web: Make viewing the in-page documentation optional

After talking with @GirlBossRush, I realized that my architecture would be simplified by separating
the style controller from the renderer.  Lit uses Controllers just for that purpose, so:

1. A renderer that either puts down the button or puts down the documentation

2. A controller that monitors the button for its state and, when that state changes, updates the
   host's CSS to fit within the page correctly when the button is rotated.

3. Some helper styles the container needs to help the button display correctly.

Run the thing and click on the button.

This changes the look and feel of the application to a small degree. Screenshots may need to be
updated.

None.

\# What

\# Why

\# How

\# Designs

\# Test Steps

\# Other Notes

.github/actions/docker-push-variables/action.yml

@@ -9,6 +9,9 @@ inputs:
   image-arch:
     required: false
     description: "Docker image arch"
+  release:
+    required: true
+    description: "True if this is a release build, false if this is a dev/PR build"
 
 outputs:
   shouldPush:
@@ -44,6 +47,9 @@ outputs:
   imageMainName:
     description: "Docker image main name"
     value: ${{ steps.ev.outputs.imageMainName }}
+  imageBuildArgs:
+    description: "Docker image build args"
+    value: ${{ steps.ev.outputs.imageBuildArgs }}
 
 runs:
   using: "composite"
@@ -54,6 +60,8 @@ runs:
       env:
         IMAGE_NAME: ${{ inputs.image-name }}
         IMAGE_ARCH: ${{ inputs.image-arch }}
+        RELEASE: ${{ inputs.release }}
         PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        REF: ${{ github.ref }}
       run: |
         python3 ${{ github.action_path }}/push_vars.py

.github/actions/docker-push-variables/push_vars.py

@@ -80,6 +80,13 @@ if should_push:
     cache_to = f"type=registry,ref={get_attest_image_names(image_tags)}:{_cache_tag},mode=max"
 
 
+image_build_args = []
+if os.getenv("RELEASE", "false").lower() == "true":
+    image_build_args = [f"VERSION={os.getenv('REF')}"]
+else:
+    image_build_args = [f"GIT_BUILD_HASH={sha}"]
+image_build_args = "\n".join(image_build_args)
+
 with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
     print(f"shouldPush={str(should_push).lower()}", file=_output)
     print(f"sha={sha}", file=_output)
@@ -91,3 +98,4 @@ with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
     print(f"imageMainTag={image_main_tag}", file=_output)
     print(f"imageMainName={image_tags[0]}", file=_output)
     print(f"cacheTo={cache_to}", file=_output)
+    print(f"imageBuildArgs={image_build_args}", file=_output)

.github/workflows/_reusable-docker-build-single.yaml

@@ -50,6 +50,7 @@ jobs:
         with:
           image-name: ${{ inputs.image_name }}
           image-arch: ${{ inputs.image_arch }}
+          release: ${{ inputs.release }}
       - name: Login to Docker Hub
         if: ${{ inputs.registry_dockerhub }}
         uses: docker/login-action@v3
@@ -81,7 +82,7 @@ jobs:
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
           build-args: |
-            VERSION=${{ github.ref }}
+            ${{ steps.ev.outputs.imageBuildArgs }}
           tags: ${{ steps.ev.outputs.imageTags }}
           platforms: linux/${{ inputs.image_arch }}
           cache-from: type=registry,ref=${{ steps.ev.outputs.attestImageNames }}:buildcache-${{ inputs.image_arch }}

Dockerfile

@@ -132,9 +132,10 @@ RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
     . "$HOME/.cargo/env" && \
     python -m venv /ak-root/venv/ && \
     bash -c "source ${VENV_PATH}/bin/activate && \
-    pip3 install --upgrade pip && \
-    pip3 install poetry && \
+    pip3 install --upgrade pip poetry && \
     poetry config --local installer.no-binary cryptography,xmlsec,lxml,python-kadmin-rs && \
+    poetry install --only=main --no-ansi --no-interaction --no-root && \
+    pip uninstall cryptography -y && \
     poetry install --only=main --no-ansi --no-interaction --no-root"
 
 # Stage 6: Run
@@ -154,10 +155,12 @@ WORKDIR /
 
 # We cannot cache this layer otherwise we'll end up with a bigger image
 RUN apt-get update && \
+    apt-get upgrade -y && \
     # Required for runtime
     apt-get install -y --no-install-recommends libpq5 libmaxminddb0 ca-certificates libkrb5-3 libkadm5clnt-mit12 libkdb5-10 libltdl7 libxslt1.1 && \
     # Required for bootstrap & healtcheck
     apt-get install -y --no-install-recommends runit && \
+    pip3 install --no-cache-dir --upgrade pip && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \

Makefile

@@ -152,7 +152,7 @@ gen-client-ts: gen-clean-ts  ## Build and install the authentik API for Typescri
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		docker.io/openapitools/openapi-generator-cli:v6.5.0 generate \
+		docker.io/openapitools/openapi-generator-cli:v7.11.0 generate \
 		-i /local/schema.yml \
 		-g typescript-fetch \
 		-o /local/${GEN_API_TS} \

authentik/stages/redirect/stage.py

@@ -20,7 +20,7 @@ from authentik.flows.planner import (
     FlowPlanner,
 )
 from authentik.flows.stage import ChallengeStageView
-from authentik.flows.views.executor import SESSION_KEY_PLAN, InvalidStageError
+from authentik.flows.views.executor import SESSION_KEY_GET, SESSION_KEY_PLAN, InvalidStageError
 from authentik.lib.utils.urls import reverse_with_qs
 from authentik.stages.redirect.models import RedirectMode, RedirectStage
 
@@ -72,7 +72,9 @@ class RedirectStageView(ChallengeStageView):
         self.request.session[SESSION_KEY_PLAN] = plan
         kwargs = self.executor.kwargs
         kwargs.update({"flow_slug": flow.slug})
-        return reverse_with_qs("authentik_core:if-flow", self.request.GET, kwargs=kwargs)
+        return reverse_with_qs(
+            "authentik_core:if-flow", self.request.session[SESSION_KEY_GET], kwargs=kwargs
+        )
 
     def get_challenge(self, *args, **kwargs) -> Challenge:
         """Get the redirect target. Prioritize `redirect_stage_target` if present."""

authentik/stages/redirect/tests.py

@@ -1,5 +1,7 @@
 """Test Redirect stage"""
 
+from urllib.parse import urlencode
+
 from django.urls.base import reverse
 from rest_framework.exceptions import ValidationError
 
@@ -58,6 +60,23 @@ class TestRedirectStage(FlowTestCase):
             response, reverse("authentik_core:if-flow", kwargs={"flow_slug": self.target_flow.slug})
         )
 
