand):
         else:
             try:
                 hook()
-            except Exception:
+            except Exception:  # pylint: disable=broad-except
                 # Match the behavior of the cpython shell where an error in
                 # sys.__interactivehook__ prints a warning and the exception
                 # and continues.

authentik/core/middleware.py

@@ -1,7 +1,7 @@
 """authentik admin Middleware to impersonate users"""
 
-from collections.abc import Callable
 from contextvars import ContextVar
+from typing import Callable, Optional
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
@@ -15,9 +15,9 @@ RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
-CTX_REQUEST_ID = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
-CTX_HOST = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "host", default=None)
-CTX_AUTH_VIA = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
 
 
 class ImpersonateMiddleware:
@@ -55,7 +55,7 @@ class RequestIDMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
-            request.request_id = request_id
+            setattr(request, "request_id", request_id)
             CTX_REQUEST_ID.set(request_id)
             CTX_HOST.set(request.get_host())
             set_tag("authentik.request_id", request_id)
@@ -67,7 +67,7 @@ class RequestIDMiddleware:
         response = self.get_response(request)
 
         response[RESPONSE_HEADER_ID] = request.request_id
-        response.ak_context = {}
+        setattr(response, "ak_context", {})
         response.ak_context["request_id"] = CTX_REQUEST_ID.get()
         response.ak_context["host"] = CTX_HOST.get()
         response.ak_context[KEY_AUTH_VIA] = CTX_AUTH_VIA.get()

authentik/core/models.py

@@ -33,7 +33,7 @@ from authentik.lib.models import (
     SerializerModel,
 )
 from authentik.policies.models import PolicyBindingModel
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
@@ -222,7 +222,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         there are at most 3 queries done"""
         return Group.children_recursive(self.ak_groups.all())
 
-    def group_attributes(self, request: HttpRequest | None = None) -> dict[str, Any]:
+    def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
@@ -276,13 +276,13 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{get_unique_identifier()}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
 
-    def locale(self, request: HttpRequest | None = None) -> str:
+    def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
         if request:
@@ -358,7 +358,7 @@ class Provider(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return None
@@ -435,7 +435,7 @@ class Application(SerializerModel, PolicyBindingModel):
         return ApplicationSerializer
 
     @property
-    def get_meta_icon(self) -> str | None:
+    def get_meta_icon(self) -> Optional[str]:
         """Get the URL to the App Icon image. If the name is /static or starts with http
         it is returned as-is"""
         if not self.meta_icon:
@@ -444,7 +444,7 @@ class Application(SerializerModel, PolicyBindingModel):
             return self.meta_icon.name
         return self.meta_icon.url
 
-    def get_launch_url(self, user: Optional["User"] = None) -> str | None:
+    def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
         if self.meta_launch_url:
@@ -457,13 +457,13 @@ class Application(SerializerModel, PolicyBindingModel):
                 user = user._wrapped
             try:
                 return url % user.__dict__
-
+            # pylint: disable=broad-except
             except Exception as exc:
                 LOGGER.warning("Failed to format launch url", exc=exc)
                 return url
         return url
 
-    def get_provider(self) -> Provider | None:
+    def get_provider(self) -> Optional[Provider]:
         """Get casted provider instance"""
         if not self.provider:
             return None
@@ -551,7 +551,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def icon_url(self) -> str | None:
+    def icon_url(self) -> Optional[str]:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:
@@ -566,7 +566,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
             return self.user_path_template % {
                 "slug": self.slug,
             }
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to template user path", exc=exc, source=self)
             return User.default_path()
@@ -576,12 +576,12 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_login_button(self, request: HttpRequest) -> UILoginButton | None:
+    def ui_login_button(self, request: HttpRequest) -> Optional[UILoginButton]:
         """If source uses a http-based flow, return UI Information about the login
         button. If source doesn't use http-based flow, return None."""
         return None
 
-    def ui_user_settings(self) -> UserSettingSerializer | None:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or UserSettingSerializer."""
         return None
@@ -617,9 +617,6 @@ class UserSourceConnection(SerializerModel, CreatedUpdatedModel):
         """Get serializer for this model"""
         raise NotImplementedError
 
-    def __str__(self) -> str:
-        return f"User-source connection (user={self.user.username}, source={self.source.slug})"
-
     class Meta:
         unique_together = (("user", "source"),)
 
@@ -630,9 +627,6 @@ class ExpiringModel(models.Model):
     expires = models.DateTimeField(default=default_token_duration)
     expiring = models.BooleanField(default=True)
 
-    class Meta:
-        abstract = True
-
     def expire_action(self, *args, **kwargs):
         """Handler which is called when this object is expired. By
         default the object is deleted. This is less efficient compared
@@ -655,6 +649,9 @@ class ExpiringModel(models.Model):
             return False
         return now() > self.expires
 
+    class Meta:
+        abstract = True
+
 
 class TokenIntents(models.TextChoices):
     """Intents a Token can be created for."""
@@ -684,21 +681,6 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
     user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
     description = models.TextField(default="", blank=True)
 
-    class Meta:
-        verbose_name = _("Token")
-        verbose_name_plural = _("Tokens")
-        indexes = [
-            models.Index(fields=["identifier"]),
-            models.Index(fields=["key"]),
-        ]
-        permissions = [("view_token_key", _("View token's key"))]
-
-    def __str__(self):
-        description = f"{self.identifier}"
-        if self.expiring:
-            description += f" (expires={self.expires})"
-        return description
-
     @property
     def serializer(self) -> type[Serializer]:
         from authentik.core.api.tokens import TokenSerializer
@@ -726,6 +708,21 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
             message=f"Token {self.identifier}'s secret was rotated.",
         ).save()
 
+    def __str__(self):
+        description = f"{self.identifier}"
+        if self.expiring:
+            description += f" (expires={self.expires})"
+        return description
+
+    class Meta:
+        verbose_name = _("Token")
+        verbose_name_plural = _("Tokens")
+        indexes = [
+            models.Index(fields=["identifier"]),
+            models.Index(fields=["key"]),
+        ]
+        permissions = [("view_token_key", _("View token's key"))]
+
 
 class PropertyMapping(SerializerModel, ManagedModel):
     """User-defined key -> x mapping which can be used by providers to expose extra data."""
@@ -746,7 +743,7 @@ class PropertyMapping(SerializerModel, ManagedModel):
         """Get serializer for this model"""
         raise NotImplementedError
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         from authentik.core.expression.evaluator import PropertyMappingEvaluator
 
@@ -782,13 +779,6 @@ class AuthenticatedSession(ExpiringModel):
     last_user_agent = models.TextField(blank=True)
     last_used = models.DateTimeField(auto_now=True)
 
-    class Meta:
-        verbose_name = _("Authenticated Session")
-        verbose_name_plural = _("Authenticated Sessions")
-
-    def __str__(self) -> str:
-        return f"Authenticated Session {self.session_key[:10]}"
-
     @staticmethod
     def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
         """Create a new session from a http request"""
@@ -803,3 +793,7 @@ class AuthenticatedSession(ExpiringModel):
             last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
             expires=request.session.get_expiry_date(),
         )
+
+    class Meta:
+        verbose_name = _("Authenticated Session")
+        verbose_name_plural = _("Authenticated Sessions")

authentik/core/sources/flow_manager.py

@@ -1,7 +1,7 @@
 """Source decision helper"""
 
 from enum import Enum
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib import messages
 from django.db import IntegrityError
@@ -16,9 +16,8 @@ from authentik.core.models import Source, SourceUserMatchingModes, User, UserSou
 from authentik.core.sources.stage import PLAN_CONTEXT_SOURCES_CONNECTION, PostUserEnrollmentStage
 from authentik.events.models import Event, EventAction
 from authentik.flows.exceptions import FlowNonApplicableException
-from authentik.flows.models import Flow, FlowToken, Stage, in_memory_stage
+from authentik.flows.models import Flow, Stage, in_memory_stage
 from authentik.flows.planner import (
-    PLAN_CONTEXT_IS_RESTORED,
     PLAN_CONTEXT_PENDING_USER,
     PLAN_CONTEXT_REDIRECT,
     PLAN_CONTEXT_SOURCE,
@@ -36,8 +35,6 @@ from authentik.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
 from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT
 from authentik.stages.user_write.stage import PLAN_CONTEXT_USER_PATH
 
