Merge branch 'main' into celery-2-dramatiq

Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2025.6.1
+current_version = 2025.6.3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?
@@ -21,6 +21,8 @@ optional_value = final
 
 [bumpversion:file:package.json]
 
+[bumpversion:file:package-lock.json]
+
 [bumpversion:file:docker-compose.yml]
 
 [bumpversion:file:schema.yml]
@@ -31,6 +33,4 @@ optional_value = final
 
 [bumpversion:file:internal/constants/constants.go]
 
-[bumpversion:file:web/src/common/constants.ts]
-
 [bumpversion:file:lifecycle/aws/template.yaml]

.editorconfig

@@ -7,6 +7,9 @@ charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
 
+[*.toml]
+indent_size = 2
+
 [*.html]
 indent_size = 2
 

.github/workflows/_reusable-docker-build-single.yaml

@@ -38,6 +38,8 @@ jobs:
       # Needed for attestation
       id-token: write
       attestations: write
+      # Needed for checkout
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-qemu-action@v3.6.0

.github/workflows/ci-main-daily.yml

@@ -9,14 +9,15 @@ on:
 
 jobs:
   test-container:
+    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         version:
           - docs
+          - version-2025-4
           - version-2025-2
-          - version-2024-12
     steps:
       - uses: actions/checkout@v4
       - run: |

.github/workflows/ci-main.yml

@@ -202,7 +202,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: web/dist
-          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/src/**', 'web/packages/sfe/src/**') }}-b
+          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'package-lock.json', 'web/src/**', 'web/packages/sfe/src/**') }}-b
       - name: prepare web ui
         if: steps.cache-web.outputs.cache-hit != 'true'
         working-directory: web
@@ -247,11 +247,13 @@ jobs:
       # Needed for attestation
       id-token: write
       attestations: write
+      # Needed for checkout
+      contents: read
     needs: ci-core-mark
     uses: ./.github/workflows/_reusable-docker-build.yaml
     secrets: inherit
     with:
-      image_name: ghcr.io/goauthentik/dev-server
+      image_name: ${{ github.repository == 'goauthentik/authentik-internal' && 'ghcr.io/goauthentik/internal-server' || 'ghcr.io/goauthentik/dev-server' }}
       release: false
   pr-comment:
     needs:

.github/workflows/ci-outpost.yml

@@ -59,6 +59,7 @@ jobs:
         with:
           jobs: ${{ toJSON(needs) }}
   build-container:
+    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
     timeout-minutes: 120
     needs:
       - ci-outpost-mark

.github/workflows/ci-website.yml

@@ -41,7 +41,29 @@ jobs:
       - name: test
         working-directory: website/
         run: npm test
+  build:
+    runs-on: ubuntu-latest
+    name: ${{ matrix.job }}
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - build
+          - build:integrations
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: website/package.json
+          cache: "npm"
+          cache-dependency-path: website/package-lock.json
+      - working-directory: website/
+        run: npm ci
+      - name: build
+        working-directory: website/
+        run: npm run ${{ matrix.job }}
   build-container:
+    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload container images to ghcr.io
@@ -94,9 +116,11 @@ jobs:
     needs:
       - lint
       - test
+      - build
       - build-container
     runs-on: ubuntu-latest
     steps:
       - uses: re-actors/alls-green@release/v1
         with:
           jobs: ${{ toJSON(needs) }}
+          allowed-skips: ${{ github.repository == 'goauthentik/authentik-internal' && 'build-container' || '[]' }}

.github/workflows/codeql-analysis.yml

@@ -2,7 +2,7 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [main, "*", next, version*]
+    branches: [main, next, version*]
   pull_request:
     branches: [main]
   schedule:

.github/workflows/repo-mirror-cleanup.yml

@@ -0,0 +1,21 @@
+name: "authentik-repo-mirror-cleanup"
+
+on:
+  workflow_dispatch:
+
+jobs:
+  to_internal:
+    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - if: ${{ env.MIRROR_KEY != '' }}
+        uses: BeryJu/repository-mirroring-action@5cf300935bc2e068f73ea69bcc411a8a997208eb
+        with:
+          target_repo_url: git@github.com:goauthentik/authentik-internal.git
+          ssh_private_key: ${{ secrets.GH_MIRROR_KEY }}
+          args: --tags --force --prune
+        env:
+          MIRROR_KEY: ${{ secrets.GH_MIRROR_KEY }}

.github/workflows/repo-mirror.yml

@@ -11,11 +11,10 @@ jobs:
         with:
           fetch-depth: 0
       - if: ${{ env.MIRROR_KEY != '' }}
-        uses: pixta-dev/repository-mirroring-action@v1
+        uses: BeryJu/repository-mirroring-action@5cf300935bc2e068f73ea69bcc411a8a997208eb
         with:
-          target_repo_url:
-            git@github.com:goauthentik/authentik-internal.git
-          ssh_private_key:
-            ${{ secrets.GH_MIRROR_KEY }}
+          target_repo_url: git@github.com:goauthentik/authentik-internal.git
+          ssh_private_key: ${{ secrets.GH_MIRROR_KEY }}
+          args: --tags --force
         env:
           MIRROR_KEY: ${{ secrets.GH_MIRROR_KEY }}

.github/workflows/translation-extract-compile.yml

@@ -16,6 +16,7 @@ env:
 
 jobs:
   compile:
+    if: ${{ github.repository != 'goauthentik/authentik-internal' }}
     runs-on: ubuntu-latest
     steps:
       - id: generate_token

.gitignore

@@ -100,9 +100,6 @@ ipython_config.py
 # pyenv
 .python-version
 
-# celery beat schedule file
-celerybeat-schedule
-
 # SageMath parsed files
 *.sage.py
 
@@ -166,8 +163,6 @@ dmypy.json
 
 # pyenv
 
-# celery beat schedule file
-
 # SageMath parsed files
 
 # Environments

.vscode/settings.json

@@ -6,13 +6,15 @@
         "!Context scalar",
         "!Enumerate sequence",
         "!Env scalar",
+        "!Env sequence",
         "!Find sequence",
         "!Format sequence",
         "!If sequence",
         "!Index scalar",
         "!KeyOf scalar",
         "!Value scalar",
-        "!AtIndex scalar"
+        "!AtIndex scalar",
+        "!ParseJSON scalar"
     ],
     "typescript.preferences.importModuleSpecifier": "non-relative",
     "typescript.preferences.importModuleSpecifierEnding": "index",

Dockerfile

@@ -75,9 +75,9 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     /bin/sh -c "GEOIPUPDATE_LICENSE_KEY_FILE=/run/secrets/GEOIPUPDATE_LICENSE_KEY /usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
 # Stage 4: Download uv
-FROM ghcr.io/astral-sh/uv:0.7.13 AS uv
+FROM ghcr.io/astral-sh/uv:0.7.17 AS uv
 # Stage 5: Base python image
-FROM ghcr.io/goauthentik/fips-python:3.13.4-slim-bookworm-fips AS python-base
+FROM ghcr.io/goauthentik/fips-python:3.13.5-slim-bookworm-fips AS python-base
 
 ENV VENV_PATH="/ak-root/.venv" \
     PATH="/lifecycle:/ak-root/.venv/bin:$PATH" \
@@ -122,6 +122,7 @@ ENV UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 
 RUN --mount=type=bind,target=pyproject.toml,src=pyproject.toml \
     --mount=type=bind,target=uv.lock,src=uv.lock \
+    --mount=type=bind,target=packages,src=packages \
     --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-install-project --no-dev
 
@@ -167,6 +168,7 @@ COPY ./blueprints /blueprints
 COPY ./lifecycle/ /lifecycle
 COPY ./authentik/sources/kerberos/krb5.conf /etc/krb5.conf
 COPY --from=go-builder /go/authentik /bin/authentik
+COPY ./packages/ /ak-root/packages
 COPY --from=python-deps /ak-root/.venv /ak-root/.venv
 COPY --from=node-builder /work/web/dist/ /web/dist/
 COPY --from=node-builder /work/web/authentik/ /web/authentik/

Makefile

@@ -6,7 +6,7 @@ PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.generate_semver)
-PY_SOURCES = authentik tests scripts lifecycle .github
+PY_SOURCES = authentik packages tests scripts lifecycle .github
 DOCKER_IMAGE ?= "authentik:test"
 
 GEN_API_TS = gen-ts-api
@@ -86,6 +86,10 @@ dev-create-db:
 
 dev-reset: dev-drop-db dev-create-db migrate  ## Drop and restore the Authentik PostgreSQL instance to a "fresh install" state.
 
+update-test-mmdb:  ## Update test GeoIP and ASN Databases
+	curl -L https://raw.githubusercontent.com/maxmind/MaxMind-DB/refs/heads/main/test-data/GeoLite2-ASN-Test.mmdb -o ${PWD}/tests/GeoLite2-ASN-Test.mmdb
+	curl -L https://raw.githubusercontent.com/maxmind/MaxMind-DB/refs/heads/main/test-data/GeoLite2-City-Test.mmdb -o ${PWD}/tests/GeoLite2-City-Test.mmdb
+
 #########################
 ## API Schema
 #########################
@@ -94,7 +98,7 @@ gen-build:  ## Extract the schema from the database
 	AUTHENTIK_DEBUG=true \
 		AUTHENTIK_TENANTS__ENABLED=true \
 		AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true \
-		uv run ak make_blueprint_schema > blueprints/schema.json
+		uv run ak make_blueprint_schema --file blueprints/schema.json
 	AUTHENTIK_DEBUG=true \
 		AUTHENTIK_TENANTS__ENABLED=true \
 		AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true \
@@ -146,9 +150,9 @@ gen-client-ts: gen-clean-ts  ## Build and install the authentik API for Typescri
 		--additional-properties=npmVersion=${NPM_VERSION} \
 		--git-repo-id authentik \
 		--git-user-id goauthentik
-	mkdir -p web/node_modules/@goauthentik/api
-	cd ${PWD}/${GEN_API_TS} && npm i
-	\cp -rf ${PWD}/${GEN_API_TS}/* web/node_modules/@goauthentik/api
+
+	cd ${PWD}/${GEN_API_TS} && npm link
+	cd ${PWD}/web && npm link @goauthentik/api
 
 gen-client-py: gen-clean-py ## Build and install the authentik API for Python
 	docker run \

authentik/__init__.py

@@ -2,7 +2,7 @@
 
 from os import environ
 
-__version__ = "2025.6.1"
+__version__ = "2025.6.3"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/version.py

@@ -41,7 +41,7 @@ class VersionSerializer(PassiveSerializer):
             return __version__
         version_in_cache = cache.get(VERSION_CACHE_KEY)
         if not version_in_cache:  # pragma: no cover
-            update_latest_version.delay()
+            update_latest_version.send()
             return __version__
         return version_in_cache
 

authentik/admin/api/workers.py

@@ -1,57 +0,0 @@
-"""authentik administration overview"""
-
-from socket import gethostname
-
-from django.conf import settings
-from drf_spectacular.utils import extend_schema, inline_serializer
-from packaging.version import parse
-from rest_framework.fields import BooleanField, CharField
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-
-from authentik import get_full_version
-from authentik.rbac.permissions import HasPermission
-from authentik.root.celery import CELERY_APP
-
-
-class WorkerView(APIView):
-    """Get currently connected worker count."""
-
-    permission_classes = [HasPermission("authentik_rbac.view_system_info")]
-
-    @extend_schema(
-        responses=inline_serializer(
-            "Worker",
-            fields={
-                "worker_id": CharField(),
-                "version": CharField(),
-                "version_matching": BooleanField(),
-            },
-            many=True,
-        )
-    )
-    def get(self, request: Request) -> Response:
-        """Get currently connected worker count."""
-        raw: list[dict[str, dict]] = CELERY_APP.control.ping(timeout=0.5)
-        our_version = parse(get_full_version())
-        response = []
-        for worker in raw:
-            key = list(worker.keys())[0]
-            version = worker[key].get("version")
-            version_matching = False
-            if version:
-                version_matching = parse(version) == our_version
-            response.append(
-                {"worker_id": key, "version": version, "version_matching": version_matching}
-            )
-        # In debug we run with `task_always_eager`, so tasks are ran on the main process
-        if settings.DEBUG:  # pragma: no cover
-            response.append(
-                {
-                    "worker_id": f"authentik-debug@{gethostname()}",
-                    "version": get_full_version(),
-                    "version_matching": True,
-                }
-            )
-        return Response(response)

authentik/admin/apps.py

@@ -3,6 +3,9 @@
 from prometheus_client import Info
 
 from authentik.blueprints.apps import ManagedAppConfig
+from authentik.lib.config import CONFIG
+from authentik.lib.utils.time import fqdn_rand
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 PROM_INFO = Info("authentik_version", "Currently running authentik version")
 
@@ -30,3 +33,15 @@ class AuthentikAdminConfig(ManagedAppConfig):
             notification_version = notification.event.context["new_version"]
             if LOCAL_VERSION >= parse(notification_version):
                 notification.delete()
+
+    @property
+    def global_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.admin.tasks import update_latest_version
+
+        return [
+            ScheduleSpec(
+                actor=update_latest_version,
+                crontab=f"{fqdn_rand('admin_latest_version')} * * * *",
+                paused=CONFIG.get_bool("disable_update_check"),
+            ),
+        ]

authentik/admin/settings.py

@@ -1,15 +0,0 @@
-"""authentik admin settings"""
-
-from celery.schedules import crontab
-from django_tenants.utils import get_public_schema_name
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "admin_latest_version": {
-        "task": "authentik.admin.tasks.update_latest_version",
-        "schedule": crontab(minute=fqdn_rand("admin_latest_version"), hour="*"),
-        "tenant_schemas": [get_public_schema_name()],
-        "options": {"queue": "authentik_scheduled"},
-    }
-}

authentik/admin/signals.py

@@ -1,35 +0,0 @@
-"""admin signals"""
-
-from django.dispatch import receiver
-from packaging.version import parse
-from prometheus_client import Gauge
-
-from authentik import get_full_version
-from authentik.root.celery import CELERY_APP
-from authentik.root.monitoring import monitoring_set
-
-GAUGE_WORKERS = Gauge(
-    "authentik_admin_workers",
-    "Currently connected workers, their versions and if they are the same version as authentik",
-    ["version", "version_matched"],
-)
-
-
-_version = parse(get_full_version())
-
-
-@receiver(monitoring_set)
-def monitoring_set_workers(sender, **kwargs):
-    """Set worker gauge"""
-    raw: list[dict[str, dict]] = CELERY_APP.control.ping(timeout=0.5)
-    worker_version_count = {}
-    for worker in raw:
-        key = list(worker.keys())[0]
-        version = worker[key].get("version")
-        version_matching = False
-        if version:
-            version_matching = parse(version) == _version
-        worker_version_count.setdefault(version, {"count": 0, "matching": version_matching})
-        worker_version_count[version]["count"] += 1
-    for version, stats in worker_version_count.items():
-        GAUGE_WORKERS.labels(version, stats["matching"]).set(stats["count"])

authentik/admin/tasks.py

@@ -2,6 +2,8 @@
 
 from django.core.cache import cache
 from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask
+from dramatiq import actor
 from packaging.version import parse
 from requests import RequestException
 from structlog.stdlib import get_logger
@@ -9,10 +11,9 @@ from structlog.stdlib import get_logger
 from authentik import __version__, get_build_hash
 from authentik.admin.apps import PROM_INFO
 from authentik.events.models import Event, EventAction
-from authentik.events.system_tasks import SystemTask, TaskStatus, prefill_task
 from authentik.lib.config import CONFIG
 from authentik.lib.utils.http import get_http_session
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
 
