release: 2022.10.0

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2022.8.2
+current_version = 2022.10.0
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)
@@ -17,4 +17,4 @@ tag_name = version/{new_version}
 
 [bumpversion:file:internal/constants/constants.go]
 
-[bumpversion:file:web/src/constants.ts]
+[bumpversion:file:web/src/common/constants.ts]

.github/actions/comment-pr-instructions/action.yml

@@ -11,38 +11,7 @@ runs:
   steps:
     - name: Generate config
       id: ev
-      shell: python
-      run: |
-        """Helper script to get the actual branch name, docker safe"""
-        import os
-        from time import time
-
-        env_pr_branch = "GITHUB_HEAD_REF"
-        default_branch = "GITHUB_REF"
-        sha = "GITHUB_SHA"
-
-        branch_name = os.environ[default_branch]
-        if os.environ.get(env_pr_branch, "") != "":
-            branch_name = os.environ[env_pr_branch]
-
-        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
-
-        print("##[set-output name=branchName]%s" % branch_name)
-        print(
-            "##[set-output name=branchNameContainer]%s"
-            % branch_name.replace("refs/heads/", "").replace("/", "-")
-        )
-        print("##[set-output name=timestamp]%s" % int(time()))
-        print("##[set-output name=sha]%s" % os.environ[sha])
-        print("##[set-output name=shouldBuild]%s" % should_build)
-
-        import configparser
-        parser = configparser.ConfigParser()
-        parser.read(".bumpversion.cfg")
-        version = parser.get("bumpversion", "current_version")
-        version_family = ".".join(version.split(".")[:-1])
-        print("##[set-output name=version]%s" % version)
-        print("##[set-output name=versionFamily]%s" % version_family)
+      uses: ./.github/actions/docker-push-variables
     - name: Find Comment
       uses: peter-evans/find-comment@v2
       id: fc
@@ -83,8 +52,6 @@ runs:
             image:
                 repository: ghcr.io/goauthentik/dev-server
                 tag: ${{ inputs.tag }}
-                # pullPolicy: Always to ensure you always get the latest version
-                pullPolicy: Always
             ```
 
             Afterwards, run the upgrade commands from the latest release notes.

.github/actions/docker-push-variables/action.yml

@@ -32,32 +32,27 @@ runs:
       shell: python
       run: |
         """Helper script to get the actual branch name, docker safe"""
+        import configparser
         import os
         from time import time
 
-        env_pr_branch = "GITHUB_HEAD_REF"
-        default_branch = "GITHUB_REF"
-        sha = "GITHUB_SHA"
-
-        branch_name = os.environ[default_branch]
-        if os.environ.get(env_pr_branch, "") != "":
-            branch_name = os.environ[env_pr_branch]
-
-        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
-
-        print("##[set-output name=branchName]%s" % branch_name)
-        print(
-            "##[set-output name=branchNameContainer]%s"
-            % branch_name.replace("refs/heads/", "").replace("/", "-")
-        )
-        print("##[set-output name=timestamp]%s" % int(time()))
-        print("##[set-output name=sha]%s" % os.environ[sha])
-        print("##[set-output name=shouldBuild]%s" % should_build)
-
-        import configparser
         parser = configparser.ConfigParser()
         parser.read(".bumpversion.cfg")
+
+        branch_name = os.environ["GITHUB_REF"]
+        if os.environ.get("GITHUB_HEAD_REF", "") != "":
+            branch_name = os.environ["GITHUB_HEAD_REF"]
+
+        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
         version = parser.get("bumpversion", "current_version")
         version_family = ".".join(version.split(".")[:-1])
-        print("##[set-output name=version]%s" % version)
-        print("##[set-output name=versionFamily]%s" % version_family)
+        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+            print("branchName=%s" % branch_name, file=_output)
+            print("branchNameContainer=%s" % safe_branch_name, file=_output)
+            print("timestamp=%s" % int(time()), file=_output)
+            print("sha=%s" % os.environ["GITHUB_SHA"], file=_output)
+            print("shouldBuild=%s" % should_build, file=_output)
+            print("version=%s" % version, file=_output)
+            print("versionFamily=%s" % version_family, file=_output)

.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
-name: 'Setup authentik testing environemnt'
-description: 'Setup authentik testing environemnt'
+name: 'Setup authentik testing environment'
+description: 'Setup authentik testing environment'
 
 runs:
   using: "composite"
@@ -27,7 +27,7 @@ runs:
         docker-compose -f .github/actions/setup/docker-compose.yml up -d
         poetry env use python3.10
         poetry install
-        npm install -g pyright@1.1.136
+        cd web && npm ci
     - name: Generate config
       shell: poetry run python {0}
       run: |

.github/codespell-words.txt

@@ -1,3 +1,4 @@
 keypair
 keypairs
 hass
+warmup

.github/transifex.yml

@@ -0,0 +1,16 @@
+git:
+  filters:
+    - filter_type: file
+      # all supported i18n types: https://docs.transifex.com/formats
+      file_format: PO
+      source_language: en
+      source_file: web/src/locales/en.po
+      # path expression to translation files, must contain <lang> placeholder
+      translation_files_expression: 'web/src/locales/<lang>.po'
+    - filter_type: file
+      # all supported i18n types: https://docs.transifex.com/formats
+      file_format: PO
+      source_language: en
+      source_file: locale/en/LC_MESSAGES/django.po
+      # path expression to translation files, must contain <lang> placeholder
+      translation_files_expression: 'locale/<lang>/LC_MESSAGES/django.po'