+    def test_flow_query(self):
+        self.stage.mode = RedirectMode.FLOW
+        self.stage.save()
+
+        response = self.client.get(
+            reverse("authentik_api:flow-executor", kwargs={"flow_slug": self.flow.slug})
+            + "?"
+            + urlencode({"query": urlencode({"test": "foo"})})
+        )
+
+        self.assertStageRedirects(
+            response,
+            reverse("authentik_core:if-flow", kwargs={"flow_slug": self.target_flow.slug})
+            + "?"
+            + urlencode({"test": "foo"}),
+        )
+
     def test_override_static(self):
         policy = ExpressionPolicy.objects.create(
             name=generate_id(),

ldap.Dockerfile

@@ -43,6 +43,11 @@ LABEL org.opencontainers.image.source=https://github.com/goauthentik/authentik
 LABEL org.opencontainers.image.version=${VERSION}
 LABEL org.opencontainers.image.revision=${GIT_BUILD_HASH}
 
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get clean && \
+    rm -rf /tmp/* /var/lib/apt/lists/*
+
 COPY --from=builder /go/ldap /
 
 HEALTHCHECK --interval=5s --retries=20 --start-period=3s CMD [ "/ldap", "healthcheck" ]

poetry.lock

@@ -1061,13 +1061,13 @@ testing = ["pytest (>=7.2.1)", "pytest-cov (>=4.0.0)", "tox (>=4.4.3)"]
 
 [[package]]
 name = "codespell"
-version = "2.3.0"
-description = "Codespell"
+version = "2.4.0"
+description = "Fix common misspellings in text files"
 optional = false
 python-versions = ">=3.8"
 files = [
-    {file = "codespell-2.3.0-py3-none-any.whl", hash = "sha256:a9c7cef2501c9cfede2110fd6d4e5e62296920efe9abfb84648df866e47f58d1"},
-    {file = "codespell-2.3.0.tar.gz", hash = "sha256:360c7d10f75e65f67bad720af7007e1060a5d395670ec11a7ed1fed9dd17471f"},
+    {file = "codespell-2.4.0-py3-none-any.whl", hash = "sha256:b4c5b779f747dd481587aeecb5773301183f52b94b96ed51a28126d0482eec1d"},
+    {file = "codespell-2.4.0.tar.gz", hash = "sha256:587d45b14707fb8ce51339ba4cce50ae0e98ce228ef61f3c5e160e34f681be58"},
 ]
 
 [package.extras]

proxy.Dockerfile

@@ -59,6 +59,11 @@ LABEL org.opencontainers.image.source=https://github.com/goauthentik/authentik
 LABEL org.opencontainers.image.version=${VERSION}
 LABEL org.opencontainers.image.revision=${GIT_BUILD_HASH}
 
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get clean && \
+    rm -rf /tmp/* /var/lib/apt/lists/*
+
 COPY --from=builder /go/proxy /
 COPY --from=web-builder /static/robots.txt /web/robots.txt
 COPY --from=web-builder /static/security.txt /web/security.txt

rac.Dockerfile

@@ -43,6 +43,13 @@ LABEL org.opencontainers.image.source=https://github.com/goauthentik/authentik
 LABEL org.opencontainers.image.version=${VERSION}
 LABEL org.opencontainers.image.revision=${GIT_BUILD_HASH}
 
+USER root
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get clean && \
+    rm -rf /tmp/* /var/lib/apt/lists/*
+USER 1000
+
 COPY --from=builder /go/rac /
 
 HEALTHCHECK --interval=5s --retries=20 --start-period=3s CMD [ "/rac", "healthcheck" ]

radius.Dockerfile

@@ -43,6 +43,11 @@ LABEL org.opencontainers.image.source=https://github.com/goauthentik/authentik
 LABEL org.opencontainers.image.version=${VERSION}
 LABEL org.opencontainers.image.revision=${GIT_BUILD_HASH}
 
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get clean && \
+    rm -rf /tmp/* /var/lib/apt/lists/*
+
 COPY --from=builder /go/radius /
 
 HEALTHCHECK --interval=5s --retries=20 --start-period=3s CMD [ "/radius", "healthcheck" ]

web/package-lock.json

@@ -21468,10 +21468,11 @@
             }
         },
         "node_modules/undici": {
-            "version": "6.21.0",
-            "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.0.tgz",
-            "integrity": "sha512-BUgJXc752Kou3oOIuU1i+yZZypyZRqNPW0vqoMPl8VaoalSfeR0D8/t4iAS3yirs79SSMTxTag+ZC86uswv+Cw==",
+            "version": "6.21.1",
+            "resolved": "https://registry.npmjs.org/undici/-/undici-6.21.1.tgz",
+            "integrity": "sha512-q/1rj5D0/zayJB2FraXdaWxbhWiNKDvu8naDT2dl1yTlvJp4BLtOcp2a5BvgGNQpYYJzau7tf1WgKv3b+7mqpQ==",
             "dev": true,
+            "license": "MIT",
             "engines": {
                 "node": ">=18.17"
             }
@@ -21792,10 +21793,11 @@
             }
         },
         "node_modules/vite": {
-            "version": "5.4.11",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.11.tgz",
-            "integrity": "sha512-c7jFQRklXua0mTzneGW9QVyxFjUgwcihC4bXEtujIo2ouWCe1Ajt/amn2PCxYnhYfd5k09JX3SB7OYWFKYqj8Q==",
+            "version": "5.4.14",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-5.4.14.tgz",
+            "integrity": "sha512-EK5cY7Q1D8JNhSaPKVK4pwBFvaTmZxEnoKXLG/U9gmdDcihQGNzFlgIvaxezFR4glP1LsuiedwMBqCXH3wZccA==",
             "dev": true,
+            "license": "MIT",
             "dependencies": {
                 "esbuild": "^0.21.3",
                 "postcss": "^8.4.43",

web/package.json

@@ -125,6 +125,7 @@
         "lint:nightmare": "wireit",
         "lint:package": "wireit",
         "lint:precommit": "wireit",
+        "lint:types": "wireit",
         "lit-analyse": "wireit",
         "postinstall": "bash scripts/patch-spotlight.sh",
         "precommit": "wireit",

web/src/admin/applications/ApplicationListPage.ts

@@ -4,6 +4,8 @@ import MDApplication from "@goauthentik/docs/add-secure-apps/applications/index.
 import "@goauthentik/elements/AppIcon.js";
 import { WithBrandConfig } from "@goauthentik/elements/Interface/brandProvider";
 import "@goauthentik/elements/Markdown";
+import "@goauthentik/elements/SidebarHelp/SidebarHelp.js";
+import { SidebarHelpController } from "@goauthentik/elements/SidebarHelp/SidebarHelpController.js";
 import "@goauthentik/elements/buttons/SpinnerButton";
 import "@goauthentik/elements/forms/DeleteBulkForm";
 import "@goauthentik/elements/forms/ModalForm";
@@ -18,6 +20,7 @@ import { CSSResult, TemplateResult, css, html } from "lit";
 import { customElement, property } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";
 
+import SidebarHelp from "@goauthentik/elements/SidebarHelp/SidebarHelp.css";
 import PFCard from "@patternfly/patternfly/components/Card/card.css";
 
 import { Application, CoreApi } from "@goauthentik/api";
@@ -63,6 +66,8 @@ export class ApplicationListPage extends WithBrandConfig(TablePage<Application>)
     @property()
     order = "name";
 