 LOGGER = get_logger()
 VERSION_NULL = "0.0.0"
@@ -32,13 +33,12 @@ def _set_prom_info():
     )
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def update_latest_version(self: SystemTask):
-    """Update latest version info"""
+@actor(description=_("Update latest version info."))
+def update_latest_version():
+    self: Task = CurrentTask.get_task()
     if CONFIG.get_bool("disable_update_check"):
         cache.set(VERSION_CACHE_KEY, VERSION_NULL, VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskStatus.WARNING, "Version check disabled.")
+        self.info("Version check disabled.")
         return
     try:
         response = get_http_session().get(
@@ -48,7 +48,7 @@ def update_latest_version(self: SystemTask):
         data = response.json()
         upstream_version = data.get("stable", {}).get("version")
         cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskStatus.SUCCESSFUL, "Successfully updated latest Version")
+        self.info("Successfully updated latest Version")
         _set_prom_info()
         # Check if upstream version is newer than what we're running,
         # and if no event exists yet, create one.
@@ -71,7 +71,7 @@ def update_latest_version(self: SystemTask):
             ).save()
     except (RequestException, IndexError) as exc:
         cache.set(VERSION_CACHE_KEY, VERSION_NULL, VERSION_CACHE_TIMEOUT)
-        self.set_error(exc)
+        raise exc
 
 
 _set_prom_info()

authentik/admin/tests/test_api.py

@@ -29,13 +29,6 @@ class TestAdminAPI(TestCase):
         body = loads(response.content)
         self.assertEqual(body["version_current"], __version__)
 
-    def test_workers(self):
-        """Test Workers API"""
-        response = self.client.get(reverse("authentik_api:admin_workers"))
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content)
-        self.assertEqual(len(body), 0)
-
     def test_apps(self):
         """Test apps API"""
         response = self.client.get(reverse("authentik_api:apps-list"))

authentik/admin/tests/test_tasks.py

@@ -30,7 +30,7 @@ class TestAdminTasks(TestCase):
         """Test Update checker with valid response"""
         with Mocker() as mocker, CONFIG.patch("disable_update_check", False):
             mocker.get("https://version.goauthentik.io/version.json", json=RESPONSE_VALID)
-            update_latest_version.delay().get()
+            update_latest_version.send()
             self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
             self.assertTrue(
                 Event.objects.filter(
@@ -40,7 +40,7 @@ class TestAdminTasks(TestCase):
                 ).exists()
             )
             # test that a consecutive check doesn't create a duplicate event
-            update_latest_version.delay().get()
+            update_latest_version.send()
             self.assertEqual(
                 len(
                     Event.objects.filter(
@@ -56,7 +56,7 @@ class TestAdminTasks(TestCase):
         """Test Update checker with invalid response"""
         with Mocker() as mocker:
             mocker.get("https://version.goauthentik.io/version.json", status_code=400)
-            update_latest_version.delay().get()
+            update_latest_version.send()
             self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
             self.assertFalse(
                 Event.objects.filter(
@@ -67,14 +67,15 @@ class TestAdminTasks(TestCase):
     def test_version_disabled(self):
         """Test Update checker while its disabled"""
         with CONFIG.patch("disable_update_check", True):
-            update_latest_version.delay().get()
+            update_latest_version.send()
             self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
 
     def test_clear_update_notifications(self):
         """Test clear of previous notification"""
         admin_config = apps.get_app_config("authentik_admin")
         Event.objects.create(
-            action=EventAction.UPDATE_AVAILABLE, context={"new_version": "99999999.9999999.9999999"}
+            action=EventAction.UPDATE_AVAILABLE,
+            context={"new_version": "99999999.9999999.9999999"},
         )
         Event.objects.create(action=EventAction.UPDATE_AVAILABLE, context={"new_version": "1.1.1"})
         Event.objects.create(action=EventAction.UPDATE_AVAILABLE, context={})

authentik/admin/urls.py

@@ -6,13 +6,11 @@ from authentik.admin.api.meta import AppsViewSet, ModelViewSet
 from authentik.admin.api.system import SystemView
 from authentik.admin.api.version import VersionView
 from authentik.admin.api.version_history import VersionHistoryViewSet
-from authentik.admin.api.workers import WorkerView
 
 api_urlpatterns = [
     ("admin/apps", AppsViewSet, "apps"),
     ("admin/models", ModelViewSet, "models"),
     path("admin/version/", VersionView.as_view(), name="admin_version"),
     ("admin/version/history", VersionHistoryViewSet, "version_history"),
-    path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
     path("admin/system/", SystemView.as_view(), name="admin_system"),
 ]

authentik/blueprints/api.py

@@ -39,7 +39,7 @@ class BlueprintInstanceSerializer(ModelSerializer):
         """Ensure the path (if set) specified is retrievable"""
         if path == "" or path.startswith(OCI_PREFIX):
             return path
-        files: list[dict] = blueprints_find_dict.delay().get()
+        files: list[dict] = blueprints_find_dict.send().get_result(block=True)
         if path not in [file["path"] for file in files]:
             raise ValidationError(_("Blueprint file does not exist"))
         return path
@@ -115,7 +115,7 @@ class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
     @action(detail=False, pagination_class=None, filter_backends=[])
     def available(self, request: Request) -> Response:
         """Get blueprints"""
-        files: list[dict] = blueprints_find_dict.delay().get()
+        files: list[dict] = blueprints_find_dict.send().get_result(block=True)
         return Response(files)
 
     @permission_required("authentik_blueprints.view_blueprintinstance")
@@ -129,5 +129,5 @@ class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
     def apply(self, request: Request, *args, **kwargs) -> Response:
         """Apply a blueprint"""
         blueprint = self.get_object()
-        apply_blueprint.delay(str(blueprint.pk)).get()
+        apply_blueprint.send_with_options(args=(blueprint.pk,), rel_obj=blueprint)
         return self.retrieve(request, *args, **kwargs)

authentik/blueprints/apps.py

@@ -6,9 +6,12 @@ from inspect import ismethod
 
 from django.apps import AppConfig
 from django.db import DatabaseError, InternalError, ProgrammingError
+from dramatiq.broker import get_broker
 from structlog.stdlib import BoundLogger, get_logger
 
+from authentik.lib.utils.time import fqdn_rand
 from authentik.root.signals import startup
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 
 class ManagedAppConfig(AppConfig):
@@ -34,7 +37,7 @@ class ManagedAppConfig(AppConfig):
 
     def import_related(self):
         """Automatically import related modules which rely on just being imported
-        to register themselves (mainly django signals and celery tasks)"""
+        to register themselves (mainly django signals and tasks)"""
 
         def import_relative(rel_module: str):
             try:
@@ -80,6 +83,16 @@ class ManagedAppConfig(AppConfig):
         func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_GLOBAL_CATEGORY
         return func
 
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        """Get a list of schedule specs that must exist in each tenant"""
+        return []
+
+    @property
+    def global_schedule_specs(self) -> list[ScheduleSpec]:
+        """Get a list of schedule specs that must exist in the default tenant"""
+        return []
+
     def _reconcile_tenant(self) -> None:
         """reconcile ourselves for tenanted methods"""
         from authentik.tenants.models import Tenant
@@ -100,8 +113,12 @@ class ManagedAppConfig(AppConfig):
         """
         from django_tenants.utils import get_public_schema_name, schema_context
 
-        with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
+        try:
+            with schema_context(get_public_schema_name()):
+                self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
+        except (DatabaseError, ProgrammingError, InternalError) as exc:
+            self.logger.debug("Failed to access database to run reconcile", exc=exc)
+            return
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -112,19 +129,29 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def load_blueprints_v1_tasks(self):
-        """Load v1 tasks"""
-        self.import_module("authentik.blueprints.v1.tasks")
-
-    @ManagedAppConfig.reconcile_tenant
-    def blueprints_discovery(self):
-        """Run blueprint discovery"""
-        from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
-
-        blueprints_discovery.delay()
-        clear_failed_blueprints.delay()
-
     def import_models(self):
         super().import_models()
         self.import_module("authentik.blueprints.v1.meta.apply_blueprint")
+
+    @ManagedAppConfig.reconcile_global
+    def tasks_middlewares(self):
+        from authentik.blueprints.v1.tasks import BlueprintWatcherMiddleware
+
+        get_broker().add_middleware(BlueprintWatcherMiddleware())
+
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
+
+        return [
+            ScheduleSpec(
+                actor=blueprints_discovery,
+                crontab=f"{fqdn_rand('blueprints_v1_discover')} * * * *",
+                send_on_startup=True,
+            ),
+            ScheduleSpec(
+                actor=clear_failed_blueprints,
+                crontab=f"{fqdn_rand('blueprints_v1_cleanup')} * * * *",
+                send_on_startup=True,
+            ),
+        ]

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -72,20 +72,33 @@ class Command(BaseCommand):
                     "additionalProperties": True,
                 },
                 "entries": {
-                    "type": "array",
-                    "items": {
-                        "oneOf": [],
-                    },
+                    "anyOf": [
+                        {
+                            "type": "array",
+                            "items": {"$ref": "#/$defs/blueprint_entry"},
+                        },
+                        {
+                            "type": "object",
+                            "additionalProperties": {
+                                "type": "array",
+                                "items": {"$ref": "#/$defs/blueprint_entry"},
+                            },
+                        },
+                    ],
                 },
             },
-            "$defs": {},
+            "$defs": {"blueprint_entry": {"oneOf": []}},
         }
 
+    def add_arguments(self, parser):
+        parser.add_argument("--file", type=str)
+
     @no_translations
-    def handle(self, *args, **options):
+    def handle(self, *args, file: str, **options):
         """Generate JSON Schema for blueprints"""
         self.build()
-        self.stdout.write(dumps(self.schema, indent=4, default=Command.json_default))
+        with open(file, "w") as _schema:
+            _schema.write(dumps(self.schema, indent=4, default=Command.json_default))
 
     @staticmethod
     def json_default(value: Any) -> Any:
@@ -112,7 +125,7 @@ class Command(BaseCommand):
                 }
             )
             model_path = f"{model._meta.app_label}.{model._meta.model_name}"
-            self.schema["properties"]["entries"]["items"]["oneOf"].append(
+            self.schema["$defs"]["blueprint_entry"]["oneOf"].append(
                 self.template_entry(model_path, model, serializer)
             )
 

authentik/blueprints/models.py

@@ -3,6 +3,7 @@
 from pathlib import Path
 from uuid import uuid4
 
+from django.contrib.contenttypes.fields import GenericRelation
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 from django.utils.translation import gettext_lazy as _
@@ -71,6 +72,13 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
+    # Manual link to tasks instead of using TasksModel because of loop imports
+    tasks = GenericRelation(
+        "authentik_tasks.Task",
+        content_type_field="rel_obj_content_type",
+        object_id_field="rel_obj_id",
+    )
+
     class Meta:
         verbose_name = _("Blueprint Instance")
         verbose_name_plural = _("Blueprint Instances")

authentik/blueprints/settings.py

@@ -1,18 +0,0 @@
-"""blueprint Settings"""
-
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "blueprints_v1_discover": {
-        "task": "authentik.blueprints.v1.tasks.blueprints_discovery",
-        "schedule": crontab(minute=fqdn_rand("blueprints_v1_discover"), hour="*"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-    "blueprints_v1_cleanup": {
-        "task": "authentik.blueprints.v1.tasks.clear_failed_blueprints",
-        "schedule": crontab(minute=fqdn_rand("blueprints_v1_cleanup"), hour="*"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-}

authentik/blueprints/tasks.py

@@ -0,0 +1,2 @@
+# Import all v1 tasks for auto task discovery
+from authentik.blueprints.v1.tasks import *  # noqa: F403

authentik/blueprints/tests/fixtures/state_present.yaml

@@ -1,10 +1,11 @@
 version: 1
 entries:
-    - identifiers:
-          name: "%(id)s"
-          slug: "%(id)s"
-      model: authentik_flows.flow
-      state: present
-      attrs:
-          designation: stage_configuration
-          title: foo
+  foo:
+      - identifiers:
+            name: "%(id)s"
+            slug: "%(id)s"
+        model: authentik_flows.flow
+        state: present
+        attrs:
+            designation: stage_configuration
+            title: foo

authentik/blueprints/tests/fixtures/tags.yaml

@@ -37,6 +37,7 @@ entries:
     - attrs:
           attributes:
               env_null: !Env [bar-baz, null]
+              json_parse: !ParseJSON '{"foo": "bar"}'
               policy_pk1:
                   !Format [
                       "%s-%s",

authentik/blueprints/tests/test_packaged.py

@@ -35,6 +35,6 @@ def blueprint_tester(file_name: Path) -> Callable:
 
 
 for blueprint_file in Path("blueprints/").glob("**/*.yaml"):
-    if "local" in str(blueprint_file):
+    if "local" in str(blueprint_file) or "testing" in str(blueprint_file):
         continue
     setattr(TestPackaged, f"test_blueprint_{blueprint_file}", blueprint_tester(blueprint_file))

authentik/blueprints/tests/test_serializer_models.py

@@ -5,7 +5,6 @@ from collections.abc import Callable
 from django.apps import apps
 from django.test import TestCase
 
-from authentik.blueprints.v1.importer import is_model_allowed
 from authentik.lib.models import SerializerModel
 from authentik.providers.oauth2.models import RefreshToken
 
@@ -22,10 +21,13 @@ def serializer_tester_factory(test_model: type[SerializerModel]) -> Callable:
             return
         model_class = test_model()
         self.assertTrue(isinstance(model_class, SerializerModel))
+        # Models that have subclasses don't have to have a serializer
+        if len(test_model.__subclasses__()) > 0:
+            return
         self.assertIsNotNone(model_class.serializer)
         if model_class.serializer.Meta().model == RefreshToken:
             return
-        self.assertEqual(model_class.serializer.Meta().model, test_model)
+        self.assertTrue(issubclass(test_model, model_class.serializer.Meta().model))
 
     return tester
 
@@ -34,6 +36,6 @@ for app in apps.get_app_configs():
     if not app.label.startswith("authentik"):
         continue
     for model in app.get_models():
-        if not is_model_allowed(model):
+        if not issubclass(model, SerializerModel):
             continue
         setattr(TestModels, f"test_{app.label}_{model.__name__}", serializer_tester_factory(model))

authentik/blueprints/tests/test_v1.py

@@ -215,6 +215,7 @@ class TestBlueprintsV1(TransactionTestCase):
                     },
                     "nested_context": "context-nested-value",
                     "env_null": None,
+                    "json_parse": {"foo": "bar"},
                     "at_index_sequence": "foo",
                     "at_index_sequence_default": "non existent",
                     "at_index_mapping": 2,

authentik/blueprints/tests/test_v1_tasks.py

@@ -54,7 +54,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
             file.seek(0)
             file_hash = sha512(file.read().encode()).hexdigest()
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery.send()
             instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
             self.assertEqual(instance.last_applied_hash, file_hash)
             self.assertEqual(
@@ -82,7 +82,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery.send()
             blueprint = BlueprintInstance.objects.filter(name="foo").first()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -107,7 +107,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery.send()
             blueprint.refresh_from_db()
             self.assertEqual(
                 blueprint.last_applied_hash,

authentik/blueprints/v1/common.py

@@ -6,6 +6,7 @@ from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
 from functools import reduce
+from json import JSONDecodeError, loads
 from operator import ixor
 from os import getenv
 from typing import Any, Literal, Union
@@ -191,11 +192,18 @@ class Blueprint:
     """Dataclass used for a full export"""
 
     version: int = field(default=1)
-    entries: list[BlueprintEntry] = field(default_factory=list)
+    entries: list[BlueprintEntry] | dict[str, list[BlueprintEntry]] = field(default_factory=list)
     context: dict = field(default_factory=dict)
 
     metadata: BlueprintMetadata | None = field(default=None)
 