-SESSION_KEY_OVERRIDE_FLOW_TOKEN = "authentik/flows/source_override_flow_token"  # nosec
-
 
 class Action(Enum):
     """Actions that can be decided based on the request
@@ -93,14 +90,15 @@ class SourceFlowManager:
         self._logger = get_logger().bind(source=source, identifier=identifier)
         self.policy_context = {}
 
-    def get_action(self, **kwargs) -> tuple[Action, UserSourceConnection | None]:  # noqa: PLR0911
+    # pylint: disable=too-many-return-statements
+    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
         """decide which action should be taken"""
         new_connection = self.connection_type(source=self.source, identifier=self.identifier)
         # When request is authenticated, always link
         if self.request.user.is_authenticated:
             new_connection.user = self.request.user
             new_connection = self.update_connection(new_connection, **kwargs)
-
+            # pylint: disable=no-member
             new_connection.save()
             return Action.LINK, new_connection
 
@@ -190,10 +188,8 @@ class SourceFlowManager:
         # Default case, assume deny
         error = Exception(
             _(
-                "Request to authenticate with {source} has been denied. Please authenticate "
-                "with the source you've previously signed up with.".format_map(
-                    {"source": self.source.name}
-                )
+                "Request to authenticate with %(source)s has been denied. Please authenticate "
+                "with the source you've previously signed up with." % {"source": self.source.name}
             ),
         )
         return self.error_handler(error)
@@ -221,47 +217,26 @@ class SourceFlowManager:
         self,
         flow: Flow,
         connection: UserSourceConnection,
-        stages: list[StageView] | None = None,
+        stages: Optional[list[StageView]] = None,
         **kwargs,
     ) -> HttpResponse:
         """Prepare Authentication Plan, redirect user FlowExecutor"""
+        # Ensure redirect is carried through when user was trying to
+        # authorize application
+        final_redirect = self.request.session.get(SESSION_KEY_GET, {}).get(
+            NEXT_ARG_NAME, "authentik_core:if-user"
+        )
         kwargs.update(
             {
                 # Since we authenticate the user by their token, they have no backend set
                 PLAN_CONTEXT_AUTHENTICATION_BACKEND: BACKEND_INBUILT,
                 PLAN_CONTEXT_SSO: True,
                 PLAN_CONTEXT_SOURCE: self.source,
+                PLAN_CONTEXT_REDIRECT: final_redirect,
                 PLAN_CONTEXT_SOURCES_CONNECTION: connection,
             }
         )
         kwargs.update(self.policy_context)
-        if SESSION_KEY_OVERRIDE_FLOW_TOKEN in self.request.session:
-            token: FlowToken = self.request.session.get(SESSION_KEY_OVERRIDE_FLOW_TOKEN)
-            self._logger.info("Replacing source flow with overridden flow", flow=token.flow.slug)
-            plan = token.plan
-            plan.context[PLAN_CONTEXT_IS_RESTORED] = token
-            plan.context.update(kwargs)
-            for stage in self.get_stages_to_append(flow):
-                plan.append_stage(stage)
-            if stages:
-                for stage in stages:
-                    plan.append_stage(stage)
-            self.request.session[SESSION_KEY_PLAN] = plan
-            flow_slug = token.flow.slug
-            token.delete()
-            return redirect_with_qs(
-                "authentik_core:if-flow",
-                self.request.GET,
-                flow_slug=flow_slug,
-            )
-        # Ensure redirect is carried through when user was trying to
-        # authorize application
-        final_redirect = self.request.session.get(SESSION_KEY_GET, {}).get(
-            NEXT_ARG_NAME, "authentik_core:if-user"
-        )
-        if PLAN_CONTEXT_REDIRECT not in kwargs:
-            kwargs[PLAN_CONTEXT_REDIRECT] = final_redirect
-
         if not flow:
             return bad_request_message(
                 self.request,
@@ -295,9 +270,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
-                            {"source": self.source.name}
-                        )
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
                     ),
                 )
             ],
@@ -321,7 +294,7 @@ class SourceFlowManager:
         ).from_http(self.request)
         messages.success(
             self.request,
-            _("Successfully linked {source}!".format_map({"source": self.source.name})),
+            _("Successfully linked %(source)s!" % {"source": self.source.name}),
         )
         return redirect(
             reverse(
@@ -349,9 +322,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
-                            {"source": self.source.name}
-                        )
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
                     ),
                 )
             ],

authentik/core/tasks.py

@@ -37,20 +37,20 @@ def clean_expired_models(self: SystemTask):
         messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
     # Special case
     amount = 0
-
+    # pylint: disable=no-member
     for session in AuthenticatedSession.objects.all():
         cache_key = f"{KEY_PREFIX}{session.session_key}"
         value = None
         try:
             value = cache.get(cache_key)
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.debug("Failed to get session from cache", exc=exc)
         if not value:
             session.delete()
             amount += 1
     LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
-
+    # pylint: disable=no-member
     messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
     self.set_status(TaskStatus.SUCCESSFUL, *messages)
 

authentik/core/tests/test_models.py

@@ -1,7 +1,7 @@
 """authentik core models tests"""
 
-from collections.abc import Callable
 from time import sleep
+from typing import Callable
 
 from django.test import RequestFactory, TestCase
 from django.utils.timezone import now

authentik/core/tests/test_source_flow_manager.py

@@ -173,5 +173,5 @@ class TestSourceFlowManager(TestCase):
         self.assertEqual(action, Action.ENROLL)
         response = flow_manager.get_flow()
         self.assertIsInstance(response, AccessDeniedResponse)
-
+        # pylint: disable=no-member
         self.assertEqual(response.error_message, "foo")

authentik/core/tests/test_token_api.py

@@ -7,8 +7,8 @@ from guardian.shortcuts import get_anonymous_user
 from rest_framework.test import APITestCase
 
 from authentik.core.api.tokens import TokenSerializer
-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
-from authentik.core.tests.utils import create_test_admin_user
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
+from authentik.core.tests.utils import create_test_admin_user, create_test_user
 from authentik.lib.generators import generate_id
 
 
@@ -17,7 +17,7 @@ class TestTokenAPI(APITestCase):
 
     def setUp(self) -> None:
         super().setUp()
-        self.user = User.objects.create(username="testuser")
+        self.user = create_test_user()
         self.admin = create_test_admin_user()
         self.client.force_login(self.user)
 
@@ -76,6 +76,24 @@ class TestTokenAPI(APITestCase):
         self.assertEqual(token.intent, TokenIntents.INTENT_API)
         self.assertEqual(token.expiring, False)
 
+    def test_token_change_user(self):
+        """Test creating a token and then changing the user"""
+        ident = generate_id()
+        response = self.client.post(reverse("authentik_api:token-list"), {"identifier": ident})
+        self.assertEqual(response.status_code, 201)
+        token = Token.objects.get(identifier=ident)
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, True)
+        self.assertTrue(self.user.has_perm("authentik_core.view_token_key", token))
+        response = self.client.put(
+            reverse("authentik_api:token-detail", kwargs={"identifier": ident}),
+            data={"identifier": "user_token_poc_v3", "intent": "api", "user": self.admin.pk},
+        )
+        self.assertEqual(response.status_code, 400)
+        token.refresh_from_db()
+        self.assertEqual(token.user, self.user)
+
     def test_list(self):
         """Test Token List (Test normal authentication)"""
         Token.objects.all().delete()

authentik/core/tests/test_users_api.py

@@ -60,11 +60,10 @@ class TestUsersAPI(APITestCase):
     def test_recovery_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
+        self.assertEqual(response.status_code, 404)
 
     def test_set_password(self):
         """Test Direct password set"""
@@ -85,7 +84,7 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
         self.assertEqual(response.status_code, 200)
@@ -93,20 +92,16 @@ class TestUsersAPI(APITestCase):
     def test_recovery_email_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(
-            response.content, {"non_field_errors": "User does not have an email address set."}
-        )
+        self.assertEqual(response.status_code, 404)
         self.user.email = "foo@bar.baz"
         self.user.save()
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
+        self.assertEqual(response.status_code, 404)
 
     def test_recovery_email_no_stage(self):
         """Test user recovery link (no email stage)"""
@@ -117,11 +112,10 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "Email stage does not exist."})
+        self.assertEqual(response.status_code, 404)
 
     def test_recovery_email(self):
         """Test user recovery link"""
@@ -135,7 +129,7 @@ class TestUsersAPI(APITestCase):
         stage = EmailStage.objects.create(name="email")
 