+    sidebarHelpController = new SidebarHelpController(this);
+
     async apiEndpoint(): Promise<PaginatedResponse<Application>> {
         return new CoreApi(DEFAULT_CONFIG).coreApplicationsList({
             ...(await this.defaultEndpointConfig()),
@@ -71,7 +76,7 @@ export class ApplicationListPage extends WithBrandConfig(TablePage<Application>)
     }
 
     static get styles(): CSSResult[] {
-        return super.styles.concat(PFCard, applicationListStyle);
+        return super.styles.concat(PFCard, SidebarHelp, applicationListStyle);
     }
 
     columns(): TableColumn[] {
@@ -90,13 +95,12 @@ export class ApplicationListPage extends WithBrandConfig(TablePage<Application>)
     }
 
     renderSidebarAfter(): TemplateResult {
-        return html`<div class="pf-c-sidebar__panel pf-m-width-25">
-            <div class="pf-c-card">
-                <div class="pf-c-card__body">
-                    <ak-markdown .md=${MDApplication} meta="applications/index.md"></ak-markdown>
-                </div>
-            </div>
-        </div>`;
+        return html`<ak-sidebar-help
+            label=${msg("Applications Documentation")}
+            .content=${MDApplication}
+            class="pf-c-sidebar__panel"
+            active-style="pf-m-width-25"
+        ></ak-sidebar-help>`;
     }
 
     renderToolbarSelected(): TemplateResult {

web/src/admin/applications/ApplicationViewPage.ts

@@ -80,8 +80,8 @@ export class ApplicationViewPage extends AKElement {
             if (
                 app.providerObj &&
                 [
-                    RbacPermissionsAssignedByUsersListModelEnum.ProvidersProxyProxyprovider.toString(),
-                    RbacPermissionsAssignedByUsersListModelEnum.ProvidersLdapLdapprovider.toString(),
+                    RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersProxyProxyprovider.toString(),
+                    RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersLdapLdapprovider.toString(),
                 ].includes(app.providerObj.metaModelName)
             ) {
                 this.fetchIsMissingOutpost([app.provider || 0]);
@@ -340,7 +340,7 @@ export class ApplicationViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.CoreApplication}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreApplication}
                 objectPk=${this.application.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/applications/entitlements/ApplicationEntitlementPage.ts

@@ -86,7 +86,7 @@ export class ApplicationEntitlementsPage extends Table<ApplicationEntitlement> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.CoreApplicationentitlement}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreApplicationentitlement}
                     objectPk=${item.pbmUuid}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/applications/wizard/steps/SubmitStepOverviewRenderers.ts

@@ -142,11 +142,11 @@ function renderLDAPOverview(rawProvider: OneOfProvider) {
 const providerName = (p: ProviderModelEnum): string => p.toString().split(".")[1];
 
 export const providerRenderers = new Map([
-    [providerName(ProviderModelEnum.SamlSamlprovider), renderSAMLOverview],
-    [providerName(ProviderModelEnum.ScimScimprovider), renderSCIMOverview],
-    [providerName(ProviderModelEnum.RadiusRadiusprovider), renderRadiusOverview],
-    [providerName(ProviderModelEnum.RacRacprovider), renderRACOverview],
-    [providerName(ProviderModelEnum.ProxyProxyprovider), renderProxyOverview],
-    [providerName(ProviderModelEnum.Oauth2Oauth2provider), renderOAuth2Overview],
-    [providerName(ProviderModelEnum.LdapLdapprovider), renderLDAPOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersSamlSamlprovider), renderSAMLOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersScimScimprovider), renderSCIMOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersRadiusRadiusprovider), renderRadiusOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersRacRacprovider), renderRACOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersProxyProxyprovider), renderProxyOverview],
+    [providerName(ProviderModelEnum.AuthentikProvidersOauth2Oauth2provider), renderOAuth2Overview],
+    [providerName(ProviderModelEnum.AuthentikProvidersLdapLdapprovider), renderLDAPOverview],
 ]);

web/src/admin/blueprints/BlueprintListPage.ts

@@ -155,7 +155,7 @@ export class BlueprintListPage extends TablePage<BlueprintInstance> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.BlueprintsBlueprintinstance}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikBlueprintsBlueprintinstance}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>

web/src/admin/brands/BrandListPage.ts

@@ -93,7 +93,7 @@ export class BrandListPage extends TablePage<Brand> {
                 </ak-forms-modal>
 
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.BrandsBrand}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikBrandsBrand}
                     objectPk=${item.brandUuid}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/crypto/CertificateKeyPairListPage.ts

@@ -134,7 +134,7 @@ export class CertificateKeyPairListPage extends TablePage<CertificateKeyPair> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.CryptoCertificatekeypair}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCryptoCertificatekeypair}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/enterprise/EnterpriseLicenseListPage.ts

@@ -231,7 +231,7 @@ export class EnterpriseLicenseListPage extends TablePage<License> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.EnterpriseLicense}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikEnterpriseLicense}
                     objectPk=${item.licenseUuid}
                 >
                 </ak-rbac-object-permission-modal> `,

web/src/admin/events/RuleListPage.ts

@@ -99,7 +99,7 @@ export class RuleListPage extends TablePage<NotificationRule> {
                 </ak-forms-modal>
 
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.EventsNotificationrule}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikEventsNotificationrule}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/events/TransportListPage.ts

@@ -94,7 +94,7 @@ export class TransportListPage extends TablePage<NotificationTransport> {
                 </ak-forms-modal>
 
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.EventsNotificationtransport}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikEventsNotificationtransport}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>

web/src/admin/flows/FlowViewPage.ts

@@ -280,7 +280,7 @@ export class FlowViewPage extends AKElement {
                 <ak-rbac-object-permission-page
                     slot="page-permissions"
                     data-tab-title="${msg("Permissions")}"
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.FlowsFlow}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikFlowsFlow}
                     objectPk=${this.flow.pk}
                 ></ak-rbac-object-permission-page>
             </ak-tabs>`;

web/src/admin/groups/GroupViewPage.ts

@@ -203,7 +203,7 @@ export class GroupViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.CoreGroup}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreGroup}
                 objectPk=${this.group.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/outposts/OutpostListPage.ts