+    def iter_entries(self) -> Iterable[BlueprintEntry]:
+        if isinstance(self.entries, dict):
+            for _section, entries in self.entries.items():
+                yield from entries
+        else:
+            yield from self.entries
+
 
 class YAMLTag:
     """Base class for all YAML Tags"""
@@ -226,7 +234,7 @@ class KeyOf(YAMLTag):
         self.id_from = node.value
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
-        for _entry in blueprint.entries:
+        for _entry in blueprint.iter_entries():
             if _entry.id == self.id_from and _entry._state.instance:
                 # Special handling for PolicyBindingModels, as they'll have a different PK
                 # which is used when creating policy bindings
@@ -284,6 +292,22 @@ class Context(YAMLTag):
         return value
 
 
+class ParseJSON(YAMLTag):
+    """Parse JSON from context/env/etc value"""
+
+    raw: str
+
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
+        super().__init__()
+        self.raw = node.value
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        try:
+            return loads(self.raw)
+        except JSONDecodeError as exc:
+            raise EntryInvalidError.from_entry(exc, entry) from exc
+
+
 class Format(YAMLTag):
     """Format a string"""
 
@@ -659,6 +683,7 @@ class BlueprintLoader(SafeLoader):
         self.add_constructor("!Value", Value)
         self.add_constructor("!Index", Index)
         self.add_constructor("!AtIndex", AtIndex)
+        self.add_constructor("!ParseJSON", ParseJSON)
 
 
 class EntryInvalidError(SentryIgnoredException):

authentik/blueprints/v1/importer.py

@@ -57,7 +57,6 @@ from authentik.enterprise.stages.authenticator_endpoint_gdtc.models import (
     EndpointDeviceConnection,
 )
 from authentik.events.logs import LogEvent, capture_logs
-from authentik.events.models import SystemTask
 from authentik.events.utils import cleanse_dict
 from authentik.flows.models import FlowToken, Stage
 from authentik.lib.models import SerializerModel
@@ -77,6 +76,7 @@ from authentik.providers.scim.models import SCIMProviderGroup, SCIMProviderUser
 from authentik.rbac.models import Role
 from authentik.sources.scim.models import SCIMSourceGroup, SCIMSourceUser
 from authentik.stages.authenticator_webauthn.models import WebAuthnDeviceType
+from authentik.tasks.models import Task
 from authentik.tenants.models import Tenant
 
 # Context set when the serializer is created in a blueprint context
@@ -118,7 +118,7 @@ def excluded_models() -> list[type[Model]]:
         SCIMProviderGroup,
         SCIMProviderUser,
         Tenant,
-        SystemTask,
+        Task,
         ConnectionToken,
         AuthorizationCode,
         AccessToken,
@@ -384,7 +384,7 @@ class Importer:
     def _apply_models(self, raise_errors=False) -> bool:
         """Apply (create/update) models yaml"""
         self.__pk_map = {}
-        for entry in self._import.entries:
+        for entry in self._import.iter_entries():
             model_app_label, model_name = entry.get_model(self._import).split(".")
             try:
                 model: type[SerializerModel] = registry.get_model(model_app_label, model_name)

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -44,7 +44,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
             return MetaResult()
         LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
 
-        apply_blueprint(str(self.blueprint_instance.pk))
+        apply_blueprint(self.blueprint_instance.pk)
         return MetaResult()
 
 

authentik/blueprints/v1/tasks.py

@@ -4,12 +4,17 @@ from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
 from sys import platform
+from uuid import UUID
 
 from dacite.core import from_dict
+from django.conf import settings
 from django.db import DatabaseError, InternalError, ProgrammingError
 from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask, CurrentTaskNotFound
+from dramatiq.actor import actor
+from dramatiq.middleware import Middleware
 from structlog.stdlib import get_logger
 from watchdog.events import (
     FileCreatedEvent,
@@ -31,15 +36,13 @@ from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_INSTANTIATE
 from authentik.blueprints.v1.oci import OCI_PREFIX
 from authentik.events.logs import capture_logs
-from authentik.events.models import TaskStatus
-from authentik.events.system_tasks import SystemTask, prefill_task
 from authentik.events.utils import sanitize_dict
 from authentik.lib.config import CONFIG
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
+from authentik.tasks.schedules.models import Schedule
 from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
-_file_watcher_started = False
 
 
 @dataclass
@@ -53,22 +56,21 @@ class BlueprintFile:
     meta: BlueprintMetadata | None = field(default=None)
 
 
-def start_blueprint_watcher():
-    """Start blueprint watcher, if it's not running already."""
-    # This function might be called twice since it's called on celery startup
+class BlueprintWatcherMiddleware(Middleware):
+    def start_blueprint_watcher(self):
+        """Start blueprint watcher"""
+        observer = Observer()
+        kwargs = {}
+        if platform.startswith("linux"):
+            kwargs["event_filter"] = (FileCreatedEvent, FileModifiedEvent)
+        observer.schedule(
+            BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True, **kwargs
+        )
+        observer.start()
 
-    global _file_watcher_started  # noqa: PLW0603
-    if _file_watcher_started:
-        return
-    observer = Observer()
-    kwargs = {}
-    if platform.startswith("linux"):
-        kwargs["event_filter"] = (FileCreatedEvent, FileModifiedEvent)
-    observer.schedule(
-        BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True, **kwargs
-    )
-    observer.start()
-    _file_watcher_started = True
+    def after_worker_boot(self, broker, worker):
+        if not settings.TEST:
+            self.start_blueprint_watcher()
 
 
 class BlueprintEventHandler(FileSystemEventHandler):
@@ -92,7 +94,7 @@ class BlueprintEventHandler(FileSystemEventHandler):
         LOGGER.debug("new blueprint file created, starting discovery")
         for tenant in Tenant.objects.filter(ready=True):
             with tenant:
-                blueprints_discovery.delay()
+                Schedule.dispatch_by_actor(blueprints_discovery)
 
     def on_modified(self, event: FileSystemEvent):
         """Process file modification"""
@@ -103,14 +105,14 @@ class BlueprintEventHandler(FileSystemEventHandler):
             with tenant:
                 for instance in BlueprintInstance.objects.filter(path=rel_path, enabled=True):
                     LOGGER.debug("modified blueprint file, starting apply", instance=instance)
-                    apply_blueprint.delay(instance.pk.hex)
+                    apply_blueprint.send_with_options(args=(instance.pk,), rel_obj=instance)
 
 
-@CELERY_APP.task(
+@actor(
+    description=_("Find blueprints as `blueprints_find` does, but return a safe dict."),
     throws=(DatabaseError, ProgrammingError, InternalError),
 )
 def blueprints_find_dict():
-    """Find blueprints as `blueprints_find` does, but return a safe dict"""
     blueprints = []
     for blueprint in blueprints_find():
         blueprints.append(sanitize_dict(asdict(blueprint)))
@@ -146,21 +148,19 @@ def blueprints_find() -> list[BlueprintFile]:
     return blueprints
 
 
-@CELERY_APP.task(
-    throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
+@actor(
+    description=_("Find blueprints and check if they need to be created in the database."),
+    throws=(DatabaseError, ProgrammingError, InternalError),
 )
-@prefill_task
-def blueprints_discovery(self: SystemTask, path: str | None = None):
-    """Find blueprints and check if they need to be created in the database"""
+def blueprints_discovery(path: str | None = None):
+    self: Task = CurrentTask.get_task()
     count = 0
     for blueprint in blueprints_find():
         if path and blueprint.path != path:
             continue
         check_blueprint_v1_file(blueprint)
         count += 1
-    self.set_status(
-        TaskStatus.SUCCESSFUL, _("Successfully imported {count} files.".format(count=count))
-    )
+    self.info(f"Successfully imported {count} files.")
 
 
 def check_blueprint_v1_file(blueprint: BlueprintFile):
@@ -187,22 +187,26 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
         )
     if instance.last_applied_hash != blueprint.hash:
         LOGGER.info("Applying blueprint due to changed file", instance=instance, path=instance.path)
-        apply_blueprint.delay(str(instance.pk))
+        apply_blueprint.send_with_options(args=(instance.pk,), rel_obj=instance)
 
 
-@CELERY_APP.task(
-    bind=True,
-    base=SystemTask,
-)
-def apply_blueprint(self: SystemTask, instance_pk: str):
-    """Apply single blueprint"""
-    self.save_on_success = False
+@actor(description=_("Apply single blueprint."))
+def apply_blueprint(instance_pk: UUID):
+    try:
+        self: Task = CurrentTask.get_task()
+    except CurrentTaskNotFound:
+        self = Task()
+    self.set_uid(str(instance_pk))
     instance: BlueprintInstance | None = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
-        if not instance or not instance.enabled:
+        if not instance:
+            self.warning(f"Could not find blueprint {instance_pk}, skipping")
             return
         self.set_uid(slugify(instance.name))
+        if not instance.enabled:
+            self.info(f"Blueprint {instance.name} is disabled, skipping")
+            return
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
         importer = Importer.from_string(blueprint_content, instance.context)
@@ -212,19 +216,18 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         if not valid:
             instance.status = BlueprintInstanceStatus.ERROR
             instance.save()
-            self.set_status(TaskStatus.ERROR, *logs)
+            self.logs(logs)
             return
         with capture_logs() as logs:
             applied = importer.apply()
             if not applied:
                 instance.status = BlueprintInstanceStatus.ERROR
                 instance.save()
-                self.set_status(TaskStatus.ERROR, *logs)
+                self.logs(logs)
                 return
         instance.status = BlueprintInstanceStatus.SUCCESSFUL
         instance.last_applied_hash = file_hash
         instance.last_applied = now()
-        self.set_status(TaskStatus.SUCCESSFUL)
     except (
         OSError,
         DatabaseError,
@@ -235,15 +238,14 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
     ) as exc:
         if instance:
             instance.status = BlueprintInstanceStatus.ERROR
-        self.set_error(exc)
+        self.error(exc)
     finally:
         if instance:
             instance.save()
 
 
-@CELERY_APP.task()
+@actor(description=_("Remove blueprints which couldn't be fetched."))
 def clear_failed_blueprints():
-    """Remove blueprints which couldn't be fetched"""
     # Exclude OCI blueprints as those might be temporarily unavailable
     for blueprint in BlueprintInstance.objects.exclude(path__startswith=OCI_PREFIX):
         try:

authentik/brands/apps.py

@@ -9,6 +9,7 @@ class AuthentikBrandsConfig(ManagedAppConfig):
     name = "authentik.brands"
     label = "authentik_brands"
     verbose_name = "authentik Brands"
+    default = True
     mountpoints = {
         "authentik.brands.urls_root": "",
     }

authentik/core/api/devices.py

@@ -1,8 +1,6 @@
 """Authenticator Devices API Views"""
 
-from django.utils.translation import gettext_lazy as _
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, extend_schema
+from drf_spectacular.utils import extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.fields import (
     BooleanField,
@@ -15,6 +13,7 @@ from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
 
+from authentik.core.api.users import ParamUserSerializer
 from authentik.core.api.utils import MetaNameSerializer
 from authentik.enterprise.stages.authenticator_endpoint_gdtc.models import EndpointDevice
 from authentik.stages.authenticator import device_classes, devices_for_user
@@ -23,7 +22,7 @@ from authentik.stages.authenticator_webauthn.models import WebAuthnDevice
 
 
 class DeviceSerializer(MetaNameSerializer):
-    """Serializer for Duo authenticator devices"""
+    """Serializer for authenticator devices"""
 
     pk = CharField()
     name = CharField()
@@ -33,22 +32,27 @@ class DeviceSerializer(MetaNameSerializer):
     last_updated = DateTimeField(read_only=True)
     last_used = DateTimeField(read_only=True, allow_null=True)
     extra_description = SerializerMethodField()
+    external_id = SerializerMethodField()
 
     def get_type(self, instance: Device) -> str:
         """Get type of device"""
         return instance._meta.label
 
-    def get_extra_description(self, instance: Device) -> str:
+    def get_extra_description(self, instance: Device) -> str | None:
         """Get extra description"""
         if isinstance(instance, WebAuthnDevice):
-            return (
-                instance.device_type.description
-                if instance.device_type
-                else _("Extra description not available")
-            )
+            return instance.device_type.description if instance.device_type else None
         if isinstance(instance, EndpointDevice):
             return instance.data.get("deviceSignals", {}).get("deviceModel")
-        return ""
+        return None
+
+    def get_external_id(self, instance: Device) -> str | None:
+        """Get external Device ID"""
+        if isinstance(instance, WebAuthnDevice):
+            return instance.device_type.aaguid if instance.device_type else None
+        if isinstance(instance, EndpointDevice):
+            return instance.data.get("deviceSignals", {}).get("deviceModel")
+        return None
 
 
 class DeviceViewSet(ViewSet):
@@ -57,7 +61,6 @@ class DeviceViewSet(ViewSet):
     serializer_class = DeviceSerializer
     permission_classes = [IsAuthenticated]
 
-    @extend_schema(responses={200: DeviceSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """Get all devices for current user"""
         devices = devices_for_user(request.user)
@@ -79,18 +82,11 @@ class AdminDeviceViewSet(ViewSet):
             yield from device_set
 
     @extend_schema(
-        parameters=[
-            OpenApiParameter(
-                name="user",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.INT,
-            )
-        ],
+        parameters=[ParamUserSerializer],
         responses={200: DeviceSerializer(many=True)},
     )
     def list(self, request: Request) -> Response:
         """Get all devices for current user"""
-        kwargs = {}
-        if "user" in request.query_params:
-            kwargs = {"user": request.query_params["user"]}
-        return Response(DeviceSerializer(self.get_devices(**kwargs), many=True).data)
+        args = ParamUserSerializer(data=request.query_params)
+        args.is_valid(raise_exception=True)
+        return Response(DeviceSerializer(self.get_devices(**args.validated_data), many=True).data)

authentik/core/api/users.py

@@ -90,6 +90,12 @@ from authentik.stages.email.utils import TemplateEmailMessage
 LOGGER = get_logger()
 
 
+class ParamUserSerializer(PassiveSerializer):
+    """Partial serializer for query parameters to select a user"""
+
+    user = PrimaryKeyRelatedField(queryset=User.objects.all().exclude_anonymous(), required=False)
+
+
 class UserGroupSerializer(ModelSerializer):
     """Simplified Group Serializer for user's groups"""
 
@@ -386,8 +392,23 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     queryset = User.objects.none()
     ordering = ["username"]
     serializer_class = UserSerializer
-    search_fields = ["username", "name", "is_active", "email", "uuid", "attributes"]
     filterset_class = UsersFilter
+    search_fields = ["username", "name", "is_active", "email", "uuid", "attributes"]
+
+    def get_ql_fields(self):
+        from djangoql.schema import BoolField, StrField
+
+        from authentik.enterprise.search.fields import ChoiceSearchField, JSONSearchField
+
+        return [
+            StrField(User, "username"),
+            StrField(User, "name"),
+            StrField(User, "email"),
+            StrField(User, "path"),
+            BoolField(User, "is_active", nullable=True),
+            ChoiceSearchField(User, "type"),
+            JSONSearchField(User, "attributes", suggest_nested=False),
+        ]
 
     def get_queryset(self):
         base_qs = User.objects.all().exclude_anonymous()

authentik/core/api/utils.py

@@ -2,6 +2,7 @@
 
 from typing import Any
 
+from django.db import models
 from django.db.models import Model
 from drf_spectacular.extensions import OpenApiSerializerFieldExtension
 from drf_spectacular.plumbing import build_basic_type
@@ -30,7 +31,27 @@ def is_dict(value: Any):
     raise ValidationError("Value must be a dictionary, and not have any duplicate keys.")
 
