website: bump docusaurus-theme-openapi-docs in /website

Bumps [docusaurus-theme-openapi-docs](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/tree/HEAD/packages/docusaurus-theme-openapi-docs) from 4.4.0 to 4.5.1.
- [Release notes](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/releases)
- [Changelog](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PaloAltoNetworks/docusaurus-openapi-docs/commits/v4.5.1/packages/docusaurus-theme-openapi-docs)

---
updated-dependencies:
- dependency-name: docusaurus-theme-openapi-docs
  dependency-version: 4.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

authentik/blueprints/v1/importer.py

@@ -43,7 +43,6 @@ from authentik.core.models import (
 )
 from authentik.enterprise.license import LicenseKey
 from authentik.enterprise.models import LicenseUsage
-from authentik.enterprise.providers.apple_psso.models import AppleNonce
 from authentik.enterprise.providers.google_workspace.models import (
     GoogleWorkspaceProviderGroup,
     GoogleWorkspaceProviderUser,
@@ -136,7 +135,6 @@ def excluded_models() -> list[type[Model]]:
         EndpointDeviceConnection,
         DeviceToken,
         StreamEvent,
-        AppleNonce,
     )
 
 

authentik/enterprise/providers/apple_psso/api/providers.py

@@ -1,32 +0,0 @@
-"""Apple Platform SSO Provider API Views"""
-
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.core.api.providers import ProviderSerializer
-from authentik.core.api.used_by import UsedByMixin
-from authentik.enterprise.api import EnterpriseRequiredMixin
-from authentik.enterprise.providers.apple_psso.models import ApplePlatformSSOProvider
-
-
-class ApplePlatformSSOProviderSerializer(EnterpriseRequiredMixin, ProviderSerializer):
-    """ApplePlatformSSOProvider Serializer"""
-
-    class Meta:
-        model = ApplePlatformSSOProvider
-        fields = [
-            "pk",
-            "name",
-        ]
-        extra_kwargs = {}
-
-
-class ApplePlatformSSOProviderViewSet(UsedByMixin, ModelViewSet):
-    """ApplePlatformSSOProvider Viewset"""
-
-    queryset = ApplePlatformSSOProvider.objects.all()
-    serializer_class = ApplePlatformSSOProviderSerializer
-    filterset_fields = [
-        "name",
-    ]
-    search_fields = ["name"]
-    ordering = ["name"]

authentik/enterprise/providers/apple_psso/apps.py

@@ -1,13 +0,0 @@
-from authentik.enterprise.apps import EnterpriseConfig
-
-
-class AuthentikEnterpriseProviderApplePSSOConfig(EnterpriseConfig):
-
-    name = "authentik.enterprise.providers.apple_psso"
-    label = "authentik_providers_apple_psso"
-    verbose_name = "authentik Enterprise.Providers.Apple Platform SSO"
-    default = True
-    mountpoints = {
-        "authentik.enterprise.providers.apple_psso.urls": "endpoint/apple/sso/",
-        "authentik.enterprise.providers.apple_psso.urls_root": "",
-    }

authentik/enterprise/providers/apple_psso/http.py

@@ -1,118 +0,0 @@
-from base64 import urlsafe_b64encode
-from json import dumps
-from secrets import token_bytes
-
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric import ec
-from cryptography.hazmat.primitives.ciphers.aead import AESGCM
-from cryptography.hazmat.primitives.kdf.concatkdf import ConcatKDFHash
-from django.http import HttpResponse
-from jwcrypto.common import base64url_decode, base64url_encode
-
-from authentik.enterprise.providers.apple_psso.models import AppleDevice
-
-
-def length_prefixed(data: bytes) -> bytes:
-    length = len(data)
-    return length.to_bytes(4, "big") + data
-
-
-def build_apu(public_key: ec.EllipticCurvePublicKey):
-    # X9.63 representation: 0x04 || X || Y
-    public_numbers = public_key.public_numbers()
-
-    x_bytes = public_numbers.x.to_bytes(32, "big")
-    y_bytes = public_numbers.y.to_bytes(32, "big")
-
-    x963 = bytes([0x04]) + x_bytes + y_bytes
-
-    result = length_prefixed(b"APPLE") + length_prefixed(x963)
-
-    return result
-
-
-def encrypt_token_with_a256_gcm(body: dict, device_encryption_key: str, apv: bytes) -> str:
-    ephemeral_key = ec.generate_private_key(curve=ec.SECP256R1())
-    device_public_key = serialization.load_pem_public_key(
-        device_encryption_key.encode(), backend=default_backend()
-    )
-
-    shared_secret_z = ephemeral_key.exchange(ec.ECDH(), device_public_key)
-
-    apu = build_apu(ephemeral_key.public_key())
-
-    jwe_header = {
-        "enc": "A256GCM",
-        "kid": "ephemeralKey",
-        "epk": {
-            "x": base64url_encode(
-                ephemeral_key.public_key().public_numbers().x.to_bytes(32, "big")
-            ),
-            "y": base64url_encode(
-                ephemeral_key.public_key().public_numbers().y.to_bytes(32, "big")
-            ),
-            "kty": "EC",
-            "crv": "P-256",
-        },
-        "typ": "platformsso-login-response+jwt",
-        "alg": "ECDH-ES",
-        "apu": base64url_encode(apu),
-        "apv": base64url_encode(apv),
-    }
-
-    party_u_info = length_prefixed(apu)
-    party_v_info = length_prefixed(apv)
-    supp_pub_info = (256).to_bytes(4, "big")
-
-    other_info = length_prefixed(b"A256GCM") + party_u_info + party_v_info + supp_pub_info
-
-    ckdf = ConcatKDFHash(
-        algorithm=hashes.SHA256(),
-        length=32,
-        otherinfo=other_info,
-    )
-
-    derived_key = ckdf.derive(shared_secret_z)
-
-    nonce = token_bytes(12)
-
-    header_json = dumps(jwe_header, separators=(",", ":")).encode()
-    aad = urlsafe_b64encode(header_json).rstrip(b"=")
-
-    aesgcm = AESGCM(derived_key)
-    ciphertext = aesgcm.encrypt(nonce, dumps(body).encode(), aad)
-
-    ciphertext_body = ciphertext[:-16]
-    tag = ciphertext[-16:]
-
-    # base64url encoding
-    protected_b64 = urlsafe_b64encode(header_json).rstrip(b"=")
-    iv_b64 = urlsafe_b64encode(nonce).rstrip(b"=")
-    ciphertext_b64 = urlsafe_b64encode(ciphertext_body).rstrip(b"=")
-    tag_b64 = urlsafe_b64encode(tag).rstrip(b"=")
-
-    jwe_compact = b".".join(
-        [
-            protected_b64,
-            b"",
-            iv_b64,
-            ciphertext_b64,
-            tag_b64,
-        ]
-    )
-    return jwe_compact.decode()
-
-
-class JWEResponse(HttpResponse):
-
-    def __init__(
-        self,
-        data: dict,
-        device: AppleDevice,
-        apv: str,
-    ):
-        super().__init__(
-            content=encrypt_token_with_a256_gcm(data, device.encryption_key, base64url_decode(apv)),
-            content_type="application/platformsso-login-response+jwt",
-        )

authentik/enterprise/providers/apple_psso/migrations/0001_initial.py

@@ -1,36 +0,0 @@
-# Generated by Django 5.1.11 on 2025-06-28 00:12
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    initial = True
-
-    dependencies = [
-        ("authentik_providers_oauth2", "0028_migrate_session"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="ApplePlatformSSOProvider",
-            fields=[
-                (
-                    "oauth2provider_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_providers_oauth2.oauth2provider",
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-            },
-            bases=("authentik_providers_oauth2.oauth2provider",),
-        ),
-    ]

authentik/enterprise/providers/apple_psso/migrations/0002_appledevice_appledeviceuser_appledevice_users_and_more.py

@@ -1,94 +0,0 @@
-# Generated by Django 5.1.11 on 2025-06-28 15:50
-
-import django.db.models.deletion
-import uuid
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_providers_apple_psso", "0001_initial"),
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="AppleDevice",
-            fields=[
-                (
-                    "endpoint_uuid",
-                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
-                ),
-                ("signing_key", models.TextField()),
-                ("encryption_key", models.TextField()),
-                ("key_exchange_key", models.TextField()),
-                ("sign_key_id", models.TextField()),
-                ("enc_key_id", models.TextField()),
-                ("creation_time", models.DateTimeField(auto_now_add=True)),
-                (
-                    "provider",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_providers_apple_psso.appleplatformssoprovider",
-                    ),
-                ),
-            ],
-        ),
-        migrations.CreateModel(
-            name="AppleDeviceUser",
-            fields=[
-                ("uuid", models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False)),
-                ("signing_key", models.TextField()),
-                ("encryption_key", models.TextField()),
-                ("sign_key_id", models.TextField()),
-                ("enc_key_id", models.TextField()),
-                (
-                    "device",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_providers_apple_psso.appledevice",
-                    ),
-                ),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL
-                    ),
-                ),
-            ],
-        ),
-        migrations.AddField(
-            model_name="appledevice",
-            name="users",
-            field=models.ManyToManyField(
-                through="authentik_providers_apple_psso.AppleDeviceUser",
-                to=settings.AUTH_USER_MODEL,
-            ),
-        ),
-        migrations.CreateModel(
-            name="AppleNonce",
-            fields=[
-                (
-                    "id",
-                    models.AutoField(
-                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
-                    ),
-                ),
-                ("expires", models.DateTimeField(default=None, null=True)),
-                ("expiring", models.BooleanField(default=True)),
-                ("nonce", models.TextField()),
-            ],
-            options={
-                "abstract": False,
-                "indexes": [
-                    models.Index(fields=["expires"], name="authentik_p_expires_47d534_idx"),
-                    models.Index(fields=["expiring"], name="authentik_p_expirin_87253e_idx"),
-                    models.Index(
-                        fields=["expiring", "expires"], name="authentik_p_expirin_20a7c9_idx"
-                    ),
-                ],
-            },
-        ),
-    ]

authentik/enterprise/providers/apple_psso/migrations/0003_rename_sign_key_id_appledeviceuser_enclave_key_id_and_more.py

