release: 2023.8.7

security: fix CVE-2024-23647 (#8345)

* security: fix CVE-2024-23647



* add tests



* add website



---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens L <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.10.6
+current_version = 2023.8.7
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)

.dockerignore

@@ -1,12 +1,10 @@
+env
 htmlcov
 *.env.yml
 **/node_modules
 dist/**
 build/**
 build_docs/**
-*Dockerfile
+Dockerfile
+authentik/enterprise
 blueprints/local
-.git
-!gen-ts-api/node_modules
-!gen-ts-api/dist/**
-!gen-go-api/

.github/actions/setup/action.yml

@@ -2,39 +2,36 @@ name: "Setup authentik testing environment"
 description: "Setup authentik testing environment"
 
 inputs:
-  postgresql_version:
+  postgresql_tag:
     description: "Optional postgresql image tag"
-    default: "16"
+    default: "12"
 
 runs:
   using: "composite"
   steps:
-    - name: Install poetry & deps
+    - name: Install poetry
       shell: bash
       run: |
         pipx install poetry || true
-        sudo apt-get update
-        sudo apt-get install --no-install-recommends -y libpq-dev openssl libxmlsec1-dev pkg-config gettext
+        sudo apt update
+        sudo apt install -y libpq-dev openssl libxmlsec1-dev pkg-config gettext
     - name: Setup python and restore poetry
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v3
       with:
-        python-version-file: "pyproject.toml"
+        python-version: "3.11"
         cache: "poetry"
     - name: Setup node
       uses: actions/setup-node@v3
       with:
-        node-version-file: web/package.json
+        node-version: "20.5"
         cache: "npm"
         cache-dependency-path: web/package-lock.json
-    - name: Setup go
-      uses: actions/setup-go@v4
-      with:
-        go-version-file: "go.mod"
     - name: Setup dependencies
       shell: bash
       run: |
-        export PSQL_TAG=${{ inputs.postgresql_version }}
+        export PSQL_TAG=${{ inputs.postgresql_tag }}
         docker-compose -f .github/actions/setup/docker-compose.yml up -d
+        poetry env use python3.11
         poetry install
         cd web && npm ci
     - name: Generate config

.github/actions/setup/docker-compose.yml

@@ -2,7 +2,7 @@ version: "3.7"
 
 services:
   postgresql:
-    image: docker.io/library/postgres:${PSQL_TAG:-16}
+    image: docker.io/library/postgres:${PSQL_TAG:-12}
     volumes:
       - db-data:/var/lib/postgresql/data
     environment:

.github/codecov.yml

@@ -6,5 +6,5 @@ coverage:
         # adjust accordingly based on how flaky your tests are
         # this allows a 1% drop from the previous base commit coverage
         threshold: 1%
-comment:
-  after_n_builds: 3
+  notify:
+    after_n_builds: 3

.github/codespell-words.txt

@@ -2,4 +2,3 @@ keypair
 keypairs
 hass
 warmup
-ontext

.github/dependabot.yml

@@ -30,19 +30,17 @@ updates:
     open-pull-requests-limit: 10
     commit-message:
       prefix: "web:"
-    # TODO: deduplicate these groups
     groups:
       sentry:
         patterns:
           - "@sentry/*"
-          - "@spotlightjs/*"
       babel:
         patterns:
           - "@babel/*"
           - "babel-*"
       eslint:
         patterns:
-          - "@typescript-eslint/*"
+          - "@typescript-eslint/eslint-*"
           - "eslint"
           - "eslint-*"
       storybook:
@@ -52,41 +50,6 @@ updates:
       esbuild:
         patterns:
           - "@esbuild/*"
-  - package-ecosystem: npm
-    directory: "/tests/wdio"
-    schedule:
-      interval: daily
-      time: "04:00"
-    labels:
-      - dependencies
-    open-pull-requests-limit: 10
-    commit-message:
-      prefix: "web:"
-    # TODO: deduplicate these groups
-    groups:
-      sentry:
-        patterns:
-          - "@sentry/*"
-          - "@spotlightjs/*"
-      babel:
-        patterns:
-          - "@babel/*"
-          - "babel-*"
-      eslint:
-        patterns:
-          - "@typescript-eslint/*"
-          - "eslint"
-          - "eslint-*"
-      storybook:
-        patterns:
-          - "@storybook/*"
-          - "*storybook*"
-      esbuild:
-        patterns:
-          - "@esbuild/*"
-      wdio:
-        patterns:
-          - "@wdio/*"
   - package-ecosystem: npm
     directory: "/website"
     schedule:

.github/workflows/ci-main.yml

@@ -34,7 +34,7 @@ jobs:
           - ruff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: run job
@@ -42,40 +42,31 @@ jobs:
   test-migrations:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: run migrations
         run: poetry run python -m lifecycle.migrate
   test-migrations-from-stable:
-    name: test-migrations-from-stable - PostgreSQL ${{ matrix.psql }}
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        psql:
-          - 12-alpine
-          - 15-alpine
-          - 16-alpine
+    continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           fetch-depth: 0
+      - name: Setup authentik env
+        uses: ./.github/actions/setup
       - name: checkout stable
         run: |
-          # Delete all poetry envs
-          rm -rf /home/runner/.cache/pypoetry
           # Copy current, latest config to local
           cp authentik/lib/default.yml local.env.yml
           cp -R .github ..
           cp -R scripts ..
-          git checkout version/$(python -c "from authentik import __version__; print(__version__)")
+          git checkout $(git describe --tags $(git rev-list --tags --max-count=1))
           rm -rf .github/ scripts/
           mv ../.github ../scripts .
-      - name: Setup authentik env (stable)
+      - name: Setup authentik env (ensure stable deps are installed)
         uses: ./.github/actions/setup
-        with:
-          postgresql_version: ${{ matrix.psql }}
       - name: run migrations to stable
         run: poetry run python -m lifecycle.migrate
       - name: checkout current code
@@ -85,21 +76,11 @@ jobs:
           git reset --hard HEAD
           git clean -d -fx .
           git checkout $GITHUB_SHA
-          # Delete previous poetry env
-          rm -rf /home/runner/.cache/pypoetry/virtualenvs/*
+          poetry install
       - name: Setup authentik env (ensure latest deps are installed)
         uses: ./.github/actions/setup
-        with:
-          postgresql_version: ${{ matrix.psql }}
       - name: migrate to latest
-        run: |
-          poetry run python -m lifecycle.migrate
-      - name: run tests
-        env:
-          # Test in the main database that we just migrated from the previous stable version
-          AUTHENTIK_POSTGRESQL__TEST__NAME: authentik
-        run: |
-          poetry run make test
+        run: poetry run python -m lifecycle.migrate
   test-unittest:
     name: test-unittest - PostgreSQL ${{ matrix.psql }}
     runs-on: ubuntu-latest
@@ -110,13 +91,12 @@ jobs:
         psql:
           - 12-alpine
           - 15-alpine
-          - 16-alpine
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
         with:
-          postgresql_version: ${{ matrix.psql }}
+          postgresql_tag: ${{ matrix.psql }}
       - name: run unittest
         run: |
           poetry run make test
@@ -129,7 +109,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
@@ -165,14 +145,14 @@ jobs:
           - name: flows
             glob: tests/e2e/test_flows*
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Setup e2e env (chrome, etc)
         run: |
           docker-compose -f tests/e2e/docker-compose.yml up -d
       - id: cache-web
-        uses: actions/cache@v4
+        uses: actions/cache@v3
         with:
           path: web/dist
           key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/src/**') }}
@@ -210,31 +190,28 @@ jobs:
       packages: write
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       - name: Login to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: generate ts client
-        run: make gen-client-ts
       - name: Build Docker Image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
         with:
-          context: .
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
@@ -247,8 +224,12 @@ jobs:
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
             VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: ./.github/actions/comment-pr-instructions
+        with:
+          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}
   build-arm64:
     needs: ci-core-mark
     runs-on: ubuntu-latest
@@ -257,31 +238,28 @@ jobs:
       packages: write
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       - name: Login to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: generate ts client
-        run: make gen-client-ts
       - name: Build Docker Image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
         with:
-          context: .
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
@@ -295,28 +273,3 @@ jobs:
             VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/arm64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-  pr-comment:
-    needs:
-      - build
-      - build-arm64
-    runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'pull_request' }}
-    permissions:
-      # Needed to write comments on PRs
-      pull-requests: write
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - name: prepare variables
-        uses: ./.github/actions/docker-push-variables
-        id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      - name: Comment on PR
-        uses: ./.github/actions/comment-pr-instructions
-        with:
-          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}

.github/workflows/ci-outpost.yml

@@ -15,8 +15,8 @@ jobs:
   lint-golint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
       - name: Prepare and generate API
@@ -30,18 +30,16 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.54.2
+          version: v1.52.2
           args: --timeout 5000s --verbose
-          skip-cache: true
+          skip-pkg-cache: true
   test-unittest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
       - name: Generate API
         run: make gen-client-go
       - name: Go unittests
@@ -65,26 +63,25 @@ jobs:
           - proxy
           - ldap
           - radius
-          - rac
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload contianer images to ghcr.io
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       - name: Login to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
@@ -93,7 +90,7 @@ jobs:
       - name: Generate API
         run: make gen-client-go
       - name: Build Docker Image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
         with:
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           tags: |
@@ -106,8 +103,6 @@ jobs:
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/amd64,linux/arm64
           context: .
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
   build-binary:
     timeout-minutes: 120
     needs:
@@ -120,19 +115,18 @@ jobs:
           - proxy
           - ldap
           - radius
-          - rac
         goos: [linux]
         goarch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - name: Generate API

.github/workflows/ci-web.yml

@@ -14,33 +14,27 @@ on:
 jobs:
   lint-eslint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        project:
-          - web
-          - tests/wdio
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: ${{ matrix.project }}/package.json
+          node-version: "20.5"
           cache: "npm"
-          cache-dependency-path: ${{ matrix.project }}/package-lock.json
-      - working-directory: ${{ matrix.project }}/
+          cache-dependency-path: web/package-lock.json
+      - working-directory: web/
         run: npm ci
       - name: Generate API
         run: make gen-client-ts
       - name: Eslint
-        working-directory: ${{ matrix.project }}/
+        working-directory: web/
         run: npm run lint
   lint-build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -52,33 +46,27 @@ jobs:
         run: npm run tsc
   lint-prettier:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        project:
-          - web
-          - tests/wdio
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: ${{ matrix.project }}/package.json
+          node-version: "20.5"
           cache: "npm"
-          cache-dependency-path: ${{ matrix.project }}/package-lock.json
-      - working-directory: ${{ matrix.project }}/
+          cache-dependency-path: web/package-lock.json
+      - working-directory: web/
         run: npm ci
       - name: Generate API
         run: make gen-client-ts
       - name: prettier
-        working-directory: ${{ matrix.project }}/
+        working-directory: web/
         run: npm run prettier-check
   lint-lit-analyse:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
@@ -108,9 +96,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - working-directory: web/

.github/workflows/ci-website.yml

@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: website/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/
@@ -30,9 +30,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: website/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/
@@ -51,9 +51,9 @@ jobs:
           - build-docs-only
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: website/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: website/package-lock.json
       - working-directory: website/

.github/workflows/codeql-analysis.yml

@@ -23,14 +23,14 @@ jobs:
         language: ["go", "javascript", "python"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v2

.github/workflows/gha-cache-cleanup.yml

@@ -6,16 +6,12 @@ on:
     types:
       - closed
 
-permissions:
-  # Permission to delete cache
-  actions: write
-
 jobs:
   cleanup:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v3
 
       - name: Cleanup
         run: |

.github/workflows/ghcr-retention.yml

@@ -1,8 +1,8 @@
 name: ghcr-retention
 
 on:
-  # schedule:
-  #   - cron: "0 0 * * *" # every day at midnight
+  schedule:
+    - cron: "0 0 * * *" # every day at midnight
   workflow_dispatch:
 
 jobs:
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}

.github/workflows/image-compress.yml

@@ -29,11 +29,11 @@ jobs:
        github.event.pull_request.head.repo.full_name == github.repository)
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
       - name: Compress images

.github/workflows/publish-source-docs.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: generate docs

.github/workflows/release-next-branch.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: internal-production
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           ref: main
       - run: |

.github/workflows/release-publish.yml

@@ -11,33 +11,28 @@ jobs:
       # Needed to upload contianer images to ghcr.io
       packages: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
       - name: Docker Login Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: make empty clients
-        run: |
-          mkdir -p ./gen-ts-api
-          mkdir -p ./gen-go-api
       - name: Build Docker Image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
         with:
-          context: .
           push: ${{ github.event_name == 'release' }}
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
@@ -65,36 +60,31 @@ jobs:
           - proxy
           - ldap
           - radius
-          - rac
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3.0.0
+        uses: docker/setup-qemu-action@v2.2.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v2
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-      - name: make empty clients
-        run: |
-          mkdir -p ./gen-ts-api
-          mkdir -p ./gen-go-api
       - name: Docker Login Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Docker Image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v4
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
@@ -106,7 +96,6 @@ jobs:
             ghcr.io/goauthentik/${{ matrix.type }}:latest
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
-          context: .
           build-args: |
             VERSION=${{ steps.ev.outputs.version }}
             VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
@@ -126,13 +115,13 @@ jobs:
         goos: [linux, darwin]
         goarch: [amd64, arm64]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
         with:
           go-version-file: "go.mod"
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           cache: "npm"
           cache-dependency-path: web/package-lock.json
       - name: Build web
@@ -161,7 +150,7 @@ jobs:
       - build-outpost-binary
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Run test suite in final docker images
         run: |
           echo "PG_PASS=$(openssl rand -base64 32)" >> .env
@@ -177,7 +166,7 @@ jobs:
       - build-outpost-binary
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev

.github/workflows/release-tag.yml

@@ -10,13 +10,12 @@ jobs:
     name: Create Release from Tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
       - name: Pre-release test
         run: |
           echo "PG_PASS=$(openssl rand -base64 32)" >> .env
           echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
           docker buildx install
-          mkdir -p ./gen-ts-api
           docker build -t testing:latest .
           echo "AUTHENTIK_IMAGE=testing" >> .env
           echo "AUTHENTIK_TAG=latest" >> .env
@@ -24,13 +23,13 @@ jobs:
           docker-compose start postgresql redis
           docker-compose run -u root server test-all
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
       - name: Extract version number
         id: get_version
-        uses: actions/github-script@v7
+        uses: actions/github-script@v6
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           script: |

.github/workflows/repo-stale.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/stale@v9
+      - uses: actions/stale@v8
         with:
           repo-token: ${{ steps.generate_token.outputs.token }}
           days-before-stale: 60

.github/workflows/translation-advice.yml

@@ -7,12 +7,7 @@ on:
     paths:
       - "!**"
       - "locale/**"
-      - "!locale/en/**"
-      - "web/xliff/**"
-
-permissions:
-  # Permission to write comment
-  pull-requests: write
+      - "web/src/locales/**"
 
 jobs:
   post-comment:

.github/workflows/translation-compile.yml

@@ -16,11 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
       - name: Setup authentik env

.github/workflows/translation-rename.yml

@@ -6,17 +6,13 @@ on:
   pull_request:
     types: [opened, reopened]
 
-permissions:
-  # Permission to rename PR
-  pull-requests: write
-
 jobs:
   rename_pr:
     runs-on: ubuntu-latest
     if: ${{ github.event.pull_request.user.login == 'transifex-integration[bot]'}}
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}

.github/workflows/web-api-publish.yml

@@ -10,16 +10,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: generate_token
-        uses: tibdex/github-app-token@v2
+        uses: tibdex/github-app-token@v1
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           token: ${{ steps.generate_token.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: web/package.json
+          node-version: "20.5"
           registry-url: "https://registry.npmjs.org"
       - name: Generate API Client
         run: make gen-client-ts

.gitignore

@@ -206,6 +206,3 @@ data/
 .netlify
 .ruff_cache
 source_docs/
-
-### Golang ###
-/vendor/

.vscode/extensions.json

@@ -14,7 +14,6 @@
         "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
-        "ms-python.black-formatter",
         "redhat.vscode-yaml",
         "Tobermory.es6-string-html",
         "unifiedjs.vscode-mdx",

.vscode/settings.json

@@ -19,8 +19,10 @@
         "slo",
         "scim",
     ],
+    "python.linting.pylintEnabled": true,
     "todo-tree.tree.showCountsInTree": true,
     "todo-tree.tree.showBadges": true,
+    "python.formatting.provider": "black",
     "yaml.customTags": [
         "!Find sequence",
         "!KeyOf scalar",