 
+class JSONDictField(JSONField):
+    """JSON Field which only allows dictionaries"""
+
+    default_validators = [is_dict]
+
+
+class JSONExtension(OpenApiSerializerFieldExtension):
+    """Generate API Schema for JSON fields as"""
+
+    target_class = "authentik.core.api.utils.JSONDictField"
+
+    def map_serializer_field(self, auto_schema, direction):
+        return build_basic_type(OpenApiTypes.OBJECT)
+
+
 class ModelSerializer(BaseModelSerializer):
+
+    # By default, JSON fields we have are used to store dictionaries
+    serializer_field_mapping = BaseModelSerializer.serializer_field_mapping.copy()
+    serializer_field_mapping[models.JSONField] = JSONDictField
+
     def create(self, validated_data):
         instance = super().create(validated_data)
 
@@ -71,21 +92,6 @@ class ModelSerializer(BaseModelSerializer):
         return instance
 
 
-class JSONDictField(JSONField):
-    """JSON Field which only allows dictionaries"""
-
-    default_validators = [is_dict]
-
-
-class JSONExtension(OpenApiSerializerFieldExtension):
-    """Generate API Schema for JSON fields as"""
-
-    target_class = "authentik.core.api.utils.JSONDictField"
-
-    def map_serializer_field(self, auto_schema, direction):
-        return build_basic_type(OpenApiTypes.OBJECT)
-
-
 class PassiveSerializer(Serializer):
     """Base serializer class which doesn't implement create/update methods"""
 

authentik/core/apps.py

@@ -1,8 +1,7 @@
 """authentik core app config"""
 
-from django.conf import settings
-
 from authentik.blueprints.apps import ManagedAppConfig
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 
 class AuthentikCoreConfig(ManagedAppConfig):
@@ -14,14 +13,6 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def debug_worker_hook(self):
-        """Dispatch startup tasks inline when debugging"""
-        if settings.DEBUG:
-            from authentik.root.celery import worker_ready_hook
-
-            worker_ready_hook()
-
     @ManagedAppConfig.reconcile_tenant
     def source_inbuilt(self):
         """Reconcile inbuilt source"""
@@ -34,3 +25,18 @@ class AuthentikCoreConfig(ManagedAppConfig):
             },
             managed=Source.MANAGED_INBUILT,
         )
+
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.core.tasks import clean_expired_models, clean_temporary_users
+
+        return [
+            ScheduleSpec(
+                actor=clean_expired_models,
+                crontab="2-59/5 * * * *",
+            ),
+            ScheduleSpec(
+                actor=clean_temporary_users,
+                crontab="9-59/5 * * * *",
+            ),
+        ]

authentik/core/management/commands/bootstrap_tasks.py

@@ -1,21 +0,0 @@
-"""Run bootstrap tasks"""
-
-from django.core.management.base import BaseCommand
-from django_tenants.utils import get_public_schema_name
-
-from authentik.root.celery import _get_startup_tasks_all_tenants, _get_startup_tasks_default_tenant
-from authentik.tenants.models import Tenant
-
-
-class Command(BaseCommand):
-    """Run bootstrap tasks to ensure certain objects are created"""
-
-    def handle(self, **options):
-        for task in _get_startup_tasks_default_tenant():
-            with Tenant.objects.get(schema_name=get_public_schema_name()):
-                task()
-
-        for task in _get_startup_tasks_all_tenants():
-            for tenant in Tenant.objects.filter(ready=True):
-                with tenant:
-                    task()

authentik/core/management/commands/change_user_type.py

@@ -13,7 +13,6 @@ class Command(TenantCommand):
         parser.add_argument("usernames", nargs="*", type=str)
 
     def handle_per_tenant(self, **options):
-        print(options)
         new_type = UserTypes(options["type"])
         qs = (
             User.objects.exclude_anonymous()

authentik/core/management/commands/worker.py

@@ -1,47 +0,0 @@
-"""Run worker"""
-
-from sys import exit as sysexit
-from tempfile import tempdir
-
-from celery.apps.worker import Worker
-from django.core.management.base import BaseCommand
-from django.db import close_old_connections
-from structlog.stdlib import get_logger
-
-from authentik.lib.config import CONFIG
-from authentik.lib.debug import start_debug_server
-from authentik.root.celery import CELERY_APP
-
-LOGGER = get_logger()
-
-
-class Command(BaseCommand):
-    """Run worker"""
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "-b",
-            "--beat",
-            action="store_false",
-            help="When set, this worker will _not_ run Beat (scheduled) tasks",
-        )
-
-    def handle(self, **options):
-        LOGGER.debug("Celery options", **options)
-        close_old_connections()
-        start_debug_server()
-        worker: Worker = CELERY_APP.Worker(
-            no_color=False,
-            quiet=True,
-            optimization="fair",
-            autoscale=(CONFIG.get_int("worker.concurrency"), 1),
-            task_events=True,
-            beat=options.get("beat", True),
-            schedule_filename=f"{tempdir}/celerybeat-schedule",
-            queues=["authentik", "authentik_scheduled", "authentik_events"],
-        )
-        for task in CELERY_APP.tasks:
-            LOGGER.debug("Registered task", task=task)
-
-        worker.start()
-        sysexit(worker.exitcode)

authentik/core/models.py

@@ -18,7 +18,7 @@ from django.http import HttpRequest
 from django.utils.functional import SimpleLazyObject, cached_property
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
-from django_cte import CTEQuerySet, With
+from django_cte import CTE, with_cte
 from guardian.conf import settings
 from guardian.mixins import GuardianUserMixin
 from model_utils.managers import InheritanceManager
@@ -136,7 +136,7 @@ class AttributesMixin(models.Model):
         return instance, False
 
 
-class GroupQuerySet(CTEQuerySet):
+class GroupQuerySet(QuerySet):
     def with_children_recursive(self):
         """Recursively get all groups that have the current queryset as parents
         or are indirectly related."""
@@ -165,9 +165,9 @@ class GroupQuerySet(CTEQuerySet):
             )
 
         # Build the recursive query, see above
-        cte = With.recursive(make_cte)
+        cte = CTE.recursive(make_cte)
         # Return the result, as a usable queryset for Group.
-        return cte.join(Group, group_uuid=cte.col.group_uuid).with_cte(cte)
+        return with_cte(cte, select=cte.join(Group, group_uuid=cte.col.group_uuid))
 
 
 class Group(SerializerModel, AttributesMixin):
@@ -1082,6 +1082,12 @@ class AuthenticatedSession(SerializerModel):
 
     user = models.ForeignKey(User, on_delete=models.CASCADE)
 
+    @property
+    def serializer(self) -> type[Serializer]:
+        from authentik.core.api.authenticated_sessions import AuthenticatedSessionSerializer
+
+        return AuthenticatedSessionSerializer
+
     class Meta:
         verbose_name = _("Authenticated Session")
         verbose_name_plural = _("Authenticated Sessions")

authentik/core/tasks.py

@@ -3,6 +3,9 @@
 from datetime import datetime, timedelta
 
 from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask
+from dramatiq.actor import actor
 from structlog.stdlib import get_logger
 
 from authentik.core.models import (
@@ -11,17 +14,14 @@ from authentik.core.models import (
     ExpiringModel,
     User,
 )
-from authentik.events.system_tasks import SystemTask, TaskStatus, prefill_task
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
 
 LOGGER = get_logger()
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def clean_expired_models(self: SystemTask):
-    """Remove expired objects"""
-    messages = []
+@actor(description=_("Remove expired objects."))
+def clean_expired_models():
+    self: Task = CurrentTask.get_task()
     for cls in ExpiringModel.__subclasses__():
         cls: ExpiringModel
         objects = (
@@ -31,16 +31,13 @@ def clean_expired_models(self: SystemTask):
         for obj in objects:
             obj.expire_action()
         LOGGER.debug("Expired models", model=cls, amount=amount)
-        messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
-    self.set_status(TaskStatus.SUCCESSFUL, *messages)
+        self.info(f"Expired {amount} {cls._meta.verbose_name_plural}")
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def clean_temporary_users(self: SystemTask):
-    """Remove temporary users created by SAML Sources"""
+@actor(description=_("Remove temporary users created by SAML Sources."))
+def clean_temporary_users():
+    self: Task = CurrentTask.get_task()
     _now = datetime.now()
-    messages = []
     deleted_users = 0
     for user in User.objects.filter(**{f"attributes__{USER_ATTRIBUTE_GENERATED}": True}):
         if not user.attributes.get(USER_ATTRIBUTE_EXPIRES):
@@ -52,5 +49,4 @@ def clean_temporary_users(self: SystemTask):
             LOGGER.debug("User is expired and will be deleted.", user=user, delta=delta)
             user.delete()
             deleted_users += 1
-    messages.append(f"Successfully deleted {deleted_users} users.")
-    self.set_status(TaskStatus.SUCCESSFUL, *messages)
+    self.info(f"Successfully deleted {deleted_users} users.")

authentik/core/tests/test_applications_api.py

@@ -114,6 +114,7 @@ class TestApplicationsAPI(APITestCase):
         self.assertJSONEqual(
             response.content.decode(),
             {
+                "autocomplete": {},
                 "pagination": {
                     "next": 0,
                     "previous": 0,
@@ -167,6 +168,7 @@ class TestApplicationsAPI(APITestCase):
         self.assertJSONEqual(
             response.content.decode(),
             {
+                "autocomplete": {},
                 "pagination": {
                     "next": 0,
                     "previous": 0,

authentik/core/tests/test_tasks.py

@@ -36,7 +36,7 @@ class TestTasks(APITestCase):
             expires=now(), user=get_anonymous_user(), intent=TokenIntents.INTENT_API
         )
         key = token.key
-        clean_expired_models.delay().get()
+        clean_expired_models.send()
         token.refresh_from_db()
         self.assertNotEqual(key, token.key)
 
@@ -50,5 +50,5 @@ class TestTasks(APITestCase):
                 USER_ATTRIBUTE_EXPIRES: mktime(now().timetuple()),
             },
         )
-        clean_temporary_users.delay().get()
+        clean_temporary_users.send()
         self.assertFalse(User.objects.filter(username=username))

authentik/crypto/apps.py

@@ -4,6 +4,8 @@ from datetime import UTC, datetime
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
+from authentik.lib.utils.time import fqdn_rand
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 MANAGED_KEY = "goauthentik.io/crypto/jwt-managed"
 
@@ -67,3 +69,14 @@ class AuthentikCryptoConfig(ManagedAppConfig):
                 "key_data": builder.private_key,
             },
         )
+
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.crypto.tasks import certificate_discovery
+
+        return [
+            ScheduleSpec(
+                actor=certificate_discovery,
+                crontab=f"{fqdn_rand('crypto_certificate_discovery')} * * * *",
+            ),
+        ]

authentik/crypto/settings.py

@@ -1,13 +0,0 @@
-"""Crypto task Settings"""
-
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "crypto_certificate_discovery": {
-        "task": "authentik.crypto.tasks.certificate_discovery",
-        "schedule": crontab(minute=fqdn_rand("crypto_certificate_discovery"), hour="*"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-}

authentik/crypto/tasks.py

@@ -7,13 +7,13 @@ from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509.base import load_pem_x509_certificate
 from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask
+from dramatiq.actor import actor
 from structlog.stdlib import get_logger
 
 from authentik.crypto.models import CertificateKeyPair
-from authentik.events.models import TaskStatus
-from authentik.events.system_tasks import SystemTask, prefill_task
 from authentik.lib.config import CONFIG
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
 
 LOGGER = get_logger()
 
@@ -36,10 +36,9 @@ def ensure_certificate_valid(body: str):
     return body
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def certificate_discovery(self: SystemTask):
-    """Discover, import and update certificates from the filesystem"""
+@actor(description=_("Discover, import and update certificates from the filesystem."))
+def certificate_discovery():
+    self: Task = CurrentTask.get_task()
     certs = {}
     private_keys = {}
     discovered = 0
@@ -84,6 +83,4 @@ def certificate_discovery(self: SystemTask):
                 dirty = True
         if dirty:
             cert.save()
-    self.set_status(
-        TaskStatus.SUCCESSFUL, _("Successfully imported {count} files.".format(count=discovered))
-    )
+    self.info(f"Successfully imported {discovered} files.")

