release: 2023.2.0

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.1.2
+current_version = 2023.2.0
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.github/actions/setup/action.yml

@@ -18,7 +18,7 @@ runs:
     - name: Setup node
       uses: actions/setup-node@v3.1.0
       with:
-        node-version: '16'
+        node-version: '18'
         cache: 'npm'
         cache-dependency-path: web/package-lock.json
     - name: Setup dependencies

.github/workflows/ci-main.yml

@@ -188,7 +188,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
@@ -229,7 +229,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}

.github/workflows/ci-outpost.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: echo mark
-  build:
+  build-container:
     timeout-minutes: 120
     needs:
       - ci-outpost-mark
@@ -83,7 +83,7 @@ jobs:
       - name: Generate API
         run: make gen-client-go
       - name: Build Docker Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           tags: |
@@ -94,7 +94,8 @@ jobs:
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: ${{ matrix.arch }}
-  build-outpost-binary:
+          context: .
+  build-binary:
     timeout-minutes: 120
     needs:
       - ci-outpost-mark
@@ -114,7 +115,7 @@ jobs:
           go-version: "^1.17"
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - name: Generate API

.github/workflows/ci-web.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -49,7 +49,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -97,7 +97,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/

.github/workflows/ci-website.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: website/package-lock.json
       - working-directory: website/
@@ -25,9 +25,24 @@ jobs:
       - name: prettier
         working-directory: website/
         run: npm run prettier-check
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3.6.0
+        with:
+          node-version: '18'
+          cache: 'npm'
+          cache-dependency-path: website/package-lock.json
+      - working-directory: website/
+        run: npm ci
+      - name: test
+        working-directory: website/
+        run: npm test
   ci-website-mark:
     needs:
       - lint-prettier
+      - test
     runs-on: ubuntu-latest
     steps:
       - run: echo mark

.github/workflows/release-publish.yml

@@ -28,7 +28,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           push: ${{ github.event_name == 'release' }}
           secrets: |
@@ -76,7 +76,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v4
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
@@ -108,7 +108,7 @@ jobs:
           go-version: "^1.17"
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - name: Build web

.github/workflows/web-api-publish.yml

@@ -14,7 +14,7 @@ jobs:
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
       - uses: actions/setup-node@v3.6.0
         with:
-          node-version: '16'
+          node-version: '18'
           registry-url: 'https://registry.npmjs.org'
       - name: Generate API Client
         run: make gen-client-ts

.vscode/settings.json

@@ -46,5 +46,6 @@
             "url": "https://github.com/goauthentik/authentik/issues/<num>",
             "ignoreCase": false
         }
-    ]
+    ],
+    "go.testFlags": ["-count=1"]
 }

Dockerfile

@@ -20,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.11.1-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.11.2-slim-bullseye AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -31,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.19.5-bullseye AS go-builder
+FROM docker.io/golang:1.20.0-bullseye AS go-builder
 
 WORKDIR /work
 
@@ -62,7 +62,7 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     "
 
 # Stage 6: Run
-FROM docker.io/python:3.11.1-slim-bullseye AS final-image
+FROM docker.io/python:3.11.2-slim-bullseye AS final-image
 
 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.

README.md

@@ -38,6 +38,10 @@ See [Development Documentation](https://goauthentik.io/developer-docs/?utm_sourc
 
 See [SECURITY.md](SECURITY.md)
 
+## Support
+
+Your organization uses authentik? We'd love to add your logo to the readme and our website! Email us @ hello@goauthentik.io or open a GitHub Issue/PR!
+
 ## Sponsors
 
 This project is proudly sponsored by:
@@ -49,11 +53,3 @@ This project is proudly sponsored by:
 </p>
 
 DigitalOcean provides development and testing resources for authentik.
-
-<p>
-    <a href="https://www.netlify.com">
-        <img src="https://www.netlify.com/img/global/badges/netlify-color-accent.svg" alt="Deploys by Netlify" />
-    </a>
-</p>
-
-Netlify hosts the [goauthentik.io](https://goauthentik.io) site.

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.1.2"
+__version__ = "2023.2.0"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/system.py

@@ -97,8 +97,14 @@ class SystemView(APIView):
     permission_classes = [IsAdminUser]
     pagination_class = None
     filter_backends = []
+    serializer_class = SystemSerializer
 
     @extend_schema(responses={200: SystemSerializer(many=False)})
     def get(self, request: Request) -> Response:
         """Get system information."""
         return Response(SystemSerializer(request).data)
+
+    @extend_schema(responses={200: SystemSerializer(many=False)})
+    def post(self, request: Request) -> Response:
+        """Get system information."""
+        return Response(SystemSerializer(request).data)

authentik/admin/api/tasks.py

@@ -50,7 +50,8 @@ class TaskSerializer(PassiveSerializer):
         are pickled in cache. In that case, just delete the info"""
         try:
             return super().to_representation(instance)
-        except AttributeError:  # pragma: no cover
+        # pylint: disable=broad-except
+        except Exception:  # pragma: no cover
             if isinstance(self.instance, list):
                 for inst in self.instance:
                     inst.delete()

authentik/admin/signals.py

@@ -18,4 +18,4 @@ def monitoring_set_workers(sender, **kwargs):
 def monitoring_set_tasks(sender, **kwargs):
     """Set task gauges"""
     for task in TaskInfo.all().values():
-        task.set_prom_metrics()
+        task.update_metrics()

authentik/api/authentication.py

@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
 
 def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
-    from authentik.providers.oauth2.models import RefreshToken
+    from authentik.providers.oauth2.models import AccessToken
 
     auth_credentials = validate_auth(raw_header)
     if not auth_credentials:
@@ -55,8 +55,8 @@ def auth_user_lookup(raw_header: bytes) -> Optional[User]:
         CTX_AUTH_VIA.set("api_token")
         return key_token.user
     # then try to auth via JWT
-    jwt_token = RefreshToken.filter_not_expired(
-        refresh_token=auth_credentials, _scope__icontains=SCOPE_AUTHENTIK_API
+    jwt_token = AccessToken.filter_not_expired(
+        token=auth_credentials, _scope__icontains=SCOPE_AUTHENTIK_API
     ).first()
     if jwt_token:
         # Double-check scopes, since they are saved in a single string

authentik/api/tests/test_auth.py

@@ -1,4 +1,5 @@
 """Test API Authentication"""
+import json
 from base64 import b64encode
 
 from django.conf import settings
@@ -11,7 +12,7 @@ from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.lib.generators import generate_id
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
-from authentik.providers.oauth2.models import OAuth2Provider, RefreshToken
+from authentik.providers.oauth2.models import AccessToken, OAuth2Provider
 
 
 class TestAPIAuth(TestCase):
@@ -63,24 +64,26 @@ class TestAPIAuth(TestCase):
         provider = OAuth2Provider.objects.create(
             name=generate_id(), client_id=generate_id(), authorization_flow=create_test_flow()
         )
-        refresh = RefreshToken.objects.create(
+        refresh = AccessToken.objects.create(
             user=create_test_admin_user(),
             provider=provider,
-            refresh_token=generate_id(),
+            token=generate_id(),
             _scope=SCOPE_AUTHENTIK_API,
+            _id_token=json.dumps({}),
         )
-        self.assertEqual(bearer_auth(f"Bearer {refresh.refresh_token}".encode()), refresh.user)
+        self.assertEqual(bearer_auth(f"Bearer {refresh.token}".encode()), refresh.user)
 
     def test_jwt_missing_scope(self):
         """Test valid JWT"""
         provider = OAuth2Provider.objects.create(
             name=generate_id(), client_id=generate_id(), authorization_flow=create_test_flow()
         )
-        refresh = RefreshToken.objects.create(
+        refresh = AccessToken.objects.create(
             user=create_test_admin_user(),
             provider=provider,
-            refresh_token=generate_id(),
+            token=generate_id(),
             _scope="",
+            _id_token=json.dumps({}),
         )
         with self.assertRaises(AuthenticationFailed):
-            self.assertEqual(bearer_auth(f"Bearer {refresh.refresh_token}".encode()), refresh.user)
+            self.assertEqual(bearer_auth(f"Bearer {refresh.token}".encode()), refresh.user)

authentik/api/v3/urls.py

@@ -50,7 +50,11 @@ from authentik.policies.reputation.api import ReputationPolicyViewSet, Reputatio
 from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
 from authentik.providers.oauth2.api.providers import OAuth2ProviderViewSet
 from authentik.providers.oauth2.api.scopes import ScopeMappingViewSet
-from authentik.providers.oauth2.api.tokens import AuthorizationCodeViewSet, RefreshTokenViewSet
+from authentik.providers.oauth2.api.tokens import (
+    AccessTokenViewSet,
+    AuthorizationCodeViewSet,
+    RefreshTokenViewSet,
+)
 from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
 from authentik.providers.saml.api.property_mapping import SAMLPropertyMappingViewSet
 from authentik.providers.saml.api.providers import SAMLProviderViewSet
@@ -162,6 +166,7 @@ router.register("providers/saml", SAMLProviderViewSet)
 
 router.register("oauth2/authorization_codes", AuthorizationCodeViewSet)
 router.register("oauth2/refresh_tokens", RefreshTokenViewSet)
+router.register("oauth2/access_tokens", AccessTokenViewSet)
 
 router.register("propertymappings/all", PropertyMappingViewSet)
 router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)

authentik/blueprints/api.py

@@ -58,7 +58,6 @@ class BlueprintInstanceSerializer(ModelSerializer):
         return super().validate(attrs)
 
     class Meta:
-
         model = BlueprintInstance
         fields = [
             "pk",

authentik/blueprints/migrations/0001_initial.py

@@ -71,7 +71,6 @@ def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [("authentik_flows", "0001_initial")]
@@ -86,7 +85,12 @@ class Migration(migrations.Migration):
                     "managed",
                     models.TextField(
                         default=None,
-                        help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                        help_text=(
+                            "Objects which are managed by authentik. These objects are created and"
+                            " updated automatically. This is flag only indicates that an object can"
+                            " be overwritten by migrations. You can still modify the objects via"
+                            " the API, but expect changes to be overwritten in a later update."
+                        ),
                         null=True,
                         unique=True,
                         verbose_name="Managed by authentik",