CODEOWNERS

@@ -1,26 +1,2 @@
-# Fallback
-*                               @goauthentik/backend @goauthentik/frontend
-# Backend
-authentik/                      @goauthentik/backend
-blueprints/                     @goauthentik/backend
-cmd/                            @goauthentik/backend
-internal/                       @goauthentik/backend
-lifecycle/                      @goauthentik/backend
-schemas/                        @goauthentik/backend
-scripts/                        @goauthentik/backend
-tests/                          @goauthentik/backend
-pyproject.toml                  @goauthentik/backend
-poetry.lock                     @goauthentik/backend
-# Infrastructure
-.github/                        @goauthentik/infrastructure
-Dockerfile                      @goauthentik/infrastructure
-*Dockerfile                     @goauthentik/infrastructure
-.dockerignore                   @goauthentik/infrastructure
-docker-compose.yml              @goauthentik/infrastructure
-# Web
-web/                            @goauthentik/frontend
-tests/wdio/                     @goauthentik/frontend
-# Docs & Website
-website/                        @goauthentik/docs
-# Security
-website/docs/security/          @goauthentik/security
+*   @goauthentik/core
+website/docs/security/**    @goauthentik/security

Dockerfile

@@ -1,59 +1,56 @@
-# syntax=docker/dockerfile:1
+# Stage 1: Build website
+FROM --platform=${BUILDPLATFORM} docker.io/node:20.5 as website-builder
 
-# Stage 1: Build webui
-FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
+COPY ./website /work/website/
+COPY ./blueprints /work/blueprints/
+COPY ./SECURITY.md /work/
 
 ENV NODE_ENV=production
+WORKDIR /work/website
+RUN npm ci --include=dev && npm run build-docs-only
 
-WORKDIR /work/web
-
-RUN --mount=type=bind,target=/work/web/package.json,src=./web/package.json \
-    --mount=type=bind,target=/work/web/package-lock.json,src=./web/package-lock.json \
-    --mount=type=cache,id=npm-web,sharing=shared,target=/root/.npm \
-    npm ci --include=dev
+# Stage 2: Build webui
+FROM --platform=${BUILDPLATFORM} docker.io/node:20.5 as web-builder
 
 COPY ./web /work/web/
 COPY ./website /work/website/
-COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 
-RUN npm run build
+ENV NODE_ENV=production
+WORKDIR /work/web
+RUN npm ci --include=dev && npm run build
 
-# Stage 2: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.21.6-bookworm AS go-builder
+# Stage 3: Poetry to requirements.txt export
+FROM docker.io/python:3.11.5-slim-bookworm AS poetry-locker
 
-ARG TARGETOS
-ARG TARGETARCH
-ARG TARGETVARIANT
+WORKDIR /work
+COPY ./pyproject.toml /work
+COPY ./poetry.lock /work
 
-ARG GOOS=$TARGETOS
-ARG GOARCH=$TARGETARCH
+RUN pip install --no-cache-dir poetry && \
+    poetry export -f requirements.txt --output requirements.txt && \
+    poetry export -f requirements.txt --dev --output requirements-dev.txt
 
-WORKDIR /go/src/goauthentik.io
+# Stage 4: Build go proxy
+FROM docker.io/golang:1.21.0-bookworm AS go-builder
 
-RUN --mount=type=bind,target=/go/src/goauthentik.io/go.mod,src=./go.mod \
-    --mount=type=bind,target=/go/src/goauthentik.io/go.sum,src=./go.sum \
-    --mount=type=cache,target=/go/pkg/mod \
-    go mod download
+WORKDIR /work
 
-COPY ./cmd /go/src/goauthentik.io/cmd
-COPY ./authentik/lib /go/src/goauthentik.io/authentik/lib
-COPY ./web/static.go /go/src/goauthentik.io/web/static.go
-COPY --from=web-builder /work/web/robots.txt /go/src/goauthentik.io/web/robots.txt
-COPY --from=web-builder /work/web/security.txt /go/src/goauthentik.io/web/security.txt
-COPY ./internal /go/src/goauthentik.io/internal
-COPY ./go.mod /go/src/goauthentik.io/go.mod
-COPY ./go.sum /go/src/goauthentik.io/go.sum
+COPY --from=web-builder /work/web/robots.txt /work/web/robots.txt
+COPY --from=web-builder /work/web/security.txt /work/web/security.txt
 
-ENV CGO_ENABLED=0
+COPY ./cmd /work/cmd
+COPY ./authentik/lib /work/authentik/lib
+COPY ./web/static.go /work/web/static.go
+COPY ./internal /work/internal
+COPY ./go.mod /work/go.mod
+COPY ./go.sum /work/go.sum
 
-RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \
-    --mount=type=cache,id=go-build-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/root/.cache/go-build \
-    GOARM="${TARGETVARIANT#v}" go build -o /go/authentik ./cmd/server
+RUN go build -o /work/bin/authentik ./cmd/server/
 
-# Stage 3: MaxMind GeoIP
-FROM --platform=${BUILDPLATFORM} ghcr.io/maxmind/geoipupdate:v6.1 as geoip
+# Stage 5: MaxMind GeoIP
+FROM ghcr.io/maxmind/geoipupdate:v6.0 as geoip
 
-ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN"
+ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City"
 ENV GEOIPUPDATE_VERBOSE="true"
 ENV GEOIPUPDATE_ACCOUNT_ID_FILE="/run/secrets/GEOIPUPDATE_ACCOUNT_ID"
 ENV GEOIPUPDATE_LICENSE_KEY_FILE="/run/secrets/GEOIPUPDATE_LICENSE_KEY"
@@ -64,33 +61,8 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     mkdir -p /usr/share/GeoIP && \
     /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
-# Stage 4: Python dependencies
-FROM docker.io/python:3.12.1-slim-bookworm AS python-deps
-
-WORKDIR /ak-root/poetry
-
-ENV VENV_PATH="/ak-root/venv" \
-    POETRY_VIRTUALENVS_CREATE=false \
-    PATH="/ak-root/venv/bin:$PATH"
-
-RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' > /etc/apt/apt.conf.d/keep-cache
-
-RUN --mount=type=cache,id=apt-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/var/cache/apt \
-    apt-get update && \
-    # Required for installing pip packages
-    apt-get install -y --no-install-recommends build-essential pkg-config libxmlsec1-dev zlib1g-dev libpq-dev
-
-RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
-    --mount=type=bind,target=./poetry.lock,src=./poetry.lock \
-    --mount=type=cache,target=/root/.cache/pip \
-    --mount=type=cache,target=/root/.cache/pypoetry \
-    python -m venv /ak-root/venv/ && \
-    pip3 install --upgrade pip && \
-    pip3 install poetry && \
-    poetry install --only=main --no-ansi --no-interaction
-
-# Stage 5: Run
-FROM docker.io/python:3.12.1-slim-bookworm AS final-image
+# Stage 6: Run
+FROM docker.io/python:3.11.5-slim-bookworm AS final-image
 
 ARG GIT_BUILD_HASH
 ARG VERSION
@@ -104,44 +76,46 @@ LABEL org.opencontainers.image.revision ${GIT_BUILD_HASH}
 
 WORKDIR /
 
-# We cannot cache this layer otherwise we'll end up with a bigger image
+COPY --from=poetry-locker /work/requirements.txt /
+COPY --from=poetry-locker /work/requirements-dev.txt /
+COPY --from=geoip /usr/share/GeoIP /geoip
+
 RUN apt-get update && \
+    # Required for installing pip packages
+    apt-get install -y --no-install-recommends build-essential pkg-config libxmlsec1-dev zlib1g-dev libpq-dev python3-dev && \
     # Required for runtime
-    apt-get install -y --no-install-recommends libpq5 openssl libxmlsec1-openssl libmaxminddb0 ca-certificates && \
+    apt-get install -y --no-install-recommends libpq5 openssl libxmlsec1-openssl libmaxminddb0 && \
     # Required for bootstrap & healtcheck
     apt-get install -y --no-install-recommends runit && \
+    pip install --no-cache-dir -r /requirements.txt && \
+    apt-get remove --purge -y build-essential pkg-config libxmlsec1-dev libpq-dev python3-dev && \
+    apt-get autoremove --purge -y && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
     mkdir -p /certs /media /blueprints && \
     mkdir -p /authentik/.ssh && \
-    mkdir -p /ak-root && \
-    chown authentik:authentik /certs /media /authentik/.ssh /ak-root
+    chown authentik:authentik /certs /media /authentik/.ssh
 
 COPY ./authentik/ /authentik
 COPY ./pyproject.toml /
-COPY ./poetry.lock /
 COPY ./schemas /schemas
 COPY ./locale /locale
 COPY ./tests /tests
 COPY ./manage.py /
 COPY ./blueprints /blueprints
 COPY ./lifecycle/ /lifecycle
-COPY --from=go-builder /go/authentik /bin/authentik
-COPY --from=python-deps /ak-root/venv /ak-root/venv
+COPY --from=go-builder /work/bin/authentik /bin/authentik
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=geoip /usr/share/GeoIP /geoip
+COPY --from=website-builder /work/website/help/ /website/help/
 
 USER 1000
 
-ENV TMPDIR=/dev/shm/ \
-    PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1 \
-    PATH="/ak-root/venv/bin:/lifecycle:$PATH" \
-    VENV_PATH="/ak-root/venv" \
-    POETRY_VIRTUALENVS_CREATE=false
+ENV TMPDIR /dev/shm/
+ENV PYTHONUNBUFFERED 1
+ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
 
-HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "ak", "healthcheck" ]
+HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "/lifecycle/ak", "healthcheck" ]
 
-ENTRYPOINT [ "dumb-init", "--", "ak" ]
+ENTRYPOINT [ "/usr/local/bin/dumb-init", "--", "/lifecycle/ak" ]

Makefile

@@ -1,16 +1,9 @@
-.PHONY: gen dev-reset all clean test web website
-
-.SHELLFLAGS += ${SHELLFLAGS} -e
+.SHELLFLAGS += -x -e
 PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
 PY_SOURCES = authentik tests scripts lifecycle
-DOCKER_IMAGE ?= "authentik:test"
-
-pg_user := $(shell python -m authentik.lib.config postgresql.user 2>/dev/null)
-pg_host := $(shell python -m authentik.lib.config postgresql.host 2>/dev/null)
-pg_name := $(shell python -m authentik.lib.config postgresql.name 2>/dev/null)
 
 CODESPELL_ARGS = -D - -D .github/codespell-dictionary.txt \
 		-I .github/codespell-words.txt \
@@ -26,82 +19,57 @@ CODESPELL_ARGS = -D - -D .github/codespell-dictionary.txt \
 		website/integrations \
 		website/src
 
-all: lint-fix lint test gen web  ## Lint, build, and test everything
-
-HELP_WIDTH := $(shell grep -h '^[a-z][^ ]*:.*\#\#' $(MAKEFILE_LIST) 2>/dev/null | \
-	cut -d':' -f1 | awk '{printf "%d\n", length}' | sort -rn | head -1)
-
-help:  ## Show this help
-	@echo "\nSpecify a command. The choices are:\n"
-	@grep -Eh '^[0-9a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
-		awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[0;36m%-$(HELP_WIDTH)s  \033[m %s\n", $$1, $$2}' | \
-		sort
-	@echo ""
+all: lint-fix lint test gen web
 
 test-go:
 	go test -timeout 0 -v -race -cover ./...
 
-test-docker:  ## Run all tests in a docker-compose
+test-docker:
 	echo "PG_PASS=$(openssl rand -base64 32)" >> .env
 	echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
 	docker-compose pull -q
 	docker-compose up --no-start
 	docker-compose start postgresql redis
-	docker-compose run -u root server test-all
+	docker-compose run -u root server test
 	rm -f .env
 
-test: ## Run the server tests and produce a coverage report (locally)
+test:
 	coverage run manage.py test --keepdb authentik
 	coverage html
 	coverage report
 
-lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
-	isort $(PY_SOURCES)
-	black $(PY_SOURCES)
-	ruff --fix $(PY_SOURCES)
+lint-fix:
+	isort authentik $(PY_SOURCES)
+	black authentik $(PY_SOURCES)
+	ruff authentik $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
-lint: ## Lint the python and golang sources
-	bandit -r $(PY_SOURCES) -x node_modules
-	./web/node_modules/.bin/pyright $(PY_SOURCES)
+lint:
 	pylint $(PY_SOURCES)
+	bandit -r $(PY_SOURCES) -x node_modules
 	golangci-lint run -v
 
-migrate: ## Run the Authentik Django server's migrations
+migrate:
 	python -m lifecycle.migrate
 
-i18n-extract: i18n-extract-core web-i18n-extract  ## Extract strings that require translation into files to send to a translation service
+i18n-extract: i18n-extract-core web-i18n-extract
 
 i18n-extract-core:
 	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
 
-install: web-install website-install  ## Install all requires dependencies for `web`, `website` and `core`
-	poetry install
-
-dev-drop-db:
-	dropdb -U ${pg_user} -h ${pg_host} ${pg_name}
-	# Also remove the test-db if it exists
-	dropdb -U ${pg_user} -h ${pg_host} test_${pg_name} || true
-	redis-cli -n 0 flushall
-
-dev-create-db:
-	createdb -U ${pg_user} -h ${pg_host} ${pg_name}
-
-dev-reset: dev-drop-db dev-create-db migrate  ## Drop and restore the Authentik PostgreSQL instance to a "fresh install" state.
-
 #########################
 ## API Schema
 #########################
 
-gen-build:  ## Extract the schema from the database
+gen-build:
 	AUTHENTIK_DEBUG=true ak make_blueprint_schema > blueprints/schema.json
 	AUTHENTIK_DEBUG=true ak spectacular --file schema.yml
 
-gen-changelog:  ## (Release) generate the changelog based from the commits since the last tag
+gen-changelog:
 	git log --pretty=format:" - %s" $(shell git describe --tags $(shell git rev-list --tags --max-count=1))...$(shell git branch --show-current) | sort > changelog.md
 	npx prettier --write changelog.md
 
-gen-diff:  ## (Release) generate the changelog diff between the current schema and the last tag
+gen-diff:
 	git show $(shell git describe --tags $(shell git rev-list --tags --max-count=1)):schema.yml > old_schema.yml
 	docker run \
 		--rm -v ${PWD}:/local \
@@ -110,16 +78,13 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 		--markdown /local/diff.md \
 		/local/old_schema.yml /local/schema.yml
 	rm old_schema.yml
-	sed -i 's/{/{/g' diff.md
-	sed -i 's/}/}/g' diff.md
 	npx prettier --write diff.md
 
 gen-clean:
-	rm -rf gen-go-api/
-	rm -rf gen-ts-api/
-	rm -rf web/node_modules/@goauthentik/api/
+	rm -rf web/api/src/
+	rm -rf api/
 
-gen-client-ts:  ## Build and install the authentik API for Typescript into the authentik UI Application
+gen-client-ts:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
@@ -135,7 +100,7 @@ gen-client-ts:  ## Build and install the authentik API for Typescript into the a
 	cd gen-ts-api && npm i
 	\cp -rfv gen-ts-api/* web/node_modules/@goauthentik/api
 
-gen-client-go:  ## Build and install the authentik API for Golang
+gen-client-go:
 	mkdir -p ./gen-go-api ./gen-go-api/templates
 	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./gen-go-api/config.yaml
 	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O ./gen-go-api/templates/README.mustache
@@ -152,7 +117,7 @@ gen-client-go:  ## Build and install the authentik API for Golang
 	go mod edit -replace goauthentik.io/api/v3=./gen-go-api
 	rm -rf ./gen-go-api/config.yaml ./gen-go-api/templates/
 
-gen-dev-config:  ## Generate a local development config file
+gen-dev-config:
 	python -m scripts.generate_config
 
 gen: gen-build gen-clean gen-client-ts
@@ -161,21 +126,21 @@ gen: gen-build gen-clean gen-client-ts
 ## Web
 #########################
 
-web-build: web-install  ## Build the Authentik UI
+web-build: web-install
 	cd web && npm run build
 
-web: web-lint-fix web-lint web-check-compile web-i18n-extract  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it
+web: web-lint-fix web-lint web-check-compile
 
-web-install:  ## Install the necessary libraries to build the Authentik UI
+web-install:
 	cd web && npm ci
 
-web-watch:  ## Build and watch the Authentik UI for changes, updating automatically
+web-watch:
 	rm -rf web/dist/
 	mkdir web/dist/
 	touch web/dist/.gitkeep
 	cd web && npm run watch
 
-web-storybook-watch:  ## Build and run the storybook documentation server
+web-storybook-watch:
 	cd web && npm run storybook
 
 web-lint-fix:
@@ -195,7 +160,7 @@ web-i18n-extract:
 ## Website
 #########################
 
-website: website-lint-fix website-build  ## Automatically fix formatting issues in the Authentik website/docs source code, lint the code, and compile it
+website: website-lint-fix website-build
 
 website-install:
 	cd website && npm ci
@@ -206,22 +171,11 @@ website-lint-fix:
 website-build:
 	cd website && npm run build
 
-website-watch:  ## Build and watch the documentation website, updating automatically
+website-watch:
 	cd website && npm run watch
 
-#########################
-## Docker
-#########################
-
-docker:  ## Build a docker image of the current source tree
-	DOCKER_BUILDKIT=1 docker build . --progress plain --tag ${DOCKER_IMAGE}
-
-#########################
-## CI
-#########################
 # These targets are use by GitHub actions to allow usage of matrix
 # which makes the YAML File a lot smaller
-
 ci--meta-debug:
 	python -V
 	node --version
@@ -249,3 +203,14 @@ ci-pyright: ci--meta-debug
 
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check
+
+install: web-install website-install
+	poetry install
+
+dev-reset:
+	dropdb -U postgres -h localhost authentik
+	# Also remove the test-db if it exists
+	dropdb -U postgres -h localhost test_authentik || true
+	createdb -U postgres -h localhost authentik
+	redis-cli -n 0 flushall
+	make migrate

README.md

@@ -41,3 +41,15 @@ See [SECURITY.md](SECURITY.md)
 ## Adoption and Contributions
 
 Your organization uses authentik? We'd love to add your logo to the readme and our website! Email us @ hello@goauthentik.io or open a GitHub Issue/PR! For more information on how to contribute to authentik, please refer to our [CONTRIBUTING.md file](./CONTRIBUTING.md).
+
+## Sponsors
+
+This project is proudly sponsored by:
+
+<p>
+    <a href="https://www.digitalocean.com/?utm_medium=opensource&utm_source=goauthentik.io">
+        <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px">
+    </a>
+</p>
+
+DigitalOcean provides development and testing resources for authentik.