@@ -148,7 +148,7 @@ export class OutpostListPage extends TablePage<Outpost> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.OutpostsOutpost}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikOutpostsOutpost}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>

web/src/admin/policies/reputation/ReputationListPage.ts

@@ -93,7 +93,7 @@ export class ReputationListPage extends TablePage<Reputation> {
                 <small>${item.updated.toLocaleString()}</small>`,
             html`
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.PoliciesReputationReputationpolicy}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikPoliciesReputationReputationpolicy}
                     objectPk=${item.pk || ""}
                 >
                 </ak-rbac-object-permission-modal>

web/src/admin/property-mappings/PropertyMappingTestForm.ts

@@ -71,7 +71,7 @@ export class PolicyTestForm extends Form<PropertyMappingTestRequest> {
 
     renderExampleButtons() {
         return this.mapping?.metaModelName ===
-            RbacPermissionsAssignedByUsersListModelEnum.SourcesLdapLdapsourcepropertymapping
+            RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesLdapLdapsourcepropertymapping
             ? html`<p>${msg("Example context data")}</p>
                   ${this.renderExampleLDAP()}`
             : nothing;

web/src/admin/providers/google_workspace/GoogleWorkspaceProviderGroupList.ts

@@ -35,7 +35,7 @@ export class GoogleWorkspaceProviderGroupList extends Table<GoogleWorkspaceProvi
                 <span slot="header">${msg("Sync Group")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.Group}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsGroup}
                     .sync=${(data: ProvidersGoogleWorkspaceSyncObjectCreateRequest) => {
                         return new ProvidersApi(
                             DEFAULT_CONFIG,

web/src/admin/providers/google_workspace/GoogleWorkspaceProviderUserList.ts

@@ -35,7 +35,7 @@ export class GoogleWorkspaceProviderUserList extends Table<GoogleWorkspaceProvid
                 <span slot="header">${msg("Sync User")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.User}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsUser}
                     .sync=${(data: ProvidersGoogleWorkspaceSyncObjectCreateRequest) => {
                         return new ProvidersApi(
                             DEFAULT_CONFIG,

web/src/admin/providers/google_workspace/GoogleWorkspaceProviderViewPage.ts

@@ -147,7 +147,7 @@ export class GoogleWorkspaceProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersGoogleWorkspaceGoogleworkspaceprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersGoogleWorkspaceGoogleworkspaceprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/ldap/LDAPProviderViewPage.ts

@@ -111,7 +111,7 @@ export class LDAPProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersLdapLdapprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersLdapLdapprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/microsoft_entra/MicrosoftEntraProviderGroupList.ts

@@ -32,7 +32,7 @@ export class MicrosoftEntraProviderGroupList extends Table<MicrosoftEntraProvide
                 <span slot="header">${msg("Sync Group")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.Group}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsGroup}
                     .sync=${(data: ProvidersMicrosoftEntraSyncObjectCreateRequest) => {
                         return new ProvidersApi(
                             DEFAULT_CONFIG,

web/src/admin/providers/microsoft_entra/MicrosoftEntraProviderUserList.ts

@@ -35,7 +35,7 @@ export class MicrosoftEntraProviderUserList extends Table<MicrosoftEntraProvider
                 <span slot="header">${msg("Sync User")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.User}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsUser}
                     .sync=${(data: ProvidersMicrosoftEntraSyncObjectCreateRequest) => {
                         return new ProvidersApi(
                             DEFAULT_CONFIG,

web/src/admin/providers/microsoft_entra/MicrosoftEntraProviderViewPage.ts

@@ -147,7 +147,7 @@ export class MicrosoftEntraProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersMicrosoftEntraMicrosoftentraprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersMicrosoftEntraMicrosoftentraprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/oauth2/OAuth2ProviderViewPage.ts

@@ -158,7 +158,7 @@ export class OAuth2ProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersOauth2Oauth2provider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersOauth2Oauth2provider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/proxy/ProxyProviderViewPage.ts

@@ -229,7 +229,7 @@ export class ProxyProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersProxyProxyprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersProxyProxyprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/rac/EndpointList.ts

@@ -102,7 +102,7 @@ export class EndpointListPage extends Table<Endpoint> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersRacEndpoint}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersRacEndpoint}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/providers/rac/RACProviderViewPage.ts

@@ -119,7 +119,7 @@ export class RACProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersRacRacprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersRacRacprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/radius/RadiusProviderViewPage.ts

@@ -169,7 +169,7 @@ export class RadiusProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersRadiusRadiusprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersRadiusRadiusprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/saml/SAMLProviderOptions.ts

@@ -18,20 +18,20 @@ export const spBindingOptions = toOptions([
 ]);
 
 export const digestAlgorithmOptions = toOptions([
-    ["SHA1", DigestAlgorithmEnum._200009Xmldsigsha1],
-    ["SHA256", DigestAlgorithmEnum._200104Xmlencsha256, true],
-    ["SHA384", DigestAlgorithmEnum._200104XmldsigMoresha384],
-    ["SHA512", DigestAlgorithmEnum._200104Xmlencsha512],
+    ["SHA1", DigestAlgorithmEnum.HttpWwwW3Org200009Xmldsigsha1],
+    ["SHA256", DigestAlgorithmEnum.HttpWwwW3Org200104Xmlencsha256, true],
+    ["SHA384", DigestAlgorithmEnum.HttpWwwW3Org200104XmldsigMoresha384],
+    ["SHA512", DigestAlgorithmEnum.HttpWwwW3Org200104Xmlencsha512],
 ]);
 
 export const signatureAlgorithmOptions = toOptions([
-    ["RSA-SHA1", SignatureAlgorithmEnum._200009XmldsigrsaSha1],
-    ["RSA-SHA256", SignatureAlgorithmEnum._200104XmldsigMorersaSha256, true],
-    ["RSA-SHA384", SignatureAlgorithmEnum._200104XmldsigMorersaSha384],
-    ["RSA-SHA512", SignatureAlgorithmEnum._200104XmldsigMorersaSha512],
-    ["ECDSA-SHA1", SignatureAlgorithmEnum._200104XmldsigMoreecdsaSha1],
-    ["ECDSA-SHA256", SignatureAlgorithmEnum._200104XmldsigMoreecdsaSha256],
-    ["ECDSA-SHA384", SignatureAlgorithmEnum._200104XmldsigMoreecdsaSha384],
-    ["ECDSA-SHA512", SignatureAlgorithmEnum._200104XmldsigMoreecdsaSha512],
-    ["DSA-SHA1", SignatureAlgorithmEnum._200009XmldsigdsaSha1],
+    ["RSA-SHA1", SignatureAlgorithmEnum.HttpWwwW3Org200009XmldsigrsaSha1],
+    ["RSA-SHA256", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha256, true],
+    ["RSA-SHA384", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha384],
+    ["RSA-SHA512", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha512],
+    ["ECDSA-SHA1", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMoreecdsaSha1],
+    ["ECDSA-SHA256", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMoreecdsaSha256],
+    ["ECDSA-SHA384", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMoreecdsaSha384],
+    ["ECDSA-SHA512", SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMoreecdsaSha512],
+    ["DSA-SHA1", SignatureAlgorithmEnum.HttpWwwW3Org200009XmldsigdsaSha1],
 ]);

web/src/admin/providers/saml/SAMLProviderViewPage.ts

@@ -247,7 +247,7 @@ export class SAMLProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersSamlSamlprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersSamlSamlprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/providers/scim/SCIMProviderGroupList.ts