.github/workflows/ci-main.yml

@@ -96,6 +96,8 @@ jobs:
           testspace [unittest]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: unit
   test-integration:
     runs-on: ubuntu-latest
     steps:
@@ -106,7 +108,7 @@ jobs:
         with:
           domain: ${{github.repository_owner}}
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.3.0
+        uses: helm/kind-action@v1.4.0
       - name: run integration
         run: |
           poetry run make test-integration
@@ -117,6 +119,8 @@ jobs:
           testspace [integration]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: integration
   test-e2e-provider:
     runs-on: ubuntu-latest
     steps:
@@ -126,7 +130,7 @@ jobs:
       - uses: testspace-com/setup-testspace@v1
         with:
           domain: ${{github.repository_owner}}
-      - name: Setup authentik env
+      - name: Setup e2e env (chrome, etc)
         run: |
           docker-compose -f tests/e2e/docker-compose.yml up -d
       - id: cache-web
@@ -151,6 +155,8 @@ jobs:
           testspace [e2e-provider]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: e2e
   test-e2e-rest:
     runs-on: ubuntu-latest
     steps:
@@ -160,7 +166,7 @@ jobs:
       - uses: testspace-com/setup-testspace@v1
         with:
           domain: ${{github.repository_owner}}
-      - name: Setup authentik env
+      - name: Setup e2e env (chrome, etc)
         run: |
           docker-compose -f tests/e2e/docker-compose.yml up -d
       - id: cache-web
@@ -185,6 +191,8 @@ jobs:
           testspace [e2e-rest]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: e2e
   ci-core-mark:
     needs:
       - lint
@@ -209,7 +217,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -240,4 +248,4 @@ jobs:
         continue-on-error: true
         uses: ./.github/actions/comment-pr-instructions
         with:
-          tag: gh-${{ steps.ev.outputs.branchNameContainer }}
+          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}

.github/workflows/ci-outpost.yml

@@ -63,7 +63,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -111,7 +111,7 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: "^1.17"
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/ci-web.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -78,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/ci-website.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/release-publish.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -54,7 +54,7 @@ jobs:
         with:
           go-version: "^1.17"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
@@ -100,7 +100,7 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: "^1.17"
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/web-api-publish.yml

@@ -10,8 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3.4.1
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           registry-url: 'https://registry.npmjs.org'

Dockerfile

@@ -19,7 +19,7 @@ WORKDIR /work/web
 RUN npm ci && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.10.6-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.10.7-slim-bullseye AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -30,7 +30,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.19.0-bullseye AS go-builder
+FROM docker.io/golang:1.19.2-bullseye AS go-builder
 
 WORKDIR /work
 
@@ -43,10 +43,10 @@ COPY ./internal /work/internal
 COPY ./go.mod /work/go.mod
 COPY ./go.sum /work/go.sum
 
-RUN go build -o /work/authentik ./cmd/server/main.go
+RUN go build -o /work/authentik ./cmd/server/
 
 # Stage 5: Run
-FROM docker.io/python:3.10.6-slim-bullseye AS final-image
+FROM docker.io/python:3.10.7-slim-bullseye AS final-image
 
 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.

Makefile

@@ -28,7 +28,7 @@ test-docker:
 	rm -f .env
 
 test:
-	coverage run manage.py test authentik
+	coverage run manage.py test --keepdb authentik
 	coverage html
 	coverage report
 
@@ -53,7 +53,7 @@ migrate:
 	python -m lifecycle.migrate
 
 run:
-	go run -v cmd/server/main.go
+	go run -v ./cmd/server/
 
 i18n-extract: i18n-extract-core web-extract
 
@@ -73,7 +73,7 @@ gen-diff:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		docker.io/openapitools/openapi-diff:2.0.1 \
+		docker.io/openapitools/openapi-diff:2.1.0-beta.3 \
 		--markdown /local/diff.md \
 		/local/old_schema.yml /local/schema.yml
 	rm old_schema.yml
@@ -90,9 +90,11 @@ gen-client-ts:
 		-i /local/schema.yml \
 		-g typescript-fetch \
 		-o /local/gen-ts-api \
-		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=@goauthentik/api,npmVersion=${NPM_VERSION}
+		-c /local/scripts/api-ts-config.yaml \
+		--additional-properties=npmVersion=${NPM_VERSION} \
+		--git-repo-id authentik \
+		--git-user-id goauthentik
 	mkdir -p web/node_modules/@goauthentik/api
-	\cp -fv scripts/web_api_readme.md gen-ts-api/README.md
 	cd gen-ts-api && npm i
 	\cp -rfv gen-ts-api/* web/node_modules/@goauthentik/api
 
@@ -149,7 +151,7 @@ web-extract:
 ## Website
 #########################
 
-website: website-lint-fix
+website: website-lint-fix website-build
 
 website-install:
 	cd website && npm ci
@@ -157,30 +159,33 @@ website-install:
 website-lint-fix:
 	cd website && npm run prettier
 
+website-build:
+	cd website && npm run build
+
 website-watch:
 	cd website && npm run watch
 
 # These targets are use by GitHub actions to allow usage of matrix
 # which makes the YAML File a lot smaller
-
+PY_SOURCES=authentik tests lifecycle
 ci--meta-debug:
 	python -V
 	node --version
 
 ci-pylint: ci--meta-debug
-	pylint authentik tests lifecycle
+	pylint $(PY_SOURCES)
 
 ci-black: ci--meta-debug
-	black --check authentik tests lifecycle
+	black --check $(PY_SOURCES)
 
 ci-isort: ci--meta-debug
-	isort --check authentik tests lifecycle
+	isort --check $(PY_SOURCES)
 
 ci-bandit: ci--meta-debug
-	bandit -r authentik tests lifecycle
+	bandit -r $(PY_SOURCES)
 
 ci-pyright: ci--meta-debug
-	pyright e2e lifecycle
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
 
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

SECURITY.md

@@ -6,10 +6,13 @@
 
 | Version    | Supported          |
 | ---------- | ------------------ |
-| 2022.6.x   | :white_check_mark: |
-| 2022.7.x   | :white_check_mark: |
-| 2022.8.x   | :white_check_mark: |
+| 2022.9.x   | :white_check_mark: |
+| 2022.10.x  | :white_check_mark: |
 
 ## Reporting a Vulnerability
 
 To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io)
+
+## Getting security notifications
+
+To get security notifications, join the [discord](https://goauthentik.io/discord) server. In the future there will be a mailing list too.