SECURITY.md

@@ -1,9 +1,5 @@
 authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
 
-## Independent audits and pentests
-
-In May/June of 2023 [Cure53](https://cure53.de) conducted an audit and pentest. The [results](https://cure53.de/pentest-report_authentik.pdf) are published on the [Cure53 website](https://cure53.de/#publications-2023). For more details about authentik's response to the findings of the audit refer to [2023-06 Cure53 Code audit](https://goauthentik.io/docs/security/2023-06-cure53).
-
 ## What authentik classifies as a CVE
 
 CVE (Common Vulnerability and Exposure) is a system designed to aggregate all vulnerabilities. As such, a CVE will be issued when there is a either vulnerability or exposure. Per NIST, A vulnerability is:

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2023.10.6"
+__version__ = "2023.8.7"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/meta.py

@@ -1,7 +1,7 @@
 """Meta API"""
 from drf_spectacular.utils import extend_schema
 from rest_framework.fields import CharField
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
@@ -21,7 +21,7 @@ class AppSerializer(PassiveSerializer):
 class AppsViewSet(ViewSet):
     """Read-only view list all installed apps"""
 
-    permission_classes = [IsAuthenticated]
+    permission_classes = [IsAdminUser]
 
     @extend_schema(responses={200: AppSerializer(many=True)})
     def list(self, request: Request) -> Response:
@@ -35,7 +35,7 @@ class AppsViewSet(ViewSet):
 class ModelViewSet(ViewSet):
     """Read-only view list all installed models"""
 
-    permission_classes = [IsAuthenticated]
+    permission_classes = [IsAdminUser]
 
     @extend_schema(responses={200: AppSerializer(many=True)})
     def list(self, request: Request) -> Response:

authentik/admin/api/metrics.py

@@ -5,7 +5,7 @@ from django.db.models.functions import ExtractHour
 from drf_spectacular.utils import extend_schema, extend_schema_field
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.fields import IntegerField, SerializerMethodField
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
@@ -68,7 +68,7 @@ class LoginMetricsSerializer(PassiveSerializer):
 class AdministrationMetricsViewSet(APIView):
     """Login Metrics per 1h"""
 
-    permission_classes = [IsAuthenticated]
+    permission_classes = [IsAdminUser]
 
     @extend_schema(responses={200: LoginMetricsSerializer(many=False)})
     def get(self, request: Request) -> Response:

authentik/admin/api/system.py

@@ -8,6 +8,7 @@ from django.utils.timezone import now
 from drf_spectacular.utils import extend_schema
 from gunicorn import version_info as gunicorn_version
 from rest_framework.fields import SerializerMethodField
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
@@ -16,7 +17,6 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.lib.utils.reflection import get_env
 from authentik.outposts.apps import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost
-from authentik.rbac.permissions import HasPermission
 
 
 class RuntimeDict(TypedDict):
@@ -30,7 +30,7 @@ class RuntimeDict(TypedDict):
     uname: str
 
 
-class SystemInfoSerializer(PassiveSerializer):
+class SystemSerializer(PassiveSerializer):
     """Get system information."""
 
     http_headers = SerializerMethodField()
@@ -88,17 +88,17 @@ class SystemInfoSerializer(PassiveSerializer):
 class SystemView(APIView):
     """Get system information."""
 
-    permission_classes = [HasPermission("authentik_rbac.view_system_info")]
+    permission_classes = [IsAdminUser]
     pagination_class = None
     filter_backends = []
-    serializer_class = SystemInfoSerializer
+    serializer_class = SystemSerializer
 
-    @extend_schema(responses={200: SystemInfoSerializer(many=False)})
+    @extend_schema(responses={200: SystemSerializer(many=False)})
     def get(self, request: Request) -> Response:
         """Get system information."""
-        return Response(SystemInfoSerializer(request).data)
+        return Response(SystemSerializer(request).data)
 
-    @extend_schema(responses={200: SystemInfoSerializer(many=False)})
+    @extend_schema(responses={200: SystemSerializer(many=False)})
     def post(self, request: Request) -> Response:
         """Get system information."""
-        return Response(SystemInfoSerializer(request).data)
+        return Response(SystemSerializer(request).data)

authentik/admin/api/tasks.py

@@ -14,15 +14,14 @@ from rest_framework.fields import (
     ListField,
     SerializerMethodField,
 )
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
 from structlog.stdlib import get_logger
 
-from authentik.api.decorators import permission_required
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus
-from authentik.rbac.permissions import HasPermission
 
 LOGGER = get_logger()
 
@@ -64,7 +63,7 @@ class TaskSerializer(PassiveSerializer):
 class TaskViewSet(ViewSet):
     """Read-only view set that returns all background tasks"""
 
-    permission_classes = [HasPermission("authentik_rbac.view_system_tasks")]
+    permission_classes = [IsAdminUser]
     serializer_class = TaskSerializer
 
     @extend_schema(
@@ -94,7 +93,6 @@ class TaskViewSet(ViewSet):
         tasks = sorted(TaskInfo.all().values(), key=lambda task: task.task_name)
         return Response(TaskSerializer(tasks, many=True).data)
 
-    @permission_required(None, ["authentik_rbac.run_system_tasks"])
     @extend_schema(
         request=OpenApiTypes.NONE,
         responses={

authentik/admin/api/workers.py

@@ -2,18 +2,18 @@
 from django.conf import settings
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.fields import IntegerField
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
-from authentik.rbac.permissions import HasPermission
 from authentik.root.celery import CELERY_APP
 
 
 class WorkerView(APIView):
     """Get currently connected worker count."""
 
-    permission_classes = [HasPermission("authentik_rbac.view_system_info")]
+    permission_classes = [IsAdminUser]
 
     @extend_schema(responses=inline_serializer("Workers", fields={"count": IntegerField()}))
     def get(self, request: Request) -> Response:

authentik/api/authorization.py

@@ -7,9 +7,9 @@ from rest_framework.authentication import get_authorization_header
 from rest_framework.filters import BaseFilterBackend
 from rest_framework.permissions import BasePermission
 from rest_framework.request import Request
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 
 from authentik.api.authentication import validate_auth
-from authentik.rbac.filters import ObjectFilter
 
 
 class OwnerFilter(BaseFilterBackend):
@@ -26,14 +26,14 @@ class OwnerFilter(BaseFilterBackend):
 class SecretKeyFilter(DjangoFilterBackend):
     """Allow access to all objects when authenticated with secret key as token.
 
-    Replaces both DjangoFilterBackend and ObjectFilter"""
+    Replaces both DjangoFilterBackend and ObjectPermissionsFilter"""
 
     def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
         auth_header = get_authorization_header(request)
         token = validate_auth(auth_header)
         if token and token == settings.SECRET_KEY:
             return queryset
-        queryset = ObjectFilter().filter_queryset(request, queryset, view)
+        queryset = ObjectPermissionsFilter().filter_queryset(request, queryset, view)
         return super().filter_queryset(request, queryset, view)
 
 

authentik/api/decorators.py

@@ -10,7 +10,7 @@ from structlog.stdlib import get_logger
 LOGGER = get_logger()
 
 
-def permission_required(obj_perm: Optional[str] = None, global_perms: Optional[list[str]] = None):
+def permission_required(perm: Optional[str] = None, other_perms: Optional[list[str]] = None):
     """Check permissions for a single custom action"""
 
     def wrapper_outter(func: Callable):
@@ -18,17 +18,15 @@ def permission_required(obj_perm: Optional[str] = None, global_perms: Optional[l
 
         @wraps(func)
         def wrapper(self: ModelViewSet, request: Request, *args, **kwargs) -> Response:
-            if obj_perm:
+            if perm:
                 obj = self.get_object()
-                if not request.user.has_perm(obj_perm, obj):
-                    LOGGER.debug(
-                        "denying access for object", user=request.user, perm=obj_perm, obj=obj
-                    )
+                if not request.user.has_perm(perm, obj):
+                    LOGGER.debug("denying access for object", user=request.user, perm=perm, obj=obj)
                     return self.permission_denied(request)
-            if global_perms:
-                for other_perm in global_perms:
+            if other_perms:
+                for other_perm in other_perms:
                     if not request.user.has_perm(other_perm):
-                        LOGGER.debug("denying access for other", user=request.user, perm=other_perm)
+                        LOGGER.debug("denying access for other", user=request.user, perm=perm)
                         return self.permission_denied(request)
             return func(self, request, *args, **kwargs)
 

authentik/api/pagination.py

@@ -77,10 +77,3 @@ class Pagination(pagination.PageNumberPagination):
             },
             "required": ["pagination", "results"],
         }
-
-
-class SmallerPagination(Pagination):
-    """Smaller pagination for objects which might require a lot of queries
-    to retrieve all data for."""
-
-    max_page_size = 10

authentik/api/tests/test_auth.py

@@ -12,8 +12,6 @@ from authentik.blueprints.tests import reconcile_app
 from authentik.core.models import Token, TokenIntents, User, UserTypes
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.lib.generators import generate_id
-from authentik.outposts.apps import MANAGED_OUTPOST
-from authentik.outposts.models import Outpost
 from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
 from authentik.providers.oauth2.models import AccessToken, OAuth2Provider
 
@@ -51,12 +49,8 @@ class TestAPIAuth(TestCase):
         with self.assertRaises(AuthenticationFailed):
             bearer_auth(f"Bearer {token.key}".encode())
 
-    @reconcile_app("authentik_outposts")
-    def test_managed_outpost_fail(self):
+    def test_managed_outpost(self):
         """Test managed outpost"""
-        outpost = Outpost.objects.filter(managed=MANAGED_OUTPOST).first()
-        outpost.user.delete()
-        outpost.delete()
         with self.assertRaises(AuthenticationFailed):
             bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
 

authentik/api/tests/test_viewsets.py

@@ -16,7 +16,6 @@ def viewset_tester_factory(test_viewset: type[ModelViewSet]) -> Callable:
 
     def tester(self: TestModelViewSets):
         self.assertIsNotNone(getattr(test_viewset, "search_fields", None))
-        self.assertIsNotNone(getattr(test_viewset, "ordering", None))
         filterset_class = getattr(test_viewset, "filterset_class", None)
         if not filterset_class:
             self.assertIsNotNone(getattr(test_viewset, "filterset_fields", None))

authentik/api/v3/config.py

@@ -19,7 +19,7 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from authentik.core.api.utils import PassiveSerializer
-from authentik.events.context_processors.base import get_context_processors
+from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 
 capabilities = Signal()
@@ -30,7 +30,6 @@ class Capabilities(models.TextChoices):
 
     CAN_SAVE_MEDIA = "can_save_media"
     CAN_GEO_IP = "can_geo_ip"
-    CAN_ASN = "can_asn"
     CAN_IMPERSONATE = "can_impersonate"
     CAN_DEBUG = "can_debug"
     IS_ENTERPRISE = "is_enterprise"
@@ -69,9 +68,8 @@ class ConfigView(APIView):
         deb_test = settings.DEBUG or settings.TEST
         if Path(settings.MEDIA_ROOT).is_mount() or deb_test:
             caps.append(Capabilities.CAN_SAVE_MEDIA)
-        for processor in get_context_processors():
-            if cap := processor.capability():
-                caps.append(cap)
+        if GEOIP_READER.enabled:
+            caps.append(Capabilities.CAN_GEO_IP)
         if CONFIG.get_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
         if settings.DEBUG:  # pragma: no cover
@@ -95,10 +93,10 @@ class ConfigView(APIView):
                     "traces_sample_rate": float(CONFIG.get("error_reporting.sample_rate", 0.4)),
                 },
                 "capabilities": self.get_capabilities(),
-                "cache_timeout": CONFIG.get_int("cache.timeout"),
-                "cache_timeout_flows": CONFIG.get_int("cache.timeout_flows"),
-                "cache_timeout_policies": CONFIG.get_int("cache.timeout_policies"),
-                "cache_timeout_reputation": CONFIG.get_int("cache.timeout_reputation"),
+                "cache_timeout": CONFIG.get_int("redis.cache_timeout"),
+                "cache_timeout_flows": CONFIG.get_int("redis.cache_timeout_flows"),
+                "cache_timeout_policies": CONFIG.get_int("redis.cache_timeout_policies"),
+                "cache_timeout_reputation": CONFIG.get_int("redis.cache_timeout_reputation"),
             }
         )
 

authentik/api/v3/urls.py

@@ -21,9 +21,7 @@ _other_urls = []
 for _authentik_app in get_apps():
     try:
         api_urls = import_module(f"{_authentik_app.name}.urls")
-    except ModuleNotFoundError:
-        continue
-    except ImportError as exc:
+    except (ModuleNotFoundError, ImportError) as exc:
         LOGGER.warning("Could not import app's URLs", app_name=_authentik_app.name, exc=exc)
         continue
     if not hasattr(api_urls, "api_urlpatterns"):

authentik/blueprints/api.py

@@ -3,7 +3,8 @@ from django.utils.translation import gettext_lazy as _
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
-from rest_framework.fields import CharField, DateTimeField
+from rest_framework.fields import CharField, DateTimeField, JSONField
+from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer
@@ -15,7 +16,7 @@ from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.oci import OCI_PREFIX
 from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import JSONDictField, PassiveSerializer
+from authentik.core.api.utils import PassiveSerializer
 
 
 class ManagedSerializer:
@@ -28,7 +29,7 @@ class MetadataSerializer(PassiveSerializer):
     """Serializer for blueprint metadata"""
 
     name = CharField()
-    labels = JSONDictField()
+    labels = JSONField()
 
 
 class BlueprintInstanceSerializer(ModelSerializer):
@@ -48,7 +49,7 @@ class BlueprintInstanceSerializer(ModelSerializer):
         if content == "":
             return content
         context = self.instance.context if self.instance else {}
-        valid, logs = Importer.from_string(content, context).validate()
+        valid, logs = Importer(content, context).validate()
         if not valid:
             text_logs = "\n".join([x["event"] for x in logs])
             raise ValidationError(_("Failed to validate blueprint: %(logs)s" % {"logs": text_logs}))
@@ -86,11 +87,11 @@ class BlueprintInstanceSerializer(ModelSerializer):
 class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
     """Blueprint instances"""
 
+    permission_classes = [IsAdminUser]
     serializer_class = BlueprintInstanceSerializer
     queryset = BlueprintInstance.objects.all()
     search_fields = ["name", "path"]
     filterset_fields = ["name", "path"]
-    ordering = ["name"]
 
     @extend_schema(
         responses={

authentik/blueprints/apps.py

@@ -40,7 +40,7 @@ class ManagedAppConfig(AppConfig):
                 meth()
                 self._logger.debug("Successfully reconciled", name=name)
             except (DatabaseError, ProgrammingError, InternalError) as exc:
-                self._logger.warning("Failed to run reconcile", name=name, exc=exc)
+                self._logger.debug("Failed to run reconcile", name=name, exc=exc)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):

authentik/blueprints/management/commands/apply_blueprint.py

@@ -18,7 +18,7 @@ class Command(BaseCommand):
         """Apply all blueprints in order, abort when one fails to import"""
         for blueprint_path in options.get("blueprints", []):
             content = BlueprintInstance(path=blueprint_path).retrieve()
-            importer = Importer.from_string(content)
+            importer = Importer(content)
             valid, _ = importer.validate()
             if not valid:
                 self.stderr.write("blueprint invalid")

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -9,7 +9,6 @@ from rest_framework.fields import Field, JSONField, UUIDField
 from rest_framework.serializers import Serializer
 from structlog.stdlib import get_logger
 