authentik/crypto/tests.py

@@ -338,7 +338,7 @@ class TestCrypto(APITestCase):
             with open(f"{temp_dir}/foo.bar/privkey.pem", "w+", encoding="utf-8") as _key:
                 _key.write(builder.private_key)
             with CONFIG.patch("cert_discovery_dir", temp_dir):
-                certificate_discovery()
+                certificate_discovery.send()
         keypair: CertificateKeyPair = CertificateKeyPair.objects.filter(
             managed=MANAGED_DISCOVERED % "foo"
         ).first()

authentik/enterprise/apps.py

@@ -3,6 +3,8 @@
 from django.conf import settings
 
 from authentik.blueprints.apps import ManagedAppConfig
+from authentik.lib.utils.time import fqdn_rand
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 
 class EnterpriseConfig(ManagedAppConfig):
@@ -26,3 +28,14 @@ class AuthentikEnterpriseConfig(EnterpriseConfig):
         from authentik.enterprise.license import LicenseKey
 
         return LicenseKey.cached_summary().status.is_valid
+
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.enterprise.tasks import enterprise_update_usage
+
+        return [
+            ScheduleSpec(
+                actor=enterprise_update_usage,
+                crontab=f"{fqdn_rand('enterprise_update_usage')} */2 * * *",
+            ),
+        ]

authentik/enterprise/policies/unique_password/apps.py

@@ -1,6 +1,8 @@
 """authentik Unique Password policy app config"""
 
 from authentik.enterprise.apps import EnterpriseConfig
+from authentik.lib.utils.time import fqdn_rand
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 
 class AuthentikEnterprisePoliciesUniquePasswordConfig(EnterpriseConfig):
@@ -8,3 +10,21 @@ class AuthentikEnterprisePoliciesUniquePasswordConfig(EnterpriseConfig):
     label = "authentik_policies_unique_password"
     verbose_name = "authentik Enterprise.Policies.Unique Password"
     default = True
+
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.enterprise.policies.unique_password.tasks import (
+            check_and_purge_password_history,
+            trim_password_histories,
+        )
+
+        return [
+            ScheduleSpec(
+                actor=trim_password_histories,
+                crontab=f"{fqdn_rand('policies_unique_password_trim')} */12 * * *",
+            ),
+            ScheduleSpec(
+                actor=check_and_purge_password_history,
+                crontab=f"{fqdn_rand('policies_unique_password_purge')} */24 * * *",
+            ),
+        ]

authentik/enterprise/policies/unique_password/settings.py

@@ -1,20 +0,0 @@
-"""Unique Password Policy settings"""
-
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "policies_unique_password_trim_history": {
-        "task": "authentik.enterprise.policies.unique_password.tasks.trim_password_histories",
-        "schedule": crontab(minute=fqdn_rand("policies_unique_password_trim"), hour="*/12"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-    "policies_unique_password_check_purge": {
-        "task": (
-            "authentik.enterprise.policies.unique_password.tasks.check_and_purge_password_history"
-        ),
-        "schedule": crontab(minute=fqdn_rand("policies_unique_password_purge"), hour="*/24"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-}

authentik/enterprise/policies/unique_password/tasks.py

@@ -1,35 +1,37 @@
 from django.db.models.aggregates import Count
+from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask
+from dramatiq.actor import actor
 from structlog import get_logger
 
 from authentik.enterprise.policies.unique_password.models import (
     UniquePasswordPolicy,
     UserPasswordHistory,
 )
-from authentik.events.system_tasks import SystemTask, TaskStatus, prefill_task
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
 
 LOGGER = get_logger()
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def check_and_purge_password_history(self: SystemTask):
-    """Check if any UniquePasswordPolicy exists, and if not, purge the password history table.
-    This is run on a schedule instead of being triggered by policy binding deletion.
-    """
+@actor(
+    description=_(
+        "Check if any UniquePasswordPolicy exists, and if not, purge the password history table."
+    )
+)
+def check_and_purge_password_history():
+    self: Task = CurrentTask.get_task()
+
     if not UniquePasswordPolicy.objects.exists():
         UserPasswordHistory.objects.all().delete()
         LOGGER.debug("Purged UserPasswordHistory table as no policies are in use")
-        self.set_status(TaskStatus.SUCCESSFUL, "Successfully purged UserPasswordHistory")
+        self.info("Successfully purged UserPasswordHistory")
         return
 
-    self.set_status(
-        TaskStatus.SUCCESSFUL, "Not purging password histories, a unique password policy exists"
-    )
+    self.info("Not purging password histories, a unique password policy exists")
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-def trim_password_histories(self: SystemTask):
+@actor(description=_("Remove user password history that are too old."))
+def trim_password_histories():
     """Removes rows from UserPasswordHistory older than
     the `n` most recent entries.
 
@@ -37,6 +39,8 @@ def trim_password_histories(self: SystemTask):
     UniquePasswordPolicy policies.
     """
 
+    self: Task = CurrentTask.get_task()
+
     # No policy, we'll let the cleanup above do its thing
     if not UniquePasswordPolicy.objects.exists():
         return
@@ -63,4 +67,4 @@ def trim_password_histories(self: SystemTask):
 
     num_deleted, _ = UserPasswordHistory.objects.exclude(pk__in=all_pks_to_keep).delete()
     LOGGER.debug("Deleted stale password history records", count=num_deleted)
-    self.set_status(TaskStatus.SUCCESSFUL, f"Delete {num_deleted} stale password history records")
+    self.info(f"Delete {num_deleted} stale password history records")

authentik/enterprise/policies/unique_password/tests/test_tasks.py

@@ -76,7 +76,7 @@ class TestCheckAndPurgePasswordHistory(TestCase):
         self.assertTrue(UserPasswordHistory.objects.exists())
 
         # Run the task - should purge since no policy is in use
-        check_and_purge_password_history()
+        check_and_purge_password_history.send()
 
         # Verify the table is empty
         self.assertFalse(UserPasswordHistory.objects.exists())
@@ -99,7 +99,7 @@ class TestCheckAndPurgePasswordHistory(TestCase):
         self.assertTrue(UserPasswordHistory.objects.exists())
 
         # Run the task - should NOT purge since a policy is in use
-        check_and_purge_password_history()
+        check_and_purge_password_history.send()
 
         # Verify the entries still exist
         self.assertTrue(UserPasswordHistory.objects.exists())
@@ -119,17 +119,17 @@ class TestTrimPasswordHistory(TestCase):
             [
                 UserPasswordHistory(
                     user=self.user,
-                    old_password="hunter1",  # nosec B106
+                    old_password="hunter1",  # nosec
                     created_at=_now - timedelta(days=3),
                 ),
                 UserPasswordHistory(
                     user=self.user,
-                    old_password="hunter2",  # nosec B106
+                    old_password="hunter2",  # nosec
                     created_at=_now - timedelta(days=2),
                 ),
                 UserPasswordHistory(
                     user=self.user,
-                    old_password="hunter3",  # nosec B106
+                    old_password="hunter3",  # nosec
                     created_at=_now,
                 ),
             ]
@@ -142,7 +142,7 @@ class TestTrimPasswordHistory(TestCase):
             enabled=True,
             order=0,
         )
-        trim_password_histories.delay()
+        trim_password_histories.send()
         user_pwd_history_qs = UserPasswordHistory.objects.filter(user=self.user)
         self.assertEqual(len(user_pwd_history_qs), 1)
 
@@ -159,7 +159,7 @@ class TestTrimPasswordHistory(TestCase):
             enabled=False,
             order=0,
         )
-        trim_password_histories.delay()
+        trim_password_histories.send()
         self.assertTrue(UserPasswordHistory.objects.filter(user=self.user).exists())
 
     def test_trim_password_history_fewer_records_than_maximum_is_no_op(self):
@@ -174,5 +174,5 @@ class TestTrimPasswordHistory(TestCase):
             enabled=True,
             order=0,
         )
-        trim_password_histories.delay()
+        trim_password_histories.send()
         self.assertTrue(UserPasswordHistory.objects.filter(user=self.user).exists())

authentik/enterprise/providers/google_workspace/api/providers.py

@@ -55,5 +55,5 @@ class GoogleWorkspaceProviderViewSet(OutgoingSyncProviderStatusMixin, UsedByMixi
     ]
     search_fields = ["name"]
     ordering = ["name"]
-    sync_single_task = google_workspace_sync
+    sync_task = google_workspace_sync
     sync_objects_task = google_workspace_sync_objects

authentik/enterprise/providers/google_workspace/models.py

@@ -7,6 +7,7 @@ from django.db import models
 from django.db.models import QuerySet
 from django.templatetags.static import static
 from django.utils.translation import gettext_lazy as _
+from dramatiq.actor import Actor
 from google.oauth2.service_account import Credentials
 from rest_framework.serializers import Serializer
 
@@ -110,6 +111,12 @@ class GoogleWorkspaceProvider(OutgoingSyncProvider, BackchannelProvider):
         help_text=_("Property mappings used for group creation/updating."),
     )
 
+    @property
+    def sync_actor(self) -> Actor:
+        from authentik.enterprise.providers.google_workspace.tasks import google_workspace_sync
+
+        return google_workspace_sync
+
     def client_for_model(
         self,
         model: type[User | Group | GoogleWorkspaceProviderUser | GoogleWorkspaceProviderGroup],

authentik/enterprise/providers/google_workspace/settings.py

@@ -1,13 +0,0 @@
-"""Google workspace provider task Settings"""
-
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "providers_google_workspace_sync": {
-        "task": "authentik.enterprise.providers.google_workspace.tasks.google_workspace_sync_all",
-        "schedule": crontab(minute=fqdn_rand("google_workspace_sync_all"), hour="*/4"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-}

authentik/enterprise/providers/google_workspace/signals.py

@@ -2,15 +2,13 @@
 
 from authentik.enterprise.providers.google_workspace.models import GoogleWorkspaceProvider
 from authentik.enterprise.providers.google_workspace.tasks import (
-    google_workspace_sync,
-    google_workspace_sync_direct,
-    google_workspace_sync_m2m,
+    google_workspace_sync_direct_dispatch,
+    google_workspace_sync_m2m_dispatch,
 )
 from authentik.lib.sync.outgoing.signals import register_signals
 
 register_signals(
     GoogleWorkspaceProvider,
-    task_sync_single=google_workspace_sync,
-    task_sync_direct=google_workspace_sync_direct,
-    task_sync_m2m=google_workspace_sync_m2m,
+    task_sync_direct_dispatch=google_workspace_sync_direct_dispatch,
+    task_sync_m2m_dispatch=google_workspace_sync_m2m_dispatch,
 )

authentik/enterprise/providers/google_workspace/tasks.py

@@ -1,37 +1,48 @@
 """Google Provider tasks"""
 
+from django.utils.translation import gettext_lazy as _
+from dramatiq.actor import actor
+
 from authentik.enterprise.providers.google_workspace.models import GoogleWorkspaceProvider
-from authentik.events.system_tasks import SystemTask
-from authentik.lib.sync.outgoing.exceptions import TransientSyncException
 from authentik.lib.sync.outgoing.tasks import SyncTasks
-from authentik.root.celery import CELERY_APP
 
 sync_tasks = SyncTasks(GoogleWorkspaceProvider)
 
 
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(description=_("Sync Google Workspace provider objects."))
 def google_workspace_sync_objects(*args, **kwargs):
     return sync_tasks.sync_objects(*args, **kwargs)
 
 
-@CELERY_APP.task(
-    base=SystemTask, bind=True, autoretry_for=(TransientSyncException,), retry_backoff=True
-)
-def google_workspace_sync(self, provider_pk: int, *args, **kwargs):
+@actor(description=_("Full sync for Google Workspace provider."))
+def google_workspace_sync(provider_pk: int, *args, **kwargs):
     """Run full sync for Google Workspace provider"""
-    return sync_tasks.sync_single(self, provider_pk, google_workspace_sync_objects)
+    return sync_tasks.sync(provider_pk, google_workspace_sync_objects)
 
 
-@CELERY_APP.task()
-def google_workspace_sync_all():
-    return sync_tasks.sync_all(google_workspace_sync)
-
-
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(description=_("Sync a direct object (user, group) for Google Workspace provider."))
 def google_workspace_sync_direct(*args, **kwargs):
     return sync_tasks.sync_signal_direct(*args, **kwargs)
 
 
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(
+    description=_(
+        "Dispatch syncs for a direct object (user, group) for Google Workspace providers."
+    )
+)
+def google_workspace_sync_direct_dispatch(*args, **kwargs):
+    return sync_tasks.sync_signal_direct_dispatch(google_workspace_sync_direct, *args, **kwargs)
+
+
+@actor(description=_("Sync a related object (memberships) for Google Workspace provider."))
 def google_workspace_sync_m2m(*args, **kwargs):
     return sync_tasks.sync_signal_m2m(*args, **kwargs)
+
+
+@actor(
+    description=_(
+        "Dispatch syncs for a related object (memberships) for Google Workspace providers."
+    )
+)
+def google_workspace_sync_m2m_dispatch(*args, **kwargs):
+    return sync_tasks.sync_signal_m2m_dispatch(google_workspace_sync_m2m, *args, **kwargs)

authentik/enterprise/providers/google_workspace/tests/test_groups.py

@@ -324,7 +324,7 @@ class GoogleWorkspaceGroupTests(TestCase):
             "authentik.enterprise.providers.google_workspace.models.GoogleWorkspaceProvider.google_credentials",
             MagicMock(return_value={"developerKey": self.api_key, "http": http}),
         ):
-            google_workspace_sync.delay(self.provider.pk).get()
+            google_workspace_sync.send(self.provider.pk).get_result()
             self.assertTrue(
                 GoogleWorkspaceProviderGroup.objects.filter(
                     group=different_group, provider=self.provider

authentik/enterprise/providers/google_workspace/tests/test_users.py

@@ -302,7 +302,7 @@ class GoogleWorkspaceUserTests(TestCase):
             "authentik.enterprise.providers.google_workspace.models.GoogleWorkspaceProvider.google_credentials",
             MagicMock(return_value={"developerKey": self.api_key, "http": http}),
         ):
-            google_workspace_sync.delay(self.provider.pk).get()
+            google_workspace_sync.send(self.provider.pk).get_result()
             self.assertTrue(
                 GoogleWorkspaceProviderUser.objects.filter(
                     user=different_user, provider=self.provider

authentik/enterprise/providers/microsoft_entra/api/providers.py

@@ -53,5 +53,5 @@ class MicrosoftEntraProviderViewSet(OutgoingSyncProviderStatusMixin, UsedByMixin
     ]
     search_fields = ["name"]
     ordering = ["name"]
-    sync_single_task = microsoft_entra_sync
+    sync_task = microsoft_entra_sync
     sync_objects_task = microsoft_entra_sync_objects

authentik/enterprise/providers/microsoft_entra/models.py

@@ -8,6 +8,7 @@ from django.db import models
 from django.db.models import QuerySet
 from django.templatetags.static import static
 from django.utils.translation import gettext_lazy as _
+from dramatiq.actor import Actor
 from rest_framework.serializers import Serializer
 
 from authentik.core.models import (
@@ -99,6 +100,12 @@ class MicrosoftEntraProvider(OutgoingSyncProvider, BackchannelProvider):
         help_text=_("Property mappings used for group creation/updating."),
     )
 