@@ -1,34 +0,0 @@
-# Generated by Django 5.1.11 on 2025-06-28 22:18
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        (
-            "authentik_providers_apple_psso",
-            "0002_appledevice_appledeviceuser_appledevice_users_and_more",
-        ),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="appledeviceuser",
-            old_name="sign_key_id",
-            new_name="enclave_key_id",
-        ),
-        migrations.RenameField(
-            model_name="appledeviceuser",
-            old_name="signing_key",
-            new_name="secure_enclave_key",
-        ),
-        migrations.RemoveField(
-            model_name="appledeviceuser",
-            name="enc_key_id",
-        ),
-        migrations.RemoveField(
-            model_name="appledeviceuser",
-            name="encryption_key",
-        ),
-    ]

authentik/enterprise/providers/apple_psso/models.py

@@ -1,85 +0,0 @@
-from uuid import uuid4
-
-from django.db import models
-from django.utils.translation import gettext_lazy as _
-from rest_framework.serializers import Serializer
-
-from authentik.core.models import ExpiringModel, User
-from authentik.crypto.models import CertificateKeyPair
-from authentik.providers.oauth2.models import (
-    ClientTypes,
-    IssuerMode,
-    OAuth2Provider,
-    RedirectURI,
-    RedirectURIMatchingMode,
-    ScopeMapping,
-)
-
-
-class ApplePlatformSSOProvider(OAuth2Provider):
-    """Integrate with Apple Platform SSO"""
-
-    def set_oauth_defaults(self):
-        """Ensure all OAuth2-related settings are correct"""
-        self.issuer_mode = IssuerMode.PER_PROVIDER
-        self.client_type = ClientTypes.PUBLIC
-        self.signing_key = CertificateKeyPair.objects.get(name="authentik Self-signed Certificate")
-        self.include_claims_in_id_token = True
-        scopes = ScopeMapping.objects.filter(
-            managed__in=[
-                "goauthentik.io/providers/oauth2/scope-openid",
-                "goauthentik.io/providers/oauth2/scope-profile",
-                "goauthentik.io/providers/oauth2/scope-email",
-                "goauthentik.io/providers/oauth2/scope-offline_access",
-                "goauthentik.io/providers/oauth2/scope-authentik_api",
-            ]
-        )
-        self.property_mappings.add(*list(scopes))
-        self.redirect_uris = [
-            RedirectURI(RedirectURIMatchingMode.STRICT, "io.goauthentik.endpoint:/oauth2redirect"),
-        ]
-
-    @property
-    def component(self) -> str:
-        return "ak-provider-apple-psso-form"
-
-    @property
-    def serializer(self) -> type[Serializer]:
-        from authentik.enterprise.providers.apple_psso.api.providers import (
-            ApplePlatformSSOProviderSerializer,
-        )
-
-        return ApplePlatformSSOProviderSerializer
-
-    class Meta:
-        verbose_name = _("Apple Platform SSO Provider")
-        verbose_name_plural = _("Apple Platform SSO Providers")
-
-
-class AppleDevice(models.Model):
-
-    endpoint_uuid = models.UUIDField(default=uuid4, primary_key=True)
-
-    signing_key = models.TextField()
-    encryption_key = models.TextField()
-    key_exchange_key = models.TextField()
-    sign_key_id = models.TextField()
-    enc_key_id = models.TextField()
-    creation_time = models.DateTimeField(auto_now_add=True)
-    provider = models.ForeignKey(ApplePlatformSSOProvider, on_delete=models.CASCADE)
-    users = models.ManyToManyField(User, through="AppleDeviceUser")
-
-
-class AppleDeviceUser(models.Model):
-
-    uuid = models.UUIDField(default=uuid4, primary_key=True)
-
-    device = models.ForeignKey(AppleDevice, on_delete=models.CASCADE)
-    user = models.ForeignKey(User, on_delete=models.CASCADE)
-
-    secure_enclave_key = models.TextField()
-    enclave_key_id = models.TextField()
-
-
-class AppleNonce(ExpiringModel):
-    nonce = models.TextField()

authentik/enterprise/providers/apple_psso/urls.py

@@ -1,15 +0,0 @@
-from django.urls import path
-
-from authentik.enterprise.providers.apple_psso.views.nonce import NonceView
-from authentik.enterprise.providers.apple_psso.views.register import (
-    RegisterDeviceView,
-    RegisterUserView,
-)
-from authentik.enterprise.providers.apple_psso.views.token import TokenView
-
-urlpatterns = [
-    path("token/", TokenView.as_view(), name="token"),
-    path("nonce/", NonceView.as_view(), name="nonce"),
-    path("register/device/", RegisterDeviceView.as_view(), name="register-device"),
-    path("register/user/", RegisterUserView.as_view(), name="register-user"),
-]

authentik/enterprise/providers/apple_psso/urls_root.py

@@ -1,7 +0,0 @@
-from django.urls import path
-
-from authentik.enterprise.providers.apple_psso.views.site_association import AppleAppSiteAssociation
-
-urlpatterns = [
-    path(".well-known/apple-app-site-association", AppleAppSiteAssociation.as_view(), name="asa"),
-]

authentik/enterprise/providers/apple_psso/views/nonce.py

@@ -1,25 +0,0 @@
-from base64 import b64encode
-from datetime import timedelta
-from secrets import token_bytes
-
-from django.http import HttpRequest, JsonResponse
-from django.utils.decorators import method_decorator
-from django.utils.timezone import now
-from django.views import View
-from django.views.decorators.csrf import csrf_exempt
-
-from authentik.enterprise.providers.apple_psso.models import AppleNonce
-
-
-@method_decorator(csrf_exempt, name="dispatch")
-class NonceView(View):
-
-    def post(self, request: HttpRequest, *args, **kwargs):
-        nonce = AppleNonce.objects.create(
-            nonce=b64encode(token_bytes(32)).decode(), expires=now() + timedelta(minutes=5)
-        )
-        return JsonResponse(
-            {
-                "Nonce": nonce.nonce,
-            }
-        )

authentik/enterprise/providers/apple_psso/views/register.py

@@ -1,92 +0,0 @@
-from django.shortcuts import get_object_or_404
-from rest_framework.authentication import BaseAuthentication
-from rest_framework.fields import CharField
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-
-from authentik.api.authentication import TokenAuthentication
-from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import User
-from authentik.enterprise.providers.apple_psso.models import (
-    AppleDevice,
-    AppleDeviceUser,
-    ApplePlatformSSOProvider,
-)
-from authentik.lib.generators import generate_key
-
-
-class DeviceRegisterAuth(BaseAuthentication):
-    def authenticate(self, request):
-        # very temporary, lol
-        return (User(), None)
-
-
-class RegisterDeviceView(APIView):
-
-    class DeviceRegistration(PassiveSerializer):
-
-        device_uuid = CharField()
-        client_id = CharField()
-        device_signing_key = CharField()
-        device_encryption_key = CharField()
-        sign_key_id = CharField()
-        enc_key_id = CharField()
-
-    permission_classes = []
-    pagination_class = None
-    filter_backends = []
-    serializer_class = DeviceRegistration
-    authentication_classes = [DeviceRegisterAuth, TokenAuthentication]
-
-    def post(self, request: Request) -> Response:
-        data = self.DeviceRegistration(data=request.data)
-        data.is_valid(raise_exception=True)
-        provider = get_object_or_404(
-            ApplePlatformSSOProvider, client_id=data.validated_data["client_id"]
-        )
-        AppleDevice.objects.update_or_create(
-            endpoint_uuid=data.validated_data["device_uuid"],
-            defaults={
-                "signing_key": data.validated_data["device_signing_key"],
-                "encryption_key": data.validated_data["device_encryption_key"],
-                "sign_key_id": data.validated_data["sign_key_id"],
-                "enc_key_id": data.validated_data["enc_key_id"],
-                "key_exchange_key": generate_key(),
-                "provider": provider,
-            },
-        )
-        return Response()
-
-
-class RegisterUserView(APIView):
-
-    class UserRegistration(PassiveSerializer):
-
-        device_uuid = CharField()
-        user_secure_enclave_key = CharField()
-        enclave_key_id = CharField()
-
-    permission_classes = []
-    pagination_class = None
-    filter_backends = []
-    serializer_class = UserRegistration
-    authentication_classes = [TokenAuthentication]
-
-    def post(self, request: Request) -> Response:
-        data = self.UserRegistration(data=request.data)
-        data.is_valid(raise_exception=True)
-        device = get_object_or_404(AppleDevice, endpoint_uuid=data.validated_data["device_uuid"])
-        AppleDeviceUser.objects.update_or_create(
-            device=device,
-            user=request.user,
-            defaults={
-                "secure_enclave_key": data.validated_data["user_secure_enclave_key"],
-                "enclave_key_id": data.validated_data["enclave_key_id"],
-            },
-        )
-        return Response(
-            {
-                "username": request.user.username,
-            }
-        )

authentik/enterprise/providers/apple_psso/views/site_association.py

@@ -1,16 +0,0 @@
-from django.http import HttpRequest, HttpResponse, JsonResponse
-from django.views import View
-
-
-class AppleAppSiteAssociation(View):
-    def get(self, request: HttpRequest) -> HttpResponse:
-        return JsonResponse(
-            {
-                "authsrv": {
-                    "apps": [
-                        "232G855Y8N.io.goauthentik.endpoint",
-                        "232G855Y8N.io.goauthentik.endpoint.psso",
-                    ]
-                }
-            }
-        )