authentik/blueprints/migrations/0002_blueprintinstance_content.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_blueprints", "0001_initial"),
     ]

authentik/blueprints/models.py

@@ -29,18 +29,15 @@ class ManagedModel(models.Model):
         null=True,
         verbose_name=_("Managed by authentik"),
         help_text=_(
-            (
-                "Objects which are managed by authentik. These objects are created and updated "
-                "automatically. This is flag only indicates that an object can be overwritten by "
-                "migrations. You can still modify the objects via the API, but expect changes "
-                "to be overwritten in a later update."
-            )
+            "Objects which are managed by authentik. These objects are created and updated "
+            "automatically. This is flag only indicates that an object can be overwritten by "
+            "migrations. You can still modify the objects via the API, but expect changes "
+            "to be overwritten in a later update."
         ),
         unique=True,
     )
 
     class Meta:
-
         abstract = True
 
 
@@ -109,7 +106,6 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return f"Blueprint Instance {self.name}"
 
     class Meta:
-
         verbose_name = _("Blueprint Instance")
         verbose_name_plural = _("Blueprint Instances")
         unique_together = (

authentik/blueprints/tests/test_v1.py

@@ -24,18 +24,14 @@ class TestBlueprintsV1(TransactionTestCase):
         importer = Importer('{"version": 3}')
         self.assertFalse(importer.validate()[0])
         importer = Importer(
-            (
-                '{"version": 1,"entries":[{"identifiers":{},"attrs":{},'
-                '"model": "authentik_core.User"}]}'
-            )
+            '{"version": 1,"entries":[{"identifiers":{},"attrs":{},'
+            '"model": "authentik_core.User"}]}'
         )
         self.assertFalse(importer.validate()[0])
         importer = Importer(
-            (
-                '{"version": 1, "entries": [{"attrs": {"name": "test"}, '
-                '"identifiers": {}, '
-                '"model": "authentik_core.Group"}]}'
-            )
+            '{"version": 1, "entries": [{"attrs": {"name": "test"}, '
+            '"identifiers": {}, '
+            '"model": "authentik_core.Group"}]}'
         )
         self.assertFalse(importer.validate()[0])
 
@@ -59,11 +55,9 @@ class TestBlueprintsV1(TransactionTestCase):
         )
 
         importer = Importer(
-            (
-                '{"version": 1, "entries": [{"attrs": {"name": "test999", "attributes": '
-                '{"key": ["updated_value"]}}, "identifiers": {"attributes": {"other_key": '
-                '["other_value"]}}, "model": "authentik_core.Group"}]}'
-            )
+            '{"version": 1, "entries": [{"attrs": {"name": "test999", "attributes": '
+            '{"key": ["updated_value"]}}, "identifiers": {"attributes": {"other_key": '
+            '["other_value"]}}, "model": "authentik_core.Group"}]}'
         )
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())

authentik/blueprints/v1/importer.py

@@ -7,6 +7,7 @@ from dacite.config import Config
 from dacite.core import from_dict
 from dacite.exceptions import DaciteError
 from deepmerge import always_merger
+from django.core.exceptions import FieldError
 from django.db import transaction
 from django.db.models import Model
 from django.db.models.query_utils import Q
@@ -181,7 +182,10 @@ class Importer:
         if not query:
             raise EntryInvalidError("No or invalid identifiers")
 
-        existing_models = model.objects.filter(query)
+        try:
+            existing_models = model.objects.filter(query)
+        except FieldError as exc:
+            raise EntryInvalidError(f"Invalid identifier field: {exc}") from exc
 
         serializer_kwargs = {}
         model_instance = existing_models.first()
@@ -231,8 +235,7 @@ class Importer:
                     raise IntegrityError
         except IntegrityError:
             return False
-        else:
-            self.logger.debug("Committing changes")
+        self.logger.debug("Committing changes")
         return True
 
     def _apply_models(self) -> bool:

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -56,5 +56,4 @@ class MetaApplyBlueprint(BaseMetaModel):
         return ApplyBlueprintMetaSerializer
 
     class Meta:
-
         abstract = True

authentik/blueprints/v1/meta/registry.py

@@ -14,7 +14,6 @@ class BaseMetaModel(Model):
         raise NotImplementedError
 
     class Meta:
-
         abstract = True
 
 

authentik/core/api/applications.py

@@ -63,7 +63,6 @@ class ApplicationSerializer(ModelSerializer):
         return app.get_launch_url(user)
 
     class Meta:
-
         model = Application
         fields = [
             "pk",

authentik/core/api/authenticated_sessions.py

@@ -74,7 +74,6 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         return GEOIP_READER.city_dict(instance.last_ip)
 
     class Meta:
-
         model = AuthenticatedSession
         fields = [
             "uuid",

authentik/core/api/groups.py

@@ -29,7 +29,6 @@ class GroupMemberSerializer(ModelSerializer):
     uid = CharField(read_only=True)
 
     class Meta:
-
         model = User
         fields = [
             "pk",
@@ -56,7 +55,6 @@ class GroupSerializer(ModelSerializer):
     num_pk = IntegerField(read_only=True)
 
     class Meta:
-
         model = Group
         fields = [
             "pk",
@@ -114,7 +112,6 @@ class GroupFilter(FilterSet):
             return queryset
 
     class Meta:
-
         model = Group
         fields = ["name", "is_superuser", "members_by_pk", "attributes", "members_by_username"]
 

authentik/core/api/propertymappings.py

@@ -49,7 +49,6 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
         return expression
 
     class Meta:
-
         model = PropertyMapping
         fields = [
             "pk",

authentik/core/api/providers.py

@@ -31,7 +31,6 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
         return obj.component
 
     class Meta:
-
         model = Provider
         fields = [
             "pk",

authentik/core/api/sources.py

@@ -46,7 +46,6 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
         return obj.component
 
     class Meta:
-
         model = Source
         fields = [
             "pk",

authentik/core/api/tokens.py

@@ -39,7 +39,6 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
         return attrs
 
     class Meta:
-
         model = Token
         fields = [
             "pk",
@@ -134,9 +133,10 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
     )
     @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     def set_key(self, request: Request, identifier: str) -> Response:
-        """Return token key and log access"""
+        """Set token key. Action is logged as event. `authentik_core.set_token_key` permission
+        is required."""
         token: Token = self.get_object()
-        key = request.POST.get("key")
+        key = request.data.get("key")
         if not key:
             return Response(status=400)
         token.key = key

authentik/core/api/users.py

@@ -43,6 +43,7 @@ from rest_framework.serializers import (
     PrimaryKeyRelatedField,
     ValidationError,
 )
+from rest_framework.validators import UniqueValidator
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 from structlog.stdlib import get_logger
@@ -84,7 +85,6 @@ class UserGroupSerializer(ModelSerializer):
     parent_name = CharField(source="parent.name", read_only=True)
 
     class Meta:
-
         model = Group
         fields = [
             "pk",
@@ -108,7 +108,7 @@ class UserSerializer(ModelSerializer):
     )
     groups_obj = ListSerializer(child=UserGroupSerializer(), read_only=True, source="ak_groups")
     uid = CharField(read_only=True)
-    username = CharField(max_length=150)
+    username = CharField(max_length=150, validators=[UniqueValidator(queryset=User.objects.all())])
 
     def validate_path(self, path: str) -> str:
         """Validate path"""
@@ -120,7 +120,6 @@ class UserSerializer(ModelSerializer):
         return path
 
     class Meta:
-
         model = User
         fields = [
             "pk",
@@ -172,7 +171,6 @@ class UserSelfSerializer(ModelSerializer):
         return user.group_attributes(self._context["request"]).get("settings", {})
 
     class Meta:
-
         model = User
         fields = [
             "pk",
@@ -402,7 +400,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 )
                 response["token"] = token.key
                 return Response(response)
-            except (IntegrityError) as exc:
+            except IntegrityError as exc:
                 return Response(data={"non_field_errors": [str(exc)]}, status=400)
 
     @extend_schema(responses={200: SessionUserSerializer(many=False)})

authentik/core/migrations/0001_initial.py

@@ -14,7 +14,6 @@ import authentik.core.models
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = [
@@ -44,7 +43,10 @@ class Migration(migrations.Migration):
                     "is_superuser",
                     models.BooleanField(
                         default=False,
-                        help_text="Designates that this user has all permissions without explicitly assigning them.",
+                        help_text=(
+                            "Designates that this user has all permissions without explicitly"
+                            " assigning them."
+                        ),
                         verbose_name="superuser status",
                     ),
                 ),
@@ -52,7 +54,9 @@ class Migration(migrations.Migration):
                     "username",
                     models.CharField(
                         error_messages={"unique": "A user with that username already exists."},
-                        help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
+                        help_text=(
+                            "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
+                        ),
                         max_length=150,
                         unique=True,
                         validators=[django.contrib.auth.validators.UnicodeUsernameValidator()],
@@ -83,7 +87,10 @@ class Migration(migrations.Migration):
                     "is_active",
                     models.BooleanField(
                         default=True,
-                        help_text="Designates whether this user should be treated as active. Unselect this instead of deleting accounts.",
+                        help_text=(
+                            "Designates whether this user should be treated as active. Unselect"
+                            " this instead of deleting accounts."
+                        ),
                         verbose_name="active",
                     ),
                 ),

authentik/core/migrations/0002_auto_20200523_1133_squashed_0011_provider_name_temp.py

@@ -51,7 +51,6 @@ def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_core", "0002_auto_20200523_1133"),
         ("authentik_core", "0003_default_user"),
@@ -172,7 +171,10 @@ class Migration(migrations.Migration):
             name="groups",
             field=models.ManyToManyField(
                 blank=True,
-                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
+                help_text=(
+                    "The groups this user belongs to. A user will get all permissions granted to"
+                    " each of their groups."
+                ),
                 related_name="user_set",
                 related_query_name="user",
                 to="auth.Group",

authentik/core/migrations/0012_auto_20201003_1737_squashed_0016_auto_20201202_2234.py