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse(
                 "authentik_api:user-recovery-email",
                 kwargs={"pk": self.user.pk},

authentik/core/tests/utils.py

@@ -1,5 +1,7 @@
 """Test Utils"""
 
+from typing import Optional
+
 from django.utils.text import slugify
 
 from authentik.brands.models import Brand
@@ -20,7 +22,7 @@ def create_test_flow(
     )
 
 
-def create_test_user(name: str | None = None, **kwargs) -> User:
+def create_test_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test user"""
     uid = generate_id(20) if not name else name
     kwargs.setdefault("email", f"{uid}@goauthentik.io")
@@ -34,7 +36,7 @@ def create_test_user(name: str | None = None, **kwargs) -> User:
     return user
 
 
-def create_test_admin_user(name: str | None = None, **kwargs) -> User:
+def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test-admin user"""
     user = create_test_user(name, **kwargs)
     group = Group.objects.create(name=user.name or name, is_superuser=True)

authentik/core/types.py

@@ -1,6 +1,7 @@
 """authentik core dataclasses"""
 
 from dataclasses import dataclass
+from typing import Optional
 
 from rest_framework.fields import CharField
 
@@ -19,7 +20,7 @@ class UILoginButton:
     challenge: Challenge
 
     # Icon URL, used as-is
-    icon_url: str | None = None
+    icon_url: Optional[str] = None
 
 
 class UserSettingSerializer(PassiveSerializer):

authentik/core/urls.py

@@ -6,6 +6,7 @@ from django.conf import settings
 from django.contrib.auth.decorators import login_required
 from django.urls import path
 from django.views.decorators.csrf import ensure_csrf_cookie
+from django.views.generic import RedirectView
 
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
@@ -19,12 +20,7 @@ from authentik.core.api.transactional_applications import TransactionalApplicati
 from authentik.core.api.users import UserViewSet
 from authentik.core.views import apps
 from authentik.core.views.debug import AccessDeniedView
-from authentik.core.views.interface import (
-    BrandDefaultRedirectView,
-    FlowInterfaceView,
-    InterfaceView,
-    RootRedirectView,
-)
+from authentik.core.views.interface import FlowInterfaceView, InterfaceView
 from authentik.core.views.session import EndSessionView
 from authentik.root.asgi_middleware import SessionMiddleware
 from authentik.root.messages.consumer import MessageConsumer
@@ -33,11 +29,13 @@ from authentik.root.middleware import ChannelsLoggingMiddleware
 urlpatterns = [
     path(
         "",
-        login_required(RootRedirectView.as_view()),
+        login_required(
+            RedirectView.as_view(pattern_name="authentik_core:if-user", query_string=True)
+        ),
         name="root-redirect",
     ),
     path(
-        # We have to use this format since everything else uses application/o or application/saml
+        # We have to use this format since everything else uses applications/o or applications/saml
         "application/launch/<slug:application_slug>/",
         apps.RedirectToAppLaunch.as_view(),
         name="application-launch",
@@ -45,12 +43,12 @@ urlpatterns = [
     # Interfaces
     path(
         "if/admin/",
-        ensure_csrf_cookie(BrandDefaultRedirectView.as_view(template_name="if/admin.html")),
+        ensure_csrf_cookie(InterfaceView.as_view(template_name="if/admin.html")),
         name="if-admin",
     ),
     path(
         "if/user/",
-        ensure_csrf_cookie(BrandDefaultRedirectView.as_view(template_name="if/user.html")),
+        ensure_csrf_cookie(InterfaceView.as_view(template_name="if/user.html")),
         name="if-user",
     ),
     path(

authentik/core/views/apps.py

@@ -57,7 +57,7 @@ class RedirectToAppLaunch(View):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(in_memory_stage(RedirectToAppStage))
         request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs("authentik_core:if-flow", request.GET, flow_slug=flow.slug)

authentik/core/views/error.py

@@ -61,6 +61,7 @@ class ServerErrorView(TemplateView):
     response_class = ServerErrorTemplateResponse
     template_name = "if/error.html"
 
+    # pylint: disable=useless-super-delegation
     def dispatch(self, *args, **kwargs):  # pragma: no cover
         """Little wrapper so django accepts this function"""
         return super().dispatch(*args, **kwargs)

authentik/core/views/interface.py

@@ -3,43 +3,15 @@
 from json import dumps
 from typing import Any
 
-from django.http import HttpRequest
-from django.http.response import HttpResponse
-from django.shortcuts import get_object_or_404, redirect
-from django.utils.translation import gettext as _
-from django.views.generic.base import RedirectView, TemplateView
+from django.shortcuts import get_object_or_404
+from django.views.generic.base import TemplateView
 from rest_framework.request import Request
 
 from authentik import get_build_hash
 from authentik.admin.tasks import LOCAL_VERSION
 from authentik.api.v3.config import ConfigView
 from authentik.brands.api import CurrentBrandSerializer
-from authentik.brands.models import Brand
-from authentik.core.models import UserTypes
 from authentik.flows.models import Flow
-from authentik.policies.denied import AccessDeniedResponse
-
-
-class RootRedirectView(RedirectView):
-    """Root redirect view, redirect to brand's default application if set"""
-
-    pattern_name = "authentik_core:if-user"
-    query_string = True
-
-    def redirect_to_app(self, request: HttpRequest):
-        if request.user.is_authenticated and request.user.type == UserTypes.EXTERNAL:
-            brand: Brand = request.brand
-            if brand.default_application:
-                return redirect(
-                    "authentik_core:application-launch",
-                    application_slug=brand.default_application.slug,
-                )
-        return None
-
-    def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
-        if redirect_response := RootRedirectView().redirect_to_app(request):
-            return redirect_response
-        return super().dispatch(request, *args, **kwargs)
 
 
 class InterfaceView(TemplateView):
@@ -55,22 +27,6 @@ class InterfaceView(TemplateView):
         return super().get_context_data(**kwargs)
 
 
-class BrandDefaultRedirectView(InterfaceView):
-    """By default redirect to default app"""
-
-    def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
-        if request.user.is_authenticated and request.user.type == UserTypes.EXTERNAL:
-            brand: Brand = request.brand
-            if brand.default_application:
-                return redirect(
-                    "authentik_core:application-launch",
-                    application_slug=brand.default_application.slug,
-                )
-            response = AccessDeniedResponse(self.request)
-            response.error_message = _("Interface can only be accessed by internal users.")
-        return super().dispatch(request, *args, **kwargs)
-
-
 class FlowInterfaceView(InterfaceView):
     """Flow interface"""
 

authentik/crypto/api.py

@@ -1,6 +1,7 @@
 """Crypto API Views"""
 
 from datetime import datetime
+from typing import Optional
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
@@ -55,25 +56,25 @@ class CertificateKeyPairSerializer(ModelSerializer):
             return True
         return str(request.query_params.get("include_details", "true")).lower() == "true"
 
-    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA256)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha256
 
-    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA1)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha1
 
-    def get_cert_expiry(self, instance: CertificateKeyPair) -> datetime | None:
+    def get_cert_expiry(self, instance: CertificateKeyPair) -> Optional[datetime]:
         "Get certificate expiry"
         if not self._should_include_details:
             return None
-        return DateTimeField().to_representation(instance.certificate.not_valid_after_utc)
+        return DateTimeField().to_representation(instance.certificate.not_valid_after)
 
-    def get_cert_subject(self, instance: CertificateKeyPair) -> str | None:
+    def get_cert_subject(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get certificate subject as full rfc4514"""
         if not self._should_include_details:
             return None
@@ -83,7 +84,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
         """Show if this keypair has a private key configured or not"""
         return instance.key_data != "" and instance.key_data is not None
 