-from authentik.blueprints.v1.common import BlueprintEntryDesiredState
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT, is_model_allowed
 from authentik.blueprints.v1.meta.registry import BaseMetaModel, registry
 from authentik.lib.models import SerializerModel
@@ -111,7 +110,7 @@ class Command(BaseCommand):
                 "id": {"type": "string"},
                 "state": {
                     "type": "string",
-                    "enum": [s.value for s in BlueprintEntryDesiredState],
+                    "enum": ["absent", "present", "created"],
                     "default": "present",
                 },
                 "conditions": {"type": "array", "items": {"type": "boolean"}},

authentik/blueprints/tests/__init__.py

@@ -20,7 +20,7 @@ def apply_blueprint(*files: str):
         def wrapper(*args, **kwargs):
             for file in files:
                 content = BlueprintInstance(path=file).retrieve()
-                Importer.from_string(content).apply()
+                Importer(content).apply()
             return func(*args, **kwargs)
 
         return wrapper

authentik/blueprints/tests/test_packaged.py

@@ -25,7 +25,7 @@ def blueprint_tester(file_name: Path) -> Callable:
     def tester(self: TestPackaged):
         base = Path("blueprints/")
         rel_path = Path(file_name).relative_to(base)
-        importer = Importer.from_string(BlueprintInstance(path=str(rel_path)).retrieve())
+        importer = Importer(BlueprintInstance(path=str(rel_path)).retrieve())
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 

authentik/blueprints/tests/test_serializer_models.py

@@ -6,7 +6,6 @@ from django.test import TestCase
 
 from authentik.blueprints.v1.importer import is_model_allowed
 from authentik.lib.models import SerializerModel
-from authentik.providers.oauth2.models import RefreshToken
 
 
 class TestModels(TestCase):
@@ -22,9 +21,6 @@ def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
         model_class = test_model()
         self.assertTrue(isinstance(model_class, SerializerModel))
         self.assertIsNotNone(model_class.serializer)
-        if model_class.serializer.Meta().model == RefreshToken:
-            return
-        self.assertEqual(model_class.serializer.Meta().model, test_model)
 
     return tester
 

authentik/blueprints/tests/test_v1.py

@@ -21,14 +21,14 @@ class TestBlueprintsV1(TransactionTestCase):
 
     def test_blueprint_invalid_format(self):
         """Test blueprint with invalid format"""
-        importer = Importer.from_string('{"version": 3}')
+        importer = Importer('{"version": 3}')
         self.assertFalse(importer.validate()[0])
-        importer = Importer.from_string(
+        importer = Importer(
             '{"version": 1,"entries":[{"identifiers":{},"attrs":{},'
             '"model": "authentik_core.User"}]}'
         )
         self.assertFalse(importer.validate()[0])
-        importer = Importer.from_string(
+        importer = Importer(
             '{"version": 1, "entries": [{"attrs": {"name": "test"}, '
             '"identifiers": {}, '
             '"model": "authentik_core.Group"}]}'
@@ -54,7 +54,7 @@ class TestBlueprintsV1(TransactionTestCase):
             },
         )
 
-        importer = Importer.from_string(
+        importer = Importer(
             '{"version": 1, "entries": [{"attrs": {"name": "test999", "attributes": '
             '{"key": ["updated_value"]}}, "identifiers": {"attributes": {"other_key": '
             '["other_value"]}}, "model": "authentik_core.Group"}]}'
@@ -103,7 +103,7 @@ class TestBlueprintsV1(TransactionTestCase):
             self.assertEqual(len(export.entries), 3)
             export_yaml = exporter.export_to_string()
 
-        importer = Importer.from_string(export_yaml)
+        importer = Importer(export_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 
@@ -113,14 +113,14 @@ class TestBlueprintsV1(TransactionTestCase):
         """Test export and import it twice"""
         count_initial = Prompt.objects.filter(field_key="username").count()
 
-        importer = Importer.from_string(load_fixture("fixtures/static_prompt_export.yaml"))
+        importer = Importer(load_fixture("fixtures/static_prompt_export.yaml"))
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 
         count_before = Prompt.objects.filter(field_key="username").count()
         self.assertEqual(count_initial + 1, count_before)
 
-        importer = Importer.from_string(load_fixture("fixtures/static_prompt_export.yaml"))
+        importer = Importer(load_fixture("fixtures/static_prompt_export.yaml"))
         self.assertTrue(importer.apply())
 
         self.assertEqual(Prompt.objects.filter(field_key="username").count(), count_before)
@@ -130,7 +130,7 @@ class TestBlueprintsV1(TransactionTestCase):
         ExpressionPolicy.objects.filter(name="foo-bar-baz-qux").delete()
         Group.objects.filter(name="test").delete()
         environ["foo"] = generate_id()
-        importer = Importer.from_string(load_fixture("fixtures/tags.yaml"), {"bar": "baz"})
+        importer = Importer(load_fixture("fixtures/tags.yaml"), {"bar": "baz"})
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         policy = ExpressionPolicy.objects.filter(name="foo-bar-baz-qux").first()
@@ -248,7 +248,7 @@ class TestBlueprintsV1(TransactionTestCase):
             exporter = FlowExporter(flow)
             export_yaml = exporter.export_to_string()
 
-        importer = Importer.from_string(export_yaml)
+        importer = Importer(export_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         self.assertTrue(UserLoginStage.objects.filter(name=stage_name).exists())
@@ -297,7 +297,7 @@ class TestBlueprintsV1(TransactionTestCase):
             exporter = FlowExporter(flow)
             export_yaml = exporter.export_to_string()
 
-        importer = Importer.from_string(export_yaml)
+        importer = Importer(export_yaml)
 
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -18,7 +18,7 @@ class TestBlueprintsV1ConditionalFields(TransactionTestCase):
         self.uid = generate_id()
         import_yaml = load_fixture("fixtures/conditional_fields.yaml", uid=self.uid, user=user.pk)
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 

authentik/blueprints/tests/test_v1_conditions.py

@@ -18,7 +18,7 @@ class TestBlueprintsV1Conditions(TransactionTestCase):
             "fixtures/conditions_fulfilled.yaml", id1=flow_slug1, id2=flow_slug2
         )
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         # Ensure objects exist
@@ -35,7 +35,7 @@ class TestBlueprintsV1Conditions(TransactionTestCase):
             "fixtures/conditions_not_fulfilled.yaml", id1=flow_slug1, id2=flow_slug2
         )
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         # Ensure objects do not exist

authentik/blueprints/tests/test_v1_state.py

@@ -15,7 +15,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         flow_slug = generate_id()
         import_yaml = load_fixture("fixtures/state_present.yaml", id=flow_slug)
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         # Ensure object exists
@@ -30,7 +30,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         self.assertEqual(flow.title, "bar")
 
         # Ensure importer updates it
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         flow: Flow = Flow.objects.filter(slug=flow_slug).first()
@@ -41,7 +41,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         flow_slug = generate_id()
         import_yaml = load_fixture("fixtures/state_created.yaml", id=flow_slug)
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         # Ensure object exists
@@ -56,7 +56,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         self.assertEqual(flow.title, "bar")
 
         # Ensure importer doesn't update it
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         flow: Flow = Flow.objects.filter(slug=flow_slug).first()
@@ -67,7 +67,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         flow_slug = generate_id()
         import_yaml = load_fixture("fixtures/state_created.yaml", id=flow_slug)
 
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         # Ensure object exists
@@ -75,7 +75,7 @@ class TestBlueprintsV1State(TransactionTestCase):
         self.assertEqual(flow.slug, flow_slug)
 
         import_yaml = load_fixture("fixtures/state_absent.yaml", id=flow_slug)
-        importer = Importer.from_string(import_yaml)
+        importer = Importer(import_yaml)
         self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
         flow: Flow = Flow.objects.filter(slug=flow_slug).first()

authentik/blueprints/v1/common.py

@@ -12,7 +12,6 @@ from uuid import UUID
 from deepmerge import always_merger
 from django.apps import apps
 from django.db.models import Model, Q
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import Field
 from rest_framework.serializers import Serializer
 from yaml import SafeDumper, SafeLoader, ScalarNode, SequenceNode
@@ -53,7 +52,6 @@ class BlueprintEntryDesiredState(Enum):
     ABSENT = "absent"
     PRESENT = "present"
     CREATED = "created"
-    MUST_CREATED = "must_created"
 
 
 @dataclass
@@ -208,8 +206,8 @@ class KeyOf(YAMLTag):
                 ):
                     return _entry._state.instance.pbm_uuid
                 return _entry._state.instance.pk
-        raise EntryInvalidError.from_entry(
-            f"KeyOf: failed to find entry with `id` of `{self.id_from}` and a model instance", entry
+        raise EntryInvalidError(
+            f"KeyOf: failed to find entry with `id` of `{self.id_from}` and a model instance"
         )
 
 
@@ -280,7 +278,7 @@ class Format(YAMLTag):
         try:
             return self.format_string % tuple(args)
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError(exc)
 
 
 class Find(YAMLTag):
@@ -357,15 +355,13 @@ class Condition(YAMLTag):
                 args.append(arg)
 
         if not args:
-            raise EntryInvalidError.from_entry(
-                "At least one value is required after mode selection.", entry
-            )
+            raise EntryInvalidError("At least one value is required after mode selection.")
 
         try:
             comparator = self._COMPARATORS[self.mode.upper()]
             return comparator(tuple(bool(x) for x in args))
         except (TypeError, KeyError) as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError(exc)
 
 
 class If(YAMLTag):
@@ -397,7 +393,7 @@ class If(YAMLTag):
                 blueprint,
             )
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError(exc)
 
 
 class Enumerate(YAMLTag, YAMLTagContext):
@@ -429,10 +425,9 @@ class Enumerate(YAMLTag, YAMLTagContext):
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         if isinstance(self.iterable, EnumeratedItem) and self.iterable.depth == 0:
-            raise EntryInvalidError.from_entry(
+            raise EntryInvalidError(
                 f"{self.__class__.__name__} tag's iterable references this tag's context. "
-                "This is a noop. Check you are setting depth bigger than 0.",
-                entry,
+                "This is a noop. Check you are setting depth bigger than 0."
             )
 
         if isinstance(self.iterable, YAMLTag):
@@ -441,10 +436,9 @@ class Enumerate(YAMLTag, YAMLTagContext):
             iterable = self.iterable
 
         if not isinstance(iterable, Iterable):
-            raise EntryInvalidError.from_entry(
+            raise EntryInvalidError(
                 f"{self.__class__.__name__}'s iterable must be an iterable "
-                "such as a sequence or a mapping",
-                entry,
+                "such as a sequence or a mapping"
             )
 
         if isinstance(iterable, Mapping):
@@ -455,7 +449,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         try:
             output_class, add_fn = self._OUTPUT_BODIES[self.output_body.upper()]
         except KeyError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError(exc)
 
         result = output_class()
 
@@ -467,8 +461,8 @@ class Enumerate(YAMLTag, YAMLTagContext):
                 resolved_body = entry.tag_resolver(self.item_body, blueprint)
                 result = add_fn(result, resolved_body)
                 if not isinstance(result, output_class):
-                    raise EntryInvalidError.from_entry(
-                        f"Invalid {self.__class__.__name__} item found: {resolved_body}", entry
+                    raise EntryInvalidError(
+                        f"Invalid {self.__class__.__name__} item found: {resolved_body}"
                     )
         finally:
             self.__current_context = tuple()
@@ -495,13 +489,12 @@ class EnumeratedItem(YAMLTag):
             )
         except ValueError as exc:
             if self.depth == 0:
-                raise EntryInvalidError.from_entry(
+                raise EntryInvalidError(
                     f"{self.__class__.__name__} tags are only usable "
-                    f"inside an {Enumerate.__name__} tag",
-                    entry,
+                    f"inside an {Enumerate.__name__} tag"
                 )
 
-            raise EntryInvalidError.from_entry(f"{self.__class__.__name__} tag: {exc}", entry)
+            raise EntryInvalidError(f"{self.__class__.__name__} tag: {exc}")
 
         return context_tag.get_context(entry, blueprint)
 
@@ -515,7 +508,7 @@ class Index(EnumeratedItem):
         try:
             return context[0]
         except IndexError:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
+            raise EntryInvalidError(f"Empty/invalid context: {context}")
 
 
 class Value(EnumeratedItem):
@@ -527,7 +520,7 @@ class Value(EnumeratedItem):
         try:
             return context[1]
         except IndexError:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
+            raise EntryInvalidError(f"Empty/invalid context: {context}")
 
 
 class BlueprintDumper(SafeDumper):
@@ -581,31 +574,8 @@ class BlueprintLoader(SafeLoader):
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
 
-    entry_model: Optional[str]
-    entry_id: Optional[str]
-    validation_error: Optional[ValidationError]
-    serializer: Optional[Serializer] = None
+    serializer_errors: Optional[dict]
 
-    def __init__(
-        self, *args: object, validation_error: Optional[ValidationError] = None, **kwargs
-    ) -> None:
+    def __init__(self, *args: object, serializer_errors: Optional[dict] = None) -> None:
         super().__init__(*args)
-        self.entry_model = None
-        self.entry_id = None
-        self.validation_error = validation_error
-        for key, value in kwargs.items():
-            setattr(self, key, value)
-
-    @staticmethod
-    def from_entry(
-        msg_or_exc: str | Exception, entry: BlueprintEntry, *args, **kwargs
-    ) -> "EntryInvalidError":
-        """Create EntryInvalidError with the context of an entry"""
-        error = EntryInvalidError(msg_or_exc, *args, **kwargs)
-        if isinstance(msg_or_exc, ValidationError):
-            error.validation_error = msg_or_exc
-        # Make sure the model and id are strings, depending where the error happens
-        # they might still be YAMLTag instances
-        error.entry_model = str(entry.model)
-        error.entry_id = str(entry.id)
-        return error
+        self.serializer_errors = serializer_errors

authentik/blueprints/v1/importer.py

@@ -8,9 +8,9 @@ from dacite.core import from_dict
 from dacite.exceptions import DaciteError
 from deepmerge import always_merger
 from django.core.exceptions import FieldError
+from django.db import transaction
 from django.db.models import Model
 from django.db.models.query_utils import Q
-from django.db.transaction import atomic
 from django.db.utils import IntegrityError
 from rest_framework.exceptions import ValidationError
 from rest_framework.serializers import BaseSerializer, Serializer
@@ -35,28 +35,24 @@ from authentik.core.models import (
     Source,
     UserSourceConnection,
 )
-from authentik.enterprise.models import LicenseKey, LicenseUsage
 from authentik.events.utils import cleanse_dict
 from authentik.flows.models import FlowToken, Stage
 from authentik.lib.models import SerializerModel
-from authentik.lib.sentry import SentryIgnoredException
 from authentik.outposts.models import OutpostServiceConnection
 from authentik.policies.models import Policy, PolicyBindingModel
-from authentik.providers.scim.models import SCIMGroup, SCIMUser
 
 # Context set when the serializer is created in a blueprint context
 # Update website/developer-docs/blueprints/v1/models.md when used
 SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry"
 
 
-def excluded_models() -> list[type[Model]]:
-    """Return a list of all excluded models that shouldn't be exposed via API
-    or other means (internal only, base classes, non-used objects, etc)"""
+def is_model_allowed(model: type[Model]) -> bool:
+    """Check if model is allowed"""
     # pylint: disable=imported-auth-user
     from django.contrib.auth.models import Group as DjangoGroup
     from django.contrib.auth.models import User as DjangoUser
 
-    return (
+    excluded_models = (
         DjangoUser,
         DjangoGroup,
         # Base classes
@@ -72,68 +68,45 @@ def excluded_models() -> list[type[Model]]:
         AuthenticatedSession,
         # Classes which are only internally managed
         FlowToken,
-        LicenseUsage,
-        SCIMGroup,
-        SCIMUser,
     )
-
-
-def is_model_allowed(model: type[Model]) -> bool:
-    """Check if model is allowed"""
-    return model not in excluded_models() and issubclass(model, (SerializerModel, BaseMetaModel))
-
-
-class DoRollback(SentryIgnoredException):
-    """Exception to trigger a rollback"""
+    return model not in excluded_models and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 @contextmanager
 def transaction_rollback():
     """Enters an atomic transaction and always triggers a rollback at the end of the block."""
-    try:
-        with atomic():
-            yield
-            raise DoRollback()
-    except DoRollback:
-        pass
+    atomic = transaction.atomic()
+    # pylint: disable=unnecessary-dunder-call
+    atomic.__enter__()
+    yield
+    atomic.__exit__(IntegrityError, None, None)
 
 
 class Importer:
-    """Import Blueprint from raw dict or YAML/JSON"""
+    """Import Blueprint from YAML"""
 
     logger: BoundLogger
-    _import: Blueprint
 
-    def __init__(self, blueprint: Blueprint, context: Optional[dict] = None):
+    def __init__(self, yaml_input: str, context: Optional[dict] = None):
         self.__pk_map: dict[Any, Model] = {}
-        self._import = blueprint
         self.logger = get_logger()
-        ctx = self.default_context()
-        always_merger.merge(ctx, self._import.context)
-        if context:
-            always_merger.merge(ctx, context)
-        self._import.context = ctx
-
-    def default_context(self):
-        """Default context"""
-        return {"goauthentik.io/enterprise/licensed": LicenseKey.get_total().is_valid()}
-
-    @staticmethod
-    def from_string(yaml_input: str, context: dict | None = None) -> "Importer":
-        """Parse YAML string and create blueprint importer from it"""
         import_dict = load(yaml_input, BlueprintLoader)
         try:
-            _import = from_dict(
+            self.__import = from_dict(
                 Blueprint, import_dict, config=Config(cast=[BlueprintEntryDesiredState])
             )
         except DaciteError as exc:
             raise EntryInvalidError from exc
-        return Importer(_import, context)
+        ctx = {}
+        always_merger.merge(ctx, self.__import.context)
+        if context:
+            always_merger.merge(ctx, context)
+        self.__import.context = ctx
 