authentik/enterprise/providers/apple_psso/views/token.py

@@ -1,140 +0,0 @@
-from datetime import timedelta
-
-from django.http import Http404, HttpRequest, HttpResponse
-from django.utils.decorators import method_decorator
-from django.utils.timezone import now
-from django.views import View
-from django.views.decorators.csrf import csrf_exempt
-from jwt import PyJWT, decode
-from rest_framework.exceptions import ValidationError
-from structlog.stdlib import get_logger
-
-from authentik.core.models import AuthenticatedSession, Session, User
-from authentik.core.sessions import SessionStore
-from authentik.enterprise.providers.apple_psso.http import JWEResponse
-from authentik.enterprise.providers.apple_psso.models import (
-    AppleDevice,
-    AppleDeviceUser,
-    AppleNonce,
-    ApplePlatformSSOProvider,
-)
-from authentik.events.models import Event, EventAction
-from authentik.events.signals import SESSION_LOGIN_EVENT
-from authentik.providers.oauth2.constants import TOKEN_TYPE
-from authentik.providers.oauth2.id_token import IDToken
-from authentik.providers.oauth2.models import RefreshToken
-from authentik.root.middleware import SessionMiddleware
-
-LOGGER = get_logger()
-
-
-@method_decorator(csrf_exempt, name="dispatch")
-class TokenView(View):
-
-    device: AppleDevice
-    provider: ApplePlatformSSOProvider
-
-    def post(self, request: HttpRequest) -> HttpResponse:
-        version = request.POST.get("platform_sso_version")
-        assertion = request.POST.get("assertion", request.POST.get("request"))
-        if not assertion:
-            return HttpResponse(status=400)
-
-        decode_unvalidated = PyJWT().decode_complete(assertion, options={"verify_signature": False})
-        LOGGER.debug(decode_unvalidated["header"])
-        expected_kid = decode_unvalidated["header"]["kid"]
-
-        self.device = AppleDevice.objects.filter(sign_key_id=expected_kid).first()
-        if not self.device:
-            raise Http404
-        self.provider = self.device.provider
-
-        # Properly decode the JWT with the key from the device
-        decoded = decode(
-            assertion, self.device.signing_key, algorithms=["ES256"], options={"verify_aud": False}
-        )
-        LOGGER.debug(decoded)
-
-        LOGGER.debug("got device", device=self.device)
-
-        # Check that the nonce hasn't been used before
-        nonce = AppleNonce.objects.filter(nonce=decoded["request_nonce"]).first()
-        if not nonce:
-            return HttpResponse(status=400)
-        nonce.delete()
-
-        handler_func = (
-            f"handle_v{version}_{decode_unvalidated["header"]["typ"]}".replace("-", "_")
-            .replace("+", "_")
-            .replace(".", "_")
-        )
-        handler = getattr(self, handler_func, None)
-        if not handler:
-            LOGGER.debug("Handler not found", handler=handler_func)
-            return HttpResponse(status=400)
-        LOGGER.debug("sending to handler", handler=handler_func)
-        return handler(decoded)
-
-    def validate_device_user_response(self, assertion: str) -> tuple[AppleDeviceUser, dict] | None:
-        """Decode an embedded assertion and validate it by looking up the matching device user"""
-        decode_unvalidated = PyJWT().decode_complete(assertion, options={"verify_signature": False})
-        expected_kid = decode_unvalidated["header"]["kid"]
-
-        device_user = AppleDeviceUser.objects.filter(
-            device=self.device, enclave_key_id=expected_kid
-        ).first()
-        if not device_user:
-            return None
-        return device_user, decode(
-            assertion,
-            device_user.secure_enclave_key,
-            audience="apple-platform-sso",
-            algorithms=["ES256"],
-        )
-
-    def create_auth_session(self, user: User):
-        event = Event.new(EventAction.LOGIN).from_http(self.request, user=user)
-        store = SessionStore()
-        store[SESSION_LOGIN_EVENT] = event
-        store.save()
-        session = Session.objects.filter(session_key=store.session_key).first()
-        AuthenticatedSession.objects.create(session=session, user=user)
-        session = SessionMiddleware.encode_session(store.session_key, user)
-        return session
-
-    def handle_v1_0_platformsso_login_request_jwt(self, decoded: dict):
-        user = None
-        if decoded["grant_type"] == "urn:ietf:params:oauth:grant-type:jwt-bearer":
-            # Decode and validate inner assertion
-            user, inner = self.validate_device_user_response(decoded["assertion"])
-            if inner["nonce"] != decoded["nonce"]:
-                LOGGER.warning("Mis-matched nonce to outer assertion")
-                raise ValidationError("Invalid request")
-
-        refresh_token = RefreshToken(
-            user=user.user,
-            scope=decoded["scope"],
-            expires=now() + timedelta(hours=8),
-            provider=self.provider,
-            auth_time=now(),
-            session=None,
-        )
-        id_token = IDToken.new(
-            self.provider,
-            refresh_token,
-            self.request,
-        )
-        id_token.nonce = decoded["nonce"]
-        refresh_token.id_token = id_token
-        refresh_token.save()
-        return JWEResponse(
-            {
-                "refresh_token": refresh_token.token,
-                "refresh_token_expires_in": int((refresh_token.expires - now()).total_seconds()),
-                "id_token": refresh_token.id_token.to_jwt(self.provider),
-                "token_type": TOKEN_TYPE,
-                "session_key": self.create_auth_session(user.user),
-            },
-            device=self.device,
-            apv=decoded["jwe_crypto"]["apv"],
-        )

authentik/enterprise/search/ql.py

@@ -6,7 +6,7 @@ from djangoql.ast import Name
 from djangoql.exceptions import DjangoQLError
 from djangoql.queryset import apply_search
 from djangoql.schema import DjangoQLSchema
-from rest_framework.filters import SearchFilter
+from rest_framework.filters import BaseFilterBackend, SearchFilter
 from rest_framework.request import Request
 from structlog.stdlib import get_logger
 
@@ -39,19 +39,21 @@ class BaseSchema(DjangoQLSchema):
         return super().resolve_name(name)
 
 
-class QLSearch(SearchFilter):
+class QLSearch(BaseFilterBackend):
     """rest_framework search filter which uses DjangoQL"""
 
+    def __init__(self):
+        super().__init__()
+        self._fallback = SearchFilter()
+
     @property
     def enabled(self):
         return apps.get_app_config("authentik_enterprise").enabled()
 
-    def get_search_terms(self, request) -> str:
-        """
-        Search terms are set by a ?search=... query parameter,
-        and may be comma and/or whitespace delimited.
-        """
-        params = request.query_params.get(self.search_param, "")
+    def get_search_terms(self, request: Request) -> str:
+        """Search terms are set by a ?search=... query parameter,
+        and may be comma and/or whitespace delimited."""
+        params = request.query_params.get("search", "")
         params = params.replace("\x00", "")  # strip null characters
         return params
 
@@ -70,9 +72,9 @@ class QLSearch(SearchFilter):
         search_query = self.get_search_terms(request)
         schema = self.get_schema(request, view)
         if len(search_query) == 0 or not self.enabled:
-            return super().filter_queryset(request, queryset, view)
+            return self._fallback.filter_queryset(request, queryset, view)
         try:
             return apply_search(queryset, search_query, schema=schema)
         except DjangoQLError as exc:
             LOGGER.debug("Failed to parse search expression", exc=exc)
-            return super().filter_queryset(request, queryset, view)
+            return self._fallback.filter_queryset(request, queryset, view)

authentik/enterprise/search/tests.py

@@ -57,7 +57,7 @@ class QLTest(APITestCase):
         )
         self.assertEqual(res.status_code, 200)
         content = loads(res.content)
-        self.assertGreaterEqual(content["pagination"]["count"], 1)
+        self.assertEqual(content["pagination"]["count"], 1)
         self.assertEqual(content["results"][0]["username"], self.user.username)
 
     def test_search_json(self):

authentik/enterprise/settings.py

@@ -15,7 +15,6 @@ CELERY_BEAT_SCHEDULE = {
 TENANT_APPS = [
     "authentik.enterprise.audit",
     "authentik.enterprise.policies.unique_password",
-    "authentik.enterprise.providers.apple_psso",
     "authentik.enterprise.providers.google_workspace",
     "authentik.enterprise.providers.microsoft_entra",
     "authentik.enterprise.providers.ssf",

authentik/providers/oauth2/views/token.py

@@ -555,8 +555,6 @@ class TokenView(View):
 
     provider: OAuth2Provider | None = None
     params: TokenParams | None = None
-    params_class = TokenParams
-    provider_class = OAuth2Provider
 
     def dispatch(self, request: HttpRequest, *args: Any, **kwargs: Any) -> HttpResponse:
         response = super().dispatch(request, *args, **kwargs)
@@ -576,14 +574,12 @@ class TokenView(View):
                 op="authentik.providers.oauth2.post.parse",
             ):
                 client_id, client_secret = extract_client_auth(request)
-                self.provider = self.provider_class.objects.filter(client_id=client_id).first()
+                self.provider = OAuth2Provider.objects.filter(client_id=client_id).first()
                 if not self.provider:
                     LOGGER.warning("OAuth2Provider does not exist", client_id=client_id)
                     raise TokenError("invalid_client")
                 CTX_AUTH_VIA.set("oauth_client_secret")
-                self.params = self.params_class.parse(
-                    request, self.provider, client_id, client_secret
-                )
+                self.params = TokenParams.parse(request, self.provider, client_id, client_secret)
 
             with start_span(
                 op="authentik.providers.oauth2.post.response",

authentik/root/middleware.py

@@ -61,22 +61,6 @@ class SessionMiddleware(UpstreamSessionMiddleware):
             pass
         return session_key
 