@@ -17,7 +17,6 @@ def set_default_token_key(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_core", "0012_auto_20201003_1737"),
         ("authentik_core", "0013_auto_20201003_2132"),

authentik/core/migrations/0017_managed.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0016_auto_20201202_2234"),
     ]
@@ -15,7 +14,12 @@ class Migration(migrations.Migration):
             name="managed",
             field=models.TextField(
                 default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                help_text=(
+                    "Objects which are managed by authentik. These objects are created and updated"
+                    " automatically. This is flag only indicates that an object can be overwritten"
+                    " by migrations. You can still modify the objects via the API, but expect"
+                    " changes to be overwritten in a later update."
+                ),
                 null=True,
                 verbose_name="Managed by authentik",
                 unique=True,
@@ -26,7 +30,12 @@ class Migration(migrations.Migration):
             name="managed",
             field=models.TextField(
                 default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                help_text=(
+                    "Objects which are managed by authentik. These objects are created and updated"
+                    " automatically. This is flag only indicates that an object can be overwritten"
+                    " by migrations. You can still modify the objects via the API, but expect"
+                    " changes to be overwritten in a later update."
+                ),
                 null=True,
                 verbose_name="Managed by authentik",
                 unique=True,

authentik/core/migrations/0018_auto_20210330_1345_squashed_0028_alter_token_intent.py

@@ -63,7 +63,6 @@ def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEdito
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_core", "0018_auto_20210330_1345"),
         ("authentik_core", "0019_source_managed"),
@@ -96,7 +95,12 @@ class Migration(migrations.Migration):
             name="managed",
             field=models.TextField(
                 default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                help_text=(
+                    "Objects which are managed by authentik. These objects are created and updated"
+                    " automatically. This is flag only indicates that an object can be overwritten"
+                    " by migrations. You can still modify the objects via the API, but expect"
+                    " changes to be overwritten in a later update."
+                ),
                 null=True,
                 unique=True,
                 verbose_name="Managed by authentik",
@@ -110,23 +114,38 @@ class Migration(migrations.Migration):
                     ("identifier", "Use the source-specific identifier"),
                     (
                         "email_link",
-                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
+                        (
+                            "Link to a user with identical email address. Can have security"
+                            " implications when a source doesn't validate email addresses."
+                        ),
                     ),
                     (
                         "email_deny",
-                        "Use the user's email address, but deny enrollment when the email address already exists.",
+                        (
+                            "Use the user's email address, but deny enrollment when the email"
+                            " address already exists."
+                        ),
                     ),
                     (
                         "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
+                        (
+                            "Link to a user with identical username. Can have security implications"
+                            " when a username is used with another source."
+                        ),
                     ),
                     (
                         "username_deny",
-                        "Use the user's username, but deny enrollment when the username already exists.",
+                        (
+                            "Use the user's username, but deny enrollment when the username already"
+                            " exists."
+                        ),
                     ),
                 ],
                 default="identifier",
-                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
+                help_text=(
+                    "How the source determines if an existing user should be authenticated or a new"
+                    " user enrolled."
+                ),
             ),
         ),
         migrations.AlterField(

authentik/core/migrations/0019_application_group.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0018_auto_20210330_1345_squashed_0028_alter_token_intent"),
     ]

authentik/core/migrations/0020_application_open_in_new_tab.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0019_application_group"),
     ]

authentik/core/migrations/0021_source_user_path_user_path.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0020_application_open_in_new_tab"),
     ]

authentik/core/migrations/0022_alter_group_parent.py

@@ -5,7 +5,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0021_source_user_path_user_path"),
     ]

authentik/core/migrations/0023_source_authentik_c_slug_ccb2e5_idx_and_more.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0022_alter_group_parent"),
     ]

authentik/core/migrations/0024_source_icon.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0023_source_authentik_c_slug_ccb2e5_idx_and_more"),
     ]

authentik/core/models.py

@@ -1,8 +1,7 @@
 """authentik core models"""
 from datetime import timedelta
-from hashlib import md5, sha256
+from hashlib import sha256
 from typing import Any, Optional
-from urllib.parse import urlencode
 from uuid import uuid4
 
 from deepmerge import always_merger
@@ -13,9 +12,7 @@ from django.contrib.auth.models import UserManager as DjangoUserManager
 from django.db import models
 from django.db.models import Q, QuerySet, options
 from django.http import HttpRequest
-from django.templatetags.static import static
 from django.utils.functional import SimpleLazyObject, cached_property
-from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from guardian.mixins import GuardianUserMixin
@@ -27,7 +24,8 @@ from authentik.blueprints.models import ManagedModel
 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.signals import password_changed
 from authentik.core.types import UILoginButton, UserSettingSerializer
-from authentik.lib.config import CONFIG, get_path_from_dict
+from authentik.lib.avatars import get_avatar
+from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id
 from authentik.lib.models import CreatedUpdatedModel, DomainlessURLValidator, SerializerModel
 from authentik.lib.utils.http import get_client_ip
@@ -49,9 +47,6 @@ USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
 USER_PATH_SYSTEM_PREFIX = "goauthentik.io"
 USER_PATH_SERVICE_ACCOUNT = USER_PATH_SYSTEM_PREFIX + "/service-accounts"
 
-GRAVATAR_URL = "https://secure.gravatar.com"
-DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
-
 
 options.DEFAULT_NAMES = options.DEFAULT_NAMES + ("authentik_used_by_shadows",)
 
@@ -129,7 +124,6 @@ class Group(SerializerModel):
         return f"Group {self.name}"
 
     class Meta:
-
         unique_together = (
             (
                 "name",
@@ -234,28 +228,9 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def avatar(self) -> str:
         """Get avatar, depending on authentik.avatar setting"""
-        mode: str = CONFIG.y("avatars", "none")
-        if mode == "none":
-            return DEFAULT_AVATAR
-        if mode.startswith("attributes."):
-            return get_path_from_dict(self.attributes, mode[11:], default=DEFAULT_AVATAR)
-        # gravatar uses md5 for their URLs, so md5 can't be avoided
-        mail_hash = md5(self.email.lower().encode("utf-8")).hexdigest()  # nosec
-        if mode == "gravatar":
-            parameters = [
-                ("s", "158"),
-                ("r", "g"),
-            ]
-            gravatar_url = f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
-            return escape(gravatar_url)
-        return mode % {
-            "username": self.username,
-            "mail_hash": mail_hash,
-            "upn": self.attributes.get("upn", ""),
-        }
+        return get_avatar(self)
 
     class Meta:
-
         permissions = (
             ("reset_user_password", "Reset Password"),
             ("impersonate", "Can impersonate other users"),
@@ -382,7 +357,6 @@ class Application(SerializerModel, PolicyBindingModel):
         return str(self.name)
 
     class Meta:
-
         verbose_name = _("Application")
         verbose_name_plural = _("Applications")
 
@@ -392,19 +366,15 @@ class SourceUserMatchingModes(models.TextChoices):
 
     IDENTIFIER = "identifier", _("Use the source-specific identifier")
     EMAIL_LINK = "email_link", _(
-        (
-            "Link to a user with identical email address. Can have security implications "
-            "when a source doesn't validate email addresses."
-        )
+        "Link to a user with identical email address. Can have security implications "
+        "when a source doesn't validate email addresses."
     )
     EMAIL_DENY = "email_deny", _(
         "Use the user's email address, but deny enrollment when the email address already exists."
     )
     USERNAME_LINK = "username_link", _(
-        (
-            "Link to a user with identical username. Can have security implications "
-            "when a username is used with another source."
-        )
+        "Link to a user with identical username. Can have security implications "
+        "when a username is used with another source."
     )
     USERNAME_DENY = "username_deny", _(
         "Use the user's username, but deny enrollment when the username already exists."
@@ -451,10 +421,8 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         choices=SourceUserMatchingModes.choices,
         default=SourceUserMatchingModes.IDENTIFIER,
         help_text=_(
-            (
-                "How the source determines if an existing user should be authenticated or "
-                "a new user enrolled."
-            )
+            "How the source determines if an existing user should be authenticated or "
+            "a new user enrolled."
         ),
     )
 
@@ -500,7 +468,6 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         return str(self.name)
 
     class Meta:
-
         indexes = [
             models.Index(
                 fields=[
@@ -529,7 +496,6 @@ class UserSourceConnection(SerializerModel, CreatedUpdatedModel):
         raise NotImplementedError
 
     class Meta:
-
         unique_together = (("user", "source"),)
 
 
@@ -562,7 +528,6 @@ class ExpiringModel(models.Model):
         return now() > self.expires
 
     class Meta:
-
         abstract = True
 
 
@@ -628,7 +593,6 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
         return description
 
     class Meta:
-
         verbose_name = _("Token")
         verbose_name_plural = _("Tokens")
         indexes = [
@@ -671,7 +635,6 @@ class PropertyMapping(SerializerModel, ManagedModel):
         return f"Property Mapping {self.name}"
 
     class Meta:
-
         verbose_name = _("Property Mapping")
         verbose_name_plural = _("Property Mappings")
 
@@ -708,6 +671,5 @@ class AuthenticatedSession(ExpiringModel):
         )
 
     class Meta:
-
         verbose_name = _("Authenticated Session")
         verbose_name_plural = _("Authenticated Sessions")

authentik/core/sources/flow_manager.py

@@ -190,11 +190,8 @@ class SourceFlowManager:
         # Default case, assume deny
         error = Exception(
             _(
-                (
-                    "Request to authenticate with %(source)s has been denied. Please authenticate "
-                    "with the source you've previously signed up with."
-                )
-                % {"source": self.source.name}
+                "Request to authenticate with %(source)s has been denied. Please authenticate "
+                "with the source you've previously signed up with." % {"source": self.source.name}
             ),
         )
         return self.error_handler(error)

authentik/core/tasks.py

@@ -43,7 +43,12 @@ def clean_expired_models(self: MonitoredTask):
     amount = 0
     for session in AuthenticatedSession.objects.all():
         cache_key = f"{KEY_PREFIX}{session.session_key}"
-        value = cache.get(cache_key)
+        value = None
+        try:
+            value = cache.get(cache_key)
+        # pylint: disable=broad-except
+        except Exception as exc:
+            LOGGER.debug("Failed to get session from cache", exc=exc)
         if not value:
             session.delete()
             amount += 1

authentik/core/templates/base/skeleton.html

@@ -13,7 +13,6 @@
         <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}">
         <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}">
         <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/dropdown.css' %}">
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">

authentik/core/templates/if/end_session.html

@@ -21,9 +21,15 @@ You've logged out of {{ application }}.
         {% endblocktrans %}
     </p>
 