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2022.8.2"
+__version__ = "2022.10.0"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/metrics.py

@@ -23,6 +23,7 @@ class LoginMetricsSerializer(PassiveSerializer):
 
     logins_per_1h = SerializerMethodField()
     logins_failed_per_1h = SerializerMethodField()
+    authorizations_per_1h = SerializerMethodField()
 
     @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
@@ -44,6 +45,16 @@ class LoginMetricsSerializer(PassiveSerializer):
             .get_events_per_hour()
         )
 
+    @extend_schema_field(CoordinateSerializer(many=True))
+    def get_authorizations_per_1h(self, _):
+        """Get successful authorizations per hour for the last 24 hours"""
+        user = self.context["user"]
+        return (
+            get_objects_for_user(user, "authentik_events.view_event")
+            .filter(action=EventAction.AUTHORIZE_APPLICATION)
+            .get_events_per_hour()
+        )
+
 
 class AdministrationMetricsViewSet(APIView):
     """Login Metrics per 1h"""

authentik/admin/api/tasks.py

@@ -5,7 +5,7 @@ from django.contrib import messages
 from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
 from rest_framework.permissions import IsAdminUser
@@ -58,7 +58,15 @@ class TaskViewSet(ViewSet):
         responses={
             200: TaskSerializer(many=False),
             404: OpenApiResponse(description="Task not found"),
-        }
+        },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
     )
     # pylint: disable=invalid-name
     def retrieve(self, request: Request, pk=None) -> Response:
@@ -81,6 +89,14 @@ class TaskViewSet(ViewSet):
             404: OpenApiResponse(description="Task not found"),
             500: OpenApiResponse(description="Failed to retry task"),
         },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
     )
     @action(detail=True, methods=["post"])
     # pylint: disable=invalid-name

authentik/admin/apps.py

@@ -1,7 +1,7 @@
 """authentik admin app config"""
 from prometheus_client import Gauge, Info
 
-from authentik.blueprints.manager import ManagedAppConfig
+from authentik.blueprints.apps import ManagedAppConfig
 
 PROM_INFO = Info("authentik_version", "Currently running authentik version")
 GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")

authentik/api/authentication.py

@@ -16,7 +16,7 @@ from authentik.providers.oauth2.models import RefreshToken
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> str:
+def validate_auth(header: bytes) -> Optional[str]:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()

authentik/api/v3/config.py

@@ -28,6 +28,7 @@ class Capabilities(models.TextChoices):
     CAN_SAVE_MEDIA = "can_save_media"
     CAN_GEO_IP = "can_geo_ip"
     CAN_IMPERSONATE = "can_impersonate"
+    CAN_DEBUG = "can_debug"
 
 
 class ErrorReportingConfigSerializer(PassiveSerializer):
@@ -66,6 +67,8 @@ class ConfigView(APIView):
             caps.append(Capabilities.CAN_GEO_IP)
         if CONFIG.y_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
+        if settings.DEBUG:
+            caps.append(Capabilities.CAN_DEBUG)
         return caps
 
     def get_config(self) -> ConfigSerializer:

authentik/api/v3/urls.py

@@ -59,7 +59,8 @@ from authentik.sources.oauth.api.source import OAuthSourceViewSet
 from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
 from authentik.sources.plex.api.source import PlexSourceViewSet
 from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
-from authentik.sources.saml.api import SAMLSourceViewSet
+from authentik.sources.saml.api.source import SAMLSourceViewSet
+from authentik.sources.saml.api.source_connection import UserSAMLSourceConnectionViewSet
 from authentik.stages.authenticator_duo.api import (
     AuthenticatorDuoStageViewSet,
     DuoAdminDeviceViewSet,
@@ -138,6 +139,7 @@ router.register("sources/all", SourceViewSet)
 router.register("sources/user_connections/all", UserSourceConnectionViewSet)
 router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
 router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
+router.register("sources/user_connections/saml", UserSAMLSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)

authentik/blueprints/apps.py

@@ -1,6 +1,46 @@
 """authentik Blueprints app"""
 
-from authentik.blueprints.manager import ManagedAppConfig
+from importlib import import_module
+from inspect import ismethod
+
+from django.apps import AppConfig
+from django.db import DatabaseError, InternalError, ProgrammingError
+from structlog.stdlib import BoundLogger, get_logger
+
+
+class ManagedAppConfig(AppConfig):
+    """Basic reconciliation logic for apps"""
+
+    _logger: BoundLogger
+
+    def __init__(self, app_name: str, *args, **kwargs) -> None:
+        super().__init__(app_name, *args, **kwargs)
+        self._logger = get_logger().bind(app_name=app_name)
+
+    def ready(self) -> None:
+        self.reconcile()
+        return super().ready()
+
+    def import_module(self, path: str):
+        """Load module"""
+        import_module(path)
+
+    def reconcile(self) -> None:
+        """reconcile ourselves"""
+        prefix = "reconcile_"
+        for meth_name in dir(self):
+            meth = getattr(self, meth_name)
+            if not ismethod(meth):
+                continue
+            if not meth_name.startswith(prefix):
+                continue
+            name = meth_name.replace(prefix, "")
+            try:
+                self._logger.debug("Starting reconciler", name=name)
+                meth()
+                self._logger.debug("Successfully reconciled", name=name)
+            except (DatabaseError, ProgrammingError, InternalError) as exc:
+                self._logger.debug("Failed to run reconcile", name=name, exc=exc)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -20,3 +60,7 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
         from authentik.blueprints.v1.tasks import blueprints_discover
 
         blueprints_discover.delay()
+
+    def import_models(self):
+        super().import_models()
+        self.import_module("authentik.blueprints.v1.meta.apply_blueprint")

authentik/blueprints/management/commands/apply_blueprint.py

@@ -1,4 +1,6 @@
 """Apply blueprint from commandline"""
+from sys import exit as sys_exit
+
 from django.core.management.base import BaseCommand, no_translations
 from structlog.stdlib import get_logger
 