     @property
     def blueprint(self) -> Blueprint:
         """Get imported blueprint"""
-        return self._import
+        return self.__import
 
     def __update_pks_for_attrs(self, attrs: dict[str, Any]) -> dict[str, Any]:
         """Replace any value if it is a known primary key of an other object"""
@@ -179,19 +152,19 @@ class Importer:
     # pylint: disable-msg=too-many-locals
     def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
         """Validate a single entry"""
-        if not entry.check_all_conditions_match(self._import):
+        if not entry.check_all_conditions_match(self.__import):
             self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
             return None
 
-        model_app_label, model_name = entry.get_model(self._import).split(".")
+        model_app_label, model_name = entry.get_model(self.__import).split(".")
         model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
         # Don't use isinstance since we don't want to check for inheritance
         if not is_model_allowed(model):
-            raise EntryInvalidError.from_entry(f"Model {model} not allowed", entry)
+            raise EntryInvalidError(f"Model {model} not allowed")
         if issubclass(model, BaseMetaModel):
             serializer_class: type[Serializer] = model.serializer()
             serializer = serializer_class(
-                data=entry.get_attrs(self._import),
+                data=entry.get_attrs(self.__import),
                 context={
                     SERIALIZER_CONTEXT_BLUEPRINT: entry,
                 },
@@ -199,10 +172,8 @@ class Importer:
             try:
                 serializer.is_valid(raise_exception=True)
             except ValidationError as exc:
-                raise EntryInvalidError.from_entry(
-                    f"Serializer errors {serializer.errors}",
-                    validation_error=exc,
-                    entry=entry,
+                raise EntryInvalidError(
+                    f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
                 ) from exc
             return serializer
 
@@ -211,7 +182,7 @@ class Importer:
         # the full serializer for later usage
         # Because a model might have multiple unique columns, we chain all identifiers together
         # to create an OR query.
-        updated_identifiers = self.__update_pks_for_attrs(entry.get_identifiers(self._import))
+        updated_identifiers = self.__update_pks_for_attrs(entry.get_identifiers(self.__import))
         for key, value in list(updated_identifiers.items()):
             if isinstance(value, dict) and "pk" in value:
                 del updated_identifiers[key]
@@ -219,12 +190,12 @@ class Importer:
 
         query = self.__query_from_identifier(updated_identifiers)
         if not query:
-            raise EntryInvalidError.from_entry("No or invalid identifiers", entry)
+            raise EntryInvalidError("No or invalid identifiers")
 
         try:
             existing_models = model.objects.filter(query)
         except FieldError as exc:
-            raise EntryInvalidError.from_entry(f"Invalid identifier field: {exc}", entry) from exc
+            raise EntryInvalidError(f"Invalid identifier field: {exc}") from exc
 
         serializer_kwargs = {}
         model_instance = existing_models.first()
@@ -237,14 +208,6 @@ class Importer:
             )
             serializer_kwargs["instance"] = model_instance
             serializer_kwargs["partial"] = True
-        elif model_instance and entry.state == BlueprintEntryDesiredState.MUST_CREATED:
-            raise EntryInvalidError.from_entry(
-                (
-                    f"state is set to {BlueprintEntryDesiredState.MUST_CREATED} "
-                    "and object exists already",
-                ),
-                entry,
-            )
         else:
             self.logger.debug(
                 "initialised new serializer instance",
@@ -257,12 +220,9 @@ class Importer:
                 model_instance.pk = updated_identifiers["pk"]
             serializer_kwargs["instance"] = model_instance
         try:
-            full_data = self.__update_pks_for_attrs(entry.get_attrs(self._import))
+            full_data = self.__update_pks_for_attrs(entry.get_attrs(self.__import))
         except ValueError as exc:
-            raise EntryInvalidError.from_entry(
-                exc,
-                entry,
-            ) from exc
+            raise EntryInvalidError(exc) from exc
         always_merger.merge(full_data, updated_identifiers)
         serializer_kwargs["data"] = full_data
 
@@ -275,18 +235,15 @@ class Importer:
         try:
             serializer.is_valid(raise_exception=True)
         except ValidationError as exc:
-            raise EntryInvalidError.from_entry(
-                f"Serializer errors {serializer.errors}",
-                validation_error=exc,
-                entry=entry,
-                serializer=serializer,
+            raise EntryInvalidError(
+                f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
             ) from exc
         return serializer
 
     def apply(self) -> bool:
         """Apply (create/update) models yaml, in database transaction"""
         try:
-            with atomic():
+            with transaction.atomic():
                 if not self._apply_models():
                     self.logger.debug("Reverting changes due to error")
                     raise IntegrityError
@@ -295,11 +252,11 @@ class Importer:
         self.logger.debug("Committing changes")
         return True
 
-    def _apply_models(self, raise_errors=False) -> bool:
+    def _apply_models(self) -> bool:
         """Apply (create/update) models yaml"""
         self.__pk_map = {}
-        for entry in self._import.entries:
-            model_app_label, model_name = entry.get_model(self._import).split(".")
+        for entry in self.__import.entries:
+            model_app_label, model_name = entry.get_model(self.__import).split(".")
             try:
                 model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
             except LookupError:
@@ -308,27 +265,19 @@ class Importer:
                 )
                 return False
             # Validate each single entry
-            serializer = None
             try:
                 serializer = self._validate_single(entry)
             except EntryInvalidError as exc:
                 # For deleting objects we don't need the serializer to be valid
-                if entry.get_state(self._import) == BlueprintEntryDesiredState.ABSENT:
-                    serializer = exc.serializer
-                else:
-                    self.logger.warning(f"entry invalid: {exc}", entry=entry, error=exc)
-                    if raise_errors:
-                        raise exc
-                    return False
+                if entry.get_state(self.__import) == BlueprintEntryDesiredState.ABSENT:
+                    continue
+                self.logger.warning(f"entry invalid: {exc}", entry=entry, error=exc)
+                return False
             if not serializer:
                 continue
 
-            state = entry.get_state(self._import)
-            if state in [
-                BlueprintEntryDesiredState.PRESENT,
-                BlueprintEntryDesiredState.CREATED,
-                BlueprintEntryDesiredState.MUST_CREATED,
-            ]:
+            state = entry.get_state(self.__import)
+            if state in [BlueprintEntryDesiredState.PRESENT, BlueprintEntryDesiredState.CREATED]:
                 instance = serializer.instance
                 if (
                     instance
@@ -356,23 +305,23 @@ class Importer:
                 self.logger.debug("entry to delete with no instance, skipping")
         return True
 
-    def validate(self, raise_validation_errors=False) -> tuple[bool, list[EventDict]]:
+    def validate(self) -> tuple[bool, list[EventDict]]:
         """Validate loaded blueprint export, ensure all models are allowed
         and serializers have no errors"""
         self.logger.debug("Starting blueprint import validation")
-        orig_import = deepcopy(self._import)
-        if self._import.version != 1:
+        orig_import = deepcopy(self.__import)
+        if self.__import.version != 1:
             self.logger.warning("Invalid blueprint version")
             return False, [{"event": "Invalid blueprint version"}]
         with (
             transaction_rollback(),
             capture_logs() as logs,
         ):
-            successful = self._apply_models(raise_errors=raise_validation_errors)
+            successful = self._apply_models()
             if not successful:
                 self.logger.debug("Blueprint validation failed")
         for log in logs:
             getattr(self.logger, log.get("log_level"))(**log)
         self.logger.debug("Finished blueprint import validation")
-        self._import = orig_import
+        self.__import = orig_import
         return successful, logs

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -2,11 +2,11 @@
 from typing import TYPE_CHECKING
 
 from rest_framework.exceptions import ValidationError
-from rest_framework.fields import BooleanField
+from rest_framework.fields import BooleanField, JSONField
 from structlog.stdlib import get_logger
 
 from authentik.blueprints.v1.meta.registry import BaseMetaModel, MetaResult, registry
-from authentik.core.api.utils import JSONDictField, PassiveSerializer
+from authentik.core.api.utils import PassiveSerializer, is_dict
 
 if TYPE_CHECKING:
     from authentik.blueprints.models import BlueprintInstance
@@ -17,7 +17,7 @@ LOGGER = get_logger()
 class ApplyBlueprintMetaSerializer(PassiveSerializer):
     """Serializer for meta apply blueprint model"""
 
-    identifiers = JSONDictField()
+    identifiers = JSONField(validators=[is_dict])
     required = BooleanField(default=True)
 
     # We cannot override `instance` as that will confuse rest_framework

authentik/blueprints/v1/tasks.py

@@ -75,14 +75,14 @@ class BlueprintEventHandler(FileSystemEventHandler):
             return
         if event.is_directory:
             return
-        root = Path(CONFIG.get("blueprints_dir")).absolute()
-        path = Path(event.src_path).absolute()
-        rel_path = str(path.relative_to(root))
         if isinstance(event, FileCreatedEvent):
-            LOGGER.debug("new blueprint file created, starting discovery", path=rel_path)
-            blueprints_discovery.delay(rel_path)
+            LOGGER.debug("new blueprint file created, starting discovery")
+            blueprints_discovery.delay()
         if isinstance(event, FileModifiedEvent):
-            for instance in BlueprintInstance.objects.filter(path=rel_path, enabled=True):
+            path = Path(event.src_path)
+            root = Path(CONFIG.get("blueprints_dir")).absolute()
+            rel_path = str(path.relative_to(root))
+            for instance in BlueprintInstance.objects.filter(path=rel_path):
                 LOGGER.debug("modified blueprint file, starting apply", instance=instance)
                 apply_blueprint.delay(instance.pk.hex)
 
@@ -98,32 +98,39 @@ def blueprints_find_dict():
     return blueprints
 
 
-def blueprints_find() -> list[BlueprintFile]:
+def blueprints_find():
     """Find blueprints and return valid ones"""
     blueprints = []
     root = Path(CONFIG.get("blueprints_dir"))
     for path in root.rglob("**/*.yaml"):
-        rel_path = path.relative_to(root)
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
             continue
+        LOGGER.debug("found blueprint", path=str(path))
         with open(path, "r", encoding="utf-8") as blueprint_file:
             try:
                 raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
             except YAMLError as exc:
                 raw_blueprint = None
-                LOGGER.warning("failed to parse blueprint", exc=exc, path=str(rel_path))
+                LOGGER.warning("failed to parse blueprint", exc=exc, path=str(path))
             if not raw_blueprint:
                 continue
             metadata = raw_blueprint.get("metadata", None)
             version = raw_blueprint.get("version", 1)
             if version != 1:
-                LOGGER.warning("invalid blueprint version", version=version, path=str(rel_path))
+                LOGGER.warning("invalid blueprint version", version=version, path=str(path))
                 continue
         file_hash = sha512(path.read_bytes()).hexdigest()
-        blueprint = BlueprintFile(str(rel_path), version, file_hash, int(path.stat().st_mtime))
+        blueprint = BlueprintFile(
+            str(path.relative_to(root)), version, file_hash, int(path.stat().st_mtime)
+        )
         blueprint.meta = from_dict(BlueprintMetadata, metadata) if metadata else None
         blueprints.append(blueprint)
+        LOGGER.debug(
+            "parsed & loaded blueprint",
+            hash=file_hash,
+            path=str(path),
+        )
     return blueprints
 
 
@@ -131,12 +138,10 @@ def blueprints_find() -> list[BlueprintFile]:
     throws=(DatabaseError, ProgrammingError, InternalError), base=MonitoredTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: MonitoredTask, path: Optional[str] = None):
+def blueprints_discovery(self: MonitoredTask):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
-        if path and blueprint.path != path:
-            continue
         check_blueprint_v1_file(blueprint)
         count += 1
     self.set_status(
@@ -166,11 +171,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
             metadata={},
         )
         instance.save()
-        LOGGER.info(
-            "Creating new blueprint instance from file", instance=instance, path=instance.path
-        )
     if instance.last_applied_hash != blueprint.hash:
-        LOGGER.info("Applying blueprint due to changed file", instance=instance, path=instance.path)
         apply_blueprint.delay(str(instance.pk))
 
 
@@ -189,7 +190,7 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
         self.set_uid(slugify(instance.name))
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
-        importer = Importer.from_string(blueprint_content, instance.context)
+        importer = Importer(blueprint_content, instance.context)
         if importer.blueprint.metadata:
             instance.metadata = asdict(importer.blueprint.metadata)
         valid, logs = importer.validate()

authentik/core/api/applications.py

@@ -17,6 +17,7 @@ from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 from structlog.stdlib import get_logger
 from structlog.testing import capture_logs
 
@@ -37,7 +38,6 @@ from authentik.lib.utils.file import (
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
 from authentik.policies.types import PolicyResult
-from authentik.rbac.filters import ObjectFilter
 
 LOGGER = get_logger()
 
@@ -98,7 +98,6 @@ class ApplicationSerializer(ModelSerializer):
 class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
-    # pylint: disable=no-member
     queryset = Application.objects.all().prefetch_related("provider")
     serializer_class = ApplicationSerializer
     search_fields = [
@@ -123,7 +122,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
     def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
         """Custom filter_queryset method which ignores guardian, but still supports sorting"""
         for backend in list(self.filter_backends):
-            if backend == ObjectFilter:
+            if backend == ObjectPermissionsFilter:
                 continue
             queryset = backend().filter_queryset(self.request, queryset, self)
         return queryset

authentik/core/api/authenticated_sessions.py

@@ -14,8 +14,7 @@ from ua_parser import user_agent_parser
 from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.models import AuthenticatedSession
-from authentik.events.context_processors.asn import ASN_CONTEXT_PROCESSOR, ASNDict
-from authentik.events.context_processors.geoip import GEOIP_CONTEXT_PROCESSOR, GeoIPDict
+from authentik.events.geo import GEOIP_READER, GeoIPDict
 
 
 class UserAgentDeviceDict(TypedDict):
@@ -60,7 +59,6 @@ class AuthenticatedSessionSerializer(ModelSerializer):
     current = SerializerMethodField()
     user_agent = SerializerMethodField()
     geo_ip = SerializerMethodField()
-    asn = SerializerMethodField()
 
     def get_current(self, instance: AuthenticatedSession) -> bool:
         """Check if session is currently active session"""
@@ -72,12 +70,8 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         return user_agent_parser.Parse(instance.last_user_agent)
 
     def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
-        """Get GeoIP Data"""
-        return GEOIP_CONTEXT_PROCESSOR.city_dict(instance.last_ip)
-
-    def get_asn(self, instance: AuthenticatedSession) -> Optional[ASNDict]:  # pragma: no cover
-        """Get ASN Data"""
-        return ASN_CONTEXT_PROCESSOR.asn_dict(instance.last_ip)
+        """Get parsed user agent"""
+        return GEOIP_READER.city_dict(instance.last_ip)
 
     class Meta:
         model = AuthenticatedSession
@@ -86,7 +80,6 @@ class AuthenticatedSessionSerializer(ModelSerializer):
             "current",
             "user_agent",
             "geo_ip",
-            "asn",
             "user",
             "last_ip",
             "last_user_agent",

authentik/core/api/devices.py

@@ -1,4 +1,6 @@
 """Authenticator Devices API Views"""
+from django_otp import device_classes, devices_for_user
+from django_otp.models import Device
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema
 from rest_framework.fields import BooleanField, CharField, IntegerField, SerializerMethodField
@@ -8,8 +10,6 @@ from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
 
 from authentik.core.api.utils import MetaNameSerializer
-from authentik.stages.authenticator import device_classes, devices_for_user
-from authentik.stages.authenticator.models import Device
 
 
 class DeviceSerializer(MetaNameSerializer):

authentik/core/api/groups.py

@@ -2,29 +2,30 @@
 from json import loads
 from typing import Optional
 
+from django.db.models.query import QuerySet
 from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, IntegerField
+from rest_framework.fields import CharField, IntegerField, JSONField
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 
 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import JSONDictField, PassiveSerializer
+from authentik.core.api.utils import PassiveSerializer, is_dict
 from authentik.core.models import Group, User
-from authentik.rbac.api.roles import RoleSerializer
 
 
 class GroupMemberSerializer(ModelSerializer):
     """Stripped down user serializer to show relevant users for groups"""
 
-    attributes = JSONDictField(required=False)
+    attributes = JSONField(validators=[is_dict], required=False)
     uid = CharField(read_only=True)
 
     class Meta:
@@ -44,16 +45,10 @@ class GroupMemberSerializer(ModelSerializer):
 class GroupSerializer(ModelSerializer):
     """Group Serializer"""
 