-    def get_private_key_type(self, instance: CertificateKeyPair) -> str | None:
+    def get_private_key_type(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get the private key's type, if set"""
         if not self._should_include_details:
             return None
@@ -120,7 +121,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             str(load_pem_x509_certificate(value.encode("utf-8"), default_backend()))
         except ValueError as exc:
             LOGGER.warning("Failed to load certificate", exc=exc)
-            raise ValidationError("Unable to load certificate.") from None
+            raise ValidationError("Unable to load certificate.")
         return value
 
     def validate_key_data(self, value: str) -> str:
@@ -139,7 +140,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
                 )
             except (ValueError, TypeError) as exc:
                 LOGGER.warning("Failed to load private key", exc=exc)
-                raise ValidationError("Unable to load private key (possibly encrypted?).") from None
+                raise ValidationError("Unable to load private key (possibly encrypted?).")
         return value
 
     class Meta:

authentik/crypto/apps.py

@@ -1,6 +1,7 @@
 """authentik crypto app config"""
 
-from datetime import UTC, datetime
+from datetime import datetime, timezone
+from typing import Optional
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
@@ -35,22 +36,20 @@ class AuthentikCryptoConfig(ManagedAppConfig):
             },
         )
 
-    @ManagedAppConfig.reconcile_tenant
-    def managed_jwt_cert(self):
+    def reconcile_tenant_managed_jwt_cert(self):
         """Ensure managed JWT certificate"""
         from authentik.crypto.models import CertificateKeyPair
 
-        cert: CertificateKeyPair | None = CertificateKeyPair.objects.filter(
+        cert: Optional[CertificateKeyPair] = CertificateKeyPair.objects.filter(
             managed=MANAGED_KEY
         ).first()
-        now = datetime.now(tz=UTC)
+        now = datetime.now(tz=timezone.utc)
         if not cert or (
             now < cert.certificate.not_valid_after_utc or now > cert.certificate.not_valid_after_utc
         ):
             self._create_update_cert()
 
-    @ManagedAppConfig.reconcile_tenant
-    def self_signed(self):
+    def reconcile_tenant_self_signed(self):
         """Create self-signed keypair"""
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair

authentik/crypto/builder.py

@@ -2,6 +2,7 @@
 
 import datetime
 import uuid
+from typing import Optional
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -43,7 +44,7 @@ class CertificateBuilder:
     def generate_private_key(self) -> PrivateKeyTypes:
         """Generate private key"""
         if self._use_ec_private_key:
-            return ec.generate_private_key(curve=ec.SECP256R1())
+            return ec.generate_private_key(curve=ec.SECP256R1)
         return rsa.generate_private_key(
             public_exponent=65537, key_size=4096, backend=default_backend()
         )
@@ -51,7 +52,7 @@ class CertificateBuilder:
     def build(
         self,
         validity_days: int = 365,
-        subject_alt_names: list[str] | None = None,
+        subject_alt_names: Optional[list[str]] = None,
     ):
         """Build self-signed certificate"""
         one_day = datetime.timedelta(1, 0, 0)

authentik/crypto/management/commands/import_certificate.py

@@ -24,13 +24,13 @@ class Command(TenantCommand):
         if not keypair:
             keypair = CertificateKeyPair(name=options["name"])
             dirty = True
-        with open(options["certificate"], encoding="utf-8") as _cert:
+        with open(options["certificate"], mode="r", encoding="utf-8") as _cert:
             cert_data = _cert.read()
             if keypair.certificate_data != cert_data:
                 dirty = True
             keypair.certificate_data = cert_data
         if options["private_key"]:
-            with open(options["private_key"], encoding="utf-8") as _key:
+            with open(options["private_key"], mode="r", encoding="utf-8") as _key:
                 key_data = _key.read()
                 if keypair.key_data != key_data:
                     dirty = True

authentik/crypto/models.py

@@ -2,6 +2,7 @@
 
 from binascii import hexlify
 from hashlib import md5
+from typing import Optional
 from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
@@ -36,9 +37,9 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         default="",
     )
 
-    _cert: Certificate | None = None
-    _private_key: PrivateKeyTypes | None = None
-    _public_key: PublicKeyTypes | None = None
+    _cert: Optional[Certificate] = None
+    _private_key: Optional[PrivateKeyTypes] = None
+    _public_key: Optional[PublicKeyTypes] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -56,7 +57,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> PublicKeyTypes | None:
+    def public_key(self) -> Optional[PublicKeyTypes]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -65,7 +66,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> PrivateKeyTypes | None:
+    ) -> Optional[PrivateKeyTypes]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -58,7 +58,7 @@ def certificate_discovery(self: SystemTask):
         else:
             cert_name = path.name.replace(path.suffix, "")
         try:
-            with open(path, encoding="utf-8") as _file:
+            with open(path, "r", encoding="utf-8") as _file:
                 body = _file.read()
                 if "PRIVATE KEY" in body:
                     private_keys[cert_name] = ensure_private_key_valid(body)

authentik/crypto/tests.py

@@ -1,5 +1,6 @@
 """Crypto tests"""
 
+import datetime
 from json import loads
 from os import makedirs
 from tempfile import TemporaryDirectory
@@ -7,7 +8,6 @@ from tempfile import TemporaryDirectory
 from cryptography.x509.extensions import SubjectAlternativeName
 from cryptography.x509.general_name import DNSName
 from django.urls import reverse
-from django.utils.timezone import now
 from rest_framework.test import APITestCase
 
 from authentik.core.api.used_by import DeleteAction
@@ -68,9 +68,9 @@ class TestCrypto(APITestCase):
             validity_days=3,
         )
         instance = builder.save()
-        _now = now()
+        now = datetime.datetime.today()
         self.assertEqual(instance.name, name)
-        self.assertEqual((instance.certificate.not_valid_after_utc - _now).days, 2)
+        self.assertEqual((instance.certificate.not_valid_after - now).days, 2)
 
     def test_builder_api(self):
         """Test Builder (via API)"""
@@ -267,7 +267,7 @@ class TestCrypto(APITestCase):
             with open(f"{temp_dir}/foo.bar/privkey.pem", "w+", encoding="utf-8") as _key:
                 _key.write(builder.private_key)
             with CONFIG.patch("cert_discovery_dir", temp_dir):
-                certificate_discovery()
+                certificate_discovery()  # pylint: disable=no-value-for-parameter
         keypair: CertificateKeyPair = CertificateKeyPair.objects.filter(
             managed=MANAGED_DISCOVERED % "foo"
         ).first()

authentik/enterprise/api.py

@@ -22,7 +22,7 @@ from authentik.core.models import User, UserTypes
 from authentik.enterprise.license import LicenseKey, LicenseSummarySerializer
 from authentik.enterprise.models import License
 from authentik.rbac.decorators import permission_required
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 
 class EnterpriseRequiredMixin:
@@ -92,7 +92,7 @@ class LicenseViewSet(UsedByMixin, ModelViewSet):
         """Get install_id"""
         return Response(
             data={
-                "install_id": get_unique_identifier(),
+                "install_id": get_install_id(),
             }
         )
 

authentik/enterprise/audit/apps.py

@@ -13,8 +13,7 @@ class AuthentikEnterpriseAuditConfig(EnterpriseConfig):
     verbose_name = "authentik Enterprise.Audit"
     default = True
 
-    @EnterpriseConfig.reconcile_global
-    def install_middleware(self):
+    def reconcile_global_install_middleware(self):
         """Install enterprise audit middleware"""
         orig_import = "authentik.events.middleware.AuditMiddleware"
         new_import = "authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware"

authentik/enterprise/audit/middleware.py

@@ -11,7 +11,6 @@ from django.db.models.expressions import BaseExpression, Combinable
 from django.db.models.signals import post_init
 from django.http import HttpRequest
 
-from authentik.core.models import User
 from authentik.events.middleware import AuditMiddleware, should_log_model
 from authentik.events.utils import cleanse_dict, sanitize_item
 
@@ -28,13 +27,10 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
         super().connect(request)
         if not self.enabled:
             return
-        user = getattr(request, "user", self.anonymous_user)
-        if not user.is_authenticated:
-            user = self.anonymous_user
         if not hasattr(request, "request_id"):
             return
         post_init.connect(
-            partial(self.post_init_handler, user=user, request=request),
+            partial(self.post_init_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
@@ -62,7 +58,7 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 field_value = value.name
 
             # If current field value is an expression, we are not evaluating it
-            if isinstance(field_value, BaseExpression | Combinable):
+            if isinstance(field_value, (BaseExpression, Combinable)):
                 continue
             field_value = field.to_python(field_value)
             data[field.name] = deepcopy(field_value)
@@ -76,21 +72,21 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 diff[key] = {"previous_value": value, "new_value": after.get(key)}
         return sanitize_item(diff)
 