-    @staticmethod
-    def encode_session(session_key: str, user: User):
-        payload = {
-            "sid": session_key,
-            "iss": "authentik",
-            "sub": "anonymous",
-            "authenticated": user.is_authenticated,
-            "acr": ACR_AUTHENTIK_SESSION,
-        }
-        if user.is_authenticated:
-            payload["sub"] = user.uid
-        value = encode(payload=payload, key=SIGNING_HASH)
-        if settings.TEST:
-            value = session_key
-        return value
-
     def process_request(self, request: HttpRequest):
         raw_session = request.COOKIES.get(settings.SESSION_COOKIE_NAME)
         session_key = SessionMiddleware.decode_session_key(raw_session)
@@ -133,9 +117,21 @@ class SessionMiddleware(UpstreamSessionMiddleware):
                             "request completed. The user may have logged "
                             "out in a concurrent request, for example."
                         ) from None
+                    payload = {
+                        "sid": request.session.session_key,
+                        "iss": "authentik",
+                        "sub": "anonymous",
+                        "authenticated": request.user.is_authenticated,
+                        "acr": ACR_AUTHENTIK_SESSION,
+                    }
+                    if request.user.is_authenticated:
+                        payload["sub"] = request.user.uid
+                    value = encode(payload=payload, key=SIGNING_HASH)
+                    if settings.TEST:
+                        value = request.session.session_key
                     response.set_cookie(
                         settings.SESSION_COOKIE_NAME,
-                        SessionMiddleware.encode_session(request.session.session_key, request.user),
+                        value,
                         max_age=max_age,
                         expires=expires,
                         domain=settings.SESSION_COOKIE_DOMAIN,

blueprints/schema.json

@@ -496,46 +496,6 @@
                         }
                     }
                 },
-                {
-                    "type": "object",
-                    "required": [
-                        "model",
-                        "identifiers"
-                    ],
-                    "properties": {
-                        "model": {
-                            "const": "authentik_providers_apple_psso.appleplatformssoprovider"
-                        },
-                        "id": {
-                            "type": "string"
-                        },
-                        "state": {
-                            "type": "string",
-                            "enum": [
-                                "absent",
-                                "created",
-                                "must_created",
-                                "present"
-                            ],
-                            "default": "present"
-                        },
-                        "conditions": {
-                            "type": "array",
-                            "items": {
-                                "type": "boolean"
-                            }
-                        },
-                        "permissions": {
-                            "$ref": "#/$defs/model_authentik_providers_apple_psso.appleplatformssoprovider_permissions"
-                        },
-                        "attrs": {
-                            "$ref": "#/$defs/model_authentik_providers_apple_psso.appleplatformssoprovider"
-                        },
-                        "identifiers": {
-                            "$ref": "#/$defs/model_authentik_providers_apple_psso.appleplatformssoprovider"
-                        }
-                    }
-                },
                 {
                     "type": "object",
                     "required": [
@@ -5068,22 +5028,6 @@
                             "authentik_policies_unique_password.delete_userpasswordhistory",
                             "authentik_policies_unique_password.view_uniquepasswordpolicy",
                             "authentik_policies_unique_password.view_userpasswordhistory",
-                            "authentik_providers_apple_psso.add_appledevice",
-                            "authentik_providers_apple_psso.add_appledeviceuser",
-                            "authentik_providers_apple_psso.add_applenonce",
-                            "authentik_providers_apple_psso.add_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.change_appledevice",
-                            "authentik_providers_apple_psso.change_appledeviceuser",
-                            "authentik_providers_apple_psso.change_applenonce",
-                            "authentik_providers_apple_psso.change_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.delete_appledevice",
-                            "authentik_providers_apple_psso.delete_appledeviceuser",
-                            "authentik_providers_apple_psso.delete_applenonce",
-                            "authentik_providers_apple_psso.delete_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.view_appledevice",
-                            "authentik_providers_apple_psso.view_appledeviceuser",
-                            "authentik_providers_apple_psso.view_applenonce",
-                            "authentik_providers_apple_psso.view_appleplatformssoprovider",
                             "authentik_providers_google_workspace.add_googleworkspaceprovider",
                             "authentik_providers_google_workspace.add_googleworkspaceprovidergroup",
                             "authentik_providers_google_workspace.add_googleworkspaceprovidermapping",
@@ -5655,43 +5599,6 @@
                 }
             }
         },
-        "model_authentik_providers_apple_psso.appleplatformssoprovider": {
-            "type": "object",
-            "properties": {
-                "name": {
-                    "type": "string",
-                    "minLength": 1,
-                    "title": "Name"
-                }
-            },
-            "required": []
-        },
-        "model_authentik_providers_apple_psso.appleplatformssoprovider_permissions": {
-            "type": "array",
-            "items": {
-                "type": "object",
-                "required": [
-                    "permission"
-                ],
-                "properties": {
-                    "permission": {
-                        "type": "string",
-                        "enum": [
-                            "add_appleplatformssoprovider",
-                            "change_appleplatformssoprovider",
-                            "delete_appleplatformssoprovider",
-                            "view_appleplatformssoprovider"
-                        ]
-                    },
-                    "user": {
-                        "type": "integer"
-                    },
-                    "role": {
-                        "type": "string"
-                    }
-                }
-            }
-        },
         "model_authentik_providers_google_workspace.googleworkspaceprovider": {
             "type": "object",
             "properties": {
@@ -7435,7 +7342,6 @@
                         "authentik.enterprise",
                         "authentik.enterprise.audit",
                         "authentik.enterprise.policies.unique_password",
-                        "authentik.enterprise.providers.apple_psso",
                         "authentik.enterprise.providers.google_workspace",
                         "authentik.enterprise.providers.microsoft_entra",
                         "authentik.enterprise.providers.ssf",
@@ -7546,7 +7452,6 @@
                         "authentik_core.token",
                         "authentik_enterprise.license",
                         "authentik_policies_unique_password.uniquepasswordpolicy",
-                        "authentik_providers_apple_psso.appleplatformssoprovider",
                         "authentik_providers_google_workspace.googleworkspaceprovider",
                         "authentik_providers_google_workspace.googleworkspaceprovidermapping",
                         "authentik_providers_microsoft_entra.microsoftentraprovider",
@@ -9769,22 +9674,6 @@
                             "authentik_policies_unique_password.delete_userpasswordhistory",
                             "authentik_policies_unique_password.view_uniquepasswordpolicy",
                             "authentik_policies_unique_password.view_userpasswordhistory",
-                            "authentik_providers_apple_psso.add_appledevice",
-                            "authentik_providers_apple_psso.add_appledeviceuser",
-                            "authentik_providers_apple_psso.add_applenonce",
-                            "authentik_providers_apple_psso.add_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.change_appledevice",
-                            "authentik_providers_apple_psso.change_appledeviceuser",
-                            "authentik_providers_apple_psso.change_applenonce",
-                            "authentik_providers_apple_psso.change_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.delete_appledevice",
-                            "authentik_providers_apple_psso.delete_appledeviceuser",
-                            "authentik_providers_apple_psso.delete_applenonce",
-                            "authentik_providers_apple_psso.delete_appleplatformssoprovider",
-                            "authentik_providers_apple_psso.view_appledevice",
-                            "authentik_providers_apple_psso.view_appledeviceuser",
-                            "authentik_providers_apple_psso.view_applenonce",
-                            "authentik_providers_apple_psso.view_appleplatformssoprovider",
                             "authentik_providers_google_workspace.add_googleworkspaceprovider",
                             "authentik_providers_google_workspace.add_googleworkspaceprovidergroup",
                             "authentik_providers_google_workspace.add_googleworkspaceprovidermapping",

pyproject.toml

@@ -43,7 +43,7 @@ dependencies = [
     "jwcrypto==1.5.6",
     "kubernetes==33.1.0",
     "ldap3==2.9.1",
-    "lxml==5.4.0",
+    "lxml==6.0.0",
     "msgraph-sdk==1.35.0",
     "opencontainers==0.0.14",
     "packaging==25.0",

schema.yml

@@ -24864,7 +24864,6 @@ paths:
           - authentik_policies_password.passwordpolicy
           - authentik_policies_reputation.reputationpolicy
           - authentik_policies_unique_password.uniquepasswordpolicy
-          - authentik_providers_apple_psso.appleplatformssoprovider
           - authentik_providers_google_workspace.googleworkspaceprovider
           - authentik_providers_google_workspace.googleworkspaceprovidermapping
           - authentik_providers_ldap.ldapprovider
@@ -25114,7 +25113,6 @@ paths:
           - authentik_policies_password.passwordpolicy
           - authentik_policies_reputation.reputationpolicy
           - authentik_policies_unique_password.uniquepasswordpolicy
-          - authentik_providers_apple_psso.appleplatformssoprovider
           - authentik_providers_google_workspace.googleworkspaceprovider
           - authentik_providers_google_workspace.googleworkspaceprovidermapping
           - authentik_providers_ldap.ldapprovider
@@ -41214,7 +41212,6 @@ components:
       - authentik.enterprise
       - authentik.enterprise.audit
       - authentik.enterprise.policies.unique_password
-      - authentik.enterprise.providers.apple_psso
       - authentik.enterprise.providers.google_workspace
       - authentik.enterprise.providers.microsoft_entra
       - authentik.enterprise.providers.ssf
@@ -41261,15 +41258,6 @@ components:
       - redirect_uri
       - scope
       - state
-    ApplePlatformSSOProviderRequest:
-      type: object
-      description: ApplePlatformSSOProvider Serializer
-      properties:
-        name:
-          type: string
-          minLength: 1
-      required:
-      - name
     Application:
       type: object
       description: Application Serializer
@@ -48726,7 +48714,6 @@ components:
       - authentik_core.token
       - authentik_enterprise.license
       - authentik_policies_unique_password.uniquepasswordpolicy
-      - authentik_providers_apple_psso.appleplatformssoprovider
       - authentik_providers_google_workspace.googleworkspaceprovider
       - authentik_providers_google_workspace.googleworkspaceprovidermapping
       - authentik_providers_microsoft_entra.microsoftentraprovider
@@ -56672,7 +56659,6 @@ components:
       type: string
     ProviderModelEnum:
       enum:
-      - authentik_providers_apple_psso.appleplatformssoprovider
       - authentik_providers_google_workspace.googleworkspaceprovider
       - authentik_providers_ldap.ldapprovider
       - authentik_providers_microsoft_entra.microsoftentraprovider
@@ -61885,7 +61871,6 @@ components:
       - worker_id
     modelRequest:
       oneOf:
-      - $ref: '#/components/schemas/ApplePlatformSSOProviderRequest'
       - $ref: '#/components/schemas/GoogleWorkspaceProviderRequest'
       - $ref: '#/components/schemas/LDAPProviderRequest'
       - $ref: '#/components/schemas/MicrosoftEntraProviderRequest'
@@ -61899,7 +61884,6 @@ components:
       discriminator:
         propertyName: provider_model
         mapping:
-          authentik_providers_apple_psso.appleplatformssoprovider: '#/components/schemas/ApplePlatformSSOProviderRequest'
           authentik_providers_google_workspace.googleworkspaceprovider: '#/components/schemas/GoogleWorkspaceProviderRequest'
           authentik_providers_ldap.ldapprovider: '#/components/schemas/LDAPProviderRequest'
           authentik_providers_microsoft_entra.microsoftentraprovider: '#/components/schemas/MicrosoftEntraProviderRequest'

uv.lock

@@ -305,7 +305,7 @@ requires-dist = [
     { name = "jwcrypto", specifier = "==1.5.6" },
     { name = "kubernetes", specifier = "==33.1.0" },
     { name = "ldap3", specifier = "==2.9.1" },
-    { name = "lxml", specifier = "==5.4.0" },
+    { name = "lxml", specifier = "==6.0.0" },
     { name = "msgraph-sdk", specifier = "==1.35.0" },
     { name = "opencontainers", git = "https://github.com/vsoch/oci-python?rev=ceb4fcc090851717a3069d78e85ceb1e86c2740c" },
     { name = "packaging", specifier = "==25.0" },
@@ -1824,27 +1824,22 @@ wheels = [
 