@@ -33,7 +33,7 @@ export class SCIMProviderGroupList extends Table<SCIMProviderGroup> {
                 <span slot="header">${msg("Sync Group")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.Group}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsGroup}
                     .sync=${(data: ProvidersScimSyncObjectCreateRequest) => {
                         return new ProvidersApi(DEFAULT_CONFIG).providersScimSyncObjectCreate(data);
                     }}

web/src/admin/providers/scim/SCIMProviderUserList.ts

@@ -33,7 +33,7 @@ export class SCIMProviderUserList extends Table<SCIMProviderUser> {
                 <span slot="header">${msg("Sync User")}</span>
                 <ak-sync-object-form
                     .provider=${this.providerId}
-                    model=${SyncObjectModelEnum.User}
+                    model=${SyncObjectModelEnum.AuthentikCoreModelsUser}
                     .sync=${(data: ProvidersScimSyncObjectCreateRequest) => {
                         return new ProvidersApi(DEFAULT_CONFIG).providersScimSyncObjectCreate(data);
                     }}

web/src/admin/providers/scim/SCIMProviderViewPage.ts

@@ -130,7 +130,7 @@ export class SCIMProviderViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.ProvidersScimScimprovider}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikProvidersScimScimprovider}
                 objectPk=${this.provider.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/rbac/ObjectPermissionsPage.ts

@@ -35,10 +35,10 @@ export class ObjectPermissionPage extends AKElement {
 
     render() {
         return html` <ak-tabs pageIdentifier="permissionPage" ?vertical=${!this.embedded}>
-            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.CoreUser
+            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreUser
                 ? this.renderCoreUser()
                 : nothing}
-            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.RbacRole
+            ${this.model === RbacPermissionsAssignedByUsersListModelEnum.AuthentikRbacRole
                 ? this.renderRbacRole()
                 : nothing}
             <section

web/src/admin/rbac/RoleObjectPermissionTable.ts

@@ -35,7 +35,7 @@ export class RoleAssignedObjectPermissionTable extends Table<RoleAssignedObjectP
         const perms = await new RbacApi(DEFAULT_CONFIG).rbacPermissionsAssignedByRolesList({
             ...(await this.defaultEndpointConfig()),
             // TODO: better default
-            model: this.model || RbacPermissionsAssignedByRolesListModelEnum.CoreUser,
+            model: this.model || RbacPermissionsAssignedByRolesListModelEnum.AuthentikCoreUser,
             objectPk: this.objectPk?.toString(),
         });
         const [appLabel, modelName] = (this.model || "").split(".");

web/src/admin/rbac/UserObjectPermissionTable.ts

@@ -35,7 +35,7 @@ export class UserAssignedObjectPermissionTable extends Table<UserAssignedObjectP
         const perms = await new RbacApi(DEFAULT_CONFIG).rbacPermissionsAssignedByUsersList({
             ...(await this.defaultEndpointConfig()),
             // TODO: better default
-            model: this.model || RbacPermissionsAssignedByUsersListModelEnum.CoreUser,
+            model: this.model || RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreUser,
             objectPk: this.objectPk?.toString(),
         });
         const [appLabel, modelName] = (this.model || "").split(".");

web/src/admin/roles/RoleViewPage.ts

@@ -133,7 +133,7 @@ export class RoleViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.RbacRole}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikRbacRole}
                 objectPk=${this._role.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/kerberos/KerberosSourceViewPage.ts

@@ -216,7 +216,7 @@ export class KerberosSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesKerberosKerberossource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesKerberosKerberossource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/ldap/LDAPSourceViewPage.ts

@@ -192,7 +192,7 @@ export class LDAPSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesLdapLdapsource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesLdapLdapsource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/oauth/OAuthSourceViewPage.ts

@@ -253,7 +253,7 @@ export class OAuthSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesOauthOauthsource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesOauthOauthsource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/plex/PlexSourceViewPage.ts

@@ -143,7 +143,7 @@ export class PlexSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesPlexPlexsource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesPlexPlexsource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/saml/SAMLSourceForm.ts

@@ -358,37 +358,37 @@ export class SAMLSourceForm extends WithCapabilitiesConfig(BaseSourceForm<SAMLSo
                     >
                         <select class="pf-c-form-control">
                             <option
-                                value=${NameIdPolicyEnum._20nameidFormatpersistent}
+                                value=${NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatPersistent}
                                 ?selected=${this.instance?.nameIdPolicy ===
-                                NameIdPolicyEnum._20nameidFormatpersistent}
+                                NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatPersistent}
                             >
                                 ${msg("Persistent")}
                             </option>
                             <option
-                                value=${NameIdPolicyEnum._11nameidFormatemailAddress}
+                                value=${NameIdPolicyEnum.UrnOasisNamesTcSaml11NameidFormatEmailAddress}
                                 ?selected=${this.instance?.nameIdPolicy ===
-                                NameIdPolicyEnum._11nameidFormatemailAddress}
+                                NameIdPolicyEnum.UrnOasisNamesTcSaml11NameidFormatEmailAddress}
                             >
                                 ${msg("Email address")}
                             </option>
                             <option
-                                value=${NameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName}
+                                value=${NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatWindowsDomainQualifiedName}
                                 ?selected=${this.instance?.nameIdPolicy ===
-                                NameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName}
+                                NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatWindowsDomainQualifiedName}
                             >
                                 ${msg("Windows")}
                             </option>
                             <option
-                                value=${NameIdPolicyEnum._11nameidFormatX509SubjectName}
+                                value=${NameIdPolicyEnum.UrnOasisNamesTcSaml11NameidFormatX509SubjectName}
                                 ?selected=${this.instance?.nameIdPolicy ===
-                                NameIdPolicyEnum._11nameidFormatX509SubjectName}
+                                NameIdPolicyEnum.UrnOasisNamesTcSaml11NameidFormatX509SubjectName}
                             >
                                 ${msg("X509 Subject")}
                             </option>
                             <option
-                                value=${NameIdPolicyEnum._20nameidFormattransient}
+                                value=${NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatTransient}
                                 ?selected=${this.instance?.nameIdPolicy ===
-                                NameIdPolicyEnum._20nameidFormattransient}
+                                NameIdPolicyEnum.UrnOasisNamesTcSaml20NameidFormatTransient}
                             >
                                 ${msg("Transient")}
                             </option>
@@ -432,20 +432,20 @@ export class SAMLSourceForm extends WithCapabilitiesConfig(BaseSourceForm<SAMLSo
                             .options=${[
                                 {
                                     label: "SHA1",
-                                    value: DigestAlgorithmEnum._200009Xmldsigsha1,
+                                    value: DigestAlgorithmEnum.HttpWwwW3Org200009Xmldsigsha1,
                                 },
                                 {
                                     label: "SHA256",
-                                    value: DigestAlgorithmEnum._200104Xmlencsha256,
+                                    value: DigestAlgorithmEnum.HttpWwwW3Org200104Xmlencsha256,
                                     default: true,
                                 },
                                 {
                                     label: "SHA384",
-                                    value: DigestAlgorithmEnum._200104XmldsigMoresha384,
+                                    value: DigestAlgorithmEnum.HttpWwwW3Org200104XmldsigMoresha384,
                                 },
                                 {
                                     label: "SHA512",
-                                    value: DigestAlgorithmEnum._200104Xmlencsha512,
+                                    value: DigestAlgorithmEnum.HttpWwwW3Org200104Xmlencsha512,
                                 },
                             ]}
                             .value=${this.instance?.digestAlgorithm}
@@ -461,24 +461,24 @@ export class SAMLSourceForm extends WithCapabilitiesConfig(BaseSourceForm<SAMLSo
                             .options=${[
                                 {
                                     label: "RSA-SHA1",
-                                    value: SignatureAlgorithmEnum._200009XmldsigrsaSha1,
+                                    value: SignatureAlgorithmEnum.HttpWwwW3Org200009XmldsigrsaSha1,
                                 },
                                 {
                                     label: "RSA-SHA256",
-                                    value: SignatureAlgorithmEnum._200104XmldsigMorersaSha256,
+                                    value: SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha256,
                                     default: true,
                                 },
                                 {
                                     label: "RSA-SHA384",
-                                    value: SignatureAlgorithmEnum._200104XmldsigMorersaSha384,
+                                    value: SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha384,
                                 },
                                 {
                                     label: "RSA-SHA512",
-                                    value: SignatureAlgorithmEnum._200104XmldsigMorersaSha512,
+                                    value: SignatureAlgorithmEnum.HttpWwwW3Org200104XmldsigMorersaSha512,
                                 },
                                 {
                                     label: "DSA-SHA1",
-                                    value: SignatureAlgorithmEnum._200009XmldsigdsaSha1,
+                                    value: SignatureAlgorithmEnum.HttpWwwW3Org200009XmldsigdsaSha1,
                                 },
                             ]}
                             .value=${this.instance?.signatureAlgorithm}