-    def post_init_handler(self, user: User, request: HttpRequest, sender, instance: Model, **_):
+    def post_init_handler(self, request: HttpRequest, sender, instance: Model, **_):
         """post_init django model handler"""
         if not should_log_model(instance):
             return
         if hasattr(instance, "_previous_state"):
             return
         before = len(connection.queries)
-        instance._previous_state = self.serialize_simple(instance)
+        setattr(instance, "_previous_state", self.serialize_simple(instance))
         after = len(connection.queries)
         if after > before:
             raise AssertionError("More queries generated by serialize_simple")
 
+    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
-        user: User,
         request: HttpRequest,
         sender,
         instance: Model,
@@ -112,6 +108,4 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 for field_set in ignored_field_sets:
                     if set(diff.keys()) == set(field_set):
                         return None
-        return super().post_save_handler(
-            user, request, sender, instance, created, thread_kwargs, **_
-        )
+        return super().post_save_handler(request, sender, instance, created, thread_kwargs, **_)

authentik/enterprise/license.py

@@ -21,13 +21,13 @@ from rest_framework.fields import BooleanField, DateTimeField, IntegerField
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import User, UserTypes
 from authentik.enterprise.models import License, LicenseUsage
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 CACHE_KEY_ENTERPRISE_LICENSE = "goauthentik.io/enterprise/license"
 CACHE_EXPIRY_ENTERPRISE_LICENSE = 3 * 60 * 60  # 2 Hours
 
 
-@lru_cache
+@lru_cache()
 def get_licensing_key() -> Certificate:
     """Get Root CA PEM"""
     with open("authentik/enterprise/public.pem", "rb") as _key:
@@ -36,7 +36,7 @@ def get_licensing_key() -> Certificate:
 
 def get_license_aud() -> str:
     """Get the JWT audience field"""
-    return f"enterprise.goauthentik.io/license/{get_unique_identifier()}"
+    return f"enterprise.goauthentik.io/license/{get_install_id()}"
 
 
 class LicenseFlags(Enum):
@@ -88,7 +88,7 @@ class LicenseKey:
         try:
             headers = get_unverified_header(jwt)
         except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         x5c: list[str] = headers.get("x5c", [])
         if len(x5c) < 1:
             raise ValidationError("Unable to verify license")
@@ -98,7 +98,7 @@ class LicenseKey:
             our_cert.verify_directly_issued_by(intermediate)
             intermediate.verify_directly_issued_by(get_licensing_key())
         except (InvalidSignature, TypeError, ValueError, Error):
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         try:
             body = from_dict(
                 LicenseKey,
@@ -110,7 +110,7 @@ class LicenseKey:
                 ),
             )
         except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         return body
 
     @staticmethod
@@ -142,7 +142,13 @@ class LicenseKey:
     @staticmethod
     def get_external_user_count():
         """Get current external user count"""
-        return LicenseKey.base_user_qs().filter(type=UserTypes.EXTERNAL).count()
+        # Count since start of the month
+        last_month = now().replace(day=1)
+        return (
+            LicenseKey.base_user_qs()
+            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
+            .count()
+        )
 
     def is_valid(self) -> bool:
         """Check if the given license body covers all users

authentik/enterprise/policy.py

@@ -1,5 +1,7 @@
 """Enterprise license policies"""
 
+from typing import Optional
+
 from django.utils.translation import gettext_lazy as _
 
 from authentik.core.models import User, UserTypes
@@ -19,7 +21,7 @@ class EnterprisePolicyAccessView(PolicyAccessView):
             return PolicyResult(False, _("Feature only accessible for internal users."))
         return PolicyResult(True)
 
-    def user_has_access(self, user: User | None = None) -> PolicyResult:
+    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
         user = user or self.request.user
         request = PolicyRequest(user)
         request.http_request = self.request

authentik/enterprise/providers/rac/api/endpoints.py

@@ -1,5 +1,7 @@
 """RAC Provider API Views"""
 
+from typing import Optional
+
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.urls import reverse
@@ -34,11 +36,11 @@ class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
     provider_obj = RACProviderSerializer(source="provider", read_only=True)
     launch_url = SerializerMethodField()
 
-    def get_launch_url(self, endpoint: Endpoint) -> str | None:
+    def get_launch_url(self, endpoint: Endpoint) -> Optional[str]:
         """Build actual launch URL (the provider itself does not have one, just
         individual endpoints)"""
         try:
-
+            # pylint: disable=no-member
             return reverse(
                 "authentik_providers_rac:start",
                 kwargs={"app": endpoint.provider.application.slug, "endpoint": endpoint.pk},

authentik/enterprise/providers/rac/models.py

@@ -1,6 +1,6 @@
 """RAC Models"""
 
-from typing import Any
+from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
@@ -58,7 +58,7 @@ class RACProvider(Provider):
     )
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return "goauthentik.io://providers/rac/launch"
@@ -112,7 +112,7 @@ class RACPropertyMapping(PropertyMapping):
 
     static_settings = models.JSONField(default=dict)
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         if len(self.static_settings) > 0:
             return self.static_settings

authentik/enterprise/providers/rac/views.py

@@ -47,7 +47,7 @@ class RACStartView(EnterprisePolicyAccessView):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(
             in_memory_stage(
                 RACFinalStage,
@@ -132,7 +132,16 @@ class RACFinalStage(RedirectStage):
             flow=self.executor.plan.flow_pk,
             endpoint=self.endpoint.name,
         ).from_http(self.request)
-        self.executor.current_stage.destination = self.request.build_absolute_uri(
-            reverse("authentik_providers_rac:if-rac", kwargs={"token": str(token.token)})
+        setattr(
+            self.executor.current_stage,
+            "destination",
+            self.request.build_absolute_uri(
+                reverse(
+                    "authentik_providers_rac:if-rac",
+                    kwargs={
+                        "token": str(token.token),
+                    },
+                )
+            ),
         )
         return super().get_challenge(*args, **kwargs)

authentik/enterprise/settings.py

@@ -15,7 +15,6 @@ CELERY_BEAT_SCHEDULE = {
 TENANT_APPS = [
     "authentik.enterprise.audit",
     "authentik.enterprise.providers.rac",
-    "authentik.enterprise.stages.source",
 ]
 
 MIDDLEWARE = ["authentik.enterprise.middleware.EnterpriseMiddleware"]

authentik/enterprise/stages/source/api.py

@@ -1,38 +0,0 @@
-"""Source Stage API Views"""
-
-from rest_framework.exceptions import ValidationError
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.models import Source
-from authentik.enterprise.api import EnterpriseRequiredMixin
-from authentik.enterprise.stages.source.models import SourceStage
-from authentik.flows.api.stages import StageSerializer
-
-
-class SourceStageSerializer(EnterpriseRequiredMixin, StageSerializer):
-    """SourceStage Serializer"""
-
-    def validate_source(self, _source: Source) -> Source:
-        """Ensure configured source supports web-based login"""
-        source = Source.objects.filter(pk=_source.pk).select_subclasses().first()
-        if not source:
-            raise ValidationError("Invalid source")
-        login_button = source.ui_login_button(self.context["request"])
-        if not login_button:
-            raise ValidationError("Invalid source selected, only web-based sources are supported.")
-        return source
-
-    class Meta:
-        model = SourceStage
-        fields = StageSerializer.Meta.fields + ["source", "resume_timeout"]
-
-
-class SourceStageViewSet(UsedByMixin, ModelViewSet):
-    """SourceStage Viewset"""
-
-    queryset = SourceStage.objects.all()
-    serializer_class = SourceStageSerializer
-    filterset_fields = "__all__"
-    ordering = ["name"]
-    search_fields = ["name"]

authentik/enterprise/stages/source/apps.py

@@ -1,12 +0,0 @@
-"""authentik stage app config"""
-
-from authentik.enterprise.apps import EnterpriseConfig
-
-
-class AuthentikEnterpriseStageSourceConfig(EnterpriseConfig):
-    """authentik source stage config"""
-
-    name = "authentik.enterprise.stages.source"
-    label = "authentik_stages_source"
-    verbose_name = "authentik Enterprise.Stages.Source"
-    default = True