 [[package]]
 name = "lxml"
-version = "5.4.0"
+version = "6.0.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/76/3d/14e82fc7c8fb1b7761f7e748fd47e2ec8276d137b6acfe5a4bb73853e08f/lxml-5.4.0.tar.gz", hash = "sha256:d12832e1dbea4be280b22fd0ea7c9b87f0d8fc51ba06e92dc62d52f804f78ebd", size = 3679479, upload-time = "2025-04-23T01:50:29.322Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c5/ed/60eb6fa2923602fba988d9ca7c5cdbd7cf25faa795162ed538b527a35411/lxml-6.0.0.tar.gz", hash = "sha256:032e65120339d44cdc3efc326c9f660f5f7205f3a535c1fdbf898b29ea01fb72", size = 4096938, upload-time = "2025-06-26T16:28:19.373Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/87/cb/2ba1e9dd953415f58548506fa5549a7f373ae55e80c61c9041b7fd09a38a/lxml-5.4.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:773e27b62920199c6197130632c18fb7ead3257fce1ffb7d286912e56ddb79e0", size = 8110086, upload-time = "2025-04-23T01:46:52.218Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/3e/6602a4dca3ae344e8609914d6ab22e52ce42e3e1638c10967568c5c1450d/lxml-5.4.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ce9c671845de9699904b1e9df95acfe8dfc183f2310f163cdaa91a3535af95de", size = 4404613, upload-time = "2025-04-23T01:46:55.281Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/72/bf00988477d3bb452bef9436e45aeea82bb40cdfb4684b83c967c53909c7/lxml-5.4.0-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9454b8d8200ec99a224df8854786262b1bd6461f4280064c807303c642c05e76", size = 5012008, upload-time = "2025-04-23T01:46:57.817Z" },
-    { url = "https://files.pythonhosted.org/packages/92/1f/93e42d93e9e7a44b2d3354c462cd784dbaaf350f7976b5d7c3f85d68d1b1/lxml-5.4.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cccd007d5c95279e529c146d095f1d39ac05139de26c098166c4beb9374b0f4d", size = 4760915, upload-time = "2025-04-23T01:47:00.745Z" },
-    { url = "https://files.pythonhosted.org/packages/45/0b/363009390d0b461cf9976a499e83b68f792e4c32ecef092f3f9ef9c4ba54/lxml-5.4.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0fce1294a0497edb034cb416ad3e77ecc89b313cff7adbee5334e4dc0d11f422", size = 5283890, upload-time = "2025-04-23T01:47:04.702Z" },
-    { url = "https://files.pythonhosted.org/packages/19/dc/6056c332f9378ab476c88e301e6549a0454dbee8f0ae16847414f0eccb74/lxml-5.4.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:24974f774f3a78ac12b95e3a20ef0931795ff04dbb16db81a90c37f589819551", size = 4812644, upload-time = "2025-04-23T01:47:07.833Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/8a/f8c66bbb23ecb9048a46a5ef9b495fd23f7543df642dabeebcb2eeb66592/lxml-5.4.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:497cab4d8254c2a90bf988f162ace2ddbfdd806fce3bda3f581b9d24c852e03c", size = 4921817, upload-time = "2025-04-23T01:47:10.317Z" },
-    { url = "https://files.pythonhosted.org/packages/04/57/2e537083c3f381f83d05d9b176f0d838a9e8961f7ed8ddce3f0217179ce3/lxml-5.4.0-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:e794f698ae4c5084414efea0f5cc9f4ac562ec02d66e1484ff822ef97c2cadff", size = 4753916, upload-time = "2025-04-23T01:47:12.823Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/80/ea8c4072109a350848f1157ce83ccd9439601274035cd045ac31f47f3417/lxml-5.4.0-cp313-cp313-manylinux_2_28_ppc64le.whl", hash = "sha256:2c62891b1ea3094bb12097822b3d44b93fc6c325f2043c4d2736a8ff09e65f60", size = 5289274, upload-time = "2025-04-23T01:47:15.916Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/47/c4be287c48cdc304483457878a3f22999098b9a95f455e3c4bda7ec7fc72/lxml-5.4.0-cp313-cp313-manylinux_2_28_s390x.whl", hash = "sha256:142accb3e4d1edae4b392bd165a9abdee8a3c432a2cca193df995bc3886249c8", size = 4874757, upload-time = "2025-04-23T01:47:19.793Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/04/6ef935dc74e729932e39478e44d8cfe6a83550552eaa072b7c05f6f22488/lxml-5.4.0-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:1a42b3a19346e5601d1b8296ff6ef3d76038058f311902edd574461e9c036982", size = 4947028, upload-time = "2025-04-23T01:47:22.401Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/f9/c33fc8daa373ef8a7daddb53175289024512b6619bc9de36d77dca3df44b/lxml-5.4.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4291d3c409a17febf817259cb37bc62cb7eb398bcc95c1356947e2871911ae61", size = 4834487, upload-time = "2025-04-23T01:47:25.513Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/30/fc92bb595bcb878311e01b418b57d13900f84c2b94f6eca9e5073ea756e6/lxml-5.4.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4f5322cf38fe0e21c2d73901abf68e6329dc02a4994e483adbcf92b568a09a54", size = 5381688, upload-time = "2025-04-23T01:47:28.454Z" },
-    { url = "https://files.pythonhosted.org/packages/43/d1/3ba7bd978ce28bba8e3da2c2e9d5ae3f8f521ad3f0ca6ea4788d086ba00d/lxml-5.4.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:0be91891bdb06ebe65122aa6bf3fc94489960cf7e03033c6f83a90863b23c58b", size = 5242043, upload-time = "2025-04-23T01:47:31.208Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/cd/95fa2201041a610c4d08ddaf31d43b98ecc4b1d74b1e7245b1abdab443cb/lxml-5.4.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:15a665ad90054a3d4f397bc40f73948d48e36e4c09f9bcffc7d90c87410e478a", size = 5021569, upload-time = "2025-04-23T01:47:33.805Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/a6/31da006fead660b9512d08d23d31e93ad3477dd47cc42e3285f143443176/lxml-5.4.0-cp313-cp313-win32.whl", hash = "sha256:d5663bc1b471c79f5c833cffbc9b87d7bf13f87e055a5c86c363ccd2348d7e82", size = 3485270, upload-time = "2025-04-23T01:47:36.133Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/14/c115516c62a7d2499781d2d3d7215218c0731b2c940753bf9f9b7b73924d/lxml-5.4.0-cp313-cp313-win_amd64.whl", hash = "sha256:bcb7a1096b4b6b24ce1ac24d4942ad98f983cd3810f9711bcd0293f43a9d8b9f", size = 3814606, upload-time = "2025-04-23T01:47:39.028Z" },
+    { url = "https://files.pythonhosted.org/packages/79/21/6e7c060822a3c954ff085e5e1b94b4a25757c06529eac91e550f3f5cd8b8/lxml-6.0.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:6da7cd4f405fd7db56e51e96bff0865b9853ae70df0e6720624049da76bde2da", size = 8414372, upload-time = "2025-06-26T16:26:39.079Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/f6/051b1607a459db670fc3a244fa4f06f101a8adf86cda263d1a56b3a4f9d5/lxml-6.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b34339898bb556a2351a1830f88f751679f343eabf9cf05841c95b165152c9e7", size = 4593940, upload-time = "2025-06-26T16:26:41.891Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/74/dd595d92a40bda3c687d70d4487b2c7eff93fd63b568acd64fedd2ba00fe/lxml-6.0.0-cp313-cp313-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:51a5e4c61a4541bd1cd3ba74766d0c9b6c12d6a1a4964ef60026832aac8e79b3", size = 5214329, upload-time = "2025-06-26T16:26:44.669Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/4b/20555bdd75d57945bdabfbc45fdb1a36a1a0ff9eae4653e951b2b79c9209/lxml-6.0.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9f4b481b6cc3a897adb4279216695150bbe7a44c03daba3c894f49d2037e0a24", size = 5021931, upload-time = "2025-06-26T16:26:47.503Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/dd/39c8507c16db6031f8c1ddf70ed95dbb0a6d466a40002a3522c128aba472/lxml-6.0.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2ae06fbab4f1bb7db4f7c8ca9897dc8db4447d1a2b9bee78474ad403437bcc29", size = 5247467, upload-time = "2025-06-26T16:26:49.998Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/56/732d49def0631ad633844cfb2664563c830173a98d5efd9b172e89a4800d/lxml-6.0.0-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:1fa377b827ca2023244a06554c6e7dc6828a10aaf74ca41965c5d8a4925aebb4", size = 4720601, upload-time = "2025-06-26T16:26:52.564Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/7f/6b956fab95fa73462bca25d1ea7fc8274ddf68fb8e60b78d56c03b65278e/lxml-6.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1676b56d48048a62ef77a250428d1f31f610763636e0784ba67a9740823988ca", size = 5060227, upload-time = "2025-06-26T16:26:55.054Z" },
+    { url = "https://files.pythonhosted.org/packages/97/06/e851ac2924447e8b15a294855caf3d543424364a143c001014d22c8ca94c/lxml-6.0.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:0e32698462aacc5c1cf6bdfebc9c781821b7e74c79f13e5ffc8bfe27c42b1abf", size = 4790637, upload-time = "2025-06-26T16:26:57.384Z" },
+    { url = "https://files.pythonhosted.org/packages/52/03/0e764ce00b95e008d76b99d432f1807f3574fb2945b496a17807a1645dbd/lxml-6.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:7488a43033c958637b1a08cddc9188eb06d3ad36582cebc7d4815980b47e27ef", size = 5272430, upload-time = "2025-06-26T16:27:00.031Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/01/d48cc141bc47bc1644d20fe97bbd5e8afb30415ec94f146f2f76d0d9d098/lxml-6.0.0-cp313-cp313-win32.whl", hash = "sha256:5fcd7d3b1d8ecb91445bd71b9c88bdbeae528fefee4f379895becfc72298d181", size = 3612896, upload-time = "2025-06-26T16:27:04.251Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/87/6456b9541d186ee7d4cb53bf1b9a0d7f3b1068532676940fdd594ac90865/lxml-6.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:2f34687222b78fff795feeb799a7d44eca2477c3d9d3a46ce17d51a4f383e32e", size = 4013132, upload-time = "2025-06-26T16:27:06.415Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/42/85b3aa8f06ca0d24962f8100f001828e1f1f1a38c954c16e71154ed7d53a/lxml-6.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:21db1ec5525780fd07251636eb5f7acb84003e9382c72c18c542a87c416ade03", size = 3672642, upload-time = "2025-06-26T16:27:09.888Z" },
 ]
 