+    @property
+    def sync_actor(self) -> Actor:
+        from authentik.enterprise.providers.microsoft_entra.tasks import microsoft_entra_sync
+
+        return microsoft_entra_sync
+
     def client_for_model(
         self,
         model: type[User | Group | MicrosoftEntraProviderUser | MicrosoftEntraProviderGroup],

authentik/enterprise/providers/microsoft_entra/settings.py

@@ -1,13 +0,0 @@
-"""Microsoft Entra provider task Settings"""
-
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "providers_microsoft_entra_sync": {
-        "task": "authentik.enterprise.providers.microsoft_entra.tasks.microsoft_entra_sync_all",
-        "schedule": crontab(minute=fqdn_rand("microsoft_entra_sync_all"), hour="*/4"),
-        "options": {"queue": "authentik_scheduled"},
-    },
-}

authentik/enterprise/providers/microsoft_entra/signals.py

@@ -2,15 +2,13 @@
 
 from authentik.enterprise.providers.microsoft_entra.models import MicrosoftEntraProvider
 from authentik.enterprise.providers.microsoft_entra.tasks import (
-    microsoft_entra_sync,
-    microsoft_entra_sync_direct,
-    microsoft_entra_sync_m2m,
+    microsoft_entra_sync_direct_dispatch,
+    microsoft_entra_sync_m2m_dispatch,
 )
 from authentik.lib.sync.outgoing.signals import register_signals
 
 register_signals(
     MicrosoftEntraProvider,
-    task_sync_single=microsoft_entra_sync,
-    task_sync_direct=microsoft_entra_sync_direct,
-    task_sync_m2m=microsoft_entra_sync_m2m,
+    task_sync_direct_dispatch=microsoft_entra_sync_direct_dispatch,
+    task_sync_m2m_dispatch=microsoft_entra_sync_m2m_dispatch,
 )

authentik/enterprise/providers/microsoft_entra/tasks.py

@@ -1,37 +1,46 @@
 """Microsoft Entra Provider tasks"""
 
+from django.utils.translation import gettext_lazy as _
+from dramatiq.actor import actor
+
 from authentik.enterprise.providers.microsoft_entra.models import MicrosoftEntraProvider
-from authentik.events.system_tasks import SystemTask
-from authentik.lib.sync.outgoing.exceptions import TransientSyncException
 from authentik.lib.sync.outgoing.tasks import SyncTasks
-from authentik.root.celery import CELERY_APP
 
 sync_tasks = SyncTasks(MicrosoftEntraProvider)
 
 
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(description=_("Sync Microsoft Entra provider objects."))
 def microsoft_entra_sync_objects(*args, **kwargs):
     return sync_tasks.sync_objects(*args, **kwargs)
 
 
-@CELERY_APP.task(
-    base=SystemTask, bind=True, autoretry_for=(TransientSyncException,), retry_backoff=True
-)
-def microsoft_entra_sync(self, provider_pk: int, *args, **kwargs):
+@actor(description=_("Full sync for Microsoft Entra provider."))
+def microsoft_entra_sync(provider_pk: int, *args, **kwargs):
     """Run full sync for Microsoft Entra provider"""
-    return sync_tasks.sync_single(self, provider_pk, microsoft_entra_sync_objects)
+    return sync_tasks.sync(provider_pk, microsoft_entra_sync_objects)
 
 
-@CELERY_APP.task()
-def microsoft_entra_sync_all():
-    return sync_tasks.sync_all(microsoft_entra_sync)
-
-
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(description=_("Sync a direct object (user, group) for Microsoft Entra provider."))
 def microsoft_entra_sync_direct(*args, **kwargs):
     return sync_tasks.sync_signal_direct(*args, **kwargs)
 
 
-@CELERY_APP.task(autoretry_for=(TransientSyncException,), retry_backoff=True)
+@actor(
+    description=_("Dispatch syncs for a direct object (user, group) for Microsoft Entra providers.")
+)
+def microsoft_entra_sync_direct_dispatch(*args, **kwargs):
+    return sync_tasks.sync_signal_direct_dispatch(microsoft_entra_sync_direct, *args, **kwargs)
+
+
+@actor(description=_("Sync a related object (memberships) for Microsoft Entra provider."))
 def microsoft_entra_sync_m2m(*args, **kwargs):
     return sync_tasks.sync_signal_m2m(*args, **kwargs)
+
+
+@actor(
+    description=_(
+        "Dispatch syncs for a related object (memberships) for Microsoft Entra providers."
+    )
+)
+def microsoft_entra_sync_m2m_dispatch(*args, **kwargs):
+    return sync_tasks.sync_signal_m2m_dispatch(microsoft_entra_sync_m2m, *args, **kwargs)

authentik/enterprise/providers/microsoft_entra/tests/test_groups.py

@@ -252,9 +252,13 @@ class MicrosoftEntraGroupTests(TestCase):
             member_add.assert_called_once()
             self.assertEqual(
                 member_add.call_args[0][0].odata_id,
-                f"https://graph.microsoft.com/v1.0/directoryObjects/{MicrosoftEntraProviderUser.objects.filter(
+                f"https://graph.microsoft.com/v1.0/directoryObjects/{
+                    MicrosoftEntraProviderUser.objects.filter(
                         provider=self.provider,
-                    ).first().microsoft_id}",
+                    )
+                    .first()
+                    .microsoft_id
+                }",
             )
 
     def test_group_create_member_remove(self):
@@ -311,9 +315,13 @@ class MicrosoftEntraGroupTests(TestCase):
             member_add.assert_called_once()
             self.assertEqual(
                 member_add.call_args[0][0].odata_id,
-                f"https://graph.microsoft.com/v1.0/directoryObjects/{MicrosoftEntraProviderUser.objects.filter(
+                f"https://graph.microsoft.com/v1.0/directoryObjects/{
+                    MicrosoftEntraProviderUser.objects.filter(
                         provider=self.provider,
-                    ).first().microsoft_id}",
+                    )
+                    .first()
+                    .microsoft_id
+                }",
             )
             member_remove.assert_called_once()
 
@@ -413,7 +421,7 @@ class MicrosoftEntraGroupTests(TestCase):
                 ),
             ) as group_list,
         ):
-            microsoft_entra_sync.delay(self.provider.pk).get()
+            microsoft_entra_sync.send(self.provider.pk).get_result()
             self.assertTrue(
                 MicrosoftEntraProviderGroup.objects.filter(
                     group=different_group, provider=self.provider

authentik/enterprise/providers/microsoft_entra/tests/test_users.py

@@ -397,7 +397,7 @@ class MicrosoftEntraUserTests(APITestCase):
                 AsyncMock(return_value=GroupCollectionResponse(value=[])),
             ),
         ):
-            microsoft_entra_sync.delay(self.provider.pk).get()
+            microsoft_entra_sync.send(self.provider.pk).get_result()
             self.assertTrue(
                 MicrosoftEntraProviderUser.objects.filter(
                     user=different_user, provider=self.provider

authentik/enterprise/providers/ssf/models.py

@@ -17,6 +17,7 @@ from authentik.crypto.models import CertificateKeyPair
 from authentik.lib.models import CreatedUpdatedModel
 from authentik.lib.utils.time import timedelta_from_string, timedelta_string_validator
 from authentik.providers.oauth2.models import JWTAlgorithms, OAuth2Provider
+from authentik.tasks.models import TasksModel
 
 
 class EventTypes(models.TextChoices):
@@ -42,7 +43,7 @@ class SSFEventStatus(models.TextChoices):
     SENT = "sent"
 
 
-class SSFProvider(BackchannelProvider):
+class SSFProvider(TasksModel, BackchannelProvider):
     """Shared Signals Framework provider to allow applications to
     receive user events from authentik."""
 

authentik/enterprise/providers/ssf/signals.py

@@ -1,10 +1,8 @@
 from hashlib import sha256
 
-from django.contrib.auth.signals import user_logged_out
 from django.db.models import Model
 from django.db.models.signals import post_delete, post_save, pre_delete
 from django.dispatch import receiver
-from django.http.request import HttpRequest
 from guardian.shortcuts import assign_perm
 
 from authentik.core.models import (
@@ -20,7 +18,7 @@ from authentik.enterprise.providers.ssf.models import (
     EventTypes,
     SSFProvider,
 )
-from authentik.enterprise.providers.ssf.tasks import send_ssf_event
+from authentik.enterprise.providers.ssf.tasks import send_ssf_events
 from authentik.events.middleware import audit_ignore
 from authentik.stages.authenticator.models import Device
 from authentik.stages.authenticator_duo.models import DuoDevice
@@ -62,38 +60,13 @@ def ssf_providers_post_save(sender: type[Model], instance: SSFProvider, created:
             instance.save()
 
 
-@receiver(user_logged_out)
-def ssf_user_logged_out_session_revoked(sender, request: HttpRequest, user: User, **_):
-    """Session revoked trigger (user logged out)"""
-    if not request.session or not request.session.session_key or not user:
-        return
-    send_ssf_event(
-        EventTypes.CAEP_SESSION_REVOKED,
-        {
-            "initiating_entity": "user",
-        },
-        sub_id={
-            "format": "complex",
-            "session": {
-                "format": "opaque",
-                "id": sha256(request.session.session_key.encode("ascii")).hexdigest(),
-            },
-            "user": {
-                "format": "email",
-                "email": user.email,
-            },
-        },
-        request=request,
-    )
-
-
 @receiver(pre_delete, sender=AuthenticatedSession)
 def ssf_user_session_delete_session_revoked(sender, instance: AuthenticatedSession, **_):
     """Session revoked trigger (users' session has been deleted)
 
     As this signal is also triggered with a regular logout, we can't be sure
     if the session has been deleted by an admin or by the user themselves."""
-    send_ssf_event(
+    send_ssf_events(
         EventTypes.CAEP_SESSION_REVOKED,
         {
             "initiating_entity": "user",
@@ -115,7 +88,7 @@ def ssf_user_session_delete_session_revoked(sender, instance: AuthenticatedSessi
 @receiver(password_changed)
 def ssf_password_changed_cred_change(sender, user: User, password: str | None, **_):
     """Credential change trigger (password changed)"""
-    send_ssf_event(
+    send_ssf_events(
         EventTypes.CAEP_CREDENTIAL_CHANGE,
         {
             "credential_type": "password",
@@ -153,7 +126,7 @@ def ssf_device_post_save(sender: type[Model], instance: Device, created: bool, *
     }
     if isinstance(instance, WebAuthnDevice) and instance.aaguid != UNKNOWN_DEVICE_TYPE_AAGUID:
         data["fido2_aaguid"] = instance.aaguid
-    send_ssf_event(
+    send_ssf_events(
         EventTypes.CAEP_CREDENTIAL_CHANGE,
         data,
         sub_id={
@@ -180,7 +153,7 @@ def ssf_device_post_delete(sender: type[Model], instance: Device, **_):
     }
     if isinstance(instance, WebAuthnDevice) and instance.aaguid != UNKNOWN_DEVICE_TYPE_AAGUID:
         data["fido2_aaguid"] = instance.aaguid
-    send_ssf_event(
+    send_ssf_events(
         EventTypes.CAEP_CREDENTIAL_CHANGE,
         data,
         sub_id={

authentik/enterprise/providers/ssf/tasks.py

@@ -1,7 +1,11 @@
-from celery import group
+from typing import Any
+from uuid import UUID
+
 from django.http import HttpRequest
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
+from django_dramatiq_postgres.middleware import CurrentTask
+from dramatiq.actor import actor
 from requests.exceptions import RequestException
 from structlog.stdlib import get_logger
 
@@ -13,19 +17,16 @@ from authentik.enterprise.providers.ssf.models import (
     Stream,
     StreamEvent,
 )
-from authentik.events.logs import LogEvent
-from authentik.events.models import TaskStatus
-from authentik.events.system_tasks import SystemTask
 from authentik.lib.utils.http import get_http_session
 from authentik.lib.utils.time import timedelta_from_string
 from authentik.policies.engine import PolicyEngine
-from authentik.root.celery import CELERY_APP
+from authentik.tasks.models import Task
 
 session = get_http_session()
 LOGGER = get_logger()
 
 
-def send_ssf_event(
+def send_ssf_events(
     event_type: EventTypes,
     data: dict,
     stream_filter: dict | None = None,
@@ -33,7 +34,7 @@ def send_ssf_event(
     **extra_data,
 ):
     """Wrapper to send an SSF event to multiple streams"""
-    payload = []
+    events_data = {}
     if not stream_filter:
         stream_filter = {}
     stream_filter["events_requested__contains"] = [event_type]
@@ -41,16 +42,22 @@ def send_ssf_event(
         extra_data.setdefault("txn", request.request_id)
     for stream in Stream.objects.filter(**stream_filter):
         event_data = stream.prepare_event_payload(event_type, data, **extra_data)
-        payload.append((str(stream.uuid), event_data))
-    return _send_ssf_event.delay(payload)
+        events_data[stream.uuid] = event_data
+    ssf_events_dispatch.send(events_data)
 
 
-def _check_app_access(stream_uuid: str, event_data: dict) -> bool:
+@actor(description=_("Dispatch SSF events."))
+def ssf_events_dispatch(events_data: dict[str, dict[str, Any]]):
+    for stream_uuid, event_data in events_data.items():
+        stream = Stream.objects.filter(pk=stream_uuid).first()
+        if not stream:
+            continue
+        send_ssf_event.send_with_options(args=(stream_uuid, event_data), rel_obj=stream.provider)
+
+
+def _check_app_access(stream: Stream, event_data: dict) -> bool:
     """Check if event is related to user and if so, check
     if the user has access to the application"""
-    stream = Stream.objects.filter(pk=stream_uuid).first()
-    if not stream:
-        return False
     # `event_data` is a dict version of a StreamEvent
     sub_id = event_data.get("payload", {}).get("sub_id", {})
     email = sub_id.get("user", {}).get("email", None)
@@ -65,42 +72,22 @@ def _check_app_access(stream_uuid: str, event_data: dict) -> bool:
     return engine.passing
 
 
-@CELERY_APP.task()
-def _send_ssf_event(event_data: list[tuple[str, dict]]):
-    tasks = []
-    for stream, data in event_data:
-        if not _check_app_access(stream, data):
-            continue
-        event = StreamEvent.objects.create(**data)
-        tasks.extend(send_single_ssf_event(stream, str(event.uuid)))
-    main_task = group(*tasks)
-    main_task()
+@actor(description=_("Send an SSF event."))
+def send_ssf_event(stream_uuid: UUID, event_data: dict[str, Any]):
+    self: Task = CurrentTask.get_task()
 
-
-def send_single_ssf_event(stream_id: str, evt_id: str):
-    stream = Stream.objects.filter(pk=stream_id).first()
+    stream = Stream.objects.filter(pk=stream_uuid).first()
     if not stream:
         return
-    event = StreamEvent.objects.filter(pk=evt_id).first()
-    if not event:
+    if not _check_app_access(stream, event_data):
         return
+    event = StreamEvent.objects.create(**event_data)
+    self.set_uid(event.pk)
     if event.status == SSFEventStatus.SENT:
         return
-    if stream.delivery_method == DeliveryMethods.RISC_PUSH:
-        return [ssf_push_event.si(str(event.pk))]
-    return []
-
-
-@CELERY_APP.task(bind=True, base=SystemTask)
-def ssf_push_event(self: SystemTask, event_id: str):
-    self.save_on_success = False
-    event = StreamEvent.objects.filter(pk=event_id).first()
-    if not event:
-        return
-    self.set_uid(event_id)
-    if event.status == SSFEventStatus.SENT:
-        self.set_status(TaskStatus.SUCCESSFUL)
+    if stream.delivery_method != DeliveryMethods.RISC_PUSH:
         return
+
     try:
         response = session.post(
             event.stream.endpoint_url,
@@ -110,26 +97,17 @@ def ssf_push_event(self: SystemTask, event_id: str):
         response.raise_for_status()
         event.status = SSFEventStatus.SENT
         event.save()
-        self.set_status(TaskStatus.SUCCESSFUL)
         return
     except RequestException as exc:
         LOGGER.warning("Failed to send SSF event", exc=exc)
-        self.set_status(TaskStatus.ERROR)
         attrs = {}
         if exc.response:
             attrs["response"] = {
                 "content": exc.response.text,
                 "status": exc.response.status_code,
             }
-        self.set_error(
-            exc,
-            LogEvent(
-                _("Failed to send request"),
-                log_level="warning",
-                logger=self.__name__,
-                attributes=attrs,
-            ),
-        )
+        self.warning(exc)
+        self.warning("Failed to send request", **attrs)
         # Re-up the expiry of the stream event
         event.expires = now() + timedelta_from_string(event.stream.provider.event_retention)
         event.status = SSFEventStatus.PENDING_FAILED

authentik/enterprise/providers/ssf/views/stream.py

@@ -13,7 +13,7 @@ from authentik.enterprise.providers.ssf.models import (
     SSFProvider,
     Stream,
 )
-from authentik.enterprise.providers.ssf.tasks import send_ssf_event
+from authentik.enterprise.providers.ssf.tasks import send_ssf_events
 from authentik.enterprise.providers.ssf.views.base import SSFView
 