@@ -20,8 +22,9 @@ class Command(BaseCommand):
             valid, logs = importer.validate()
             if not valid:
                 for log in logs:
-                    LOGGER.debug(**log)
-                raise ValueError("blueprint invalid")
+                    getattr(LOGGER, log.pop("log_level"))(**log)
+                self.stderr.write("blueprint invalid")
+                sys_exit(1)
             importer.apply()
 
     def add_arguments(self, parser):

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -2,12 +2,11 @@
 from json import dumps, loads
 from pathlib import Path
 
-from django.apps import apps
 from django.core.management.base import BaseCommand, no_translations
 from structlog.stdlib import get_logger
 
 from authentik.blueprints.v1.importer import is_model_allowed
-from authentik.lib.models import SerializerModel
+from authentik.blueprints.v1.meta.registry import registry
 
 LOGGER = get_logger()
 
@@ -29,10 +28,9 @@ class Command(BaseCommand):
     def set_model_allowed(self):
         """Set model enum"""
         model_names = []
-        for model in apps.get_models():
+        for model in registry.get_models():
             if not is_model_allowed(model):
                 continue
-            if SerializerModel not in model.__mro__:
-                continue
             model_names.append(f"{model._meta.app_label}.{model._meta.model_name}")
+        model_names.sort()
         self.schema["properties"]["entries"]["items"]["properties"]["model"]["enum"] = model_names

authentik/blueprints/management/commands/schema_template.json

@@ -41,8 +41,7 @@
                 "$id": "#entry",
                 "type": "object",
                 "required": [
-                    "model",
-                    "identifiers"
+                    "model"
                 ],
                 "properties": {
                     "model": {
@@ -67,6 +66,7 @@
                     },
                     "identifiers": {
                         "type": "object",
+                        "default": {},
                         "properties": {
                             "pk": {
                                 "description": "Commonly available field, may not exist on all models",

authentik/blueprints/manager.py

@@ -1,44 +0,0 @@
-"""Managed objects manager"""
-from importlib import import_module
-from inspect import ismethod
-
-from django.apps import AppConfig
-from django.db import DatabaseError, InternalError, ProgrammingError
-from structlog.stdlib import BoundLogger, get_logger
-
-LOGGER = get_logger()
-
-
-class ManagedAppConfig(AppConfig):
-    """Basic reconciliation logic for apps"""
-
-    _logger: BoundLogger
-
-    def __init__(self, app_name: str, *args, **kwargs) -> None:
-        super().__init__(app_name, *args, **kwargs)
-        self._logger = get_logger().bind(app_name=app_name)
-
-    def ready(self) -> None:
-        self.reconcile()
-        return super().ready()
-
-    def import_module(self, path: str):
-        """Load module"""
-        import_module(path)
-
-    def reconcile(self) -> None:
-        """reconcile ourselves"""
-        prefix = "reconcile_"
-        for meth_name in dir(self):
-            meth = getattr(self, meth_name)
-            if not ismethod(meth):
-                continue
-            if not meth_name.startswith(prefix):
-                continue
-            name = meth_name.replace(prefix, "")
-            try:
-                self._logger.debug("Starting reconciler", name=name)
-                meth()
-                self._logger.debug("Successfully reconciled", name=name)
-            except (DatabaseError, ProgrammingError, InternalError) as exc:
-                self._logger.debug("Failed to run reconcile", name=name, exc=exc)

authentik/blueprints/migrations/0001_initial.py

@@ -4,7 +4,7 @@ from glob import glob
 from pathlib import Path
 
 import django.contrib.postgres.fields
-from dacite import from_dict
+from dacite.core import from_dict
 from django.apps.registry import Apps
 from django.conf import settings
 from django.db import migrations, models

authentik/blueprints/models.py

@@ -1,4 +1,4 @@
-"""Managed Object models"""
+"""blueprint models"""
 from pathlib import Path
 from urllib.parse import urlparse
 from uuid import uuid4
@@ -6,13 +6,26 @@ from uuid import uuid4
 from django.contrib.postgres.fields import ArrayField
 from django.db import models
 from django.utils.translation import gettext_lazy as _
-from requests import RequestException
+from opencontainers.distribution.reggie import (
+    NewClient,
+    WithDebug,
+    WithDefaultName,
+    WithDigest,
+    WithReference,
+    WithUserAgent,
+    WithUsernamePassword,
+)
+from requests.exceptions import RequestException
 from rest_framework.serializers import Serializer
+from structlog import get_logger
 
 from authentik.lib.config import CONFIG
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
 from authentik.lib.sentry import SentryIgnoredException
-from authentik.lib.utils.http import get_http_session
+from authentik.lib.utils.http import authentik_user_agent
+
+OCI_MEDIA_TYPE = "application/vnd.goauthentik.blueprint.v1+yaml"
+LOGGER = get_logger()
 