 [[package]]

web/src/elements/table/Table.ts

@@ -478,8 +478,10 @@ export abstract class Table<T> extends WithLicenseSummary(AKElement) implements
     renderSearch(): TemplateResult {
         const runSearch = (value: string) => {
             this.search = value;
+            this.page = 1;
             updateURLParams({
                 search: value,
+                tablePage: 1,
             });
             this.fetch();
         };

web/src/elements/table/TablePage.ts

@@ -3,7 +3,7 @@ import { updateURLParams } from "#elements/router/RouteMatch";
 import { Table } from "#elements/table/Table";
 
 import { msg } from "@lit/localize";
-import { CSSResult } from "lit";
+import { CSSResult, nothing } from "lit";
 import { TemplateResult, html } from "lit";
 import { ifDefined } from "lit/directives/if-defined.js";
 
@@ -45,7 +45,7 @@ export abstract class TablePage<T> extends Table<T> {
                 : html`<ak-empty-state icon=${this.pageIcon()}
                       ><span>${msg("No objects found.")}</span>
                       <div slot="body">
-                          ${this.searchEnabled() ? this.renderEmptyClearSearch() : html``}
+                          ${this.searchEnabled() ? this.renderEmptyClearSearch() : nothing}
                       </div>
                       <div slot="primary">${this.renderObjectCreate()}</div>
                   </ak-empty-state>`}
@@ -61,8 +61,10 @@ export abstract class TablePage<T> extends Table<T> {
                 this.search = "";
                 this.requestUpdate();
                 this.fetch();
+                this.page = 1;
                 updateURLParams({
                     search: "",
+                    tablePage: 1,
                 });
             }}
             class="pf-c-button pf-m-link"

website/docusaurus.config.esm.mjs

@@ -131,6 +131,10 @@ const config = createDocusaurusConfig({
                         ],
                     ],
                 },
+                gtag: {
+                    trackingID: ["G-9MVR9WZFZH"],
+                    anonymizeIP: true,
+                },
                 theme: {
                     customCss: require.resolve("@goauthentik/docusaurus-config/css/index.css"),
                 },

website/integrations/docusaurus.config.esm.mjs

@@ -128,6 +128,10 @@ const config = createDocusaurusConfig({
                         ],
                     ],
                 },
+                gtag: {
+                    trackingID: ["G-9MVR9WZFZH"],
+                    anonymizeIP: true,
+                },
                 theme: {
                     customCss: require.resolve("@goauthentik/docusaurus-config/css/index.css"),
                 },