web/src/admin/sources/saml/SAMLSourceViewPage.ts

@@ -220,7 +220,7 @@ export class SAMLSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesSamlSamlsource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesSamlSamlsource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/sources/scim/SCIMSourceViewPage.ts

@@ -207,7 +207,7 @@ export class SCIMSourceViewPage extends AKElement {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.SourcesScimScimsource}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikSourcesScimScimsource}
                 objectPk=${this.source.pk}
             ></ak-rbac-object-permission-page>
         </ak-tabs>`;

web/src/admin/stages/invitation/InvitationListPage.ts

@@ -141,7 +141,7 @@ export class InvitationListPage extends TablePage<Invitation> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.StagesInvitationInvitation}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikStagesInvitationInvitation}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>`,

web/src/admin/stages/password/PasswordStageForm.ts

@@ -55,19 +55,19 @@ export class PasswordStageForm extends BaseStageForm<PasswordStage> {
     renderForm(): TemplateResult {
         const backends = [
             {
-                name: BackendsEnum.CoreAuthInbuiltBackend,
+                name: BackendsEnum.AuthentikCoreAuthInbuiltBackend,
                 label: msg("User database + standard password"),
             },
             {
-                name: BackendsEnum.CoreAuthTokenBackend,
+                name: BackendsEnum.AuthentikCoreAuthTokenBackend,
                 label: msg("User database + app passwords"),
             },
             {
-                name: BackendsEnum.SourcesLdapAuthLdapBackend,
+                name: BackendsEnum.AuthentikSourcesLdapAuthLdapBackend,
                 label: msg("User database + LDAP password"),
             },
             {
-                name: BackendsEnum.SourcesKerberosAuthKerberosBackend,
+                name: BackendsEnum.AuthentikSourcesKerberosAuthKerberosBackend,
                 label: msg("User database + Kerberos password"),
             },
         ];

web/src/admin/stages/prompt/PromptListPage.ts

@@ -97,7 +97,7 @@ export class PromptListPage extends TablePage<Prompt> {
                     </button>
                 </ak-forms-modal>
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.StagesPromptPrompt}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikStagesPromptPrompt}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal> `,

web/src/admin/tokens/TokenListPage.ts

@@ -132,7 +132,7 @@ export class TokenListPage extends TablePage<Token> {
                           </pf-tooltip>
                       </button>`}
                 <ak-rbac-object-permission-modal
-                    model=${RbacPermissionsAssignedByUsersListModelEnum.CoreToken}
+                    model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreToken}
                     objectPk=${item.pk}
                 >
                 </ak-rbac-object-permission-modal>

web/src/admin/users/UserViewPage.ts

@@ -458,7 +458,7 @@ export class UserViewPage extends WithCapabilitiesConfig(AKElement) {
             <ak-rbac-object-permission-page
                 slot="page-permissions"
                 data-tab-title="${msg("Permissions")}"
-                model=${RbacPermissionsAssignedByUsersListModelEnum.CoreUser}
+                model=${RbacPermissionsAssignedByUsersListModelEnum.AuthentikCoreUser}
                 objectPk=${this.user.pk}
             >
             </ak-rbac-object-permission-page>

web/src/elements/SidebarHelp/README.md

@@ -0,0 +1,5 @@
+The SidebarHelp feature uses some fairly fiddly CSS to rotate the "Documentation" button in a way
+that doesn't take up too much screen real-estate, because the rotation is purely visual; the layout
+flow is still driven by the size of the button as if it were horizontal. Using the SidebarHelp means
+enabling a special controller to adjust the width of the container to the _height_ of the button
+when the button is rotated into place.

web/src/elements/SidebarHelp/SidebarHelp.css

@@ -0,0 +1,14 @@
+ak-sidebar-help-toggle {
+    display: none;
+}
+
+@media screen and (min-width: 768px) {
+    ak-sidebar-help-toggle {
+        display: block;
+    }
+}
+
+ak-sidebar-help-toggle.pf-m-width-default {
+    background-color: inherit;
+    max-width: 3rem;
+}