authentik/enterprise/stages/source/migrations/0001_initial.py

@@ -1,53 +0,0 @@
-# Generated by Django 5.0.2 on 2024-02-25 20:44
-
-import authentik.lib.utils.time
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    initial = True
-
-    dependencies = [
-        ("authentik_core", "0033_alter_user_options"),
-        ("authentik_flows", "0027_auto_20231028_1424"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="SourceStage",
-            fields=[
-                (
-                    "stage_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_flows.stage",
-                    ),
-                ),
-                (
-                    "resume_timeout",
-                    models.TextField(
-                        default="minutes=10",
-                        help_text="Amount of time a user can take to return from the source to continue the flow (Format: hours=-1;minutes=-2;seconds=-3)",
-                        validators=[authentik.lib.utils.time.timedelta_string_validator],
-                    ),
-                ),
-                (
-                    "source",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="authentik_core.source"
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Source Stage",
-                "verbose_name_plural": "Source Stages",
-            },
-            bases=("authentik_flows.stage",),
-        ),
-    ]

authentik/enterprise/stages/source/models.py

@@ -1,45 +0,0 @@
-"""Source stage models"""
-
-from django.db import models
-from django.utils.translation import gettext_lazy as _
-from django.views import View
-from rest_framework.serializers import BaseSerializer
-
-from authentik.flows.models import Stage
-from authentik.lib.utils.time import timedelta_string_validator
-
-
-class SourceStage(Stage):
-    """Suspend the current flow execution and send the user to a source,
-    after which this flow execution is resumed."""
-
-    source = models.ForeignKey("authentik_core.Source", on_delete=models.CASCADE)
-
-    resume_timeout = models.TextField(
-        default="minutes=10",
-        validators=[timedelta_string_validator],
-        help_text=_(
-            "Amount of time a user can take to return from the source to continue the flow "
-            "(Format: hours=-1;minutes=-2;seconds=-3)"
-        ),
-    )
-
-    @property
-    def serializer(self) -> type[BaseSerializer]:
-        from authentik.enterprise.stages.source.api import SourceStageSerializer
-
-        return SourceStageSerializer
-
-    @property
-    def view(self) -> type[View]:
-        from authentik.enterprise.stages.source.stage import SourceStageView
-
-        return SourceStageView
-
-    @property
-    def component(self) -> str:
-        return "ak-stage-source-form"
-
-    class Meta:
-        verbose_name = _("Source Stage")
-        verbose_name_plural = _("Source Stages")

authentik/enterprise/stages/source/stage.py

@@ -1,79 +0,0 @@
-"""Source stage logic"""
-
-from typing import Any
-from uuid import uuid4
-
-from django.http import HttpRequest, HttpResponse
-from django.utils.text import slugify
-from django.utils.timezone import now
-from guardian.shortcuts import get_anonymous_user
-
-from authentik.core.models import Source, User
-from authentik.core.sources.flow_manager import SESSION_KEY_OVERRIDE_FLOW_TOKEN
-from authentik.core.types import UILoginButton
-from authentik.enterprise.stages.source.models import SourceStage
-from authentik.flows.challenge import Challenge, ChallengeResponse
-from authentik.flows.models import FlowToken
-from authentik.flows.planner import PLAN_CONTEXT_IS_RESTORED
-from authentik.flows.stage import ChallengeStageView
-from authentik.lib.utils.time import timedelta_from_string
-
-PLAN_CONTEXT_RESUME_TOKEN = "resume_token"  # nosec
-
-
-class SourceStageView(ChallengeStageView):
-    """Suspend the current flow execution and send the user to a source,
-    after which this flow execution is resumed."""
-
-    login_button: UILoginButton
-
-    def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
-        current_stage: SourceStage = self.executor.current_stage
-        source: Source = (
-            Source.objects.filter(pk=current_stage.source_id).select_subclasses().first()
-        )
-        if not source:
-            self.logger.warning("Source does not exist")
-            return self.executor.stage_invalid("Source does not exist")
-        self.login_button = source.ui_login_button(self.request)
-        if not self.login_button:
-            self.logger.warning("Source does not have a UI login button")
-            return self.executor.stage_invalid("Invalid source")
-        restore_token = self.executor.plan.context.get(PLAN_CONTEXT_IS_RESTORED)
-        override_token = self.request.session.get(SESSION_KEY_OVERRIDE_FLOW_TOKEN)
-        if restore_token and override_token and restore_token.pk == override_token.pk:
-            del self.request.session[SESSION_KEY_OVERRIDE_FLOW_TOKEN]
-            return self.executor.stage_ok()
-        return super().dispatch(request, *args, **kwargs)
-
-    def get_challenge(self, *args, **kwargs) -> Challenge:
-        resume_token = self.create_flow_token()
-        self.request.session[SESSION_KEY_OVERRIDE_FLOW_TOKEN] = resume_token
-        return self.login_button.challenge
-
-    def create_flow_token(self) -> FlowToken:
-        """Save the current flow state in a token that can be used to resume this flow"""
-        pending_user: User = self.get_pending_user()
-        if pending_user.is_anonymous:
-            pending_user = get_anonymous_user()
-        current_stage: SourceStage = self.executor.current_stage
-        identifier = slugify(f"ak-source-stage-{current_stage.name}-{str(uuid4())}")
-        # Don't check for validity here, we only care if the token exists
-        tokens = FlowToken.objects.filter(identifier=identifier)
-        valid_delta = timedelta_from_string(current_stage.resume_timeout)
-        if not tokens.exists():
-            return FlowToken.objects.create(
-                expires=now() + valid_delta,
-                user=pending_user,
-                identifier=identifier,
-                flow=self.executor.flow,
-                _plan=FlowToken.pickle(self.executor.plan),
-            )
-        token = tokens.first()
-        # Check if token is expired and rotate key if so
-        if token.is_expired:
-            token.expire_action()
-        return token
-
-    def challenge_valid(self, response: ChallengeResponse) -> HttpResponse:
-        return self.executor.stage_ok()

authentik/enterprise/stages/source/tests.py

@@ -1,99 +0,0 @@
-"""Source stage tests"""
-
-from django.urls import reverse
-
-from authentik.core.tests.utils import create_test_flow, create_test_user
-from authentik.enterprise.stages.source.models import SourceStage
-from authentik.flows.models import FlowDesignation, FlowStageBinding, FlowToken
-from authentik.flows.planner import PLAN_CONTEXT_IS_RESTORED, FlowPlan
-from authentik.flows.tests import FlowTestCase
-from authentik.flows.views.executor import SESSION_KEY_PLAN
-from authentik.lib.generators import generate_id
-from authentik.sources.saml.models import SAMLSource
-from authentik.stages.identification.models import IdentificationStage, UserFields
-from authentik.stages.password import BACKEND_INBUILT
-from authentik.stages.password.models import PasswordStage
-from authentik.stages.user_login.models import UserLoginStage
-
-
-class TestSourceStage(FlowTestCase):
-    """Source stage tests"""
-
-    def setUp(self):
-        self.source = SAMLSource.objects.create(
-            slug=generate_id(),
-            issuer="authentik",
-            allow_idp_initiated=True,
-            pre_authentication_flow=create_test_flow(),
-        )
-
-    def test_source_success(self):
-        """Test"""
-        user = create_test_user()
-        flow = create_test_flow(FlowDesignation.AUTHENTICATION)
-        stage = SourceStage.objects.create(name=generate_id(), source=self.source)
-        FlowStageBinding.objects.create(
-            target=flow,
-            stage=IdentificationStage.objects.create(
-                name=generate_id(),
-                user_fields=[UserFields.USERNAME],
-            ),
-            order=0,
-        )
-        FlowStageBinding.objects.create(
-            target=flow,
-            stage=PasswordStage.objects.create(name=generate_id(), backends=[BACKEND_INBUILT]),
-            order=5,
-        )
-        FlowStageBinding.objects.create(target=flow, stage=stage, order=10)
-        FlowStageBinding.objects.create(
-            target=flow,
-            stage=UserLoginStage.objects.create(
-                name=generate_id(),
-            ),
-            order=15,
-        )
-
-        # Get user identification stage
-        response = self.client.get(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageResponse(response, flow, component="ak-stage-identification")
-        # Send username
-        response = self.client.post(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-            data={"uid_field": user.username},
-            follow=True,
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageResponse(response, flow, component="ak-stage-password")
-        # Send password
-        response = self.client.post(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-            data={"password": user.username},
-            follow=True,
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageRedirects(
-            response,
-            reverse("authentik_sources_saml:login", kwargs={"source_slug": self.source.slug}),
-        )
-
-        # Hijack flow plan so we don't have to emulate the source
-        flow_token = FlowToken.objects.filter(
-            identifier__startswith=f"ak-source-stage-{stage.name.lower()}"
-        ).first()
-        self.assertIsNotNone(flow_token)
-        session = self.client.session
-        plan: FlowPlan = session[SESSION_KEY_PLAN]
-        plan.context[PLAN_CONTEXT_IS_RESTORED] = flow_token
-        session[SESSION_KEY_PLAN] = plan
-        session.save()
-
-        # Pretend we've just returned from the source
-        response = self.client.get(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}), follow=True
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageRedirects(response, reverse("authentik_core:root-redirect"))