-    <a id="ak-back-home" href="{% url 'authentik_core:root-redirect' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
+    <a id="ak-back-home" href="{% url 'authentik_core:root-redirect' %}" class="pf-c-button pf-m-primary">
+        {% trans 'Go back to overview' %}
+    </a>
 
-    <a id="logout" href="{% url 'authentik_flows:default-invalidation' %}" class="pf-c-button pf-m-secondary">{% trans 'Log out of authentik' %}</a>
+    <a id="logout" href="{% url 'authentik_flows:default-invalidation' %}" class="pf-c-button pf-m-secondary">
+        {% blocktrans with branding_title=tenant.branding_title %}
+            Log out of {{ branding_title }}
+        {% endblocktrans %}
+    </a>
 
     {% if application.get_launch_url %}
     <a href="{{ application.get_launch_url }}" class="pf-c-button pf-m-secondary">

authentik/core/tests/test_token_api.py

@@ -7,6 +7,7 @@ from rest_framework.test import APITestCase
 
 from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
 from authentik.core.tests.utils import create_test_admin_user
+from authentik.lib.generators import generate_id
 
 
 class TestTokenAPI(APITestCase):
@@ -30,6 +31,28 @@ class TestTokenAPI(APITestCase):
         self.assertEqual(token.expiring, True)
         self.assertTrue(self.user.has_perm("authentik_core.view_token_key", token))
 
+    def test_token_set_key(self):
+        """Test token creation endpoint"""
+        response = self.client.post(
+            reverse("authentik_api:token-list"), {"identifier": "test-token"}
+        )
+        self.assertEqual(response.status_code, 201)
+        token = Token.objects.get(identifier="test-token")
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, True)
+        self.assertTrue(self.user.has_perm("authentik_core.view_token_key", token))
+
+        self.client.force_login(self.admin)
+        new_key = generate_id()
+        response = self.client.post(
+            reverse("authentik_api:token-set-key", kwargs={"identifier": token.identifier}),
+            {"key": new_key},
+        )
+        self.assertEqual(response.status_code, 204)
+        token.refresh_from_db()
+        self.assertEqual(token.key, new_key)
+
     def test_token_create_invalid(self):
         """Test token creation endpoint (invalid data)"""
         response = self.client.post(
@@ -57,7 +80,7 @@ class TestTokenAPI(APITestCase):
             identifier="test", expiring=False, user=self.user
         )
         Token.objects.create(identifier="test-2", expiring=False, user=get_anonymous_user())
-        response = self.client.get(reverse(("authentik_api:token-list")))
+        response = self.client.get(reverse("authentik_api:token-list"))
         body = loads(response.content)
         self.assertEqual(len(body["results"]), 1)
         self.assertEqual(body["results"][0]["identifier"], token_should.identifier)
@@ -71,7 +94,7 @@ class TestTokenAPI(APITestCase):
         token_should_not: Token = Token.objects.create(
             identifier="test-2", expiring=False, user=get_anonymous_user()
         )
-        response = self.client.get(reverse(("authentik_api:token-list")))
+        response = self.client.get(reverse("authentik_api:token-list"))
         body = loads(response.content)
         self.assertEqual(len(body["results"]), 2)
         self.assertEqual(body["results"][0]["identifier"], token_should.identifier)

authentik/core/tests/test_users_api.py

@@ -1,5 +1,4 @@
 """Test Users API"""
-from json import loads
 
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
@@ -9,7 +8,6 @@ from rest_framework.test import APITestCase
 from authentik.core.models import AuthenticatedSession, User
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow, create_test_tenant
 from authentik.flows.models import FlowDesignation
-from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id, generate_key
 from authentik.stages.email.models import EmailStage
 from authentik.tenants.models import Tenant
@@ -222,44 +220,6 @@ class TestUsersAPI(APITestCase):
         response = self.client.get(reverse("authentik_api:user-me"))
         self.assertEqual(response.status_code, 200)
 
-    @CONFIG.patch("avatars", "none")
-    def test_avatars_none(self):
-        """Test avatars none"""
-        self.client.force_login(self.admin)
-        response = self.client.get(reverse("authentik_api:user-me"))
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content.decode())
-        self.assertEqual(body["user"]["avatar"], "/static/dist/assets/images/user_default.png")
-
-    @CONFIG.patch("avatars", "gravatar")
-    def test_avatars_gravatar(self):
-        """Test avatars gravatar"""
-        self.client.force_login(self.admin)
-        response = self.client.get(reverse("authentik_api:user-me"))
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content.decode())
-        self.assertIn("gravatar", body["user"]["avatar"])
-
-    @CONFIG.patch("avatars", "foo-%(username)s")
-    def test_avatars_custom(self):
-        """Test avatars custom"""
-        self.client.force_login(self.admin)
-        response = self.client.get(reverse("authentik_api:user-me"))
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content.decode())
-        self.assertEqual(body["user"]["avatar"], f"foo-{self.admin.username}")
-
-    @CONFIG.patch("avatars", "attributes.foo.avatar")
-    def test_avatars_attributes(self):
-        """Test avatars attributes"""
-        self.admin.attributes = {"foo": {"avatar": "bar"}}
-        self.admin.save()
-        self.client.force_login(self.admin)
-        response = self.client.get(reverse("authentik_api:user-me"))
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content.decode())
-        self.assertEqual(body["user"]["avatar"], "bar")
-
     def test_session_delete(self):
         """Ensure sessions are deleted when a user is deactivated"""
         user = create_test_admin_user()

authentik/core/tests/test_users_avatars.py

@@ -0,0 +1,84 @@
+"""Test Users Avatars"""
+from json import loads
+
+from django.urls.base import reverse
+from requests_mock import Mocker
+from rest_framework.test import APITestCase
+
+from authentik.core.models import User
+from authentik.core.tests.utils import create_test_admin_user
+from authentik.lib.config import CONFIG
+
+
+class TestUsersAvatars(APITestCase):
+    """Test Users avatars"""
+
+    def setUp(self) -> None:
+        self.admin = create_test_admin_user()
+        self.user = User.objects.create(username="test-user")
+
+    @CONFIG.patch("avatars", "none")
+    def test_avatars_none(self):
+        """Test avatars none"""
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertEqual(body["user"]["avatar"], "/static/dist/assets/images/user_default.png")
+
+    @CONFIG.patch("avatars", "gravatar")
+    def test_avatars_gravatar(self):
+        """Test avatars gravatar"""
+        self.admin.email = "static@t.goauthentik.io"
+        self.admin.save()
+        self.client.force_login(self.admin)
+        with Mocker() as mocker:
+            mocker.head(
+                (
+                    "https://secure.gravatar.com/avatar/84730f9c1851d1ea03f1a"
+                    "a9ed85bd1ea?size=158&rating=g&default=404"
+                ),
+                text="foo",
+            )
+            response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertIn("gravatar", body["user"]["avatar"])
+
+    @CONFIG.patch("avatars", "initials")
+    def test_avatars_initials(self):
+        """Test avatars initials"""
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertIn("data:image/svg+xml;base64,", body["user"]["avatar"])
+
+    @CONFIG.patch("avatars", "foo://%(username)s")
+    def test_avatars_custom(self):
+        """Test avatars custom"""
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertEqual(body["user"]["avatar"], f"foo://{self.admin.username}")
+
+    @CONFIG.patch("avatars", "attributes.foo.avatar")
+    def test_avatars_attributes(self):
+        """Test avatars attributes"""
+        self.admin.attributes = {"foo": {"avatar": "bar"}}
+        self.admin.save()
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertEqual(body["user"]["avatar"], "bar")
+
+    @CONFIG.patch("avatars", "attributes.foo.avatar,initials")
+    def test_avatars_fallback(self):
+        """Test fallback"""
+        self.client.force_login(self.admin)
+        response = self.client.get(reverse("authentik_api:user-me"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content.decode())
+        self.assertIn("data:image/svg+xml;base64,", body["user"]["avatar"])

authentik/crypto/api.py

@@ -143,7 +143,6 @@ class CertificateKeyPairSerializer(ModelSerializer):
         return value
 
     class Meta:
-
         model = CertificateKeyPair
         fields = [
             "pk",

authentik/crypto/migrations/0001_initial.py

@@ -6,7 +6,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     initial = True
 
     dependencies = []
@@ -36,7 +35,10 @@ class Migration(migrations.Migration):
                     models.TextField(
                         blank=True,
                         default="",
-                        help_text="Optional Private Key. If this is set, you can use this keypair for encryption.",
+                        help_text=(
+                            "Optional Private Key. If this is set, you can use this keypair for"
+                            " encryption."
+                        ),
                     ),
                 ),
             ],

authentik/crypto/migrations/0002_create_self_signed_kp.py

@@ -6,7 +6,6 @@ from authentik.lib.generators import generate_id
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_crypto", "0001_initial"),
     ]

authentik/crypto/migrations/0003_certificatekeypair_managed.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_crypto", "0002_create_self_signed_kp"),
     ]
@@ -15,7 +14,12 @@ class Migration(migrations.Migration):
             name="managed",
             field=models.TextField(
                 default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                help_text=(
+                    "Objects which are managed by authentik. These objects are created and updated"
+                    " automatically. This is flag only indicates that an object can be overwritten"
+                    " by migrations. You can still modify the objects via the API, but expect"
+                    " changes to be overwritten in a later update."
+                ),
                 null=True,
                 unique=True,
                 verbose_name="Managed by authentik",

authentik/crypto/models.py

@@ -98,6 +98,5 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return f"Certificate-Key Pair {self.name}"
 
     class Meta:
-
         verbose_name = _("Certificate-Key Pair")
         verbose_name_plural = _("Certificate-Key Pairs")