web/src/elements/SidebarHelp/SidebarHelp.ts

@@ -0,0 +1,119 @@
+import { AKElement } from "@goauthentik/elements/Base";
+import "@goauthentik/elements/Markdown";
+import { bound } from "@goauthentik/elements/decorators/bound";
+
+import { msg } from "@lit/localize";
+import { css, html } from "lit";
+import { customElement, property, query, state } from "lit/decorators.js";
+
+import PFButton from "@patternfly/patternfly/components/Button/button.css";
+import PFCard from "@patternfly/patternfly/components/Card/card.css";
+import PFDisplay from "@patternfly/patternfly/utilities/Display/display.css";
+import PFFlex from "@patternfly/patternfly/utilities/Flex/flex.css";
+import PFSpacing from "@patternfly/patternfly/utilities/Spacing/spacing.css";
+
+import { SidebarHelpToggleEvent } from "./events.js";
+
+/**
+ * A "Display documentation for this page" element.
+ *
+ * Based on the Patternfly "sidebar" pattern, this shows a vertically rotated button with a label to
+ * indicate that it leads to documentation; when pressed, the button is replaced with the
+ * documentation, rendered as a Markdown document.
+ *
+ * The SidebarHelp feature uses some fairly fiddly CSS to rotate the "Documentation" button in a way
+ * that doesn't take up too much screen real-estate, because the rotation is purely visual; the
+ * layout flow is still driven by the size of the button as if it were horizontal. Using the
+ * SidebarHelp means enabling a special SidebarHelpController on the container to adjust the width
+ * of the container to the *height* of the button when the button is rotated into place.
+ *
+ * @element ak-sidebar-help
+ *
+ * The events fired by this component are not for general use.
+ */
+
+@customElement("ak-sidebar-help")
+export class SidebarHelp extends AKElement {
+    static get styles() {
+        return [
+            PFCard,
+            PFButton,
+            PFDisplay,
+            PFFlex,
+            PFSpacing,
+            css`
+                .vert {
+                    transform-origin: bottom left;
+                    translate: 0 -100%;
+                    rotate: 90deg;
+                }
+                .ak-fit-text {
+                    width: fit-content;
+                }
+            `,
+        ];
+    }
+
+    /*
+     * @attr The content of the documentation to be shown
+     */
+    @property({ attribute: false })
+    content: string = "";
+
+    /*
+     * @attr The style to use when the content is visible
+     */
+    @property({ attribute: "active-style" })
+    activeStyle = "pf-m-width-25";
+
+    /*
+     * @attr The label on the button when the content is not visible.
+     */
+    @property()
+    label: string = msg("Documentation");
+
+    @state()
+    showing = false;
+
+    @query("#toggle")
+    button!: HTMLButtonElement;
+
+    @bound
+    toggle() {
+        this.showing = !this.showing;
+    }
+
+    render() {
+        if (!this.showing) {
+            return html`<button
+                type="button"
+                id="toggle"
+                class="pf-c-button pf-m-primary vert"
+                @click=${this.toggle}
+            >
+                ${this.label}
+            </button>`;
+        }
+
+        return html`
+            <div class="pf-c-card">
+                <div class="pf-u-display-flex pf-u-justify-content-flex-end">
+                    <button
+                        type="button"
+                        class=" pf-c-button pf-m-secondary pf-u-m-md ak-fit-text"
+                        @click=${this.toggle}
+                    >
+                        ${msg("Hide")}
+                    </button>
+                </div>
+                <div class="pf-c-card__body">
+                    <ak-markdown .md=${this.content} meta="applications/index.md"></ak-markdown>
+                </div>
+            </div>
+        `;
+    }
+
+    updated() {
+        this.dispatchEvent(new SidebarHelpToggleEvent(this));
+    }
+}

web/src/elements/SidebarHelp/SidebarHelpController.ts

@@ -0,0 +1,51 @@
+import { bound } from "@goauthentik/elements/decorators/bound";
+
+import { LitElement, ReactiveController, ReactiveControllerHost } from "lit";
+
+import { SidebarHelpToggleEvent } from "./events";
+
+type ReactiveLitElement = LitElement & ReactiveControllerHost;
+
+const DEFAULT_STYLE = "pf-m-width-default";
+
+/**
+ * A "Display documentation for this page" helper. Attach this controller to any element that
+ * contains one or more SidebarHelp entries. It adjusts the width of the sidebar controller when
+ * hidden to that of the button's *height*, since the button has been rotated 90° around a
+ * corner-oriented axis.
+ *
+ * The events consumed by this component are not for general use.
+ */
+
+export class SidebarHelpController implements ReactiveController {
+    host: ReactiveLitElement;
+
+    constructor(host: ReactiveLitElement) {
+        (this.host = host).addController(this);
+    }
+
+    @bound
+    toggleHelpToggle(ev: SidebarHelpToggleEvent) {
+        const { source } = ev;
+        if (!source.showing) {
+            source.classList.remove(source.activeStyle);
+            source.classList.add(DEFAULT_STYLE);
+            const { width } = source.button.getBoundingClientRect();
+            source.style.setProperty("width", `${width}px`);
+            return;
+        }
+        requestAnimationFrame(() => {
+            source.style.removeProperty("width");
+            source.classList.remove(DEFAULT_STYLE);
+            source.classList.add(source.activeStyle);
+        });
+    }
+
+    hostConnected() {
+        this.host.addEventListener(SidebarHelpToggleEvent.eventName, this.toggleHelpToggle);
+    }
+
+    hostDisconnected() {
+        this.host.removeEventListener(SidebarHelpToggleEvent.eventName, this.toggleHelpToggle);
+    }
+}

web/src/elements/SidebarHelp/events.ts

@@ -0,0 +1,16 @@
+import type { SidebarHelp } from "./SidebarHelp.js";
+
+export class SidebarHelpToggleEvent extends Event {
+    static readonly eventName = "ak-sidebar-help-toggle-request";
+    source: SidebarHelp;
+    constructor(source: SidebarHelp) {
+        super(SidebarHelpToggleEvent.eventName, { bubbles: true, composed: true });
+        this.source = source;
+    }
+}
+
+declare global {
+    interface GlobalEventHandlersEventMap {
+        [SidebarHelpToggleEvent.eventName]: SidebarHelpToggleEvent;
+    }
+}

web/src/elements/sync/SyncObjectForm.ts

@@ -118,8 +118,12 @@ export class SyncObjectForm extends Form<SyncObjectRequest> {
     }
 
     renderForm() {
-        return html` ${this.model === SyncObjectModelEnum.User ? this.renderSelectUser() : nothing}
-        ${this.model === SyncObjectModelEnum.Group ? this.renderSelectGroup() : nothing}
+        return html` ${this.model === SyncObjectModelEnum.AuthentikCoreModelsUser
+            ? this.renderSelectUser()
+            : nothing}
+        ${this.model === SyncObjectModelEnum.AuthentikCoreModelsGroup
+            ? this.renderSelectGroup()
+            : nothing}
         ${this.result ? this.renderResult() : html``}`;
     }
 }

website/docs/developer-docs/docs/templates/conceptual.md

@@ -24,7 +24,7 @@ In this optional section, provide some example use cases for the feature. Who wo
 
 Dive deeper into explaining the concepts behind the feature/component.
 
-Write about the feature/functionalilty from the user's perspective. What is this feature used for, why should they use it, are there situations where they should **_not_** use it?
+Write about the feature/functionality from the user's perspective. What is this feature used for, why should they use it, are there situations where they should **_not_** use it?
 
 > Pro Tip: If you were writing the related procedural topic, and you found that you had a lot to say about the topic, this is exactly where that info would go (not crowded up at the top of the procedural topic!).
 

website/docs/install-config/configuration/configuration.mdx

@@ -117,7 +117,7 @@ When your PostgreSQL database(s) are running behind a connection pooler, like Pg
 
     Using a connection pooler in transaction pool mode (e.g. PgPool, or PgBouncer in transaction or statement pool mode) requires disabling server-side cursors, so this setting must be set to `false`.
 
-Additionally, you can set `AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECK` to perform health checks on persistent database connections before they are re-used.
+Additionally, you can set `AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECK` to perform health checks on persistent database connections before they are reused.
 