authentik/enterprise/stages/source/urls.py

@@ -1,5 +0,0 @@
-"""API URLs"""
-
-from authentik.enterprise.stages.source.api import SourceStageViewSet
-
-api_urlpatterns = [("stages/source", SourceStageViewSet)]

authentik/events/api/tasks.py

@@ -92,7 +92,7 @@ class SystemTaskViewSet(ReadOnlyModelViewSet):
             task_func.delay(*task.task_call_args, **task.task_call_kwargs)
             messages.success(
                 self.request,
-                _("Successfully started task {name}.".format_map({"name": task.name})),
+                _("Successfully started task %(name)s." % {"name": task.name}),
             )
             return Response(status=204)
         except (ImportError, AttributeError) as exc:  # pragma: no cover

authentik/events/apps.py

@@ -35,8 +35,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
     verbose_name = "authentik Events"
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def check_deprecations(self):
+    def reconcile_global_check_deprecations(self):
         """Check for config deprecations"""
         from authentik.events.models import Event, EventAction
 
@@ -57,8 +56,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
                 message=msg,
             ).save()
 
-    @ManagedAppConfig.reconcile_tenant
-    def prefill_tasks(self):
+    def reconcile_tenant_prefill_tasks(self):
         """Prefill tasks"""
         from authentik.events.models import SystemTask
         from authentik.events.system_tasks import _prefill_tasks
@@ -69,8 +67,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
             task.save()
             self.logger.debug("prefilled task", task_name=task.name)
 
-    @ManagedAppConfig.reconcile_tenant
-    def run_scheduled_tasks(self):
+    def reconcile_tenant_run_scheduled_tasks(self):
         """Run schedule tasks which are behind schedule (only applies
         to tasks of which we keep metrics)"""
         from authentik.events.models import TaskStatus

authentik/events/context_processors/asn.py

@@ -46,7 +46,7 @@ class ASNContextProcessor(MMDBContextProcessor):
             "asn": self.asn_dict(ClientIPMiddleware.get_client_ip(request)),
         }
 
-    def asn(self, ip_address: str) -> ASN | None:
+    def asn(self, ip_address: str) -> Optional[ASN]:
         """Wrapper for Reader.asn"""
         with Hub.current.start_span(
             op="authentik.events.asn.asn",
@@ -71,7 +71,7 @@ class ASNContextProcessor(MMDBContextProcessor):
         }
         return asn_dict
 
-    def asn_dict(self, ip_address: str) -> ASNDict | None:
+    def asn_dict(self, ip_address: str) -> Optional[ASNDict]:
         """Wrapper for self.asn that returns a dict"""
         asn = self.asn(ip_address)
         if not asn:

authentik/events/context_processors/geoip.py

@@ -47,7 +47,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
         # Different key `geoip` vs `geo` for legacy reasons
         return {"geoip": self.city(ClientIPMiddleware.get_client_ip(request))}
 
-    def city(self, ip_address: str) -> City | None:
+    def city(self, ip_address: str) -> Optional[City]:
         """Wrapper for Reader.city"""
         with Hub.current.start_span(
             op="authentik.events.geo.city",
@@ -76,7 +76,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
             city_dict["city"] = city.city.name
         return city_dict
 
-    def city_dict(self, ip_address: str) -> GeoIPDict | None:
+    def city_dict(self, ip_address: str) -> Optional[GeoIPDict]:
         """Wrapper for self.city that returns a dict"""
         city = self.city(ip_address)
         if not city:

authentik/events/context_processors/mmdb.py

@@ -1,6 +1,7 @@
 """Common logic for reading MMDB files"""
 
 from pathlib import Path
+from typing import Optional
 
 from geoip2.database import Reader
 from structlog.stdlib import get_logger
@@ -12,7 +13,7 @@ class MMDBContextProcessor(EventContextProcessor):
     """Common logic for reading MaxMind DB files, including re-loading if the file has changed"""
 
     def __init__(self):
-        self.reader: Reader | None = None
+        self.reader: Optional[Reader] = None
         self._last_mtime: float = 0.0
         self.logger = get_logger()
         self.open()

authentik/events/middleware.py

@@ -1,9 +1,8 @@
 """Events middleware"""
 
-from collections.abc import Callable
 from functools import partial
 from threading import Thread
-from typing import Any
+from typing import Any, Callable, Optional
 
 from django.conf import settings
 from django.contrib.sessions.models import Session
@@ -50,9 +49,9 @@ class EventNewThread(Thread):
     action: str
     request: HttpRequest
     kwargs: dict[str, Any]
-    user: User | None = None
+    user: Optional[User] = None
 
-    def __init__(self, action: str, request: HttpRequest, user: User | None = None, **kwargs):
+    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
         super().__init__()
         self.action = action
         self.request = request
@@ -83,26 +82,29 @@ class AuditMiddleware:
 
         self.anonymous_user = get_anonymous_user()
 
+    def get_user(self, request: HttpRequest) -> User:
+        user = getattr(request, "user", self.anonymous_user)
+        if not user.is_authenticated:
+            return self.anonymous_user
+        return user
+
     def connect(self, request: HttpRequest):
         """Connect signal for automatic logging"""
         self._ensure_fallback_user()
-        user = getattr(request, "user", self.anonymous_user)
-        if not user.is_authenticated:
-            user = self.anonymous_user
         if not hasattr(request, "request_id"):
             return
         post_save.connect(
-            partial(self.post_save_handler, user=user, request=request),
+            partial(self.post_save_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
         pre_delete.connect(
-            partial(self.pre_delete_handler, user=user, request=request),
+            partial(self.pre_delete_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
         m2m_changed.connect(
-            partial(self.m2m_changed_handler, user=user, request=request),
+            partial(self.m2m_changed_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
@@ -145,29 +147,31 @@ class AuditMiddleware:
             )
             thread.run()
 
+    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
-        user: User,
         request: HttpRequest,
         sender,
         instance: Model,
         created: bool,
-        thread_kwargs: dict | None = None,
+        thread_kwargs: Optional[dict] = None,
         **_,
     ):
         """Signal handler for all object's post_save"""
         if not should_log_model(instance):
             return
+        user = self.get_user(request)
 
         action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
         thread = EventNewThread(action, request, user=user, model=model_to_dict(instance))
         thread.kwargs.update(thread_kwargs or {})
         thread.run()
 
-    def pre_delete_handler(self, user: User, request: HttpRequest, sender, instance: Model, **_):
+    def pre_delete_handler(self, request: HttpRequest, sender, instance: Model, **_):
         """Signal handler for all object's pre_delete"""
         if not should_log_model(instance):  # pragma: no cover
             return
+        user = self.get_user(request)
 
         EventNewThread(
             EventAction.MODEL_DELETED,
@@ -176,14 +180,13 @@ class AuditMiddleware:
             model=model_to_dict(instance),
         ).run()
 
-    def m2m_changed_handler(
-        self, user: User, request: HttpRequest, sender, instance: Model, action: str, **_
-    ):
+    def m2m_changed_handler(self, request: HttpRequest, sender, instance: Model, action: str, **_):
         """Signal handler for all object's m2m_changed"""
         if action not in ["pre_add", "pre_remove", "post_clear"]:
             return
         if not should_log_m2m(instance):
             return
+        user = self.get_user(request)
 