website/package-lock.json

@@ -21,7 +21,7 @@
                 "@mdx-js/react": "^3.1.0",
                 "clsx": "^2.1.1",
                 "docusaurus-plugin-openapi-docs": "^4.4.0",
-                "docusaurus-theme-openapi-docs": "^4.4.0",
+                "docusaurus-theme-openapi-docs": "^4.5.1",
                 "postcss": "^8.5.6",
                 "prism-react-renderer": "^2.4.1",
                 "react": "^18.3.1",
@@ -41,12 +41,12 @@
                 "@goauthentik/tsconfig": "^1.0.4",
                 "@trivago/prettier-plugin-sort-imports": "^5.2.2",
                 "@types/lodash": "^4.17.19",
-                "@types/node": "^24.0.7",
+                "@types/node": "^24.0.8",
                 "@types/postman-collection": "^3.5.11",
                 "@types/react": "^18.3.22",
                 "@types/semver": "^7.7.0",
-                "@typescript-eslint/eslint-plugin": "^8.35.0",
-                "@typescript-eslint/parser": "^8.35.0",
+                "@typescript-eslint/eslint-plugin": "^8.35.1",
+                "@typescript-eslint/parser": "^8.35.1",
                 "cross-env": "^7.0.3",
                 "eslint": "^9.30.0",
                 "fast-glob": "^3.3.3",
@@ -55,21 +55,21 @@
                 "prettier": "^3.6.2",
                 "prettier-plugin-packagejson": "^2.5.17",
                 "typescript": "^5.8.3",
-                "typescript-eslint": "^8.35.0"
+                "typescript-eslint": "^8.35.1"
             },
             "engines": {
                 "node": ">=22.14.0"
             },
             "optionalDependencies": {
-                "@rspack/binding-darwin-arm64": "1.3.15",
-                "@rspack/binding-linux-arm64-gnu": "1.3.15",
-                "@rspack/binding-linux-x64-gnu": "1.3.15",
-                "@swc/core-darwin-arm64": "1.12.7",
-                "@swc/core-linux-arm64-gnu": "1.12.7",
-                "@swc/core-linux-x64-gnu": "1.12.7",
-                "@swc/html-darwin-arm64": "1.12.7",
-                "@swc/html-linux-arm64-gnu": "1.12.7",
-                "@swc/html-linux-x64-gnu": "1.12.7",
+                "@rspack/binding-darwin-arm64": "1.4.2",
+                "@rspack/binding-linux-arm64-gnu": "1.4.2",
+                "@rspack/binding-linux-x64-gnu": "1.4.2",
+                "@swc/core-darwin-arm64": "1.12.9",
+                "@swc/core-linux-arm64-gnu": "1.12.9",
+                "@swc/core-linux-x64-gnu": "1.12.9",
+                "@swc/html-darwin-arm64": "1.12.9",
+                "@swc/html-linux-arm64-gnu": "1.12.9",
+                "@swc/html-linux-x64-gnu": "1.12.9",
                 "lightningcss-darwin-arm64": "1.30.1",
                 "lightningcss-linux-arm64-gnu": "1.30.1",
                 "lightningcss-linux-x64-gnu": "1.30.1"
@@ -5033,13 +5033,12 @@
             }
         },
         "node_modules/@rspack/binding-darwin-arm64": {
-            "version": "1.3.15",
-            "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-1.3.15.tgz",
-            "integrity": "sha512-f+DnVRENRdVe+ufpZeqTtWAUDSTnP48jVo7x9KWsXf8XyJHUi+eHKEPrFoy1HvL1/k5yJ3HVnFBh1Hb9cNIwSg==",
+            "version": "1.4.2",
+            "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-1.4.2.tgz",
+            "integrity": "sha512-0fPOew7D0l/x6qFZYdyUqutbw15K98VLvES2/7x2LPssTgypE4rVmnQSmVBnge3Nr8Qs/9qASPRpMWXBaqMfOA==",
             "cpu": [
                 "arm64"
             ],
-            "license": "MIT",
             "optional": true,
             "os": [
                 "darwin"
@@ -5060,13 +5059,12 @@
             "peer": true
         },
         "node_modules/@rspack/binding-linux-arm64-gnu": {
-            "version": "1.3.15",
-            "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.3.15.tgz",
-            "integrity": "sha512-D/YjYk9snKvYm1Elotq8/GsEipB4ZJWVv/V8cZ+ohhFNOPzygENi6JfyI06TryBTQiN0/JDZqt/S9RaWBWnMqw==",
+            "version": "1.4.2",
+            "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.4.2.tgz",
+            "integrity": "sha512-UHAzggS8Mc7b3Xguhj82HwujLqBZquCeo8qJj5XreNaMKGb6YRw/91dJOVmkNiLCB0bj71CRE1Cocd+Peq3N9A==",
             "cpu": [
                 "arm64"
             ],
-            "license": "MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -5087,13 +5085,12 @@
             "peer": true
         },
         "node_modules/@rspack/binding-linux-x64-gnu": {
-            "version": "1.3.15",
-            "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.3.15.tgz",
-            "integrity": "sha512-qGB8ucHklrzNg6lsAS36VrBsCbOw0acgpQNqTE5cuHWrp1Pu3GFTRiFEogenxEmzoRbohMZt0Ev5grivrcgKBQ==",
+            "version": "1.4.2",
+            "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.4.2.tgz",
+            "integrity": "sha512-ucCCWdtH1tekZadrsYj6GNJ8EP21BM2uSE7MootbwLw8aBtgVTKUuRDQEps1h/rtrdthzd9XBX6Lc2N926gM+g==",
             "cpu": [
                 "x64"
             ],
-            "license": "MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -5588,13 +5585,12 @@
             }
         },
         "node_modules/@swc/core-darwin-arm64": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.12.7.tgz",
-            "integrity": "sha512-w6BBT0hBRS56yS+LbReVym0h+iB7/PpCddqrn1ha94ra4rZ4R/A91A/rkv+LnQlPqU/+fhqdlXtCJU9mrhCBtA==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.12.9.tgz",
+            "integrity": "sha512-GACFEp4nD6V+TZNR2JwbMZRHB+Yyvp14FrcmB6UCUYmhuNWjkxi+CLnEvdbuiKyQYv0zA+TRpCHZ+whEs6gwfA==",
             "cpu": [
                 "arm64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "darwin"
@@ -5636,13 +5632,12 @@
             }
         },
         "node_modules/@swc/core-linux-arm64-gnu": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.12.7.tgz",
-            "integrity": "sha512-N15hKizSSh+hkZ2x3TDVrxq0TDcbvDbkQJi2ZrLb9fK+NdFUV/x+XF16ZDPlbxtrGXl1CT7VD439SNaMN9F7qw==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.12.9.tgz",
+            "integrity": "sha512-6qx1ka9LHcLzxIgn2Mros+CZLkHK2TawlXzi/h7DJeNnzi8F1Hw0Yzjp8WimxNCg6s2n+o3jnmin1oXB7gg8rw==",
             "cpu": [
                 "arm64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -5668,13 +5663,12 @@
             }
         },
         "node_modules/@swc/core-linux-x64-gnu": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.12.7.tgz",
-            "integrity": "sha512-PR4tPVwU1BQBfFDk2XfzXxsEIjF3x/bOV1BzZpYvrlkU0TKUDbR4t2wzvsYwD/coW7/yoQmlL70/qnuPtTp1Zw==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.12.9.tgz",
+            "integrity": "sha512-SFUxyhWLZRNL8QmgGNqdi2Q43PNyFVkRZ2zIif30SOGFSxnxcf2JNeSeBgKIGVgaLSuk6xFVVCtJ3KIeaStgRg==",
             "cpu": [
                 "x64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -5826,13 +5820,12 @@
             }
         },
         "node_modules/@swc/html-darwin-arm64": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/html-darwin-arm64/-/html-darwin-arm64-1.12.7.tgz",
-            "integrity": "sha512-4rHV4lW8PXSc7YfJ/c9Cj0xZWSJArkD/Yuax4plH6f4VtEcEAluZI3ryBG3Vh4VawQ1RMkytPQ2S65BbCyDIXg==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/html-darwin-arm64/-/html-darwin-arm64-1.12.9.tgz",
+            "integrity": "sha512-uQl0y9uOgqnYR6t+TgcwFeGv1TC48xHGBqw3MrOIQLc+tqavqhQsLkVEEz1yd1J0WW3cVAsNSQlbERiwQcXQXA==",
             "cpu": [
                 "arm64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "darwin"
@@ -5874,13 +5867,12 @@
             }
         },
         "node_modules/@swc/html-linux-arm64-gnu": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/html-linux-arm64-gnu/-/html-linux-arm64-gnu-1.12.7.tgz",
-            "integrity": "sha512-z66ejXsSwI0mKyDhLimG74+xZyvSQCrceSZv9jLHa23sn/di+07M9njZrj3SQKGfHoJqXsN1iPqDpvkVajNb9Q==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/html-linux-arm64-gnu/-/html-linux-arm64-gnu-1.12.9.tgz",
+            "integrity": "sha512-xX/S0galaqXMNc1olt1UOMcHXybDYGogGP90WheI6XD5zKVmbHdz9yU/nVeddZNUf5gZ011NCc5QSMB+2fh8EA==",
             "cpu": [
                 "arm64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -5906,13 +5898,12 @@
             }
         },
         "node_modules/@swc/html-linux-x64-gnu": {
-            "version": "1.12.7",
-            "resolved": "https://registry.npmjs.org/@swc/html-linux-x64-gnu/-/html-linux-x64-gnu-1.12.7.tgz",
-            "integrity": "sha512-5KFLil4ELKzCLjjvKpt+SMEU6uBDR/EL4e7eleybtYi1cU8Jzv0xnTvabsVDfpT8fsvJF3Mvach4F/ggH5+CDQ==",
+            "version": "1.12.9",
+            "resolved": "https://registry.npmjs.org/@swc/html-linux-x64-gnu/-/html-linux-x64-gnu-1.12.9.tgz",
+            "integrity": "sha512-9tRAsVsjjyEUFMH5uNrcLxb+5q0l2PCgTH7pe48hjcshKFoZamp1aiwvNnJMMBan3Ny9vFG5jKMJKG3ZkYPYxg==",
             "cpu": [
                 "x64"
             ],
-            "license": "Apache-2.0 AND MIT",
             "optional": true,
             "os": [
                 "linux"
@@ -6611,9 +6602,9 @@
             "license": "MIT"
         },
         "node_modules/@types/node": {
-            "version": "24.0.7",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.7.tgz",
-            "integrity": "sha512-YIEUUr4yf8q8oQoXPpSlnvKNVKDQlPMWrmOcgzoduo7kvA2UF0/BwJ/eMKFTiTtkNL17I0M6Xe2tvwFU7be6iw==",
+            "version": "24.0.8",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.0.8.tgz",
+            "integrity": "sha512-WytNrFSgWO/esSH9NbpWUfTMGQwCGIKfCmNlmFDNiI5gGhgMmEA+V1AEvKLeBNvvtBnailJtkrEa2OIISwrVAA==",
             "dependencies": {
                 "undici-types": "~7.8.0"
             }
@@ -6826,17 +6817,16 @@
             "license": "MIT"
         },
         "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.35.0.tgz",
-            "integrity": "sha512-ijItUYaiWuce0N1SoSMrEd0b6b6lYkYt99pqCPfybd+HKVXtEvYhICfLdwp42MhiI5mp0oq7PKEL+g1cNiz/Eg==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.35.1.tgz",
+            "integrity": "sha512-9XNTlo7P7RJxbVeICaIIIEipqxLKguyh+3UbXuT2XQuFp6d8VOeDEGuz5IiX0dgZo8CiI6aOFLg4e8cF71SFVg==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
                 "@eslint-community/regexpp": "^4.10.0",
-                "@typescript-eslint/scope-manager": "8.35.0",
-                "@typescript-eslint/type-utils": "8.35.0",
-                "@typescript-eslint/utils": "8.35.0",
-                "@typescript-eslint/visitor-keys": "8.35.0",
+                "@typescript-eslint/scope-manager": "8.35.1",
+                "@typescript-eslint/type-utils": "8.35.1",
+                "@typescript-eslint/utils": "8.35.1",
+                "@typescript-eslint/visitor-keys": "8.35.1",
                 "graphemer": "^1.4.0",
                 "ignore": "^7.0.0",
                 "natural-compare": "^1.4.0",
@@ -6850,7 +6840,7 @@
                 "url": "https://opencollective.com/typescript-eslint"
             },
             "peerDependencies": {
-                "@typescript-eslint/parser": "^8.35.0",
+                "@typescript-eslint/parser": "^8.35.1",
                 "eslint": "^8.57.0 || ^9.0.0",
                 "typescript": ">=4.8.4 <5.9.0"
             }
@@ -6866,16 +6856,15 @@
             }
         },
         "node_modules/@typescript-eslint/parser": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.35.0.tgz",
-            "integrity": "sha512-6sMvZePQrnZH2/cJkwRpkT7DxoAWh+g6+GFRK6bV3YQo7ogi3SX5rgF6099r5Q53Ma5qeT7LGmOmuIutF4t3lA==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.35.1.tgz",
+            "integrity": "sha512-3MyiDfrfLeK06bi/g9DqJxP5pV74LNv4rFTyvGDmT3x2p1yp1lOd+qYZfiRPIOf/oON+WRZR5wxxuF85qOar+w==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/scope-manager": "8.35.0",
-                "@typescript-eslint/types": "8.35.0",
-                "@typescript-eslint/typescript-estree": "8.35.0",
-                "@typescript-eslint/visitor-keys": "8.35.0",
+                "@typescript-eslint/scope-manager": "8.35.1",
+                "@typescript-eslint/types": "8.35.1",
+                "@typescript-eslint/typescript-estree": "8.35.1",
+                "@typescript-eslint/visitor-keys": "8.35.1",
                 "debug": "^4.3.4"
             },
             "engines": {
@@ -6891,14 +6880,13 @@
             }
         },
         "node_modules/@typescript-eslint/project-service": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.35.0.tgz",
-            "integrity": "sha512-41xatqRwWZuhUMF/aZm2fcUsOFKNcG28xqRSS6ZVr9BVJtGExosLAm5A1OxTjRMagx8nJqva+P5zNIGt8RIgbQ==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.35.1.tgz",
+            "integrity": "sha512-VYxn/5LOpVxADAuP3NrnxxHYfzVtQzLKeldIhDhzC8UHaiQvYlXvKuVho1qLduFbJjjy5U5bkGwa3rUGUb1Q6Q==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/tsconfig-utils": "^8.35.0",
-                "@typescript-eslint/types": "^8.35.0",
+                "@typescript-eslint/tsconfig-utils": "^8.35.1",
+                "@typescript-eslint/types": "^8.35.1",
                 "debug": "^4.3.4"
             },
             "engines": {
@@ -6913,14 +6901,13 @@
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.35.0.tgz",
-            "integrity": "sha512-+AgL5+mcoLxl1vGjwNfiWq5fLDZM1TmTPYs2UkyHfFhgERxBbqHlNjRzhThJqz+ktBqTChRYY6zwbMwy0591AA==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.35.1.tgz",
+            "integrity": "sha512-s/Bpd4i7ht2934nG+UoSPlYXd08KYz3bmjLEb7Ye1UVob0d1ENiT3lY8bsCmik4RqfSbPw9xJJHbugpPpP5JUg==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.35.0",
-                "@typescript-eslint/visitor-keys": "8.35.0"
+                "@typescript-eslint/types": "8.35.1",
+                "@typescript-eslint/visitor-keys": "8.35.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -6931,11 +6918,10 @@
             }
         },
         "node_modules/@typescript-eslint/tsconfig-utils": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.35.0.tgz",
-            "integrity": "sha512-04k/7247kZzFraweuEirmvUj+W3bJLI9fX6fbo1Qm2YykuBvEhRTPl8tcxlYO8kZZW+HIXfkZNoasVb8EV4jpA==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.35.1.tgz",
+            "integrity": "sha512-K5/U9VmT9dTHoNowWZpz+/TObS3xqC5h0xAIjXPw+MNcKV9qg6eSatEnmeAwkjHijhACH0/N7bkhKvbt1+DXWQ==",
             "dev": true,
-            "license": "MIT",
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
             },
@@ -6948,14 +6934,13 @@
             }
         },
         "node_modules/@typescript-eslint/type-utils": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.35.0.tgz",
-            "integrity": "sha512-ceNNttjfmSEoM9PW87bWLDEIaLAyR+E6BoYJQ5PfaDau37UGca9Nyq3lBk8Bw2ad0AKvYabz6wxc7DMTO2jnNA==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.35.1.tgz",
+            "integrity": "sha512-HOrUBlfVRz5W2LIKpXzZoy6VTZzMu2n8q9C2V/cFngIC5U1nStJgv0tMV4sZPzdf4wQm9/ToWUFPMN9Vq9VJQQ==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/typescript-estree": "8.35.0",
-                "@typescript-eslint/utils": "8.35.0",
+                "@typescript-eslint/typescript-estree": "8.35.1",
+                "@typescript-eslint/utils": "8.35.1",
                 "debug": "^4.3.4",
                 "ts-api-utils": "^2.1.0"
             },
@@ -6972,11 +6957,10 @@
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.35.0.tgz",
-            "integrity": "sha512-0mYH3emanku0vHw2aRLNGqe7EXh9WHEhi7kZzscrMDf6IIRUQ5Jk4wp1QrledE/36KtdZrVfKnE32eZCf/vaVQ==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.35.1.tgz",
+            "integrity": "sha512-q/O04vVnKHfrrhNAscndAn1tuQhIkwqnaW+eu5waD5IPts2eX1dgJxgqcPx5BX109/qAz7IG6VrEPTOYKCNfRQ==",
             "dev": true,
-            "license": "MIT",
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
             },
@@ -6986,16 +6970,15 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.35.0.tgz",
-            "integrity": "sha512-F+BhnaBemgu1Qf8oHrxyw14wq6vbL8xwWKKMwTMwYIRmFFY/1n/9T/jpbobZL8vp7QyEUcC6xGrnAO4ua8Kp7w==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.35.1.tgz",
+            "integrity": "sha512-Vvpuvj4tBxIka7cPs6Y1uvM7gJgdF5Uu9F+mBJBPY4MhvjrjWGK4H0lVgLJd/8PWZ23FTqsaJaLEkBCFUk8Y9g==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/project-service": "8.35.0",
-                "@typescript-eslint/tsconfig-utils": "8.35.0",
-                "@typescript-eslint/types": "8.35.0",
-                "@typescript-eslint/visitor-keys": "8.35.0",
+                "@typescript-eslint/project-service": "8.35.1",
+                "@typescript-eslint/tsconfig-utils": "8.35.1",
+                "@typescript-eslint/types": "8.35.1",
+                "@typescript-eslint/visitor-keys": "8.35.1",
                 "debug": "^4.3.4",
                 "fast-glob": "^3.3.2",
                 "is-glob": "^4.0.3",
@@ -7019,7 +7002,6 @@
             "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
             "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
                 "balanced-match": "^1.0.0"
             }
@@ -7029,7 +7011,6 @@
             "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
             "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
             "dev": true,
-            "license": "ISC",
             "dependencies": {
                 "brace-expansion": "^2.0.1"
             },
@@ -7041,16 +7022,15 @@
             }
         },
         "node_modules/@typescript-eslint/utils": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.35.0.tgz",
-            "integrity": "sha512-nqoMu7WWM7ki5tPgLVsmPM8CkqtoPUG6xXGeefM5t4x3XumOEKMoUZPdi+7F+/EotukN4R9OWdmDxN80fqoZeg==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.35.1.tgz",
+            "integrity": "sha512-lhnwatFmOFcazAsUm3ZnZFpXSxiwoa1Lj50HphnDe1Et01NF4+hrdXONSUHIcbVu2eFb1bAf+5yjXkGVkXBKAQ==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
                 "@eslint-community/eslint-utils": "^4.7.0",
-                "@typescript-eslint/scope-manager": "8.35.0",
-                "@typescript-eslint/types": "8.35.0",
-                "@typescript-eslint/typescript-estree": "8.35.0"
+                "@typescript-eslint/scope-manager": "8.35.1",
+                "@typescript-eslint/types": "8.35.1",
+                "@typescript-eslint/typescript-estree": "8.35.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -7065,13 +7045,12 @@
             }
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.35.0.tgz",
-            "integrity": "sha512-zTh2+1Y8ZpmeQaQVIc/ZZxsx8UzgKJyNg1PTvjzC7WMhPSVS8bfDX34k1SrwOf016qd5RU3az2UxUNue3IfQ5g==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.35.1.tgz",
+            "integrity": "sha512-VRwixir4zBWCSTP/ljEo091lbpypz57PoeAQ9imjG+vbeof9LplljsL1mos4ccG6H9IjfrVGM359RozUnuFhpw==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.35.0",
+                "@typescript-eslint/types": "8.35.1",
                 "eslint-visitor-keys": "^4.2.1"
             },
             "engines": {
@@ -7087,7 +7066,6 @@
             "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
             "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
             "dev": true,
-            "license": "Apache-2.0",
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
             },
@@ -10711,10 +10689,9 @@
             }
         },
         "node_modules/docusaurus-theme-openapi-docs": {
-            "version": "4.4.0",
-            "resolved": "https://registry.npmjs.org/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-4.4.0.tgz",
-            "integrity": "sha512-wmc2b946rqBcdjgEHi6Up7e8orasYk5RnIUerTfmZ/Hi006I8FIjMnJEmHAF6t5PbFiiYnlkB6vYK0CC5xBnCQ==",
-            "license": "MIT",
+            "version": "4.5.1",
+            "resolved": "https://registry.npmjs.org/docusaurus-theme-openapi-docs/-/docusaurus-theme-openapi-docs-4.5.1.tgz",
+            "integrity": "sha512-C7mYh9JC3l9jjRtqJVu0EIyOgxHB08jE0Tp5NSkNkrrBak4A13SrXCisNjvt1eaNjS+tsz7qD0bT3aI5hsRvWA==",
             "dependencies": {
                 "@hookform/error-message": "^2.0.1",
                 "@reduxjs/toolkit": "^1.7.1",
@@ -26382,15 +26359,14 @@
             }
         },
         "node_modules/typescript-eslint": {
-            "version": "8.35.0",
-            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.35.0.tgz",
-            "integrity": "sha512-uEnz70b7kBz6eg/j0Czy6K5NivaYopgxRjsnAJ2Fx5oTLo3wefTHIbL7AkQr1+7tJCRVpTs/wiM8JR/11Loq9A==",
+            "version": "8.35.1",
+            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.35.1.tgz",
+            "integrity": "sha512-xslJjFzhOmHYQzSB/QTeASAHbjmxOGEP6Coh93TXmUBFQoJ1VU35UHIDmG06Jd6taf3wqqC1ntBnCMeymy5Ovw==",
             "dev": true,
-            "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/eslint-plugin": "8.35.0",
-                "@typescript-eslint/parser": "8.35.0",
-                "@typescript-eslint/utils": "8.35.0"
+                "@typescript-eslint/eslint-plugin": "8.35.1",
+                "@typescript-eslint/parser": "8.35.1",
+                "@typescript-eslint/utils": "8.35.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"