-    attributes = JSONDictField(required=False)
+    attributes = JSONField(validators=[is_dict], required=False)
     users_obj = ListSerializer(
         child=GroupMemberSerializer(), read_only=True, source="users", required=False
     )
-    roles_obj = ListSerializer(
-        child=RoleSerializer(),
-        read_only=True,
-        source="roles",
-        required=False,
-    )
     parent_name = CharField(source="parent.name", read_only=True, allow_null=True)
 
     num_pk = IntegerField(read_only=True)
@@ -76,10 +71,8 @@ class GroupSerializer(ModelSerializer):
             "parent",
             "parent_name",
             "users",
-            "users_obj",
             "attributes",
-            "roles",
-            "roles_obj",
+            "users_obj",
         ]
         extra_kwargs = {
             "users": {
@@ -139,13 +132,25 @@ class UserAccountSerializer(PassiveSerializer):
 class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
-    # pylint: disable=no-member
     queryset = Group.objects.all().select_related("parent").prefetch_related("users")
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]
     filterset_class = GroupFilter
     ordering = ["name"]
 
+    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
+        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
+        for backend in list(self.filter_backends):
+            if backend == ObjectPermissionsFilter:
+                continue
+            queryset = backend().filter_queryset(self.request, queryset, self)
+        return queryset
+
+    def filter_queryset(self, queryset):
+        if self.request.user.has_perm("authentik_core.view_group"):
+            return self._filter_queryset_for_list(queryset)
+        return super().filter_queryset(queryset)
+
     @permission_required(None, ["authentik_core.add_user"])
     @extend_schema(
         request=UserAccountSerializer,

authentik/core/api/propertymappings.py

@@ -19,7 +19,6 @@ from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
 from authentik.core.expression.evaluator import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
-from authentik.enterprise.apps import EnterpriseConfig
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
@@ -96,7 +95,6 @@ class PropertyMappingViewSet(
                     "description": subclass.__doc__,
                     "component": subclass().component,
                     "model_name": subclass._meta.model_name,
-                    "requires_enterprise": isinstance(subclass._meta.app_config, EnterpriseConfig),
                 }
             )
         return Response(TypeCreateSerializer(data, many=True).data)

authentik/core/api/providers.py

@@ -16,7 +16,6 @@ from rest_framework.viewsets import GenericViewSet
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
-from authentik.enterprise.apps import EnterpriseConfig
 from authentik.lib.utils.reflection import all_subclasses
 
 
@@ -114,7 +113,6 @@ class ProviderViewSet(
                     "description": subclass.__doc__,
                     "component": subclass().component,
                     "model_name": subclass._meta.model_name,
-                    "requires_enterprise": isinstance(subclass._meta.app_config, EnterpriseConfig),
                 }
             )
         data.append(

authentik/core/api/sources.py

@@ -38,7 +38,7 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
 
     managed = ReadOnlyField()
     component = SerializerMethodField()
-    icon = ReadOnlyField(source="icon_url")
+    icon = ReadOnlyField(source="get_icon")
 
     def get_component(self, obj: Source) -> str:
         """Get object component so that we know how to edit the object"""

authentik/core/api/transactional_applications.py

@@ -1,140 +0,0 @@
-"""transactional application and provider creation"""
-from django.apps import apps
-from drf_spectacular.utils import PolymorphicProxySerializer, extend_schema, extend_schema_field
-from rest_framework.exceptions import ValidationError
-from rest_framework.fields import BooleanField, CharField, ChoiceField, DictField, ListField
-from rest_framework.permissions import IsAdminUser
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-from yaml import ScalarNode
-
-from authentik.blueprints.v1.common import (
-    Blueprint,
-    BlueprintEntry,
-    BlueprintEntryDesiredState,
-    EntryInvalidError,
-    KeyOf,
-)
-from authentik.blueprints.v1.importer import Importer
-from authentik.core.api.applications import ApplicationSerializer
-from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import Provider
-from authentik.lib.utils.reflection import all_subclasses
-
-
-def get_provider_serializer_mapping():
-    """Get a mapping of all providers' model names and their serializers"""
-    mapping = {}
-    for model in all_subclasses(Provider):
-        if model._meta.abstract:
-            continue
-        mapping[f"{model._meta.app_label}.{model._meta.model_name}"] = model().serializer
-    return mapping
-
-
-@extend_schema_field(
-    PolymorphicProxySerializer(
-        component_name="model",
-        serializers=get_provider_serializer_mapping,
-        resource_type_field_name="provider_model",
-    )
-)
-class TransactionProviderField(DictField):
-    """Dictionary field which can hold provider creation data"""
-
-
-class TransactionApplicationSerializer(PassiveSerializer):
-    """Serializer for creating a provider and an application in one transaction"""
-
-    app = ApplicationSerializer()
-    provider_model = ChoiceField(choices=list(get_provider_serializer_mapping().keys()))
-    provider = TransactionProviderField()
-
-    _provider_model: type[Provider] = None
-
-    def validate_provider_model(self, fq_model_name: str) -> str:
-        """Validate that the model exists and is a provider"""
-        if "." not in fq_model_name:
-            raise ValidationError("Invalid provider model")
-        try:
-            app, _, model_name = fq_model_name.partition(".")
-            model = apps.get_model(app, model_name)
-            if not issubclass(model, Provider):
-                raise ValidationError("Invalid provider model")
-            self._provider_model = model
-        except LookupError:
-            raise ValidationError("Invalid provider model")
-        return fq_model_name
-
-    def validate(self, attrs: dict) -> dict:
-        blueprint = Blueprint()
-        blueprint.entries.append(
-            BlueprintEntry(
-                model=attrs["provider_model"],
-                state=BlueprintEntryDesiredState.MUST_CREATED,
-                identifiers={
-                    "name": attrs["provider"]["name"],
-                },
-                # Must match the name of the field on `self`
-                id="provider",
-                attrs=attrs["provider"],
-            )
-        )
-        app_data = attrs["app"]
-        app_data["provider"] = KeyOf(None, ScalarNode(tag="", value="provider"))
-        blueprint.entries.append(
-            BlueprintEntry(
-                model="authentik_core.application",
-                state=BlueprintEntryDesiredState.MUST_CREATED,
-                identifiers={
-                    "slug": attrs["app"]["slug"],
-                },
-                attrs=app_data,
-                # Must match the name of the field on `self`
-                id="app",
-            )
-        )
-        importer = Importer(blueprint, {})
-        try:
-            valid, _ = importer.validate(raise_validation_errors=True)
-            if not valid:
-                raise ValidationError("Invalid blueprint")
-        except EntryInvalidError as exc:
-            raise ValidationError(
-                {
-                    exc.entry_id: exc.validation_error.detail,
-                }
-            )
-        return blueprint
-
-
-class TransactionApplicationResponseSerializer(PassiveSerializer):
-    """Transactional creation response"""
-
-    applied = BooleanField()
-    logs = ListField(child=CharField())
-
-
-class TransactionalApplicationView(APIView):
-    """Create provider and application and attach them in a single transaction"""
-
-    # TODO: Migrate to a more specific permission
-    permission_classes = [IsAdminUser]
-
-    @extend_schema(
-        request=TransactionApplicationSerializer(),
-        responses={
-            200: TransactionApplicationResponseSerializer(),
-        },
-    )
-    def put(self, request: Request) -> Response:
-        """Convert data into a blueprint, validate it and apply it"""
-        data = TransactionApplicationSerializer(data=request.data)
-        data.is_valid(raise_exception=True)
-
-        importer = Importer(data.validated_data, {})
-        applied = importer.apply()
-        response = {"applied": False, "logs": []}
-        response["applied"] = applied
-        return Response(response, status=200)

authentik/core/api/used_by.py

@@ -73,11 +73,6 @@ class UsedByMixin:
             # but so we only apply them once, have a simple flag for the first object
             first_object = True
 
-            # TODO: This will only return the used-by references that the user can see
-            # Either we have to leak model information here to not make the list
-            # useless if the user doesn't have all permissions, or we need to double
-            # query and check if there is a difference between modes the user can see
-            # and can't see and add a warning
             for obj in get_objects_for_user(
                 request.user, f"{app}.view_{model_name}", manager
             ).all():

authentik/core/api/users.py

@@ -7,6 +7,7 @@ from django.contrib.auth import update_session_auth_hash
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
 from django.db.models.functions import ExtractHour
+from django.db.models.query import QuerySet
 from django.db.transaction import atomic
 from django.db.utils import IntegrityError
 from django.urls import reverse_lazy
@@ -32,7 +33,13 @@ from drf_spectacular.utils import (
 )
 from guardian.shortcuts import get_anonymous_user, get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, IntegerField, ListField, SerializerMethodField
+from rest_framework.fields import (
+    CharField,
+    IntegerField,
+    JSONField,
+    ListField,
+    SerializerMethodField,
+)
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import (
@@ -45,13 +52,14 @@ from rest_framework.serializers import (
 )
 from rest_framework.validators import UniqueValidator
 from rest_framework.viewsets import ModelViewSet
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
 from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import JSONDictField, LinkSerializer, PassiveSerializer
+from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import (
     SESSION_KEY_IMPERSONATE_ORIGINAL_USER,
     SESSION_KEY_IMPERSONATE_USER,
@@ -83,7 +91,7 @@ LOGGER = get_logger()
 class UserGroupSerializer(ModelSerializer):
     """Simplified Group Serializer for user's groups"""
 
-    attributes = JSONDictField(required=False)
+    attributes = JSONField(required=False)
     parent_name = CharField(source="parent.name", read_only=True)
 
     class Meta:
@@ -104,7 +112,7 @@ class UserSerializer(ModelSerializer):
 
     is_superuser = BooleanField(read_only=True)
     avatar = CharField(read_only=True)
-    attributes = JSONDictField(required=False)
+    attributes = JSONField(validators=[is_dict], required=False)
     groups = PrimaryKeyRelatedField(
         allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all(), default=list
     )
@@ -165,11 +173,6 @@ class UserSerializer(ModelSerializer):
             raise ValidationError("Setting a user to internal service account is not allowed.")
         return user_type
 
-    def validate(self, attrs: dict) -> dict:
-        if self.instance and self.instance.type == UserTypes.INTERNAL_SERVICE_ACCOUNT:
-            raise ValidationError("Can't modify internal service account users")
-        return super().validate(attrs)
-
     class Meta:
         model = User
         fields = [
@@ -187,7 +190,6 @@ class UserSerializer(ModelSerializer):
             "uid",
             "path",
             "type",
-            "uuid",
         ]
         extra_kwargs = {
             "name": {"allow_blank": True},
@@ -202,7 +204,6 @@ class UserSelfSerializer(ModelSerializer):
     groups = SerializerMethodField()
     uid = CharField(read_only=True)
     settings = SerializerMethodField()
-    system_permissions = SerializerMethodField()
 
     @extend_schema_field(
         ListSerializer(
@@ -224,14 +225,6 @@ class UserSelfSerializer(ModelSerializer):
         """Get user settings with tenant and group settings applied"""
         return user.group_attributes(self._context["request"]).get("settings", {})
 
-    def get_system_permissions(self, user: User) -> list[str]:
-        """Get all system permissions assigned to the user"""
-        return list(
-            user.user_permissions.filter(
-                content_type__app_label="authentik_rbac", content_type__model="systempermission"
-            ).values_list("codename", flat=True)
-        )
-
     class Meta:
         model = User
         fields = [
@@ -246,7 +239,6 @@ class UserSelfSerializer(ModelSerializer):
             "uid",
             "settings",
             "type",
-            "system_permissions",
         ]
         extra_kwargs = {
             "is_active": {"read_only": True},
@@ -624,10 +616,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         if not request.user.has_perm("impersonate"):
             LOGGER.debug("User attempted to impersonate without permissions", user=request.user)
             return Response(status=401)
+
         user_to_be = self.get_object()
-        if user_to_be.pk == self.request.user.pk:
-            LOGGER.debug("User attempted to impersonate themselves", user=request.user)
-            return Response(status=401)
 
         request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER] = request.user
         request.session[SESSION_KEY_IMPERSONATE_USER] = user_to_be
@@ -661,6 +651,19 @@ class UserViewSet(UsedByMixin, ModelViewSet):
 
         return Response(status=204)
 
+    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
+        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
+        for backend in list(self.filter_backends):
+            if backend == ObjectPermissionsFilter:
+                continue
+            queryset = backend().filter_queryset(self.request, queryset, self)
+        return queryset
+
+    def filter_queryset(self, queryset):
+        if self.request.user.has_perm("authentik_core.view_user"):
+            return self._filter_queryset_for_list(queryset)
+        return super().filter_queryset(queryset)
+
     @extend_schema(
         responses={
             200: inline_serializer(

authentik/core/api/utils.py

@@ -2,10 +2,7 @@
 from typing import Any
 
 from django.db.models import Model
-from drf_spectacular.extensions import OpenApiSerializerFieldExtension
-from drf_spectacular.plumbing import build_basic_type
-from drf_spectacular.types import OpenApiTypes
-from rest_framework.fields import BooleanField, CharField, IntegerField, JSONField
+from rest_framework.fields import CharField, IntegerField, JSONField
 from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError
 
 
@@ -16,21 +13,6 @@ def is_dict(value: Any):
     raise ValidationError("Value must be a dictionary, and not have any duplicate keys.")
 
 
-class JSONDictField(JSONField):
-    """JSON Field which only allows dictionaries"""
-
-    default_validators = [is_dict]
-
-
-class JSONExtension(OpenApiSerializerFieldExtension):
-    """Generate API Schema for JSON fields as"""
-
-    target_class = "authentik.core.api.utils.JSONDictField"
-
-    def map_serializer_field(self, auto_schema, direction):
-        return build_basic_type(OpenApiTypes.OBJECT)
-
-
 class PassiveSerializer(Serializer):
     """Base serializer class which doesn't implement create/update methods"""
 
@@ -44,7 +26,7 @@ class PassiveSerializer(Serializer):
 class PropertyMappingPreviewSerializer(PassiveSerializer):
     """Preview how the current user is mapped via the property mappings selected in a provider"""
 
-    preview = JSONDictField(read_only=True)
+    preview = JSONField(read_only=True)
 
 
 class MetaNameSerializer(PassiveSerializer):
@@ -74,7 +56,6 @@ class TypeCreateSerializer(PassiveSerializer):
     description = CharField(required=True)
     component = CharField(required=True)
     model_name = CharField(required=True)
-    requires_enterprise = BooleanField(default=False)
 
 
 class CacheSerializer(PassiveSerializer):

authentik/core/channels.py

@@ -1,29 +1,22 @@
 """Channels base classes"""
-from channels.db import database_sync_to_async
 from channels.exceptions import DenyConnection
+from channels.generic.websocket import JsonWebsocketConsumer
 from rest_framework.exceptions import AuthenticationFailed
 from structlog.stdlib import get_logger
 
 from authentik.api.authentication import bearer_auth
+from authentik.core.models import User
 
 LOGGER = get_logger()
 
 
-class TokenOutpostMiddleware:
+class AuthJsonConsumer(JsonWebsocketConsumer):
     """Authorize a client with a token"""
 
-    def __init__(self, inner):
-        self.inner = inner
+    user: User
 
-    async def __call__(self, scope, receive, send):
-        scope = dict(scope)
-        await self.auth(scope)
-        return await self.inner(scope, receive, send)
-
-    @database_sync_to_async
-    def auth(self, scope):
-        """Authenticate request from header"""
-        headers = dict(scope["headers"])
+    def connect(self):
+        headers = dict(self.scope["headers"])
         if b"authorization" not in headers:
             LOGGER.warning("WS Request without authorization header")
             raise DenyConnection()
@@ -39,4 +32,4 @@ class TokenOutpostMiddleware:
             LOGGER.warning("Failed to authenticate", exc=exc)
             raise DenyConnection()
 
-        scope["user"] = user
+        self.user = user

authentik/core/expression/evaluator.py

@@ -44,7 +44,6 @@ class PropertyMappingEvaluator(BaseEvaluator):
         if request:
             req.http_request = request
         self._context["request"] = req
-        req.context.update(**kwargs)
         self._context.update(**kwargs)
         self.dry_run = dry_run
 

authentik/core/management/commands/dev_server.py

@@ -1,9 +0,0 @@
-"""custom runserver command"""
-from daphne.management.commands.runserver import Command as RunServer
-
-
-class Command(RunServer):
-    """custom runserver command, which doesn't show the misleading django startup message"""
-
-    def on_bind(self, server_port):
-        pass

authentik/core/management/commands/worker.py

@@ -16,16 +16,7 @@ LOGGER = get_logger()
 class Command(BaseCommand):
     """Run worker"""
 