authentik/events/api/events.py

@@ -25,7 +25,6 @@ class EventSerializer(ModelSerializer):
     """Event Serializer"""
 
     class Meta:
-
         model = Event
         fields = [
             "pk",

authentik/events/api/notification_mappings.py

@@ -10,7 +10,6 @@ class NotificationWebhookMappingSerializer(ModelSerializer):
     """NotificationWebhookMapping Serializer"""
 
     class Meta:
-
         model = NotificationWebhookMapping
         fields = [
             "pk",

authentik/events/api/notification_rules.py

@@ -13,7 +13,6 @@ class NotificationRuleSerializer(ModelSerializer):
     group_obj = GroupSerializer(read_only=True, source="group")
 
     class Meta:
-
         model = NotificationRule
         fields = [
             "pk",

authentik/events/api/notification_transports.py

@@ -43,7 +43,6 @@ class NotificationTransportSerializer(ModelSerializer):
         return attrs
 
     class Meta:
-
         model = NotificationTransport
         fields = [
             "pk",

authentik/events/api/notifications.py

@@ -25,7 +25,6 @@ class NotificationSerializer(ModelSerializer):
     event = EventSerializer(required=False)
 
     class Meta:
-
         model = Notification
         fields = [
             "pk",

authentik/events/middleware.py

@@ -27,6 +27,7 @@ from authentik.lib.sentry import before_send
 from authentik.lib.utils.errors import exception_to_string
 from authentik.outposts.models import OutpostServiceConnection
 from authentik.policies.models import Policy, PolicyBindingModel
+from authentik.providers.oauth2.models import AccessToken, AuthorizationCode, RefreshToken
 
 IGNORED_MODELS = (
     Event,
@@ -44,6 +45,9 @@ IGNORED_MODELS = (
     OutpostServiceConnection,
     Policy,
     PolicyBindingModel,
+    AuthorizationCode,
+    AccessToken,
+    RefreshToken,
 )
 
 

authentik/events/migrations/0001_squashed_0019_alter_notificationtransport_webhook_url.py

@@ -100,7 +100,6 @@ def update_expires(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_events", "0001_initial"),
         ("authentik_events", "0002_auto_20200918_2116"),
@@ -245,14 +244,19 @@ class Migration(migrations.Migration):
                     models.TextField(
                         choices=[("notice", "Notice"), ("warning", "Warning"), ("alert", "Alert")],
                         default="notice",
-                        help_text="Controls which severity level the created notifications will have.",
+                        help_text=(
+                            "Controls which severity level the created notifications will have."
+                        ),
                     ),
                 ),
                 (
                     "group",
                     models.ForeignKey(
                         blank=True,
-                        help_text="Define which group of users this notification should be sent and shown to. If left empty, Notification won't ben sent.",
+                        help_text=(
+                            "Define which group of users this notification should be sent and shown"
+                            " to. If left empty, Notification won't ben sent."
+                        ),
                         null=True,
                         on_delete=django.db.models.deletion.SET_NULL,
                         to="authentik_core.group",
@@ -261,7 +265,10 @@ class Migration(migrations.Migration):
                 (
                     "transports",
                     models.ManyToManyField(
-                        help_text="Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI.",
+                        help_text=(
+                            "Select which transports should be used to notify the user. If none are"
+                            " selected, the notification will only be shown in the authentik UI."
+                        ),
                         to="authentik_events.NotificationTransport",
                         blank=True,
                     ),
@@ -317,7 +324,10 @@ class Migration(migrations.Migration):
             name="send_once",
             field=models.BooleanField(
                 default=False,
-                help_text="Only send notification once, for example when sending a webhook into a chat channel.",
+                help_text=(
+                    "Only send notification once, for example when sending a webhook into a chat"
+                    " channel."
+                ),
             ),
         ),
         migrations.RunPython(

authentik/events/migrations/0002_alter_notificationtransport_mode.py

@@ -3,7 +3,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_events", "0001_squashed_0019_alter_notificationtransport_webhook_url"),
     ]

authentik/events/models.py

@@ -283,7 +283,6 @@ class Event(SerializerModel, ExpiringModel):
         return f"Event action={self.action} user={self.user} context={self.context}"
 
     class Meta:
-
         verbose_name = _("Event")
         verbose_name_plural = _("Events")
 
@@ -362,7 +361,9 @@ class NotificationTransport(SerializerModel):
             )
             response.raise_for_status()
         except RequestException as exc:
-            raise NotificationTransportError(exc.response.text) from exc
+            raise NotificationTransportError(
+                exc.response.text if exc.response else str(exc)
+            ) from exc
         return [
             response.status_code,
             response.text,
@@ -460,7 +461,6 @@ class NotificationTransport(SerializerModel):
         return f"Notification Transport {self.name}"
 
     class Meta:
-
         verbose_name = _("Notification Transport")
         verbose_name_plural = _("Notification Transports")
 
@@ -495,7 +495,6 @@ class Notification(SerializerModel):
         return f"Notification for user {self.user}: {body_trunc}"
 
     class Meta:
-
         verbose_name = _("Notification")
         verbose_name_plural = _("Notifications")
 
@@ -507,10 +506,8 @@ class NotificationRule(SerializerModel, PolicyBindingModel):
     transports = models.ManyToManyField(
         NotificationTransport,
         help_text=_(
-            (
-                "Select which transports should be used to notify the user. If none are "
-                "selected, the notification will only be shown in the authentik UI."
-            )
+            "Select which transports should be used to notify the user. If none are "
+            "selected, the notification will only be shown in the authentik UI."
         ),
         blank=True,
     )
@@ -522,10 +519,8 @@ class NotificationRule(SerializerModel, PolicyBindingModel):
     group = models.ForeignKey(
         Group,
         help_text=_(
-            (
-                "Define which group of users this notification should be sent and shown to. "
-                "If left empty, Notification won't ben sent."
-            )
+            "Define which group of users this notification should be sent and shown to. "
+            "If left empty, Notification won't ben sent."
         ),
         null=True,
         blank=True,
@@ -542,7 +537,6 @@ class NotificationRule(SerializerModel, PolicyBindingModel):
         return f"Notification Rule {self.name}"
 
     class Meta:
-
         verbose_name = _("Notification Rule")
         verbose_name_plural = _("Notification Rules")
 
@@ -564,6 +558,5 @@ class NotificationWebhookMapping(PropertyMapping):
         return f"Webhook Mapping {self.name}"
 
     class Meta:
-
         verbose_name = _("Webhook Mapping")
         verbose_name_plural = _("Webhook Mappings")

authentik/events/monitored_tasks.py

@@ -63,11 +63,6 @@ class TaskInfo:
 
     task_description: Optional[str] = field(default=None)
 
-    @property
-    def html_name(self) -> list[str]:
-        """Get task_name, but split on underscores, so we can join in the html template."""
-        return self.task_name.split("_")
-
     @staticmethod
     def all() -> dict[str, "TaskInfo"]:
         """Get all TaskInfo objects"""
@@ -82,7 +77,7 @@ class TaskInfo:
         """Delete task info from cache"""
         return cache.delete(CACHE_KEY_PREFIX + self.task_name)
 
-    def set_prom_metrics(self):
+    def update_metrics(self):
         """Update prometheus metrics"""
         start = default_timer()
         if hasattr(self, "start_timestamp"):
@@ -101,9 +96,9 @@ class TaskInfo:
         """Save task into cache"""
         key = CACHE_KEY_PREFIX + self.task_name
         if self.result.uid:
-            key += f"/{self.result.uid}"
-            self.task_name += f"/{self.result.uid}"
-        self.set_prom_metrics()
+            key += f":{self.result.uid}"
+            self.task_name += f":{self.result.uid}"
+        self.update_metrics()
         cache.set(key, self, timeout=timeout_hours * 60 * 60)
 
 
@@ -178,7 +173,7 @@ class MonitoredTask(Task):
         ).save(self.result_timeout_hours)
         Event.new(
             EventAction.SYSTEM_TASK_EXCEPTION,
-            message=(f"Task {self.__name__} encountered an error: {exception_to_string(exc)}"),
+            message=f"Task {self.__name__} encountered an error: {exception_to_string(exc)}",
         ).save()
 
     def run(self, *args, **kwargs):

authentik/events/tasks.py

@@ -37,11 +37,10 @@ def event_notification_handler(event_uuid: str):
 @CELERY_APP.task()
 def event_trigger_handler(event_uuid: str, trigger_name: str):
     """Check if policies attached to NotificationRule match event"""
-    events = Event.objects.filter(event_uuid=event_uuid)
-    if not events.exists():
+    event: Event = Event.objects.filter(event_uuid=event_uuid).first()
+    if not event:
         LOGGER.warning("event doesn't exist yet or anymore", event_uuid=event_uuid)
         return
-    event: Event = events.first()
     trigger: Optional[NotificationRule] = NotificationRule.objects.filter(name=trigger_name).first()
     if not trigger:
         return

authentik/events/utils.py

@@ -30,7 +30,7 @@ def cleanse_item(key: str, value: Any) -> Any:
     """Cleanse a single item"""
     if isinstance(value, dict):
         return cleanse_dict(value)
-    if isinstance(value, list):
+    if isinstance(value, (list, tuple, set)):
         for idx, item in enumerate(value):
             value[idx] = cleanse_item(key, item)
         return value
@@ -103,7 +103,7 @@ def sanitize_item(value: Any) -> Any:
         return sanitize_dict(value)
     if isinstance(value, GeneratorType):
         return sanitize_item(list(value))
-    if isinstance(value, list):
+    if isinstance(value, (list, tuple, set)):
         new_values = []
         for item in value:
             new_value = sanitize_item(item)

authentik/flows/api/bindings.py

@@ -13,7 +13,6 @@ class FlowStageBindingSerializer(ModelSerializer):
     stage_obj = StageSerializer(read_only=True, source="stage")
 
     class Meta:
-
         model = FlowStageBinding
         fields = [
             "pk",

authentik/flows/api/flows.py

@@ -53,7 +53,6 @@ class FlowSerializer(ModelSerializer):
         return reverse("authentik_api:flow-export", kwargs={"slug": flow.slug})
 