 LOGGER = get_logger()
@@ -109,7 +109,7 @@ class StreamView(SSFView):
                 "User does not have permission to create stream for this provider."
             )
         instance: Stream = stream.save(provider=self.provider)
-        send_ssf_event(
+        send_ssf_events(
             EventTypes.SET_VERIFICATION,
             {
                 "state": None,

authentik/enterprise/search/apps.py

@@ -0,0 +1,12 @@
+"""Enterprise app config"""
+
+from authentik.enterprise.apps import EnterpriseConfig
+
+
+class AuthentikEnterpriseSearchConfig(EnterpriseConfig):
+    """Enterprise app config"""
+
+    name = "authentik.enterprise.search"
+    label = "authentik_search"
+    verbose_name = "authentik Enterprise.Search"
+    default = True

authentik/enterprise/search/fields.py

@@ -0,0 +1,128 @@
+"""DjangoQL search"""
+
+from collections import OrderedDict, defaultdict
+from collections.abc import Generator
+
+from django.db import connection
+from django.db.models import Model, Q
+from djangoql.compat import text_type
+from djangoql.schema import StrField
+
+
+class JSONSearchField(StrField):
+    """JSON field for DjangoQL"""
+
+    model: Model
+
+    def __init__(self, model=None, name=None, nullable=None, suggest_nested=True):
+        # Set this in the constructor to not clobber the type variable
+        self.type = "relation"
+        self.suggest_nested = suggest_nested
+        super().__init__(model, name, nullable)
+
+    def get_lookup(self, path, operator, value):
+        search = "__".join(path)
+        op, invert = self.get_operator(operator)
+        q = Q(**{f"{search}{op}": self.get_lookup_value(value)})
+        return ~q if invert else q
+
+    def json_field_keys(self) -> Generator[tuple[str]]:
+        with connection.cursor() as cursor:
+            cursor.execute(
+                f"""
+                WITH RECURSIVE "{self.name}_keys" AS (
+                    SELECT
+                        ARRAY[jsonb_object_keys("{self.name}")] AS key_path_array,
+                        "{self.name}" -> jsonb_object_keys("{self.name}") AS value
+                    FROM {self.model._meta.db_table}
+                    WHERE "{self.name}" IS NOT NULL
+                        AND jsonb_typeof("{self.name}") = 'object'
+
+                    UNION ALL
+
+                    SELECT
+                        ck.key_path_array || jsonb_object_keys(ck.value),
+                        ck.value -> jsonb_object_keys(ck.value) AS value
+                    FROM "{self.name}_keys" ck
+                    WHERE jsonb_typeof(ck.value) = 'object'
+                ),
+
+                unique_paths AS (
+                    SELECT DISTINCT key_path_array
+                    FROM "{self.name}_keys"
+                )
+
+                SELECT key_path_array FROM unique_paths;
+            """  # nosec
+            )
+            return (x[0] for x in cursor.fetchall())
+
+    def get_nested_options(self) -> OrderedDict:
+        """Get keys of all nested objects to show autocomplete"""
+        if not self.suggest_nested:
+            return OrderedDict()
+        base_model_name = f"{self.model._meta.app_label}.{self.model._meta.model_name}_{self.name}"
+
+        def recursive_function(parts: list[str], parent_parts: list[str] | None = None):
+            if not parent_parts:
+                parent_parts = []
+            path = parts.pop(0)
+            parent_parts.append(path)
+            relation_key = "_".join(parent_parts)
+            if len(parts) > 1:
+                out_dict = {
+                    relation_key: {
+                        parts[0]: {
+                            "type": "relation",
+                            "relation": f"{relation_key}_{parts[0]}",
+                        }
+                    }
+                }
+                child_paths = recursive_function(parts.copy(), parent_parts.copy())
+                child_paths.update(out_dict)
+                return child_paths
+            else:
+                return {relation_key: {parts[0]: {}}}
+
+        relation_structure = defaultdict(dict)
+
+        for relations in self.json_field_keys():
+            result = recursive_function([base_model_name] + relations)
+            for relation_key, value in result.items():
+                for sub_relation_key, sub_value in value.items():
+                    if not relation_structure[relation_key].get(sub_relation_key, None):
+                        relation_structure[relation_key][sub_relation_key] = sub_value
+                    else:
+                        relation_structure[relation_key][sub_relation_key].update(sub_value)
+
+        final_dict = defaultdict(dict)
+
+        for key, value in relation_structure.items():
+            for sub_key, sub_value in value.items():
+                if not sub_value:
+                    final_dict[key][sub_key] = {
+                        "type": "str",
+                        "nullable": True,
+                    }
+                else:
+                    final_dict[key][sub_key] = sub_value
+        return OrderedDict(final_dict)
+
+    def relation(self) -> str:
+        return f"{self.model._meta.app_label}.{self.model._meta.model_name}_{self.name}"
+
+
+class ChoiceSearchField(StrField):
+    def __init__(self, model=None, name=None, nullable=None):
+        super().__init__(model, name, nullable, suggest_options=True)
+
+    def get_options(self, search):
+        result = []
+        choices = self._field_choices()
+        if choices:
+            search = search.lower()
+            for c in choices:
+                choice = text_type(c[0])
+                if search in choice.lower():
+                    result.append(choice)
+        return result

authentik/enterprise/search/pagination.py

@@ -0,0 +1,53 @@
+from rest_framework.response import Response
+
+from authentik.api.pagination import Pagination
+from authentik.enterprise.search.ql import AUTOCOMPLETE_COMPONENT_NAME, QLSearch
+
+
+class AutocompletePagination(Pagination):
+
+    def paginate_queryset(self, queryset, request, view=None):
+        self.view = view
+        return super().paginate_queryset(queryset, request, view)
+
+    def get_autocomplete(self):
+        schema = QLSearch().get_schema(self.request, self.view)
+        introspections = {}
+        if hasattr(self.view, "get_ql_fields"):
+            from authentik.enterprise.search.schema import AKQLSchemaSerializer
+
+            introspections = AKQLSchemaSerializer().serialize(
+                schema(self.page.paginator.object_list.model)
+            )
+        return introspections
+
+    def get_paginated_response(self, data):
+        previous_page_number = 0
+        if self.page.has_previous():
+            previous_page_number = self.page.previous_page_number()
+        next_page_number = 0
+        if self.page.has_next():
+            next_page_number = self.page.next_page_number()
+        return Response(
+            {
+                "pagination": {
+                    "next": next_page_number,
+                    "previous": previous_page_number,
+                    "count": self.page.paginator.count,
+                    "current": self.page.number,
+                    "total_pages": self.page.paginator.num_pages,
+                    "start_index": self.page.start_index(),
+                    "end_index": self.page.end_index(),
+                },
+                "results": data,
+                "autocomplete": self.get_autocomplete(),
+            }
+        )
+
+    def get_paginated_response_schema(self, schema):
+        final_schema = super().get_paginated_response_schema(schema)
+        final_schema["properties"]["autocomplete"] = {
+            "$ref": f"#/components/schemas/{AUTOCOMPLETE_COMPONENT_NAME}"
+        }
+        final_schema["required"].append("autocomplete")
+        return final_schema

authentik/enterprise/search/ql.py

@@ -0,0 +1,80 @@
+"""DjangoQL search"""
+
+from django.apps import apps
+from django.db.models import QuerySet
+from djangoql.ast import Name
+from djangoql.exceptions import DjangoQLError
+from djangoql.queryset import apply_search
+from djangoql.schema import DjangoQLSchema
+from rest_framework.filters import BaseFilterBackend, SearchFilter
+from rest_framework.request import Request
+from structlog.stdlib import get_logger
+
+from authentik.enterprise.search.fields import JSONSearchField
+
+LOGGER = get_logger()
+AUTOCOMPLETE_COMPONENT_NAME = "Autocomplete"
+AUTOCOMPLETE_SCHEMA = {
+    "type": "object",
+    "additionalProperties": {},
+}
+
+
+class BaseSchema(DjangoQLSchema):
+    """Base Schema which deals with JSON Fields"""
+
+    def resolve_name(self, name: Name):
+        model = self.model_label(self.current_model)
+        root_field = name.parts[0]
+        field = self.models[model].get(root_field)
+        # If the query goes into a JSON field, return the root
+        # field as the JSON field will do the rest
+        if isinstance(field, JSONSearchField):
+            # This is a workaround; build_filter will remove the right-most
+            # entry in the path as that is intended to be the same as the field
+            # however for JSON that is not the case
+            if name.parts[-1] != root_field:
+                name.parts.append(root_field)
+            return field
+        return super().resolve_name(name)
+
+
+class QLSearch(BaseFilterBackend):
+    """rest_framework search filter which uses DjangoQL"""
+
+    def __init__(self):
+        super().__init__()
+        self._fallback = SearchFilter()
+
+    @property
+    def enabled(self):
+        return apps.get_app_config("authentik_enterprise").enabled()
+
+    def get_search_terms(self, request: Request) -> str:
+        """Search terms are set by a ?search=... query parameter,
+        and may be comma and/or whitespace delimited."""
+        params = request.query_params.get("search", "")
+        params = params.replace("\x00", "")  # strip null characters
+        return params
+
+    def get_schema(self, request: Request, view) -> BaseSchema:
+        ql_fields = []
+        if hasattr(view, "get_ql_fields"):
+            ql_fields = view.get_ql_fields()
+
+        class InlineSchema(BaseSchema):
+            def get_fields(self, model):
+                return ql_fields or []
+
+        return InlineSchema
+
+    def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
+        search_query = self.get_search_terms(request)
+        schema = self.get_schema(request, view)
+        if len(search_query) == 0 or not self.enabled:
+            return self._fallback.filter_queryset(request, queryset, view)
+        try:
+            return apply_search(queryset, search_query, schema=schema)
+        except DjangoQLError as exc:
+            LOGGER.debug("Failed to parse search expression", exc=exc)
+            return self._fallback.filter_queryset(request, queryset, view)

authentik/enterprise/search/schema.py

@@ -0,0 +1,29 @@
+from djangoql.serializers import DjangoQLSchemaSerializer
+from drf_spectacular.generators import SchemaGenerator
+
+from authentik.api.schema import create_component
+from authentik.enterprise.search.fields import JSONSearchField
+from authentik.enterprise.search.ql import AUTOCOMPLETE_COMPONENT_NAME, AUTOCOMPLETE_SCHEMA
+
+
+class AKQLSchemaSerializer(DjangoQLSchemaSerializer):
+    def serialize(self, schema):
+        serialization = super().serialize(schema)
+        for _, fields in schema.models.items():
+            for _, field in fields.items():
+                if not isinstance(field, JSONSearchField):
+                    continue
+                serialization["models"].update(field.get_nested_options())
+        return serialization
+
+    def serialize_field(self, field):
+        result = super().serialize_field(field)
+        if isinstance(field, JSONSearchField):
+            result["relation"] = field.relation()
+        return result
+
+
+def postprocess_schema_search_autocomplete(result, generator: SchemaGenerator, **kwargs):
+    create_component(generator, AUTOCOMPLETE_COMPONENT_NAME, AUTOCOMPLETE_SCHEMA)
+
+    return result

authentik/enterprise/search/settings.py

@@ -0,0 +1,17 @@
+SPECTACULAR_SETTINGS = {
+    "POSTPROCESSING_HOOKS": [
+        "authentik.api.schema.postprocess_schema_responses",
+        "authentik.enterprise.search.schema.postprocess_schema_search_autocomplete",
+        "drf_spectacular.hooks.postprocess_schema_enums",
+    ],
+}
+
+REST_FRAMEWORK = {
+    "DEFAULT_PAGINATION_CLASS": "authentik.enterprise.search.pagination.AutocompletePagination",
+    "DEFAULT_FILTER_BACKENDS": [
+        "authentik.enterprise.search.ql.QLSearch",
+        "authentik.rbac.filters.ObjectFilter",
+        "django_filters.rest_framework.DjangoFilterBackend",
+        "rest_framework.filters.OrderingFilter",
+    ],
+}

authentik/enterprise/search/tests.py

@@ -0,0 +1,78 @@
+from json import loads
+from unittest.mock import PropertyMock, patch
+from urllib.parse import urlencode
+
+from django.urls import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.tests.utils import create_test_admin_user
+
+
+@patch(
+    "authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware.enabled",
+    PropertyMock(return_value=True),
+)
+class QLTest(APITestCase):
+
+    def setUp(self):
+        self.user = create_test_admin_user()
+        # ensure we have more than 1 user
+        create_test_admin_user()
+
+    def test_search(self):
+        """Test simple search query"""
+        self.client.force_login(self.user)
+        query = f'username = "{self.user.username}"'
+        res = self.client.get(
+            reverse(
+                "authentik_api:user-list",
+            )
+            + f"?{urlencode({"search": query})}"
+        )
+        self.assertEqual(res.status_code, 200)
+        content = loads(res.content)
+        self.assertEqual(content["pagination"]["count"], 1)
+        self.assertEqual(content["results"][0]["username"], self.user.username)
+
+    def test_no_search(self):
+        """Ensure works with no search query"""
+        self.client.force_login(self.user)
+        res = self.client.get(
+            reverse(
+                "authentik_api:user-list",
+            )
+        )
+        self.assertEqual(res.status_code, 200)
+        content = loads(res.content)
+        self.assertNotEqual(content["pagination"]["count"], 1)
+
+    def test_search_no_ql(self):
+        """Test simple search query (no QL)"""
+        self.client.force_login(self.user)
+        res = self.client.get(
+            reverse(
+                "authentik_api:user-list",
+            )
+            + f"?{urlencode({"search": self.user.username})}"
+        )
+        self.assertEqual(res.status_code, 200)
+        content = loads(res.content)
+        self.assertEqual(content["pagination"]["count"], 1)
+        self.assertEqual(content["results"][0]["username"], self.user.username)
+
+    def test_search_json(self):
+        """Test search query with a JSON attribute"""
+        self.user.attributes = {"foo": {"bar": "baz"}}
+        self.user.save()
+        self.client.force_login(self.user)
+        query = 'attributes.foo.bar = "baz"'
+        res = self.client.get(
+            reverse(
+                "authentik_api:user-list",
+            )
+            + f"?{urlencode({"search": query})}"
+        )
+        self.assertEqual(res.status_code, 200)
+        content = loads(res.content)
+        self.assertEqual(content["pagination"]["count"], 1)
+        self.assertEqual(content["results"][0]["username"], self.user.username)

authentik/enterprise/settings.py

@@ -1,23 +1,12 @@
 """Enterprise additional settings"""
 