         EventNewThread(
             EventAction.MODEL_UPDATED,

authentik/events/models.py

@@ -7,6 +7,7 @@ from difflib import get_close_matches
 from functools import lru_cache
 from inspect import currentframe
 from smtplib import SMTPException
+from typing import Optional
 from uuid import uuid4
 
 from django.apps import apps
@@ -51,8 +52,6 @@ from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
-DISCORD_FIELD_LIMIT = 25
-NOTIFICATION_SUMMARY_LENGTH = 75
 
 
 def default_event_duration():
@@ -66,7 +65,7 @@ def default_brand():
     return sanitize_dict(model_to_dict(DEFAULT_BRAND))
 
 
-@lru_cache
+@lru_cache()
 def django_app_names() -> list[str]:
     """Get a cached list of all django apps' names (not labels)"""
     return [x.name for x in apps.app_configs.values()]
@@ -199,7 +198,7 @@ class Event(SerializerModel, ExpiringModel):
     @staticmethod
     def new(
         action: str | EventAction,
-        app: str | None = None,
+        app: Optional[str] = None,
         **kwargs,
     ) -> "Event":
         """Create new Event instance from arguments. Instance is NOT saved."""
@@ -225,7 +224,7 @@ class Event(SerializerModel, ExpiringModel):
         self.user = get_user(user)
         return self
 
-    def from_http(self, request: HttpRequest, user: User | None = None) -> "Event":
+    def from_http(self, request: HttpRequest, user: Optional[User] = None) -> "Event":
         """Add data from a Django-HttpRequest, allowing the creation of
         Events independently from requests.
         `user` arguments optionally overrides user from requests."""
@@ -419,7 +418,7 @@ class NotificationTransport(SerializerModel):
                 if not isinstance(value, str):
                     continue
                 # https://birdie0.github.io/discord-webhooks-guide/other/field_limits.html
-                if len(fields) >= DISCORD_FIELD_LIMIT:
+                if len(fields) >= 25:
                     continue
                 fields.append({"title": key[:256], "value": value[:1024]})
         body = {
@@ -480,7 +479,7 @@ class NotificationTransport(SerializerModel):
                     continue
                 context["key_value"][key] = value
         else:
-            context["title"] += notification.body[:NOTIFICATION_SUMMARY_LENGTH]
+            context["title"] += notification.body[:75]
         # TODO: improve permission check
         if notification.user.is_superuser:
             context["source"] = {
@@ -497,7 +496,7 @@ class NotificationTransport(SerializerModel):
         try:
             from authentik.stages.email.tasks import send_mail
 
-            return send_mail(mail.__dict__)
+            return send_mail(mail.__dict__)  # pylint: disable=no-value-for-parameter
         except (SMTPException, ConnectionError, OSError) as exc:
             raise NotificationTransportError(exc) from exc
 
@@ -541,11 +540,7 @@ class Notification(SerializerModel):
         return NotificationSerializer
 
     def __str__(self) -> str:
-        body_trunc = (
-            (self.body[:NOTIFICATION_SUMMARY_LENGTH] + "..")
-            if len(self.body) > NOTIFICATION_SUMMARY_LENGTH
-            else self.body
-        )
+        body_trunc = (self.body[:75] + "..") if len(self.body) > 75 else self.body
         return f"Notification for user {self.user}: {body_trunc}"
 
     class Meta:

authentik/events/signals.py

@@ -1,6 +1,6 @@
 """authentik events signal listener"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.db.models.signals import post_save, pre_delete
@@ -42,7 +42,7 @@ def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
     request.session[SESSION_LOGIN_EVENT] = event
 
 
-def get_login_event(request: HttpRequest) -> Event | None:
+def get_login_event(request: HttpRequest) -> Optional[Event]:
     """Wrapper to get login event that can be mocked in tests"""
     return request.session.get(SESSION_LOGIN_EVENT, None)
 
@@ -71,7 +71,7 @@ def on_login_failed(
     sender,
     credentials: dict[str, str],
     request: HttpRequest,
-    stage: Stage | None = None,
+    stage: Optional[Stage] = None,
     **kwargs,
 ):
     """Failed Login, authentik custom event"""

authentik/events/system_tasks.py

@@ -2,15 +2,16 @@
 
 from datetime import datetime, timedelta
 from time import perf_counter
-from typing import Any
+from typing import Any, Optional
 
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from structlog.stdlib import get_logger
 from tenant_schemas_celery.task import TenantTask
 
-from authentik.events.models import Event, EventAction, TaskStatus
+from authentik.events.models import Event, EventAction
 from authentik.events.models import SystemTask as DBSystemTask
+from authentik.events.models import TaskStatus
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.errors import exception_to_string
 
@@ -26,10 +27,10 @@ class SystemTask(TenantTask):
     _status: TaskStatus
     _messages: list[str]
 
-    _uid: str | None
+    _uid: Optional[str]
     # Precise start time from perf_counter
-    _start_precise: float | None = None
-    _start: datetime | None = None
+    _start_precise: Optional[float] = None
+    _start: Optional[datetime] = None
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
@@ -59,13 +60,14 @@ class SystemTask(TenantTask):
         self._start = now()
         return super().before_start(task_id, args, kwargs)
 
-    def db(self) -> DBSystemTask | None:
+    def db(self) -> Optional[DBSystemTask]:
         """Get DB object for latest task"""
         return DBSystemTask.objects.filter(
             name=self.__name__,
             uid=self._uid,
         ).first()
 
+    # pylint: disable=too-many-arguments
     def after_return(self, status, retval, task_id, args: list[Any], kwargs: dict[str, Any], einfo):
         super().after_return(status, retval, task_id, args, kwargs, einfo=einfo)
         if not self._status:
@@ -95,6 +97,7 @@ class SystemTask(TenantTask):
             },
         )
 
+    # pylint: disable=too-many-arguments
     def on_failure(self, exc, task_id, args, kwargs, einfo):
         super().on_failure(exc, task_id, args, kwargs, einfo=einfo)
         if not self._status:

authentik/events/tasks.py

@@ -1,5 +1,7 @@
 """Event notification tasks"""
 
+from typing import Optional
+
 from django.db.models.query_utils import Q
 from guardian.shortcuts import get_anonymous_user
 from structlog.stdlib import get_logger
@@ -36,7 +38,7 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):
     if not event:
         LOGGER.warning("event doesn't exist yet or anymore", event_uuid=event_uuid)
         return
-    trigger: NotificationRule | None = NotificationRule.objects.filter(name=trigger_name).first()
+    trigger: Optional[NotificationRule] = NotificationRule.objects.filter(name=trigger_name).first()
     if not trigger:
         return
 

authentik/events/tests/test_event.py

@@ -105,7 +105,7 @@ class TestEvents(TestCase):
         # Test brand
         request = self.factory.get("/")
         brand = Brand(domain="test-brand")
-        request.brand = brand
+        setattr(request, "brand", brand)
         event = Event.new("unittest").from_http(request)
         self.assertEqual(
             event.brand,

authentik/events/tests/test_middleware.py

@@ -3,9 +3,10 @@
 from django.urls import reverse
 from rest_framework.test import APITestCase
 
-from authentik.core.models import Application
+from authentik.core.models import Application, Token, TokenIntents
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.events.models import Event, EventAction
+from authentik.lib.generators import generate_id
 
 
 class TestEventsMiddleware(APITestCase):
@@ -47,3 +48,30 @@ class TestEventsMiddleware(APITestCase):
                 context__model__name="test-delete",
             ).exists()
         )
+
+    def test_create_with_api(self):
+        """Test model creation event (with API token auth)"""
+        self.client.logout()
+        token = Token.objects.create(user=self.user, intent=TokenIntents.INTENT_API, expiring=False)
+        uid = generate_id()
+        self.client.post(
+            reverse("authentik_api:application-list"),
+            data={"name": uid, "slug": uid},
+            HTTP_AUTHORIZATION=f"Bearer {token.key}",
+        )
+        self.assertTrue(Application.objects.filter(name=uid).exists())
+        event = Event.objects.filter(
+            action=EventAction.MODEL_CREATED,
+            context__model__model_name="application",
+            context__model__app="authentik_core",
+            context__model__name=uid,
+        ).first()
+        self.assertIsNotNone(event)
+        self.assertEqual(
+            event.user,
+            {
+                "pk": self.user.pk,
+                "email": self.user.email,
+                "username": self.user.username,
+            },
+        )