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "-b",
-            "--beat",
-            action="store_false",
-            help="When set, this worker will _not_ run Beat (scheduled) tasks",
-        )
-
     def handle(self, **options):
-        LOGGER.debug("Celery options", **options)
         close_old_connections()
         if CONFIG.get_bool("remote_debug"):
             import debugpy
@@ -35,9 +26,9 @@ class Command(BaseCommand):
             no_color=False,
             quiet=True,
             optimization="fair",
-            autoscale=(CONFIG.get_int("worker.concurrency"), 1),
+            autoscale=(3, 1),
             task_events=True,
-            beat=options.get("beat", True),
+            beat=True,
             schedule_filename=f"{tempdir}/celerybeat-schedule",
             queues=["authentik", "authentik_scheduled", "authentik_events"],
         )

authentik/core/migrations/0032_group_roles.py

@@ -1,45 +0,0 @@
-# Generated by Django 4.2.6 on 2023-10-11 13:37
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_core", "0031_alter_user_type"),
-        ("authentik_rbac", "0001_initial"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="group",
-            options={"verbose_name": "Group", "verbose_name_plural": "Groups"},
-        ),
-        migrations.AlterModelOptions(
-            name="token",
-            options={
-                "permissions": [("view_token_key", "View token's key")],
-                "verbose_name": "Token",
-                "verbose_name_plural": "Tokens",
-            },
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": [
-                    ("reset_user_password", "Reset Password"),
-                    ("impersonate", "Can impersonate other users"),
-                    ("assign_user_permissions", "Can assign permissions to users"),
-                    ("unassign_user_permissions", "Can unassign permissions from users"),
-                ],
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-        migrations.AddField(
-            model_name="group",
-            name="roles",
-            field=models.ManyToManyField(
-                blank=True, related_name="ak_groups", to="authentik_rbac.role"
-            ),
-        ),
-    ]

authentik/core/models.py

@@ -1,7 +1,7 @@
 """authentik core models"""
 from datetime import timedelta
 from hashlib import sha256
-from typing import Any, Optional, Self
+from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
@@ -30,6 +30,7 @@ from authentik.lib.models import (
     DomainlessFormattedURLValidator,
     SerializerModel,
 )
+from authentik.lib.utils.http import get_client_ip
 from authentik.policies.models import PolicyBindingModel
 from authentik.root.install_id import get_install_id
 
@@ -87,8 +88,6 @@ class Group(SerializerModel):
         default=False, help_text=_("Users added to this group will be superusers.")
     )
 
-    roles = models.ManyToManyField("authentik_rbac.Role", related_name="ak_groups", blank=True)
-
     parent = models.ForeignKey(
         "Group",
         blank=True,
@@ -116,38 +115,6 @@ class Group(SerializerModel):
         """Recursively check if `user` is member of us, or any parent."""
         return user.all_groups().filter(group_uuid=self.group_uuid).exists()
 
-    def children_recursive(self: Self | QuerySet["Group"]) -> QuerySet["Group"]:
-        """Recursively get all groups that have this as parent or are indirectly related"""
-        direct_groups = []
-        if isinstance(self, QuerySet):
-            direct_groups = list(x for x in self.all().values_list("pk", flat=True).iterator())
-        else:
-            direct_groups = [self.pk]
-        if len(direct_groups) < 1:
-            return Group.objects.none()
-        query = """
-        WITH RECURSIVE parents AS (
-            SELECT authentik_core_group.*, 0 AS relative_depth
-            FROM authentik_core_group
-            WHERE authentik_core_group.group_uuid = ANY(%s)
-
-            UNION ALL
-
-            SELECT authentik_core_group.*, parents.relative_depth + 1
-            FROM authentik_core_group, parents
-            WHERE (
-                authentik_core_group.group_uuid = parents.parent_id and
-                parents.relative_depth < 20
-            )
-        )
-        SELECT group_uuid
-        FROM parents
-        GROUP BY group_uuid, name
-        ORDER BY name;
-        """
-        group_pks = [group.pk for group in Group.objects.raw(query, [direct_groups]).iterator()]
-        return Group.objects.filter(pk__in=group_pks)
-
     def __str__(self):
         return f"Group {self.name}"
 
@@ -158,8 +125,6 @@ class Group(SerializerModel):
                 "parent",
             ),
         )
-        verbose_name = _("Group")
-        verbose_name_plural = _("Groups")
 
 
 class UserManager(DjangoUserManager):
@@ -195,7 +160,33 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         """Recursively get all groups this user is a member of.
         At least one query is done to get the direct groups of the user, with groups
         there are at most 3 queries done"""
-        return Group.children_recursive(self.ak_groups.all())
+        direct_groups = list(
+            x for x in self.ak_groups.all().values_list("pk", flat=True).iterator()
+        )
+        if len(direct_groups) < 1:
+            return Group.objects.none()
+        query = """
+        WITH RECURSIVE parents AS (
+            SELECT authentik_core_group.*, 0 AS relative_depth
+            FROM authentik_core_group
+            WHERE authentik_core_group.group_uuid = ANY(%s)
+
+            UNION ALL
+
+            SELECT authentik_core_group.*, parents.relative_depth + 1
+            FROM authentik_core_group, parents
+            WHERE (
+                authentik_core_group.group_uuid = parents.parent_id and
+                parents.relative_depth < 20
+            )
+        )
+        SELECT group_uuid
+        FROM parents
+        GROUP BY group_uuid, name
+        ORDER BY name;
+        """
+        group_pks = [group.pk for group in Group.objects.raw(query, [direct_groups]).iterator()]
+        return Group.objects.filter(pk__in=group_pks)
 
     def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
@@ -270,14 +261,12 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         return get_avatar(self)
 
     class Meta:
+        permissions = (
+            ("reset_user_password", "Reset Password"),
+            ("impersonate", "Can impersonate other users"),
+        )
         verbose_name = _("User")
         verbose_name_plural = _("Users")
-        permissions = [
-            ("reset_user_password", _("Reset Password")),
-            ("impersonate", _("Can impersonate other users")),
-            ("assign_user_permissions", _("Can assign permissions to users")),
-            ("unassign_user_permissions", _("Can unassign permissions from users")),
-        ]
 
 
 class Provider(SerializerModel):
@@ -516,7 +505,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def icon_url(self) -> Optional[str]:
+    def get_icon(self) -> Optional[str]:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:
@@ -686,7 +675,7 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
             models.Index(fields=["identifier"]),
             models.Index(fields=["key"]),
         ]
-        permissions = [("view_token_key", _("View token's key"))]
+        permissions = (("view_token_key", "View token's key"),)
 
 
 class PropertyMapping(SerializerModel, ManagedModel):
@@ -747,14 +736,12 @@ class AuthenticatedSession(ExpiringModel):
     @staticmethod
     def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
         """Create a new session from a http request"""
-        from authentik.root.middleware import ClientIPMiddleware
-
         if not hasattr(request, "session") or not request.session.session_key:
             return None
         return AuthenticatedSession(
             session_key=request.session.session_key,
             user=user,
-            last_ip=ClientIPMiddleware.get_client_ip(request),
+            last_ip=get_client_ip(request),
             last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
             expires=request.session.get_expiry_date(),
         )

authentik/core/signals.py

@@ -7,7 +7,6 @@ from django.db.models import Model
 from django.db.models.signals import post_save, pre_delete, pre_save
 from django.dispatch import receiver
 from django.http.request import HttpRequest
-from structlog.stdlib import get_logger
 
 from authentik.core.models import Application, AuthenticatedSession, BackchannelProvider, User
 
@@ -16,8 +15,6 @@ password_changed = Signal()
 # Arguments: credentials: dict[str, any], request: HttpRequest, stage: Stage
 login_failed = Signal()
 
-LOGGER = get_logger()
-
 
 @receiver(post_save, sender=Application)
 def post_save_application(sender: type[Model], instance, created: bool, **_):

authentik/core/sources/flow_manager.py

@@ -48,7 +48,7 @@ class Action(Enum):
 class MessageStage(StageView):
     """Show a pre-configured message after the flow is done"""
 
-    def dispatch(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         """Show a pre-configured message after the flow is done"""
         message = getattr(self.executor.current_stage, "message", "")
         level = getattr(self.executor.current_stage, "level", messages.SUCCESS)
@@ -59,6 +59,10 @@ class MessageStage(StageView):
         )
         return self.executor.stage_ok()
 
+    def post(self, request: HttpRequest) -> HttpResponse:
+        """Wrapper for post requests"""
+        return self.get(request)
+
 
 class SourceFlowManager:
     """Help sources decide what they should do after authorization. Based on source settings and
@@ -97,7 +101,6 @@ class SourceFlowManager:
         if self.request.user.is_authenticated:
             new_connection.user = self.request.user
             new_connection = self.update_connection(new_connection, **kwargs)
-            # pylint: disable=no-member
             new_connection.save()
             return Action.LINK, new_connection
 

authentik/core/sources/stage.py

@@ -13,7 +13,7 @@ class PostUserEnrollmentStage(StageView):
     """Dynamically injected stage which saves the Connection after
     the user has been enrolled."""
 
-    def dispatch(self, request: HttpRequest) -> HttpResponse:
+    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         """Stage used after the user has been enrolled"""
         connection: UserSourceConnection = self.executor.plan.context[
             PLAN_CONTEXT_SOURCES_CONNECTION
@@ -27,3 +27,7 @@ class PostUserEnrollmentStage(StageView):
             source=connection.source,
         ).from_http(self.request)
         return self.executor.stage_ok()
+
+    def post(self, request: HttpRequest) -> HttpResponse:
+        """Wrapper for post requests"""
+        return self.get(request)

authentik/core/templates/base/skeleton.html

@@ -13,6 +13,7 @@
         {% block head_before %}
         {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/theme-dark.css' %}" media="(prefers-color-scheme: dark)">
         <link rel="stylesheet" type="text/css" href="{% static 'dist/custom.css' %}" data-inject>
         <script src="{% static 'dist/poly.js' %}?version={{ version }}" type="module"></script>
         <script src="{% static 'dist/standalone/loading/index.js' %}?version={{ version }}" type="module"></script>

authentik/core/templates/if/end_session.html

@@ -16,8 +16,8 @@ You've logged out of {{ application }}.
 {% block card %}
 <form method="POST" class="pf-c-form">
     <p>
-        {% blocktrans with application=application.name branding_title=tenant.branding_title %}
-            You've logged out of {{ application }}. You can go back to the overview to launch another application, or log out of your {{ branding_title }} account.
+        {% blocktrans with application=application.name %}
+            You've logged out of {{ application }}. You can go back to the overview to launch another application, or log out of your authentik account.
         {% endblocktrans %}
     </p>
 

authentik/core/templates/if/flow.html

@@ -27,7 +27,7 @@ window.authentik.flow = {
 
 {% block body %}
 <ak-message-container></ak-message-container>
-<ak-flow-executor flowSlug="{{ flow.slug }}">
+<ak-flow-executor>
     <ak-loading></ak-loading>
 </ak-flow-executor>
 {% endblock %}

authentik/core/templates/login/base_full.html

@@ -6,7 +6,6 @@
 {% block head_before %}
 <link rel="prefetch" href="/static/dist/assets/images/flow_background.jpg" />
 <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}">
-<link rel="stylesheet" type="text/css" href="{% static 'dist/theme-dark.css' %}" media="(prefers-color-scheme: dark)">
 {% include "base/header_js.html" %}
 {% endblock %}
 
@@ -44,14 +43,28 @@
 
 {% block body %}
 <div class="pf-c-background-image">
+    <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
+        <filter id="image_overlay">
+            <feColorMatrix in="SourceGraphic" type="matrix" values="1.3 0 0 0 0 0 1.3 0 0 0 0 0 1.3 0 0 0 0 0 1 0" />
+            <feComponentTransfer color-interpolation-filters="sRGB" result="duotone">
+                <feFuncR type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncR>
+                <feFuncG type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncG>
+                <feFuncB type="table" tableValues="0.086274509803922 0.43921568627451"></feFuncB>
+                <feFuncA type="table" tableValues="0 1"></feFuncA>
+            </feComponentTransfer>
+        </filter>
+    </svg>
 </div>
 <ak-message-container></ak-message-container>
-<div class="pf-c-login stacked">
+<div class="pf-c-login">
     <div class="ak-login-container">
-        <main class="pf-c-login__main">
-            <div class="pf-c-login__main-header pf-c-brand ak-brand">
+        <header class="pf-c-login__header">
+            <div class="pf-c-brand ak-brand">
                 <img src="{{ tenant.branding_logo }}" alt="authentik Logo" />
             </div>
+        </header>
+        {% block main_container %}
+        <main class="pf-c-login__main">
             <header class="pf-c-login__main-header">
                 <h1 class="pf-c-title pf-m-3xl">
                     {% block card_title %}
@@ -63,6 +76,7 @@
                 {% endblock %}
             </div>
         </main>
+        {% endblock %}
         <footer class="pf-c-login__footer">
             <ul class="pf-c-list pf-m-inline">
                 {% for link in footer_links %}

authentik/core/tests/test_impersonation.py

@@ -6,7 +6,6 @@ from rest_framework.test import APITestCase
 
 from authentik.core.models import User
 from authentik.core.tests.utils import create_test_admin_user
-from authentik.lib.config import CONFIG
 
 
 class TestImpersonation(APITestCase):
@@ -47,42 +46,12 @@ class TestImpersonation(APITestCase):
         """test impersonation without permissions"""
         self.client.force_login(self.other_user)
 
-        response = self.client.post(
-            reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 403)
+        self.client.get(reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk}))
 
         response = self.client.get(reverse("authentik_api:user-me"))
         response_body = loads(response.content.decode())
         self.assertEqual(response_body["user"]["username"], self.other_user.username)
 
-    @CONFIG.patch("impersonation", False)
-    def test_impersonate_disabled(self):
-        """test impersonation that is disabled"""
-        self.client.force_login(self.user)
-
-        response = self.client.post(
-            reverse("authentik_api:user-impersonate", kwargs={"pk": self.other_user.pk})
-        )
-        self.assertEqual(response.status_code, 401)
-
-        response = self.client.get(reverse("authentik_api:user-me"))
-        response_body = loads(response.content.decode())
-        self.assertEqual(response_body["user"]["username"], self.user.username)
-
-    def test_impersonate_self(self):
-        """test impersonation that user can't impersonate themselves"""
-        self.client.force_login(self.user)
-
-        response = self.client.post(
-            reverse("authentik_api:user-impersonate", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 401)
-
-        response = self.client.get(reverse("authentik_api:user-me"))
-        response_body = loads(response.content.decode())
-        self.assertEqual(response_body["user"]["username"], self.user.username)
-
     def test_un_impersonate_empty(self):
         """test un-impersonation without impersonating first"""
         self.client.force_login(self.other_user)

authentik/core/tests/test_transactional_applications_api.py

@@ -1,64 +0,0 @@
-"""Test Transactional API"""
-from django.urls import reverse
-from rest_framework.test import APITestCase
-
-from authentik.core.models import Application
-from authentik.core.tests.utils import create_test_admin_user, create_test_flow
-from authentik.lib.generators import generate_id
-from authentik.providers.oauth2.models import OAuth2Provider
-
-
-class TestTransactionalApplicationsAPI(APITestCase):
-    """Test Transactional API"""
-
-    def setUp(self) -> None:
-        self.user = create_test_admin_user()
-
-    def test_create_transactional(self):
-        """Test transactional Application + provider creation"""
-        self.client.force_login(self.user)
-        uid = generate_id()
-        authorization_flow = create_test_flow()
-        response = self.client.put(
-            reverse("authentik_api:core-transactional-application"),
-            data={
-                "app": {
-                    "name": uid,
-                    "slug": uid,
-                },
-                "provider_model": "authentik_providers_oauth2.oauth2provider",
-                "provider": {
-                    "name": uid,
-                    "authorization_flow": str(authorization_flow.pk),
-                },
-            },
-        )
-        self.assertJSONEqual(response.content.decode(), {"applied": True, "logs": []})
-        provider = OAuth2Provider.objects.filter(name=uid).first()
-        self.assertIsNotNone(provider)
-        app = Application.objects.filter(slug=uid).first()
-        self.assertIsNotNone(app)
-        self.assertEqual(app.provider.pk, provider.pk)
-
-    def test_create_transactional_invalid(self):
-        """Test transactional Application + provider creation"""
-        self.client.force_login(self.user)
-        uid = generate_id()
-        response = self.client.put(
-            reverse("authentik_api:core-transactional-application"),
-            data={
-                "app": {
-                    "name": uid,
-                    "slug": uid,
-                },
-                "provider_model": "authentik_providers_oauth2.oauth2provider",
-                "provider": {
-                    "name": uid,
-                    "authorization_flow": "",
-                },
-            },
-        )
-        self.assertJSONEqual(
-            response.content.decode(),
-            {"provider": {"authorization_flow": ["This field may not be null."]}},
-        )

authentik/core/tests/utils.py

@@ -21,24 +21,18 @@ def create_test_flow(
     )
 