 
 class BlueprintRetrievalFailed(SentryIgnoredException):
@@ -71,18 +84,63 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
+    def retrieve_oci(self) -> str:
+        """Get blueprint from an OCI registry"""
+        url = urlparse(self.path)
+        ref = "latest"
+        path = url.path[1:]
+        if ":" in url.path:
+            path, _, ref = path.partition(":")
+        client = NewClient(
+            f"{url.scheme}://{url.hostname}",
+            WithUserAgent(authentik_user_agent()),
+            WithUsernamePassword(url.username, url.password),
+            WithDefaultName(path),
+            WithDebug(True),
+        )
+        LOGGER.info("Fetching OCI manifests for blueprint", instance=self)
+        manifest_request = client.NewRequest(
+            "GET",
+            "/v2/<name>/manifests/<reference>",
+            WithReference(ref),
+        ).SetHeader("Accept", "application/vnd.oci.image.manifest.v1+json")
+        try:
+            manifest_response = client.Do(manifest_request)
+            manifest_response.raise_for_status()
+        except RequestException as exc:
+            raise BlueprintRetrievalFailed(exc) from exc
+        manifest = manifest_response.json()
+        if "errors" in manifest:
+            raise BlueprintRetrievalFailed(manifest["errors"])
+
+        blob = None
+        for layer in manifest.get("layers", []):
+            if layer.get("mediaType", "") == OCI_MEDIA_TYPE:
+                blob = layer.get("digest")
+                LOGGER.debug("Found layer with matching media type", instance=self, blob=blob)
+        if not blob:
+            raise BlueprintRetrievalFailed("Blob not found")
+
+        blob_request = client.NewRequest(
+            "GET",
+            "/v2/<name>/blobs/<digest>",
+            WithDigest(blob),
+        )
+        try:
+            blob_response = client.Do(blob_request)
+            blob_response.raise_for_status()
+            return blob_response.text
+        except RequestException as exc:
+            raise BlueprintRetrievalFailed(exc) from exc
+
     def retrieve(self) -> str:
         """Retrieve blueprint contents"""
-        if urlparse(self.path).scheme != "":
-            try:
-                res = get_http_session().get(self.path, timeout=3, allow_redirects=True)
-                res.raise_for_status()
-                return res.text
-            except RequestException as exc:
-                raise BlueprintRetrievalFailed(exc) from exc
-        path = Path(CONFIG.y("blueprints_dir")).joinpath(Path(self.path))
-        with path.open("r", encoding="utf-8") as _file:
-            return _file.read()
+        full_path = Path(CONFIG.y("blueprints_dir")).joinpath(Path(self.path))
+        if full_path.exists():
+            LOGGER.debug("Blueprint path exists locally", instance=self)
+            with full_path.open("r", encoding="utf-8") as _file:
+                return _file.read()
+        return self.retrieve_oci()
 
     @property
     def serializer(self) -> Serializer:

authentik/blueprints/tests/__init__.py

@@ -5,7 +5,7 @@ from typing import Callable
 
 from django.apps import apps
 
-from authentik.blueprints.manager import ManagedAppConfig
+from authentik.blueprints.apps import ManagedAppConfig
 from authentik.blueprints.models import BlueprintInstance
 from authentik.lib.config import CONFIG
 

authentik/blueprints/tests/test_oci.py

@@ -0,0 +1,97 @@
+"""Test blueprints OCI"""
+from django.test import TransactionTestCase
+from requests_mock import Mocker
+
+from authentik.blueprints.models import OCI_MEDIA_TYPE, BlueprintInstance, BlueprintRetrievalFailed
+
+
+class TestBlueprintOCI(TransactionTestCase):
+    """Test Blueprints OCI Tasks"""
+
+    def test_successful(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE,
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            mocker.get("https://ghcr.io/v2/goauthentik/blueprints/test/blobs/foo", text="foo")
+
+            self.assertEqual(
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci(),
+                "foo",
+            )
+
+    def test_manifests_error(self):
+        """Test manifests request erroring"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest", status_code=401
+            )
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_manifests_error_response(self):
+        """Test manifests request erroring"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={"errors": ["foo"]},
+            )
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_no_matching_blob(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE + "foo",
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_blob_error(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE,
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            mocker.get("https://ghcr.io/v2/goauthentik/blueprints/test/blobs/foo", status_code=401)
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()

authentik/blueprints/tests/test_packaged.py

@@ -33,4 +33,6 @@ def blueprint_tester(file_name: Path) -> Callable:
 
 
 for blueprint_file in Path("blueprints/").glob("**/*.yaml"):
+    if "local" in str(blueprint_file):
+        continue
     setattr(TestPackaged, f"test_blueprint_{blueprint_file}", blueprint_tester(blueprint_file))

authentik/blueprints/v1/common.py

@@ -45,8 +45,8 @@ class BlueprintEntryState:
 class BlueprintEntry:
     """Single entry of a blueprint"""
 
-    identifiers: dict[str, Any]
     model: str
+    identifiers: dict[str, Any] = field(default_factory=dict)
     attrs: Optional[dict[str, Any]] = field(default_factory=dict)
 
     # pylint: disable=invalid-name
@@ -105,9 +105,9 @@ class Blueprint:
 
     version: int = field(default=1)
     entries: list[BlueprintEntry] = field(default_factory=list)
+    context: dict = field(default_factory=dict)
 
     metadata: Optional[BlueprintMetadata] = field(default=None)
-    context: Optional[dict] = field(default_factory=dict)
 
 
 class YAMLTag:
@@ -227,6 +227,7 @@ class BlueprintDumper(SafeDumper):
         self.add_representer(UUID, lambda self, data: self.represent_str(str(data)))
         self.add_representer(OrderedDict, lambda self, data: self.represent_dict(dict(data)))
         self.add_representer(Enum, lambda self, data: self.represent_str(data.value))
+        self.add_representer(None, lambda self, data: self.represent_str(str(data)))
 
     def represent(self, data) -> None:
         if is_dataclass(data):
@@ -253,3 +254,9 @@ class BlueprintLoader(SafeLoader):
 
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
+
+    serializer_errors: Optional[dict]
+
+    def __init__(self, *args: object, serializer_errors: Optional[dict] = None) -> None:
+        super().__init__(*args)
+        self.serializer_errors = serializer_errors

authentik/blueprints/v1/exporter.py

@@ -1,11 +1,13 @@
 """Blueprint exporter"""
-from typing import Iterator
+from typing import Iterable
 from uuid import UUID
 
 from django.apps import apps
-from django.db.models import Q
+from django.contrib.auth import get_user_model
+from django.db.models import Model, Q, QuerySet
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
+from guardian.shortcuts import get_anonymous_user
 from yaml import dump
 
 from authentik.blueprints.v1.common import (
@@ -16,8 +18,8 @@ from authentik.blueprints.v1.common import (
 )
 from authentik.blueprints.v1.importer import is_model_allowed
 from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_GENERATED
+from authentik.events.models import Event
 from authentik.flows.models import Flow, FlowStageBinding, Stage
-from authentik.lib.models import SerializerModel
 from authentik.policies.models import Policy, PolicyBinding
 from authentik.stages.prompt.models import PromptStage
 
@@ -25,23 +27,30 @@ from authentik.stages.prompt.models import PromptStage
 class Exporter:
     """Export flow with attached stages into yaml"""
 