     class Meta:
-
         model = Flow
         fields = [
             "pk",
@@ -82,7 +81,6 @@ class FlowSetSerializer(FlowSerializer):
     """Stripped down flow serializer"""
 
     class Meta:
-
         model = Flow
         fields = [
             "pk",

authentik/flows/api/stages.py

@@ -33,7 +33,6 @@ class StageSerializer(ModelSerializer, MetaNameSerializer):
         return obj.component
 
     class Meta:
-
         model = Stage
         fields = [
             "pk",

authentik/flows/migrations/0001_squashed_0007_auto_20200703_2059.py

@@ -7,7 +7,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_flows", "0001_initial"),
         ("authentik_flows", "0003_auto_20200523_1133"),
@@ -98,7 +97,10 @@ class Migration(migrations.Migration):
                     "re_evaluate_policies",
                     models.BooleanField(
                         default=False,
-                        help_text="When this option is enabled, the planner will re-evaluate policies bound to this.",
+                        help_text=(
+                            "When this option is enabled, the planner will re-evaluate policies"
+                            " bound to this."
+                        ),
                     ),
                 ),
                 ("order", models.IntegerField()),

authentik/flows/migrations/0008_default_flows.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0007_auto_20200703_2059"),
     ]

authentik/flows/migrations/0009_source_flows.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0008_default_flows"),
     ]

authentik/flows/migrations/0010_provider_flows.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0009_source_flows"),
     ]

authentik/flows/migrations/0011_flow_title.py

@@ -3,7 +3,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0010_provider_flows"),
     ]

authentik/flows/migrations/0012_auto_20200908_1542_squashed_0017_auto_20210329_1334.py

@@ -20,7 +20,6 @@ def update_flow_designation(apps: Apps, schema_editor: BaseDatabaseSchemaEditor)
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_flows", "0012_auto_20200908_1542"),
         ("authentik_flows", "0013_auto_20200924_1605"),
@@ -79,7 +78,10 @@ class Migration(migrations.Migration):
             name="re_evaluate_policies",
             field=models.BooleanField(
                 default=False,
-                help_text="When this option is enabled, the planner will re-evaluate policies bound to this binding.",
+                help_text=(
+                    "When this option is enabled, the planner will re-evaluate policies bound to"
+                    " this binding."
+                ),
             ),
         ),
         migrations.AlterField(
@@ -94,7 +96,10 @@ class Migration(migrations.Migration):
             name="evaluate_on_plan",
             field=models.BooleanField(
                 default=True,
-                help_text="Evaluate policies during the Flow planning process. Disable this for input-based policies.",
+                help_text=(
+                    "Evaluate policies during the Flow planning process. Disable this for"
+                    " input-based policies."
+                ),
             ),
         ),
         migrations.AddField(
@@ -120,7 +125,10 @@ class Migration(migrations.Migration):
                     ("recovery", "Recovery"),
                     ("stage_configuration", "Stage Configuration"),
                 ],
-                help_text="Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.",
+                help_text=(
+                    "Decides what this Flow is used for. For example, the Authentication flow is"
+                    " redirect to when an un-authenticated user visits authentik."
+                ),
                 max_length=100,
             ),
         ),

authentik/flows/migrations/0018_oob_flows.py

@@ -4,7 +4,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0017_auto_20210329_1334"),
     ]

authentik/flows/migrations/0019_alter_flow_background_squashed_0024_alter_flow_compatibility_mode.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_flows", "0019_alter_flow_background"),
         ("authentik_flows", "0020_flow_compatibility_mode"),
@@ -39,7 +38,12 @@ class Migration(migrations.Migration):
                     ("restart_with_context", "Restart With Context"),
                 ],
                 default="retry",
-                help_text="Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.",
+                help_text=(
+                    "Configure how the flow executor should handle an invalid response to a"
+                    " challenge. RETRY returns the error message and a similar challenge to the"
+                    " executor. RESTART restarts the flow from the beginning, and"
+                    " RESTART_WITH_CONTEXT restarts the flow while keeping the current context."
+                ),
             ),
         ),
         migrations.AlterField(
@@ -58,7 +62,10 @@ class Migration(migrations.Migration):
             name="compatibility_mode",
             field=models.BooleanField(
                 default=False,
-                help_text="Enable compatibility mode, increases compatibility with password managers on mobile devices.",
+                help_text=(
+                    "Enable compatibility mode, increases compatibility with password managers on"
+                    " mobile devices."
+                ),
             ),
         ),
     ]

authentik/flows/migrations/0020_flowtoken.py

@@ -5,7 +5,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_core", "0018_auto_20210330_1345_squashed_0028_alter_token_intent"),
         (

authentik/flows/migrations/0021_auto_20211227_2103.py

@@ -3,7 +3,6 @@ from django.db import migrations
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0020_flowtoken"),
     ]

authentik/flows/migrations/0022_flow_layout.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0021_auto_20211227_2103"),
     ]

authentik/flows/migrations/0023_flow_denied_action.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0022_flow_layout"),
     ]

authentik/flows/migrations/0024_flow_authentication.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_flows", "0023_flow_denied_action"),
     ]

authentik/flows/models.py

@@ -135,10 +135,8 @@ class Flow(SerializerModel, PolicyBindingModel):
         max_length=100,
         choices=FlowDesignation.choices,
         help_text=_(
-            (
-                "Decides what this Flow is used for. For example, the Authentication flow "
-                "is redirect to when an un-authenticated user visits authentik."
-            )
+            "Decides what this Flow is used for. For example, the Authentication flow "
+            "is redirect to when an un-authenticated user visits authentik."
         ),
     )
 
@@ -192,7 +190,6 @@ class Flow(SerializerModel, PolicyBindingModel):
         return f"Flow {self.name} ({self.slug})"
 
     class Meta:
-
         verbose_name = _("Flow")
         verbose_name_plural = _("Flows")
 
@@ -216,10 +213,8 @@ class FlowStageBinding(SerializerModel, PolicyBindingModel):
     evaluate_on_plan = models.BooleanField(
         default=True,
         help_text=_(
-            (
-                "Evaluate policies during the Flow planning process. "
-                "Disable this for input-based policies."
-            )
+            "Evaluate policies during the Flow planning process. "
+            "Disable this for input-based policies."
         ),
     )
     re_evaluate_policies = models.BooleanField(
@@ -252,7 +247,6 @@ class FlowStageBinding(SerializerModel, PolicyBindingModel):
         return f"Flow-stage binding #{self.order} to {self.target_id}"
 
     class Meta:
-
         ordering = ["target", "order"]
 
         verbose_name = _("Flow Stage Binding")
@@ -271,15 +265,12 @@ class ConfigurableStage(models.Model):
         null=True,
         blank=True,
         help_text=_(
-            (
-                "Flow used by an authenticated user to configure this Stage. "
-                "If empty, user will not be able to configure this stage."
-            )
+            "Flow used by an authenticated user to configure this Stage. "
+            "If empty, user will not be able to configure this stage."
         ),
     )
 
     class Meta:
-
         abstract = True
 
 
@@ -305,6 +296,5 @@ class FlowToken(Token):
         return f"Flow Token {super().__str__()}"
 
     class Meta:
-
         verbose_name = _("Flow Token")
         verbose_name_plural = _("Flow Tokens")

authentik/flows/planner.py

@@ -207,10 +207,13 @@ class FlowPlanner:
     ) -> FlowPlan:
         """Build flow plan by checking each stage in their respective
         order and checking the applied policies"""
-        with Hub.current.start_span(
-            op="authentik.flow.planner.build_plan",
-            description=self.flow.slug,
-        ) as span, HIST_FLOWS_PLAN_TIME.labels(flow_slug=self.flow.slug).time():
+        with (
+            Hub.current.start_span(
+                op="authentik.flow.planner.build_plan",
+                description=self.flow.slug,
+            ) as span,
+            HIST_FLOWS_PLAN_TIME.labels(flow_slug=self.flow.slug).time(),
+        ):
             span: Span
             span.set_data("flow", self.flow)
             span.set_data("user", user)

authentik/flows/stage.py

@@ -11,7 +11,7 @@ from rest_framework.request import Request
 from sentry_sdk.hub import Hub
 from structlog.stdlib import BoundLogger, get_logger
 
-from authentik.core.models import DEFAULT_AVATAR, User
+from authentik.core.models import User
 from authentik.flows.challenge import (
     AccessDeniedChallenge,
     Challenge,
@@ -24,6 +24,7 @@ from authentik.flows.challenge import (
 )
 from authentik.flows.models import InvalidResponseAction
 from authentik.flows.planner import PLAN_CONTEXT_APPLICATION, PLAN_CONTEXT_PENDING_USER
+from authentik.lib.avatars import DEFAULT_AVATAR
 from authentik.lib.utils.reflection import class_to_path
 
 if TYPE_CHECKING:

authentik/flows/tests/test_executor.py

@@ -209,7 +209,6 @@ class TestFlowExecutor(FlowTestCase):
 
         # Here we patch the dummy policy to evaluate to true so the stage is included
         with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
-
             exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
             # First request, run the planner
             response = self.client.get(exec_url)
@@ -259,7 +258,6 @@ class TestFlowExecutor(FlowTestCase):
 
         # Here we patch the dummy policy to evaluate to true so the stage is included
         with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
-
             exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
             # First request, run the planner
             response = self.client.get(exec_url)
@@ -319,7 +317,6 @@ class TestFlowExecutor(FlowTestCase):
 
         # Here we patch the dummy policy to evaluate to true so the stage is included
         with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
-
             exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
             # First request, run the planner
             response = self.client.get(exec_url)
@@ -396,7 +393,6 @@ class TestFlowExecutor(FlowTestCase):
 