website/package.json

@@ -38,7 +38,7 @@
         "@mdx-js/react": "^3.1.0",
         "clsx": "^2.1.1",
         "docusaurus-plugin-openapi-docs": "^4.4.0",
-        "docusaurus-theme-openapi-docs": "^4.4.0",
+        "docusaurus-theme-openapi-docs": "^4.5.1",
         "postcss": "^8.5.6",
         "prism-react-renderer": "^2.4.1",
         "react": "^18.3.1",
@@ -58,12 +58,12 @@
         "@goauthentik/tsconfig": "^1.0.4",
         "@trivago/prettier-plugin-sort-imports": "^5.2.2",
         "@types/lodash": "^4.17.19",
-        "@types/node": "^24.0.7",
+        "@types/node": "^24.0.8",
         "@types/postman-collection": "^3.5.11",
         "@types/react": "^18.3.22",
         "@types/semver": "^7.7.0",
-        "@typescript-eslint/eslint-plugin": "^8.35.0",
-        "@typescript-eslint/parser": "^8.35.0",
+        "@typescript-eslint/eslint-plugin": "^8.35.1",
+        "@typescript-eslint/parser": "^8.35.1",
         "cross-env": "^7.0.3",
         "eslint": "^9.30.0",
         "fast-glob": "^3.3.3",
@@ -72,18 +72,18 @@
         "prettier": "^3.6.2",
         "prettier-plugin-packagejson": "^2.5.17",
         "typescript": "^5.8.3",
-        "typescript-eslint": "^8.35.0"
+        "typescript-eslint": "^8.35.1"
     },
     "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "1.3.15",
-        "@rspack/binding-linux-arm64-gnu": "1.3.15",
-        "@rspack/binding-linux-x64-gnu": "1.3.15",
-        "@swc/core-darwin-arm64": "1.12.7",
-        "@swc/core-linux-arm64-gnu": "1.12.7",
-        "@swc/core-linux-x64-gnu": "1.12.7",
-        "@swc/html-darwin-arm64": "1.12.7",
-        "@swc/html-linux-arm64-gnu": "1.12.7",
-        "@swc/html-linux-x64-gnu": "1.12.7",
+        "@rspack/binding-darwin-arm64": "1.4.2",
+        "@rspack/binding-linux-arm64-gnu": "1.4.2",
+        "@rspack/binding-linux-x64-gnu": "1.4.2",
+        "@swc/core-darwin-arm64": "1.12.9",
+        "@swc/core-linux-arm64-gnu": "1.12.9",
+        "@swc/core-linux-x64-gnu": "1.12.9",
+        "@swc/html-darwin-arm64": "1.12.9",
+        "@swc/html-linux-arm64-gnu": "1.12.9",
+        "@swc/html-linux-x64-gnu": "1.12.9",
         "lightningcss-darwin-arm64": "1.30.1",
         "lightningcss-linux-arm64-gnu": "1.30.1",
         "lightningcss-linux-x64-gnu": "1.30.1"