-from celery.schedules import crontab
-
-from authentik.lib.utils.time import fqdn_rand
-
-CELERY_BEAT_SCHEDULE = {
-    "enterprise_update_usage": {
-        "task": "authentik.enterprise.tasks.enterprise_update_usage",
-        "schedule": crontab(minute=fqdn_rand("enterprise_update_usage"), hour="*/2"),
-        "options": {"queue": "authentik_scheduled"},
-    }
-}
-
 TENANT_APPS = [
     "authentik.enterprise.audit",
     "authentik.enterprise.policies.unique_password",
     "authentik.enterprise.providers.google_workspace",
     "authentik.enterprise.providers.microsoft_entra",
     "authentik.enterprise.providers.ssf",
+    "authentik.enterprise.search",
     "authentik.enterprise.stages.authenticator_endpoint_gdtc",
     "authentik.enterprise.stages.mtls",
     "authentik.enterprise.stages.source",

authentik/enterprise/signals.py

@@ -10,6 +10,7 @@ from django.utils.timezone import get_current_timezone
 from authentik.enterprise.license import CACHE_KEY_ENTERPRISE_LICENSE
 from authentik.enterprise.models import License
 from authentik.enterprise.tasks import enterprise_update_usage
+from authentik.tasks.schedules.models import Schedule
 
 
 @receiver(pre_save, sender=License)
@@ -26,7 +27,7 @@ def pre_save_license(sender: type[License], instance: License, **_):
 def post_save_license(sender: type[License], instance: License, **_):
     """Trigger license usage calculation when license is saved"""
     cache.delete(CACHE_KEY_ENTERPRISE_LICENSE)
-    enterprise_update_usage.delay()
+    Schedule.dispatch_by_actor(enterprise_update_usage)
 
 
 @receiver(post_delete, sender=License)

authentik/enterprise/stages/source/stage.py

@@ -97,6 +97,7 @@ class SourceStageFinal(StageView):
         token: FlowToken = self.request.session.get(SESSION_KEY_OVERRIDE_FLOW_TOKEN)
         self.logger.info("Replacing source flow with overridden flow", flow=token.flow.slug)
         plan = token.plan
+        plan.context.update(self.executor.plan.context)
         plan.context[PLAN_CONTEXT_IS_RESTORED] = token
         response = plan.to_redirect(self.request, token.flow)
         token.delete()

authentik/enterprise/stages/source/tests.py

@@ -90,14 +90,17 @@ class TestSourceStage(FlowTestCase):
         plan: FlowPlan = session[SESSION_KEY_PLAN]
         plan.insert_stage(in_memory_stage(SourceStageFinal), index=0)
         plan.context[PLAN_CONTEXT_IS_RESTORED] = flow_token
+        plan.context["foo"] = "bar"
         session[SESSION_KEY_PLAN] = plan
         session.save()
 
         # Pretend we've just returned from the source
-        response = self.client.get(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}), follow=True
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertStageRedirects(
-            response, reverse("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
-        )
+        with self.assertFlowFinishes() as ff:
+            response = self.client.get(
+                reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}), follow=True
+            )
+            self.assertEqual(response.status_code, 200)
+            self.assertStageRedirects(
+                response, reverse("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
+            )
+        self.assertEqual(ff().context["foo"], "bar")

authentik/enterprise/tasks.py

@@ -1,14 +1,11 @@
 """Enterprise tasks"""
 
+from django.utils.translation import gettext_lazy as _
+from dramatiq.actor import actor
+
 from authentik.enterprise.license import LicenseKey
-from authentik.events.models import TaskStatus
-from authentik.events.system_tasks import SystemTask, prefill_task
-from authentik.root.celery import CELERY_APP
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def enterprise_update_usage(self: SystemTask):
-    """Update enterprise license status"""
+@actor(description=_("Update enterprise license status."))
+def enterprise_update_usage():
     LicenseKey.get_total().record_usage()
-    self.set_status(TaskStatus.SUCCESSFUL)

authentik/events/api/events.py

@@ -132,6 +132,22 @@ class EventViewSet(ModelViewSet):
     ]
     filterset_class = EventsFilter
 
+    def get_ql_fields(self):
+        from djangoql.schema import DateTimeField, StrField
+
+        from authentik.enterprise.search.fields import ChoiceSearchField, JSONSearchField
+
+        return [
+            ChoiceSearchField(Event, "action"),
+            StrField(Event, "event_uuid"),
+            StrField(Event, "app", suggest_options=True),
+            StrField(Event, "client_ip"),
+            JSONSearchField(Event, "user", suggest_nested=False),
+            JSONSearchField(Event, "brand", suggest_nested=False),
+            JSONSearchField(Event, "context", suggest_nested=False),
+            DateTimeField(Event, "created", suggest_options=True),
+        ]
+
     @extend_schema(
         methods=["GET"],
         responses={200: EventTopPerUserSerializer(many=True)},

authentik/events/api/notification_rules.py

@@ -11,7 +11,7 @@ from authentik.events.models import NotificationRule
 class NotificationRuleSerializer(ModelSerializer):
     """NotificationRule Serializer"""
 
-    group_obj = GroupSerializer(read_only=True, source="group")
+    destination_group_obj = GroupSerializer(read_only=True, source="destination_group")
 
     class Meta:
         model = NotificationRule
@@ -20,8 +20,9 @@ class NotificationRuleSerializer(ModelSerializer):
             "name",
             "transports",
             "severity",
-            "group",
-            "group_obj",
+            "destination_group",
+            "destination_group_obj",
+            "destination_event_user",
         ]
 
 
@@ -30,6 +31,6 @@ class NotificationRuleViewSet(UsedByMixin, ModelViewSet):
 
     queryset = NotificationRule.objects.all()
     serializer_class = NotificationRuleSerializer
-    filterset_fields = ["name", "severity", "group__name"]
+    filterset_fields = ["name", "severity", "destination_group__name"]
     ordering = ["name"]
-    search_fields = ["name", "group__name"]
+    search_fields = ["name", "destination_group__name"]

authentik/events/api/tasks.py

@@ -1,104 +0,0 @@
-"""Tasks API"""
-
-from importlib import import_module
-
-from django.contrib import messages
-from django.utils.translation import gettext_lazy as _
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
-from rest_framework.decorators import action
-from rest_framework.fields import (
-    CharField,
-    ChoiceField,
-    DateTimeField,
-    FloatField,
-    SerializerMethodField,
-)
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.viewsets import ReadOnlyModelViewSet
-from structlog.stdlib import get_logger
-
-from authentik.core.api.utils import ModelSerializer
-from authentik.events.logs import LogEventSerializer
-from authentik.events.models import SystemTask, TaskStatus
-from authentik.rbac.decorators import permission_required
-
-LOGGER = get_logger()
-
-
-class SystemTaskSerializer(ModelSerializer):
-    """Serialize TaskInfo and TaskResult"""
-
-    name = CharField()
-    full_name = SerializerMethodField()
-    uid = CharField(required=False)
-    description = CharField()
-    start_timestamp = DateTimeField(read_only=True)
-    finish_timestamp = DateTimeField(read_only=True)
-    duration = FloatField(read_only=True)
-
-    status = ChoiceField(choices=[(x.value, x.name) for x in TaskStatus])
-    messages = LogEventSerializer(many=True)
-
-    def get_full_name(self, instance: SystemTask) -> str:
-        """Get full name with UID"""
-        if instance.uid:
-            return f"{instance.name}:{instance.uid}"
-        return instance.name
-
-    class Meta:
-        model = SystemTask
-        fields = [
-            "uuid",
-            "name",
-            "full_name",
-            "uid",
-            "description",
-            "start_timestamp",
-            "finish_timestamp",
-            "duration",
-            "status",
-            "messages",
-            "expires",
-            "expiring",
-        ]
-
-
-class SystemTaskViewSet(ReadOnlyModelViewSet):
-    """Read-only view set that returns all background tasks"""
-
-    queryset = SystemTask.objects.all()
-    serializer_class = SystemTaskSerializer
-    filterset_fields = ["name", "uid", "status"]
-    ordering = ["name", "uid", "status"]
-    search_fields = ["name", "description", "uid", "status"]
-
-    @permission_required(None, ["authentik_events.run_task"])
-    @extend_schema(
-        request=OpenApiTypes.NONE,
-        responses={
-            204: OpenApiResponse(description="Task retried successfully"),
-            404: OpenApiResponse(description="Task not found"),
-            500: OpenApiResponse(description="Failed to retry task"),
-        },
-    )
-    @action(detail=True, methods=["POST"], permission_classes=[])
-    def run(self, request: Request, pk=None) -> Response:
-        """Run task"""
-        task: SystemTask = self.get_object()
-        try:
-            task_module = import_module(task.task_call_module)
-            task_func = getattr(task_module, task.task_call_func)
-            LOGGER.info("Running task", task=task_func)
-            task_func.delay(*task.task_call_args, **task.task_call_kwargs)
-            messages.success(
-                self.request,
-                _("Successfully started task {name}.".format_map({"name": task.name})),
-            )
-            return Response(status=204)
-        except (ImportError, AttributeError) as exc:  # pragma: no cover
-            LOGGER.warning("Failed to run task, remove state", task=task.name, exc=exc)
-            # if we get an import error, the module path has probably changed
-            task.delete()
-            return Response(status=500)

authentik/events/apps.py

@@ -1,12 +1,11 @@
 """authentik events app"""
 
-from celery.schedules import crontab
 from prometheus_client import Gauge, Histogram
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.config import CONFIG, ENV_PREFIX
-from authentik.lib.utils.reflection import path_to_class
-from authentik.root.celery import CELERY_APP
+from authentik.lib.utils.time import fqdn_rand
+from authentik.tasks.schedules.lib import ScheduleSpec
 
 # TODO: Deprecated metric - remove in 2024.2 or later
 GAUGE_TASKS = Gauge(
@@ -35,6 +34,17 @@ class AuthentikEventsConfig(ManagedAppConfig):
     verbose_name = "authentik Events"
     default = True
 
+    @property
+    def tenant_schedule_specs(self) -> list[ScheduleSpec]:
+        from authentik.events.tasks import notification_cleanup
+
+        return [
+            ScheduleSpec(
+                actor=notification_cleanup,
+                crontab=f"{fqdn_rand('notification_cleanup')} */8 * * *",
+            ),
+        ]
+
     @ManagedAppConfig.reconcile_global
     def check_deprecations(self):
         """Check for config deprecations"""
@@ -56,41 +66,3 @@ class AuthentikEventsConfig(ManagedAppConfig):
                 replacement_env=replace_env,
                 message=msg,
             ).save()
-
-    @ManagedAppConfig.reconcile_tenant
-    def prefill_tasks(self):
-        """Prefill tasks"""
-        from authentik.events.models import SystemTask
-        from authentik.events.system_tasks import _prefill_tasks
-
-        for task in _prefill_tasks:
-            if SystemTask.objects.filter(name=task.name).exists():
-                continue
-            task.save()
-            self.logger.debug("prefilled task", task_name=task.name)
-
-    @ManagedAppConfig.reconcile_tenant
-    def run_scheduled_tasks(self):
-        """Run schedule tasks which are behind schedule (only applies
-        to tasks of which we keep metrics)"""
-        from authentik.events.models import TaskStatus
-        from authentik.events.system_tasks import SystemTask as CelerySystemTask
-
-        for task in CELERY_APP.conf["beat_schedule"].values():
-            schedule = task["schedule"]
-            if not isinstance(schedule, crontab):
-                continue
-            task_class: CelerySystemTask = path_to_class(task["task"])
-            if not isinstance(task_class, CelerySystemTask):
-                continue
-            db_task = task_class.db()
-            if not db_task:
-                continue
-            due, _ = schedule.is_due(db_task.finish_timestamp)
-            if due or db_task.status == TaskStatus.UNKNOWN:
-                self.logger.debug("Running past-due scheduled task", task=task["task"])
-                task_class.apply_async(
-                    args=task.get("args", None),
-                    kwargs=task.get("kwargs", None),
-                    **task.get("options", {}),
-                )

authentik/events/context_processors/mmdb.py

@@ -15,13 +15,13 @@ class MMDBContextProcessor(EventContextProcessor):
         self.reader: Reader | None = None
         self._last_mtime: float = 0.0
         self.logger = get_logger()
-        self.open()
+        self.load()
 
     def path(self) -> str | None:
         """Get the path to the MMDB file to load"""
         raise NotImplementedError
 
-    def open(self):
+    def load(self):
         """Get GeoIP Reader, if configured, otherwise none"""
         path = self.path()
         if path == "" or not path:
@@ -44,7 +44,7 @@ class MMDBContextProcessor(EventContextProcessor):
             diff = self._last_mtime < mtime
             if diff > 0:
                 self.logger.info("Found new MMDB Database, reopening", diff=diff, path=path)
-                self.open()
+                self.load()
         except OSError as exc:
             self.logger.warning("Failed to check MMDB age", exc=exc)
 

authentik/events/middleware.py

@@ -19,7 +19,7 @@ from authentik.blueprints.v1.importer import excluded_models
 from authentik.core.models import Group, User
 from authentik.events.models import Event, EventAction, Notification
 from authentik.events.utils import model_to_dict
-from authentik.lib.sentry import before_send
+from authentik.lib.sentry import should_ignore_exception
 from authentik.lib.utils.errors import exception_to_string
 from authentik.stages.authenticator_static.models import StaticToken
 
@@ -173,7 +173,7 @@ class AuditMiddleware:
                 message=exception_to_string(exception),
             )
             thread.run()
-        elif before_send({}, {"exc_info": (None, exception, None)}) is not None:
+        elif not should_ignore_exception(exception):
             thread = EventNewThread(
                 EventAction.SYSTEM_EXCEPTION,
                 request,

authentik/events/migrations/0010_rename_group_notificationrule_destination_group_and_more.py

@@ -0,0 +1,26 @@
+# Generated by Django 5.1.11 on 2025-06-16 23:21
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_events", "0009_remove_notificationtransport_webhook_mapping_and_more"),
+    ]
+
+    operations = [
+        migrations.RenameField(
+            model_name="notificationrule",
+            old_name="group",
+            new_name="destination_group",
+        ),
+        migrations.AddField(
+            model_name="notificationrule",
+            name="destination_event_user",
+            field=models.BooleanField(
+                default=False,
+                help_text="When enabled, notification will be sent to user the user that triggered the event.When destination_group is configured, notification is sent to both.",
+            ),
+        ),
+    ]