         # Here we patch the dummy policy to evaluate to true so the stage is included
         with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
-
             exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
             # First request, run the planner
             response = self.client.get(exec_url)

authentik/lib/avatars.py

@@ -0,0 +1,187 @@
+"""Avatar utils"""
+from base64 import b64encode
+from functools import cache
+from hashlib import md5
+from typing import TYPE_CHECKING, Optional
+from urllib.parse import urlencode
+
+from django.templatetags.static import static
+from lxml import etree  # nosec
+from lxml.etree import Element, SubElement  # nosec
+from requests.exceptions import RequestException
+
+from authentik.lib.config import CONFIG, get_path_from_dict
+from authentik.lib.utils.http import get_http_session
+
+GRAVATAR_URL = "https://secure.gravatar.com"
+DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
+
+if TYPE_CHECKING:
+    from authentik.core.models import User
+
+SVG_XML_NS = "http://www.w3.org/2000/svg"
+SVG_NS_MAP = {None: SVG_XML_NS}
+# Match fonts used in web UI
+SVG_FONTS = [
+    "'RedHatText'",
+    "'Overpass'",
+    "overpass",
+    "helvetica",
+    "arial",
+    "sans-serif",
+]
+
+
+def avatar_mode_none(user: "User", mode: str) -> Optional[str]:
+    """No avatar"""
+    return DEFAULT_AVATAR
+
+
+def avatar_mode_attribute(user: "User", mode: str) -> Optional[str]:
+    """Avatars based on a user attribute"""
+    avatar = get_path_from_dict(user.attributes, mode[11:], default=None)
+    return avatar
+
+
+def avatar_mode_gravatar(user: "User", mode: str) -> Optional[str]:
+    """Gravatar avatars"""
+    # gravatar uses md5 for their URLs, so md5 can't be avoided
+    mail_hash = md5(user.email.lower().encode("utf-8")).hexdigest()  # nosec
+    parameters = [("size", "158"), ("rating", "g"), ("default", "404")]
+    gravatar_url = f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
+
+    @cache
+    def check_non_default(url: str):
+        """Cache HEAD check, based on URL"""
+        try:
+            # Since we specify a default of 404, do a HEAD request
+            # (HEAD since we don't need the body)
+            # so if that returns a 404, move onto the next mode
+            res = get_http_session().head(url, timeout=5)
+            if res.status_code == 404:
+                return None
+            res.raise_for_status()
+        except RequestException:
+            return url
+        return url
+
+    return check_non_default(gravatar_url)
+
+
+def generate_colors(text: str) -> tuple[str, str]:
+    """Generate colours based on `text`"""
+    color = int(md5(text.lower().encode("utf-8")).hexdigest(), 16) % 0xFFFFFF  # nosec
+
+    # Get a (somewhat arbitrarily) reduced scope of colors
+    # to avoid too dark or light backgrounds
+    blue = min(max((color) & 0xFF, 55), 200)
+    green = min(max((color >> 8) & 0xFF, 55), 200)
+    red = min(max((color >> 16) & 0xFF, 55), 200)
+    bg_hex = f"{red:02x}{green:02x}{blue:02x}"
+    # Contrasting text color (https://stackoverflow.com/a/3943023)
+    text_hex = "000" if (red * 0.299 + green * 0.587 + blue * 0.114) > 186 else "fff"
+    return bg_hex, text_hex
+
+
+@cache
+# pylint: disable=too-many-arguments,too-many-locals
+def generate_avatar_from_name(
+    user: "User",
+    length: int = 2,
+    size: int = 64,
+    rounded: bool = False,
+    font_size: float = 0.4375,
+    bold: bool = False,
+    uppercase: bool = True,
+) -> str:
+    """ "Generate an avatar with initials in SVG format.
+
+    Inspired from: https://github.com/LasseRafn/ui-avatars
+    """
+    name = user.name if user.name != "" else "a k"
+
+    name_parts = name.split()
+    # Only abbreviate first and last name
+    if len(name_parts) > 2:
+        name_parts = [name_parts[0], name_parts[-1]]
+
+    if len(name_parts) == 1:
+        initials = name_parts[0][:length]
+    else:
+        initials = "".join([part[0] for part in name_parts[:-1]])
+        initials += name_parts[-1]
+        initials = initials[:length]
+
+    bg_hex, text_hex = generate_colors(name)
+
+    half_size = size // 2
+    shape = "circle" if rounded else "rect"
+    font_weight = "600" if bold else "400"
+
+    root_element: Element = Element(f"{{{SVG_XML_NS}}}svg", nsmap=SVG_NS_MAP)
+    root_element.attrib["width"] = f"{size}px"
+    root_element.attrib["height"] = f"{size}px"
+    root_element.attrib["viewBox"] = f"0 0 {size} {size}"
+    root_element.attrib["version"] = "1.1"
+
+    shape = SubElement(root_element, f"{{{SVG_XML_NS}}}{shape}", nsmap=SVG_NS_MAP)
+    shape.attrib["fill"] = f"#{bg_hex}"
+    shape.attrib["cx"] = f"{half_size}"
+    shape.attrib["cy"] = f"{half_size}"
+    shape.attrib["width"] = f"{size}"
+    shape.attrib["height"] = f"{size}"
+    shape.attrib["r"] = f"{half_size}"
+
+    text = SubElement(root_element, f"{{{SVG_XML_NS}}}text", nsmap=SVG_NS_MAP)
+    text.attrib["x"] = "50%"
+    text.attrib["y"] = "50%"
+    text.attrib["style"] = (
+        f"color: #{text_hex}; " "line-height: 1; " f"font-family: {','.join(SVG_FONTS)}; "
+    )
+    text.attrib["fill"] = f"#{text_hex}"
+    text.attrib["alignment-baseline"] = "middle"
+    text.attrib["dominant-baseline"] = "middle"
+    text.attrib["text-anchor"] = "middle"
+    text.attrib["font-size"] = f"{round(size * font_size)}"
+    text.attrib["font-weight"] = f"{font_weight}"
+    text.attrib["dy"] = ".1em"
+    text.text = initials if not uppercase else initials.upper()
+
+    return etree.tostring(root_element).decode()
+
+
+def avatar_mode_generated(user: "User", mode: str) -> Optional[str]:
+    """Wrapper that converts generated avatar to base64 svg"""
+    svg = generate_avatar_from_name(user)
+    return f"data:image/svg+xml;base64,{b64encode(svg.encode('utf-8')).decode('utf-8')}"
+
+
+def avatar_mode_url(user: "User", mode: str) -> Optional[str]:
+    """Format url"""
+    mail_hash = md5(user.email.lower().encode("utf-8")).hexdigest()  # nosec
+    return mode % {
+        "username": user.username,
+        "mail_hash": mail_hash,
+        "upn": user.attributes.get("upn", ""),
+    }
+
+
+def get_avatar(user: "User") -> str:
+    """Get avatar with configured mode"""
+    mode_map = {
+        "none": avatar_mode_none,
+        "initials": avatar_mode_generated,
+        "gravatar": avatar_mode_gravatar,
+    }
+    modes: str = CONFIG.y("avatars", "none")
+    for mode in modes.split(","):
+        avatar = None
+        if mode in mode_map:
+            avatar = mode_map[mode](user, mode)
+        elif mode.startswith("attributes."):
+            avatar = avatar_mode_attribute(user, mode)
+        elif "://" in mode:
+            avatar = avatar_mode_url(user, mode)
+        if avatar:
+            return avatar
+    return avatar_mode_none(user, modes)

authentik/lib/default.yml

@@ -71,7 +71,7 @@ ldap:
 cookie_domain: null
 disable_update_check: false
 disable_startup_analytics: false
-avatars: env://AUTHENTIK_AUTHENTIK__AVATARS?gravatar
+avatars: env://AUTHENTIK_AUTHENTIK__AVATARS?gravatar,initials
 geoip: "/geoip/GeoLite2-City.mmdb"
 
 footer_links: []

authentik/lib/utils/urls.py

@@ -27,10 +27,9 @@ def redirect_with_qs(
             return redirect(view)
         LOGGER.warning("redirect target is not a valid view", view=view)
         raise
-    else:
-        if get_query_set:
-            target += "?" + urlencode(get_query_set.items())
-        return redirect(target)
+    if get_query_set:
+        target += "?" + urlencode(get_query_set.items())
+    return redirect(target)
 
 
 def reverse_with_qs(view: str, query: Optional[QueryDict] = None, **kwargs) -> str:

authentik/outposts/api/outposts.py

@@ -56,10 +56,8 @@ class OutpostSerializer(ModelSerializer):
         for provider in providers:
             if not isinstance(provider, type_map[self.initial_data.get("type")]):
                 raise ValidationError(
-                    (
-                        f"Outpost type {self.initial_data['type']} can't be used with "
-                        f"{provider.__class__.__name__} providers."
-                    )
+                    f"Outpost type {self.initial_data['type']} can't be used with "
+                    f"{provider.__class__.__name__} providers."
                 )
         if self.instance and self.instance.managed == MANAGED_OUTPOST:
             return providers
@@ -76,7 +74,6 @@ class OutpostSerializer(ModelSerializer):
         return config
 
     class Meta:
-
         model = Outpost
         fields = [
             "pk",
@@ -124,7 +121,6 @@ class OutpostFilter(FilterSet):
     )
 
     class Meta:
-
         model = Outpost
         fields = {
             "providers": ["isnull"],

authentik/outposts/api/service_connections.py

@@ -37,7 +37,6 @@ class ServiceConnectionSerializer(ModelSerializer, MetaNameSerializer):
         return obj.component
 
     class Meta:
-
         model = OutpostServiceConnection
         fields = [
             "pk",
@@ -101,7 +100,6 @@ class DockerServiceConnectionSerializer(ServiceConnectionSerializer):
     """DockerServiceConnection Serializer"""
 
     class Meta:
-
         model = DockerServiceConnection
         fields = ServiceConnectionSerializer.Meta.fields + [
             "url",
@@ -140,7 +138,6 @@ class KubernetesServiceConnectionSerializer(ServiceConnectionSerializer):
         return kubeconfig
 
     class Meta:
-
         model = KubernetesServiceConnection
         fields = ServiceConnectionSerializer.Meta.fields + ["kubeconfig", "verify_ssl"]
 

authentik/outposts/controllers/k8s/base.py

@@ -73,8 +73,7 @@ class KubernetesObjectReconciler(Generic[T]):
                     raise NeedsRecreate from exc
                 self.logger.debug("Other unhandled error", exc=exc)
                 raise exc
-            else:
-                self.reconcile(current, reference)
+            self.reconcile(current, reference)
         except NeedsUpdate:
             try:
                 self.update(current, reference)