-    excluded_models = []
+    excluded_models: list[type[Model]] = []
 
     def __init__(self):
-        self.excluded_models = []
+        self.excluded_models = [
+            Event,
+        ]
 
-    def get_entries(self) -> Iterator[BlueprintEntry]:
+    def get_entries(self) -> Iterable[BlueprintEntry]:
         """Get blueprint entries"""
         for model in apps.get_models():
             if not is_model_allowed(model):
                 continue
             if model in self.excluded_models:
                 continue
-            if SerializerModel not in model.__mro__:
-                continue
-            for obj in model.objects.all():
+            for obj in self.get_model_instances(model):
                 yield BlueprintEntry.from_model(obj)
 
+    def get_model_instances(self, model: type[Model]) -> QuerySet:
+        """Return a queryset for `model`. Can be used to filter some
+        objects on some models"""
+        if model == get_user_model():
+            return model.objects.exclude(pk=get_anonymous_user().pk)
+        return model.objects.all()
+
     def _pre_export(self, blueprint: Blueprint):
         """Hook to run anything pre-export"""
 
@@ -87,7 +96,7 @@ class FlowExporter(Exporter):
             "pbm_uuid", flat=True
         )
 
-    def walk_stages(self) -> Iterator[BlueprintEntry]:
+    def walk_stages(self) -> Iterable[BlueprintEntry]:
         """Convert all stages attached to self.flow into BlueprintEntry objects"""
         stages = Stage.objects.filter(flow=self.flow).select_related().select_subclasses()
         for stage in stages:
@@ -95,13 +104,13 @@ class FlowExporter(Exporter):
                 pass
             yield BlueprintEntry.from_model(stage, "name")
 
-    def walk_stage_bindings(self) -> Iterator[BlueprintEntry]:
+    def walk_stage_bindings(self) -> Iterable[BlueprintEntry]:
         """Convert all bindings attached to self.flow into BlueprintEntry objects"""
         bindings = FlowStageBinding.objects.filter(target=self.flow).select_related()
         for binding in bindings:
             yield BlueprintEntry.from_model(binding, "target", "stage", "order")
 
-    def walk_policies(self) -> Iterator[BlueprintEntry]:
+    def walk_policies(self) -> Iterable[BlueprintEntry]:
         """Walk over all policies. This is done at the beginning of the export for stages that have
         a direct foreign key to a policy."""
         # Special case for PromptStage as that has a direct M2M to policy, we have to ensure
@@ -112,21 +121,21 @@ class FlowExporter(Exporter):
         for policy in policies:
             yield BlueprintEntry.from_model(policy)
 
-    def walk_policy_bindings(self) -> Iterator[BlueprintEntry]:
+    def walk_policy_bindings(self) -> Iterable[BlueprintEntry]:
         """Walk over all policybindings relative to us. This is run at the end of the export, as
         we are sure all objects exist now."""
         bindings = PolicyBinding.objects.filter(target__in=self.pbm_uuids).select_related()
         for binding in bindings:
             yield BlueprintEntry.from_model(binding, "policy", "target", "order")
 
-    def walk_stage_prompts(self) -> Iterator[BlueprintEntry]:
+    def walk_stage_prompts(self) -> Iterable[BlueprintEntry]:
         """Walk over all prompts associated with any PromptStages"""
         prompt_stages = PromptStage.objects.filter(flow=self.flow)
         for stage in prompt_stages:
             for prompt in stage.fields.all():
                 yield BlueprintEntry.from_model(prompt)
 
-    def get_entries(self) -> Iterator[BlueprintEntry]:
+    def get_entries(self) -> Iterable[BlueprintEntry]:
         entries = []
         entries.append(BlueprintEntry.from_model(self.flow, "slug"))
         if self.with_stage_prompts:

authentik/blueprints/v1/importer.py

@@ -3,10 +3,9 @@ from contextlib import contextmanager
 from copy import deepcopy
 from typing import Any, Optional
 
-from dacite import from_dict
+from dacite.core import from_dict
 from dacite.exceptions import DaciteError
 from deepmerge import always_merger
-from django.apps import apps
 from django.db import transaction
 from django.db.models import Model
 from django.db.models.query_utils import Q
@@ -25,6 +24,7 @@ from authentik.blueprints.v1.common import (
     BlueprintLoader,
     EntryInvalidError,
 )
+from authentik.blueprints.v1.meta.registry import BaseMetaModel, registry
 from authentik.core.models import (
     AuthenticatedSession,
     PropertyMapping,
@@ -59,7 +59,7 @@ def is_model_allowed(model: type[Model]) -> bool:
         # Classes that have other dependencies
         AuthenticatedSession,
     )
-    return model not in excluded_models
+    return model not in excluded_models and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 @contextmanager
@@ -138,10 +138,20 @@ class Importer:
     def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer:
         """Validate a single entry"""
         model_app_label, model_name = entry.model.split(".")
-        model: type[SerializerModel] = apps.get_model(model_app_label, model_name)
+        model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
         # Don't use isinstance since we don't want to check for inheritance
         if not is_model_allowed(model):
             raise EntryInvalidError(f"Model {model} not allowed")
+        if issubclass(model, BaseMetaModel):
+            serializer_class: type[Serializer] = model.serializer()
+            serializer = serializer_class(data=entry.get_attrs(self.__import))
+            try:
+                serializer.is_valid(raise_exception=True)
+            except ValidationError as exc:
+                raise EntryInvalidError(
+                    f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
+                ) from exc
+            return serializer
         if entry.identifiers == {}:
             raise EntryInvalidError("No identifiers")
 