 
-def create_test_user(name: Optional[str] = None, **kwargs) -> User:
-    """Generate a test user"""
+def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
+    """Generate a test-admin user"""
     uid = generate_id(20) if not name else name
-    kwargs.setdefault("email", f"{uid}@goauthentik.io")
-    kwargs.setdefault("username", uid)
+    group = Group.objects.create(name=uid, is_superuser=True)
     user: User = User.objects.create(
+        username=uid,
         name=uid,
+        email=f"{uid}@goauthentik.io",
         **kwargs,
     )
     user.set_password(uid)
     user.save()
-    return user
-
-
-def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
-    """Generate a test-admin user"""
-    user = create_test_user(name, **kwargs)
-    group = Group.objects.create(name=user.name or name, is_superuser=True)
     group.users.add(user)
     return user
 

authentik/core/urls.py

@@ -15,7 +15,6 @@ from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
 from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
 from authentik.core.api.tokens import TokenViewSet
-from authentik.core.api.transactional_applications import TransactionalApplicationView
 from authentik.core.api.users import UserViewSet
 from authentik.core.views import apps
 from authentik.core.views.debug import AccessDeniedView
@@ -71,11 +70,6 @@ urlpatterns = [
 api_urlpatterns = [
     ("core/authenticated_sessions", AuthenticatedSessionViewSet),
     ("core/applications", ApplicationViewSet),
-    path(
-        "core/transactional/applications/",
-        TransactionalApplicationView.as_view(),
-        name="core-transactional-application",
-    ),
     ("core/groups", GroupViewSet),
     ("core/users", UserViewSet),
     ("core/tokens", TokenViewSet),

authentik/core/views/interface.py

@@ -22,7 +22,6 @@ class InterfaceView(TemplateView):
         kwargs["version_family"] = f"{LOCAL_VERSION.major}.{LOCAL_VERSION.minor}"
         kwargs["version_subdomain"] = f"version-{LOCAL_VERSION.major}-{LOCAL_VERSION.minor}"
         kwargs["build"] = get_build_hash()
-        kwargs["url_kwargs"] = self.kwargs
         return super().get_context_data(**kwargs)
 
 

authentik/crypto/apps.py

@@ -1,10 +1,13 @@
 """authentik crypto app config"""
 from datetime import datetime
-from typing import Optional
+from typing import TYPE_CHECKING, Optional
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
 
+if TYPE_CHECKING:
+    from authentik.crypto.models import CertificateKeyPair
+
 MANAGED_KEY = "goauthentik.io/crypto/jwt-managed"
 
 
@@ -20,37 +23,33 @@ class AuthentikCryptoConfig(ManagedAppConfig):
         """Load crypto tasks"""
         self.import_module("authentik.crypto.tasks")
 
-    def _create_update_cert(self):
+    def _create_update_cert(self, cert: Optional["CertificateKeyPair"] = None):
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair
 
-        common_name = "authentik Internal JWT Certificate"
-        builder = CertificateBuilder(common_name)
+        builder = CertificateBuilder("authentik Internal JWT Certificate")
         builder.build(
             subject_alt_names=["goauthentik.io"],
             validity_days=360,
         )
-        CertificateKeyPair.objects.update_or_create(
-            managed=MANAGED_KEY,
-            defaults={
-                "name": common_name,
-                "certificate_data": builder.certificate,
-                "key_data": builder.private_key,
-            },
-        )
+        if not cert:
+            cert = CertificateKeyPair()
+        builder.cert = cert
+        builder.cert.managed = MANAGED_KEY
+        builder.save()
 
     def reconcile_managed_jwt_cert(self):
         """Ensure managed JWT certificate"""
         from authentik.crypto.models import CertificateKeyPair
 
-        cert: Optional[CertificateKeyPair] = CertificateKeyPair.objects.filter(
-            managed=MANAGED_KEY
-        ).first()
-        now = datetime.now()
-        if not cert or (
-            now < cert.certificate.not_valid_before or now > cert.certificate.not_valid_after
-        ):
+        certs = CertificateKeyPair.objects.filter(managed=MANAGED_KEY)
+        if not certs.exists():
             self._create_update_cert()
+            return
+        cert: CertificateKeyPair = certs.first()
+        now = datetime.now()
+        if now < cert.certificate.not_valid_before or now > cert.certificate.not_valid_after:
+            self._create_update_cert(cert)
 
     def reconcile_self_signed(self):
         """Create self-signed keypair"""
@@ -62,10 +61,4 @@ class AuthentikCryptoConfig(ManagedAppConfig):
             return
         builder = CertificateBuilder(name)
         builder.build(subject_alt_names=[f"{generate_id()}.self-signed.goauthentik.io"])
-        CertificateKeyPair.objects.get_or_create(
-            name=name,
-            defaults={
-                "certificate_data": builder.certificate,
-                "key_data": builder.private_key,
-            },
-        )
+        builder.save()

authentik/enterprise/api.py

@@ -2,13 +2,11 @@
 from datetime import datetime, timedelta
 
 from django.utils.timezone import now
-from django.utils.translation import gettext as _
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.decorators import action
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.permissions import IsAdminUser, IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
@@ -22,18 +20,6 @@ from authentik.enterprise.models import License, LicenseKey
 from authentik.root.install_id import get_install_id
 
 
-class EnterpriseRequiredMixin:
-    """Mixin to validate that a valid enterprise license
-    exists before allowing to safe the object"""
-
-    def validate(self, attrs: dict) -> dict:
-        """Check that a valid license exists"""
-        total = LicenseKey.get_total()
-        if not total.is_valid():
-            raise ValidationError(_("Enterprise is required to create/update this object."))
-        return super().validate(attrs)
-
-
 class LicenseSerializer(ModelSerializer):
     """License Serializer"""
 
@@ -98,7 +84,7 @@ class LicenseViewSet(UsedByMixin, ModelViewSet):
             200: inline_serializer("InstallIDSerializer", {"install_id": CharField(required=True)}),
         },
     )
-    @action(detail=False, methods=["GET"])
+    @action(detail=False, methods=["GET"], permission_classes=[IsAdminUser])
     def get_install_id(self, request: Request) -> Response:
         """Get install_id"""
         return Response(

authentik/enterprise/apps.py

@@ -2,11 +2,7 @@
 from authentik.blueprints.apps import ManagedAppConfig
 
 
-class EnterpriseConfig(ManagedAppConfig):
-    """Base app config for all enterprise apps"""
-
-
-class AuthentikEnterpriseConfig(EnterpriseConfig):
+class AuthentikEnterpriseConfig(ManagedAppConfig):
     """Enterprise app config"""
 
     name = "authentik.enterprise"

authentik/enterprise/migrations/0002_rename_users_license_internal_users_and_more.py

@@ -33,8 +33,4 @@ class Migration(migrations.Migration):
                 "verbose_name_plural": "License Usage Records",
             },
         ),
-        migrations.AlterModelOptions(
-            name="license",
-            options={"verbose_name": "License", "verbose_name_plural": "Licenses"},
-        ),
     ]

authentik/enterprise/models.py

@@ -19,10 +19,8 @@ from django.utils.translation import gettext as _
 from guardian.shortcuts import get_anonymous_user
 from jwt import PyJWTError, decode, get_unverified_header
 from rest_framework.exceptions import ValidationError
-from rest_framework.serializers import BaseSerializer
 
 from authentik.core.models import ExpiringModel, User, UserTypes
-from authentik.lib.models import SerializerModel
 from authentik.root.install_id import get_install_id
 
 
@@ -136,9 +134,6 @@ class LicenseKey:
 
     def record_usage(self):
         """Capture the current validity status and metrics and save them"""
-        threshold = now() - timedelta(hours=8)
-        if LicenseUsage.objects.filter(record_date__gte=threshold).exists():
-            return
         LicenseUsage.objects.create(
             user_count=self.get_default_user_count(),
             external_user_count=self.get_external_user_count(),
@@ -156,7 +151,7 @@ class LicenseKey:
         return usage.record_date
 
 
-class License(SerializerModel):
+class License(models.Model):
     """An authentik enterprise license"""
 
     license_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
@@ -167,12 +162,6 @@ class License(SerializerModel):
     internal_users = models.BigIntegerField()
     external_users = models.BigIntegerField()
 
-    @property
-    def serializer(self) -> type[BaseSerializer]:
-        from authentik.enterprise.api import LicenseSerializer
-
-        return LicenseSerializer
-
     @property
     def status(self) -> LicenseKey:
         """Get parsed license status"""
@@ -180,8 +169,6 @@ class License(SerializerModel):
 
     class Meta:
         indexes = (HashIndex(fields=("key",)),)
-        verbose_name = _("License")
-        verbose_name_plural = _("Licenses")
 
 
 def usage_expiry():

authentik/enterprise/policy.py

@@ -1,31 +1,43 @@
 """Enterprise license policies"""
 from typing import Optional
 
-from django.utils.translation import gettext_lazy as _
+from rest_framework.serializers import BaseSerializer
 
 from authentik.core.models import User, UserTypes
 from authentik.enterprise.models import LicenseKey
+from authentik.policies.models import Policy
 from authentik.policies.types import PolicyRequest, PolicyResult
 from authentik.policies.views import PolicyAccessView
 
 
+class EnterprisePolicy(Policy):
+    """Check that a user is correctly licensed for the request"""
+
+    @property
+    def component(self) -> str:
+        return ""
+
+    @property
+    def serializer(self) -> type[BaseSerializer]:
+        raise NotImplementedError
+
+    def passes(self, request: PolicyRequest) -> PolicyResult:
+        if not LicenseKey.get_total().is_valid():
+            return PolicyResult(False)
+        if request.user.type != UserTypes.INTERNAL:
+            return PolicyResult(False)
+        return PolicyResult(True)
+
+
 class EnterprisePolicyAccessView(PolicyAccessView):
     """PolicyAccessView which also checks enterprise licensing"""
 
-    def check_license(self):
-        """Check license"""
-        if not LicenseKey.get_total().is_valid():
-            return PolicyResult(False, _("Enterprise required to access this feature."))
-        if self.request.user.type != UserTypes.INTERNAL:
-            return PolicyResult(False, _("Feature only accessible for internal users."))
-        return PolicyResult(True)
-
     def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
         user = user or self.request.user
         request = PolicyRequest(user)
         request.http_request = self.request
         result = super().user_has_access(user)
-        enterprise_result = self.check_license()
+        enterprise_result = EnterprisePolicy().passes(request)
         if not enterprise_result.passing:
             return enterprise_result
         return result

authentik/enterprise/providers/rac/api/endpoints.py

@@ -1,135 +0,0 @@
-"""RAC Provider API Views"""
-from typing import Optional
-
-from django.core.cache import cache
-from django.db.models import QuerySet
-from django.urls import reverse
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
-from rest_framework.fields import SerializerMethodField
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import ModelViewSet
-from structlog.stdlib import get_logger
-
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.models import Provider
-from authentik.enterprise.api import EnterpriseRequiredMixin
-from authentik.enterprise.providers.rac.api.providers import RACProviderSerializer
-from authentik.enterprise.providers.rac.models import Endpoint
-from authentik.policies.engine import PolicyEngine
-from authentik.rbac.filters import ObjectFilter
-
-LOGGER = get_logger()
-
-
-def user_endpoint_cache_key(user_pk: str) -> str:
-    """Cache key where endpoint list for user is saved"""
-    return f"goauthentik.io/providers/rac/endpoint_access/{user_pk}"
-
-
-class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
-    """Endpoint Serializer"""
-
-    provider_obj = RACProviderSerializer(source="provider", read_only=True)
-    launch_url = SerializerMethodField()
-
-    def get_launch_url(self, endpoint: Endpoint) -> Optional[str]:
-        """Build actual launch URL (the provider itself does not have one, just
-        individual endpoints)"""
-        try:
-            # pylint: disable=no-member
-            return reverse(
-                "authentik_providers_rac:start",
-                kwargs={"app": endpoint.provider.application.slug, "endpoint": endpoint.pk},
-            )
-        except Provider.application.RelatedObjectDoesNotExist:
-            return None
-
-    class Meta:
-        model = Endpoint
-        fields = [
-            "pk",
-            "name",
-            "provider",
-            "provider_obj",
-            "protocol",
-            "host",
-            "settings",
-            "property_mappings",
-            "auth_mode",
-            "launch_url",
-            "maximum_connections",
-        ]
-
-
-class EndpointViewSet(UsedByMixin, ModelViewSet):
-    """Endpoint Viewset"""
-
-    queryset = Endpoint.objects.all()
-    serializer_class = EndpointSerializer
-    filterset_fields = ["name", "provider"]
-    search_fields = ["name", "protocol"]
-    ordering = ["name", "protocol"]
-
-    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
-        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
-        for backend in list(self.filter_backends):
-            if backend == ObjectFilter:
-                continue
-            queryset = backend().filter_queryset(self.request, queryset, self)
-        return queryset
-
-    def _get_allowed_endpoints(self, queryset: QuerySet) -> list[Endpoint]:
-        endpoints = []
-        for endpoint in queryset:
-            engine = PolicyEngine(endpoint, self.request.user, self.request)
-            engine.build()
-            if engine.passing:
-                endpoints.append(endpoint)
-        return endpoints
-
-    @extend_schema(
-        parameters=[
-            OpenApiParameter(
-                "search",
-                OpenApiTypes.STR,
-            ),
-            OpenApiParameter(
-                name="superuser_full_list",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.BOOL,
-            ),
-        ],
-        responses={
-            200: EndpointSerializer(many=True),
-            400: OpenApiResponse(description="Bad request"),
-        },
-    )
-    def list(self, request: Request, *args, **kwargs) -> Response:
-        """List accessible endpoints"""
-        should_cache = request.GET.get("search", "") == ""
-
-        superuser_full_list = str(request.GET.get("superuser_full_list", "false")).lower() == "true"
-        if superuser_full_list and request.user.is_superuser:
-            return super().list(request)
-
-        queryset = self._filter_queryset_for_list(self.get_queryset())
-        self.paginate_queryset(queryset)
-
-        allowed_endpoints = []
-        if not should_cache:
-            allowed_endpoints = self._get_allowed_endpoints(queryset)
-        if should_cache:
-            allowed_endpoints = cache.get(user_endpoint_cache_key(self.request.user.pk))
-            if not allowed_endpoints:
-                LOGGER.debug("Caching allowed endpoint list")
-                allowed_endpoints = self._get_allowed_endpoints(queryset)
-                cache.set(
-                    user_endpoint_cache_key(self.request.user.pk),
-                    allowed_endpoints,
-                    timeout=86400,
-                )
-        serializer = self.get_serializer(allowed_endpoints, many=True)
-        return self.get_paginated_response(serializer.data)

authentik/enterprise/providers/rac/api/property_mappings.py

@@ -1,49 +0,0 @@
-"""RAC Provider API Views"""
-from django_filters.filters import AllValuesMultipleFilter
-from django_filters.filterset import FilterSet
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import extend_schema_field
-from rest_framework.fields import CharField
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.core.api.propertymappings import PropertyMappingSerializer
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import JSONDictField
-from authentik.enterprise.providers.rac.models import RACPropertyMapping
-
-
-class RACPropertyMappingSerializer(PropertyMappingSerializer):
-    """RACPropertyMapping Serializer"""
-
-    static_settings = JSONDictField()
-    expression = CharField(allow_blank=True, required=False)
-
-    def validate_expression(self, expression: str) -> str:
-        """Test Syntax"""
-        if expression == "":
-            return expression
-        return super().validate_expression(expression)
-
-    class Meta:
-        model = RACPropertyMapping
-        fields = PropertyMappingSerializer.Meta.fields + ["static_settings"]
-
-
-class RACPropertyMappingFilter(FilterSet):
-    """Filter for RACPropertyMapping"""
-
-    managed = extend_schema_field(OpenApiTypes.STR)(AllValuesMultipleFilter(field_name="managed"))
-
-    class Meta:
-        model = RACPropertyMapping
-        fields = ["name", "managed"]
-
-
-class RACPropertyMappingViewSet(UsedByMixin, ModelViewSet):
-    """RACPropertyMapping Viewset"""
-
-    queryset = RACPropertyMapping.objects.all()
-    serializer_class = RACPropertyMappingSerializer
-    search_fields = ["name"]
-    ordering = ["name"]
-    filterset_class = RACPropertyMappingFilter

authentik/enterprise/providers/rac/api/providers.py

@@ -1,32 +0,0 @@
-"""RAC Provider API Views"""
-from rest_framework.fields import CharField, ListField
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.core.api.providers import ProviderSerializer
-from authentik.core.api.used_by import UsedByMixin
-from authentik.enterprise.api import EnterpriseRequiredMixin
-from authentik.enterprise.providers.rac.models import RACProvider
-
-
-class RACProviderSerializer(EnterpriseRequiredMixin, ProviderSerializer):
-    """RACProvider Serializer"""
-
-    outpost_set = ListField(child=CharField(), read_only=True, source="outpost_set.all")
-
-    class Meta:
-        model = RACProvider
-        fields = ProviderSerializer.Meta.fields + ["settings", "outpost_set", "connection_expiry"]
-        extra_kwargs = ProviderSerializer.Meta.extra_kwargs
-
-
-class RACProviderViewSet(UsedByMixin, ModelViewSet):
-    """RACProvider Viewset"""
-
-    queryset = RACProvider.objects.all()
-    serializer_class = RACProviderSerializer
-    filterset_fields = {
-        "application": ["isnull"],
-        "name": ["iexact"],
-    }
-    search_fields = ["name"]
-    ordering = ["name"]