 ## Redis Settings
 

website/integrations/services/cloudflare-access/index.md

@@ -0,0 +1,44 @@
+---
+title: Integrate with Cloudflare Access
+sidebar_label: Cloudflare Access
+---
+
+# Cloudflare Access
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is Cloudflare Access
+
+> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
+>
+> -- https://www.cloudflare.com/zero-trust/products/access/
+
+## Preparation
+
+The following placeholders are used in this guide:
+
+- `company.cloudflareaccess.com` is the FQDN of your Cloudflare Access subdomain.
+- `authentik.company` is the FQDN of the authentik installation.
+
+To proceed, you need to register for a free Cloudflare Access account and have both a Cloudflare account and a publicly accessible authentik instance with a trusted SSL certificate.
+
+## authentik configuration
+
+1. From the Admin interface, navigate to **Applications** -> **Applications**.
+2. Use the wizard to create a new application and provider. During this process:
+    - Note the **Client ID**, **Client Secret**, and **slug** values because they will be required later.
+    - Set a `Strict` redirect URI to `https://company.cloudflareaccess.com/cdn-cgi/access/callback`.
+    - Select any available signing key.
+
+## Cloudflare Access configuration
+
+1. Open the [Cloudflare Access dashboard](https://one.dash.cloudflare.com) and navigate to **Settings** -> **Authentication**.
+2. Click **Login methods**, and then select **Add** -> **OpenID Connect**.
+3. From the authentik provider you created earlier, copy the following details and paste them into the corresponding fields:
+    - **Client ID** -> App ID
+    - **Client Secret** -> Client Secret
+    - **Authorize URL** -> Auth URL
+    - **Token URL** -> Token URL
+    - **JWKS URL** -> Certificate URL
+4. Click **Save**.
+5. Click **Test** to verify the login provider.

website/integrations/services/cloudflare-access/index.mdx

@@ -1,67 +0,0 @@
----
-title: Integrate with Cloudflare Access
-sidebar_label: Cloudflare Access
----
-
-# Cloudflare Access
-
-<span class="badge badge--secondary">Support level: Community</span>
-
-## What is Cloudflare Access
-
-> Cloudflare Access is a secure, cloud-based zero-trust solution for managing and authenticating user access to internal applications and resources.
->
-> -- https://www.cloudflare.com/zero-trust/products/access/
-
-## Preparation
-
-The following placeholders are used in this guide:
-
-- `company.cloudflareaccess.com` is the FQDN of your Cloudflare Access subdomain.
-- `authentik.company` is the FQDN of the authentik installation.
-
-To proceed, you need to register for a free Cloudflare Access account and have both a Cloudflare account and a publicly accessible authentik instance with a trusted SSL certificate.
-
-## authentik configuration
-
-### Step 1: Log in to authentik
-
-1. Log in to your authentik instance.
-2. Click **Admin interface**.
-
-### Step 2: Create a new authentication provider
-
-3. Under **Application**, click **Providers** and create a new provider.
-4. Choose **OAuth2/OpenID Provider** and then click **Next**.
-5. Set the authorization flow to **Authorize Application** (`default-provider-authorization-explicit-consent`).
-6. Set the client type to **Confidential**.
-7. Set the redirect URI to `https://company.cloudflareaccess.com/cdn-cgi/access/callback`.
-8. Ensure that the signing key is set to **Authentik Self-signed Certificate**.
-9. Click **Finish** to create the provider.
-
-### Step 3: Create a new application
-
-10. Create a new application and give it a name.
-11. Set the provider to the one you just created.
-12. Ensure that the **Policy engine mode** is set to **ANY, any policy must match to grant access**.
-13. Click **Create** and then navigate to your [Cloudflare Access dashboard](https://one.dash.cloudflare.com).
-
-## Cloudflare Access configuration
-
-### Step 4: Configure Cloudflare Access
-
-1. Go to the Cloudflare One dashboard.
-2. Click **Settings** at the bottom of the menu, then select **Authentication**.
-
-### Step 5: Add a login method
-
-3. From **Login methods** click **Add** and select **OpenID Connect"**
-4. Enter a name for your login method. This can be anything.
-5. Copy the following details from the authentik provider settings you previously created and paste them into the text boxes:
-    - **Client ID** -> App ID
-    - **Client Secret** -> Client Secret
-    - **Authorize URL** -> Auth URL
-    - **Token URL** -> Token URL
-    - **JWKS URL** -> Certificate URL
-6. Click **Save**.
-7. Click **Test** to verify your login provider.

website/integrations/services/rustdesk-pro/index.mdx

@@ -0,0 +1,62 @@
+---
+title: Integrate with RustDesk Server Pro
+sidebar_label: RustDesk Server Pro
+---
+
+# RustDesk Server Pro
+
+<span class="badge badge--secondary">Support level: Community</span>
+
+## What is RustDesk Server Pro?
+
+> RustDesk Server Pro is a premium self-hosted solution for managing remote desktop connections securely and efficiently.  
+> It offers enhanced performance, advanced security features, and customization options like branding to meet professional needs.  
+> Ideal for businesses, it provides full control over data while ensuring scalable and reliable remote access.
+>
+> -- https://rustdesk.com/
+
+## Preparation
+
+This guide uses the following placeholders:
+
+- `rustdesk.company` is the FQDN of the RustDesk Server Pro installation.
+- `authentik.company` is the FQDN of the authentik installation.
+
+## authentik configuration
+
+1. In the authentik Admin interface, navigate to **Applications** -> **Applications**.
+2. Use the wizard to create a new application and provider. During this process:
+    - Note the **Client ID**, **Client Secret**, and **slug** values for later use.
+    - Set the redirect URI to https://_rustdesk.company_/api/oidc/callback.
+    - Select any available signing key.
+
+## RustDesk Server Pro configuration
+
+1. Sign in to RustDesk Server Pro using a browser.
+
+2. In the left menu, select **Settings** and then **OIDC**.
+
+3. Click **+ New Auth Provider**.
+
+4. In the popup window, select **custom** as the **Auth Type** and click **OK**.
+
+5. Configure the following values using information from the authentik provider:
+    - **Name**: _SSO-Login_
+    - **Client ID**: _client-id_
+    - **Client Secret**: _client-secret_
+    - **Issuer**: https://_authentik.company_/application/o/_slug_/
+    - **Authorization Endpoint**: https://_authentik.company_/application/o/authorize/
+    - **Token Endpoint**: https://_authentik.company_/application/o/token/
+    - **Userinfo Endpoint**: https://_authentik.company_/application/o/userinfo/
+    - **JWKS Endpoint**: https://_authentik.company_/application/o/_slug_/jwks/
+
+:::info
+Users are created automatically on login. Permissions must be assigned by an administrator after user creation.
+:::
+
+## Test the Login
+
+- Open a browser and navigate to https://_rustdesk.company_.
+- Click **Continue with SSO-Login**.
+- You should be redirected to authentik (with the login flows you configured). After logging in, authentik will redirect you back to https://_rustdesk.company_.
+- If you are redirected back to https://_rustdesk.company_ and can read the username in the top right corner, the setup was successful.

website/sidebarsIntegrations.js

@@ -91,6 +91,7 @@ module.exports = {
                         "services/powerdns-admin/index",
                         "services/proftpd/index",
                         "services/qnap-nas/index",
+                        "services/rustdesk-pro/index",
                         "services/semgrep/index",
                         "services/synology-dsm/index",
                         "services/skyhigh/index",