@@ -158,7 +168,7 @@ class Importer:
         existing_models = model.objects.filter(self.__query_from_identifier(updated_identifiers))
 
         serializer_kwargs = {}
-        if existing_models.exists():
+        if not isinstance(model(), BaseMetaModel) and existing_models.exists():
             model_instance = existing_models.first()
             self.logger.debug(
                 "initialise serializer with instance",
@@ -169,13 +179,18 @@ class Importer:
             serializer_kwargs["instance"] = model_instance
             serializer_kwargs["partial"] = True
         else:
-            self.logger.debug("initialise new instance", model=model, **updated_identifiers)
+            self.logger.debug(
+                "initialised new serializer instance", model=model, **updated_identifiers
+            )
             model_instance = model()
             # pk needs to be set on the model instance otherwise a new one will be generated
             if "pk" in updated_identifiers:
                 model_instance.pk = updated_identifiers["pk"]
             serializer_kwargs["instance"] = model_instance
-        full_data = self.__update_pks_for_attrs(entry.get_attrs(self.__import))
+        try:
+            full_data = self.__update_pks_for_attrs(entry.get_attrs(self.__import))
+        except ValueError as exc:
+            raise EntryInvalidError(exc) from exc
         full_data.update(updated_identifiers)
         serializer_kwargs["data"] = full_data
 
@@ -183,7 +198,9 @@ class Importer:
         try:
             serializer.is_valid(raise_exception=True)
         except ValidationError as exc:
-            raise EntryInvalidError(f"Serializer errors {serializer.errors}") from exc
+            raise EntryInvalidError(
+                f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
+            ) from exc
         return serializer
 
     def apply(self) -> bool:
@@ -205,7 +222,7 @@ class Importer:
         for entry in self.__import.entries:
             model_app_label, model_name = entry.model.split(".")
             try:
-                model: SerializerModel = apps.get_model(model_app_label, model_name)
+                model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
             except LookupError:
                 self.logger.warning(
                     "app or model does not exist", app=model_app_label, model=model_name
@@ -215,14 +232,14 @@ class Importer:
             try:
                 serializer = self._validate_single(entry)
             except EntryInvalidError as exc:
-                self.logger.warning("entry invalid", entry=entry, error=exc)
+                self.logger.warning(f"entry invalid: {exc}", entry=entry, error=exc)
                 return False
 
             model = serializer.save()
             if "pk" in entry.identifiers:
                 self.__pk_map[entry.identifiers["pk"]] = model.pk
             entry._state = BlueprintEntryState(model)
-            self.logger.debug("updated model", model=model, pk=model.pk)
+            self.logger.debug("updated model", model=model)
         return True
 
     def validate(self) -> tuple[bool, list[EventDict]]:
@@ -239,8 +256,8 @@ class Importer:
         ):
             successful = self._apply_models()
             if not successful:
-                self.logger.debug("blueprint validation failed")
+                self.logger.debug("Blueprint validation failed")
         for log in logs:
-            self.logger.debug(**log)
+            getattr(self.logger, log.get("log_level"))(**log)
         self.__import = orig_import
         return successful, logs

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -0,0 +1,60 @@
+"""Apply Blueprint meta model"""
+from typing import TYPE_CHECKING
+
+from rest_framework.exceptions import ValidationError
+from rest_framework.fields import BooleanField, JSONField
+from structlog.stdlib import get_logger
+
+from authentik.blueprints.v1.meta.registry import BaseMetaModel, MetaResult, registry
+from authentik.core.api.utils import PassiveSerializer, is_dict
+
+if TYPE_CHECKING:
+    from authentik.blueprints.models import BlueprintInstance
+
+LOGGER = get_logger()
+
+
+class ApplyBlueprintMetaSerializer(PassiveSerializer):
+    """Serializer for meta apply blueprint model"""
+
+    identifiers = JSONField(validators=[is_dict])
+    required = BooleanField(default=True)
+
+    # We cannot override `instance` as that will confuse rest_framework
+    # and make it attempt to update the instance
+    blueprint_instance: "BlueprintInstance"
+
+    def validate(self, attrs):
+        from authentik.blueprints.models import BlueprintInstance
+
+        identifiers = attrs["identifiers"]
+        required = attrs["required"]
+        instance = BlueprintInstance.objects.filter(**identifiers).first()
+        if not instance and required:
+            raise ValidationError("Required blueprint does not exist")
+        self.blueprint_instance = instance
+        return super().validate(attrs)
+
+    def create(self, validated_data: dict) -> MetaResult:
+        from authentik.blueprints.v1.tasks import apply_blueprint
+
+        if not self.blueprint_instance:
+            LOGGER.info("Blueprint does not exist, but not required")
+            return MetaResult()
+        LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
+        # pylint: disable=no-value-for-parameter
+        apply_blueprint(str(self.blueprint_instance.pk))
+        return MetaResult()
+
+
+@registry.register("metaapplyblueprint")
+class MetaApplyBlueprint(BaseMetaModel):
+    """Meta model to apply another blueprint"""
+
+    @staticmethod
+    def serializer() -> ApplyBlueprintMetaSerializer:
+        return ApplyBlueprintMetaSerializer
+
+    class Meta:
+
+        abstract = True

authentik/blueprints/v1/meta/registry.py

@@ -0,0 +1,61 @@
+"""Base models"""
+from django.apps import apps
+from django.db.models import Model
+from rest_framework.serializers import Serializer
+
+
+class BaseMetaModel(Model):
+    """Base models"""
+
+    @staticmethod
+    def serializer() -> Serializer:
+        """Serializer similar to SerializerModel, but as a static method since
+        this is an abstract model"""
+        raise NotImplementedError
+
+    class Meta:
+
+        abstract = True
+
+
+class MetaResult:
+    """Result returned by Meta Models' serializers. Empty class but we can't return none as
+    the framework doesn't allow that"""
+
+
+class MetaModelRegistry:
+    """Registry for pseudo meta models"""
+
+    models: dict[str, BaseMetaModel]
+    virtual_prefix: str
+
+    def __init__(self, prefix: str) -> None:
+        self.models = {}
+        self.virtual_prefix = prefix
+
+    def register(self, model_id: str):
+        """Register model class under `model_id`"""
+
+        def inner_wrapper(cls):
+            self.models[model_id] = cls
+            return cls
+
+        return inner_wrapper
+
+    def get_models(self):
+        """Wrapper for django's `get_models` to list all models"""
+        models = apps.get_models()
+        for _, value in self.models.items():
+            models.append(value)
+        return models
+
+    def get_model(self, app_label: str, model_id: str) -> type[Model]:
+        """Get model checks if any virtual models are registered, and falls back
+        to actual django models"""
+        if app_label.lower() == self.virtual_prefix:
+            if model_id.lower() in self.models:
+                return self.models[model_id]
+        return apps.get_model(app_label, model_id)
+
+
+registry = MetaModelRegistry("authentik_blueprints")

authentik/blueprints/v1/tasks.py

@@ -4,8 +4,9 @@ from hashlib import sha512
 from pathlib import Path
 from typing import Optional
 