authentik/outposts/migrations/0001_squashed_0017_outpost_managed.py

@@ -80,7 +80,6 @@ def update_config_prefix(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
 
 
 class Migration(migrations.Migration):
-
     replaces = [
         ("authentik_outposts", "0001_initial"),
         ("authentik_outposts", "0002_auto_20200826_1306"),
@@ -136,7 +135,10 @@ class Migration(migrations.Migration):
                             ("custom", "Custom"),
                         ],
                         default="custom",
-                        help_text="Select between authentik-managed deployment types or a custom deployment.",
+                        help_text=(
+                            "Select between authentik-managed deployment types or a custom"
+                            " deployment."
+                        ),
                     ),
                 ),
             ],
@@ -158,7 +160,10 @@ class Migration(migrations.Migration):
                     "local",
                     models.BooleanField(
                         default=False,
-                        help_text="If enabled, use the local connection. Required Docker socket/Kubernetes Integration",
+                        help_text=(
+                            "If enabled, use the local connection. Required Docker"
+                            " socket/Kubernetes Integration"
+                        ),
                         unique=True,
                     ),
                 ),
@@ -207,7 +212,10 @@ class Migration(migrations.Migration):
             field=models.ForeignKey(
                 blank=True,
                 default=None,
-                help_text="Select Service-Connection authentik should use to manage this outpost. Leave empty if authentik should not handle the deployment.",
+                help_text=(
+                    "Select Service-Connection authentik should use to manage this outpost. Leave"
+                    " empty if authentik should not handle the deployment."
+                ),
                 null=True,
                 on_delete=django.db.models.deletion.SET_DEFAULT,
                 to="authentik_outposts.outpostserviceconnection",
@@ -240,7 +248,10 @@ class Migration(migrations.Migration):
             field=authentik.lib.models.InheritanceForeignKey(
                 blank=True,
                 default=None,
-                help_text="Select Service-Connection authentik should use to manage this outpost. Leave empty if authentik should not handle the deployment.",
+                help_text=(
+                    "Select Service-Connection authentik should use to manage this outpost. Leave"
+                    " empty if authentik should not handle the deployment."
+                ),
                 null=True,
                 on_delete=django.db.models.deletion.SET_DEFAULT,
                 to="authentik_outposts.outpostserviceconnection",
@@ -258,7 +269,10 @@ class Migration(migrations.Migration):
             name="kubeconfig",
             field=models.JSONField(
                 default=None,
-                help_text="Paste your kubeconfig here. authentik will automatically use the currently selected context.",
+                help_text=(
+                    "Paste your kubeconfig here. authentik will automatically use the currently"
+                    " selected context."
+                ),
             ),
             preserve_default=False,
         ),
@@ -272,7 +286,10 @@ class Migration(migrations.Migration):
             field=models.ForeignKey(
                 blank=True,
                 default=None,
-                help_text="Certificate/Key used for authentication. Can be left empty for no authentication.",
+                help_text=(
+                    "Certificate/Key used for authentication. Can be left empty for no"
+                    " authentication."
+                ),
                 null=True,
                 on_delete=django.db.models.deletion.SET_DEFAULT,
                 related_name="+",
@@ -285,7 +302,10 @@ class Migration(migrations.Migration):
             field=models.ForeignKey(
                 blank=True,
                 default=None,
-                help_text="CA which the endpoint's Certificate is verified against. Can be left empty for no validation.",
+                help_text=(
+                    "CA which the endpoint's Certificate is verified against. Can be left empty for"
+                    " no validation."
+                ),
                 null=True,
                 on_delete=django.db.models.deletion.SET_DEFAULT,
                 related_name="+",
@@ -297,7 +317,10 @@ class Migration(migrations.Migration):
             name="local",
             field=models.BooleanField(
                 default=False,
-                help_text="If enabled, use the local connection. Required Docker socket/Kubernetes Integration",
+                help_text=(
+                    "If enabled, use the local connection. Required Docker socket/Kubernetes"
+                    " Integration"
+                ),
             ),
         ),
         migrations.RunPython(
@@ -310,7 +333,10 @@ class Migration(migrations.Migration):
             model_name="dockerserviceconnection",
             name="url",
             field=models.TextField(
-                help_text="Can be in the format of 'unix://<path>' when connecting to a local docker daemon, or 'https://<hostname>:2376' when connecting to a remote system."
+                help_text=(
+                    "Can be in the format of 'unix://<path>' when connecting to a local docker"
+                    " daemon, or 'https://<hostname>:2376' when connecting to a remote system."
+                )
             ),
         ),
         migrations.AlterField(
@@ -318,7 +344,10 @@ class Migration(migrations.Migration):
             name="kubeconfig",
             field=models.JSONField(
                 blank=True,
-                help_text="Paste your kubeconfig here. authentik will automatically use the currently selected context.",
+                help_text=(
+                    "Paste your kubeconfig here. authentik will automatically use the currently"
+                    " selected context."
+                ),
             ),
         ),
         migrations.AlterField(
@@ -331,7 +360,12 @@ class Migration(migrations.Migration):
             name="managed",
             field=models.TextField(
                 default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                help_text=(
+                    "Objects which are managed by authentik. These objects are created and updated"
+                    " automatically. This is flag only indicates that an object can be overwritten"
+                    " by migrations. You can still modify the objects via the API, but expect"
+                    " changes to be overwritten in a later update."
+                ),
                 null=True,
                 unique=True,
                 verbose_name="Managed by authentik",

authentik/outposts/migrations/0018_kubernetesserviceconnection_verify_ssl.py

@@ -4,7 +4,6 @@ from django.db import migrations, models
 
 
 class Migration(migrations.Migration):
-
     dependencies = [
         ("authentik_outposts", "0001_squashed_0017_outpost_managed"),
     ]

authentik/outposts/models.py

@@ -86,7 +86,6 @@ class OutpostModel(Model):
         return [self]
 
     class Meta:
-
         abstract = True
 
 
@@ -119,10 +118,7 @@ class OutpostServiceConnection(models.Model):
     local = models.BooleanField(
         default=False,
         help_text=_(
-            (
-                "If enabled, use the local connection. Required Docker "
-                "socket/Kubernetes Integration"
-            )
+            "If enabled, use the local connection. Required Docker socket/Kubernetes Integration"
         ),
     )
 
@@ -152,7 +148,6 @@ class OutpostServiceConnection(models.Model):
         return ""
 
     class Meta:
-
         verbose_name = _("Outpost Service-Connection")
         verbose_name_plural = _("Outpost Service-Connections")
 
@@ -162,10 +157,8 @@ class DockerServiceConnection(SerializerModel, OutpostServiceConnection):
 
     url = models.TextField(
         help_text=_(
-            (
-                "Can be in the format of 'unix://<path>' when connecting to a local docker daemon, "
-                "or 'https://<hostname>:2376' when connecting to a remote system."
-            )
+            "Can be in the format of 'unix://<path>' when connecting to a local docker daemon, "
+            "or 'https://<hostname>:2376' when connecting to a remote system."
         )
     )
     tls_verification = models.ForeignKey(
@@ -176,10 +169,8 @@ class DockerServiceConnection(SerializerModel, OutpostServiceConnection):
         related_name="+",
         on_delete=models.SET_DEFAULT,
         help_text=_(
-            (
-                "CA which the endpoint's Certificate is verified against. "
-                "Can be left empty for no validation."
-            )
+            "CA which the endpoint's Certificate is verified against. "
+            "Can be left empty for no validation."
         ),
     )
     tls_authentication = models.ForeignKey(
@@ -208,7 +199,6 @@ class DockerServiceConnection(SerializerModel, OutpostServiceConnection):
         return f"Docker Service-Connection {self.name}"
 
     class Meta:
-
         verbose_name = _("Docker Service-Connection")
         verbose_name_plural = _("Docker Service-Connections")
 
@@ -218,10 +208,8 @@ class KubernetesServiceConnection(SerializerModel, OutpostServiceConnection):
 
     kubeconfig = models.JSONField(
         help_text=_(
-            (
-                "Paste your kubeconfig here. authentik will automatically use "
-                "the currently selected context."
-            )
+            "Paste your kubeconfig here. authentik will automatically use "
+            "the currently selected context."
         ),
         blank=True,
     )
@@ -243,7 +231,6 @@ class KubernetesServiceConnection(SerializerModel, OutpostServiceConnection):
         return f"Kubernetes Service-Connection {self.name}"
 
     class Meta:
-
         verbose_name = _("Kubernetes Service-Connection")
         verbose_name_plural = _("Kubernetes Service-Connections")
 
@@ -261,10 +248,8 @@ class Outpost(SerializerModel, ManagedModel):
         null=True,
         blank=True,
         help_text=_(
-            (
-                "Select Service-Connection authentik should use to manage this outpost. "
-                "Leave empty if authentik should not handle the deployment."
-            )
+            "Select Service-Connection authentik should use to manage this outpost. "
+            "Leave empty if authentik should not handle the deployment."
         ),
         on_delete=models.SET_DEFAULT,
     )
@@ -315,7 +300,7 @@ class Outpost(SerializerModel, ManagedModel):
                 if isinstance(model_or_perm, models.Model):
                     model_or_perm: models.Model
                     code_name = (
-                        f"{model_or_perm._meta.app_label}." f"view_{model_or_perm._meta.model_name}"
+                        f"{model_or_perm._meta.app_label}.view_{model_or_perm._meta.model_name}"
                     )
                     try:
                         assign_perm(code_name, user, model_or_perm)

authentik/policies/api/bindings.py

@@ -63,7 +63,6 @@ class PolicyBindingSerializer(ModelSerializer):
     user_obj = UserSerializer(required=False, read_only=True, source="user")
 
     class Meta:
-
         model = PolicyBinding
         fields = [
             "pk",
@@ -109,7 +108,6 @@ class PolicyBindingFilter(FilterSet):
     policy__isnull = BooleanFilter("policy", "isnull")
 
     class Meta:
-
         model = PolicyBinding
         fields = ["policy", "policy__isnull", "target", "target_in", "enabled", "order", "timeout"]