-from dacite import from_dict
+from dacite.core import from_dict
 from django.db import DatabaseError, InternalError, ProgrammingError
+from django.utils.text import slugify
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from structlog.stdlib import get_logger
@@ -17,7 +18,7 @@ from authentik.blueprints.models import (
     BlueprintInstanceStatus,
     BlueprintRetrievalFailed,
 )
-from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata
+from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata, EntryInvalidError
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_INSTANTIATE
 from authentik.events.monitored_tasks import (
@@ -76,7 +77,9 @@ def blueprints_find():
                 LOGGER.warning("invalid blueprint version", version=version, path=str(path))
                 continue
         file_hash = sha512(path.read_bytes()).hexdigest()
-        blueprint = BlueprintFile(path.relative_to(root), version, file_hash, path.stat().st_mtime)
+        blueprint = BlueprintFile(
+            str(path.relative_to(root)), version, file_hash, int(path.stat().st_mtime)
+        )
         blueprint.meta = from_dict(BlueprintMetadata, metadata) if metadata else None
         blueprints.append(blueprint)
         LOGGER.info(
@@ -125,9 +128,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
         )
         instance.save()
     if instance.last_applied_hash != blueprint.hash:
-        instance.metadata = asdict(blueprint.meta) if blueprint.meta else {}
-        instance.save()
-        apply_blueprint.delay(instance.pk.hex)
+        apply_blueprint.delay(str(instance.pk))
 
 
 @CELERY_APP.task(
@@ -136,15 +137,18 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 )
 def apply_blueprint(self: MonitoredTask, instance_pk: str):
     """Apply single blueprint"""
-    self.set_uid(instance_pk)
     self.save_on_success = False
+    instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
+        self.set_uid(slugify(instance.name))
         if not instance or not instance.enabled:
             return
         blueprint_content = instance.retrieve()
         file_hash = sha512(blueprint_content.encode()).hexdigest()
         importer = Importer(blueprint_content, instance.context)
+        if importer.blueprint.metadata:
+            instance.metadata = asdict(importer.blueprint.metadata)
         valid, logs = importer.validate()
         if not valid:
             instance.status = BlueprintInstanceStatus.ERROR
@@ -160,7 +164,6 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
         instance.status = BlueprintInstanceStatus.SUCCESSFUL
         instance.last_applied_hash = file_hash
         instance.last_applied = now()
-        instance.save()
         self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
     except (
         DatabaseError,
@@ -168,7 +171,11 @@ def apply_blueprint(self: MonitoredTask, instance_pk: str):
         InternalError,
         IOError,
         BlueprintRetrievalFailed,
+        EntryInvalidError,
     ) as exc:
-        instance.status = BlueprintInstanceStatus.ERROR
-        instance.save()
+        if instance:
+            instance.status = BlueprintInstanceStatus.ERROR
         self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
+    finally:
+        if instance:
+            instance.save()

authentik/core/api/applications.py

@@ -50,7 +50,9 @@ class ApplicationSerializer(ModelSerializer):
 
     def get_launch_url(self, app: Application) -> Optional[str]:
         """Allow formatting of launch URL"""
-        user = self.context["request"].user
+        user = None
+        if "request" in self.context:
+            user = self.context["request"].user
         return app.get_launch_url(user)
 
     class Meta:
@@ -230,7 +232,11 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             return Response({})
         if icon:
             app.meta_icon = icon
-            app.save()
+            try:
+                app.save()
+            except PermissionError as exc:
+                LOGGER.warning("Failed to save icon", exc=exc)
+                return HttpResponseBadRequest()
             return Response({})
         return HttpResponseBadRequest()
 

authentik/core/api/propertymappings.py

@@ -17,7 +17,7 @@ from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
-from authentik.core.expression import PropertyMappingEvaluator
+from authentik.core.expression.evaluator import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
@@ -41,7 +41,9 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
 
     def validate_expression(self, expression: str) -> str:
         """Test Syntax"""
-        evaluator = PropertyMappingEvaluator()
+        evaluator = PropertyMappingEvaluator(
+            self.instance,
+        )
         evaluator.validate(expression)
         return expression
 

authentik/core/apps.py

@@ -1,7 +1,7 @@
 """authentik core app config"""
 from django.conf import settings
 
-from authentik.blueprints.manager import ManagedAppConfig
+from authentik.blueprints.apps import ManagedAppConfig
 
 
 class AuthentikCoreConfig(ManagedAppConfig):

authentik/core/expression/evaluator.py

@@ -2,28 +2,32 @@
 from traceback import format_tb
 from typing import Optional
 
+from django.db.models import Model
 from django.http import HttpRequest
-from guardian.utils import get_anonymous_user
 
-from authentik.core.models import PropertyMapping, User
+from authentik.core.models import User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
 from authentik.policies.types import PolicyRequest
 
 
 class PropertyMappingEvaluator(BaseEvaluator):
-    """Custom Evalautor that adds some different context variables."""
+    """Custom Evaluator that adds some different context variables."""
 
-    def set_context(
+    def __init__(
         self,
-        user: Optional[User],
-        request: Optional[HttpRequest],
-        mapping: PropertyMapping,
+        model: Model,
+        user: Optional[User] = None,
+        request: Optional[HttpRequest] = None,
         **kwargs,
     ):
-        """Update context with context from PropertyMapping's evaluate"""
-        req = PolicyRequest(user=get_anonymous_user())
-        req.obj = mapping
+        if hasattr(model, "name"):
+            _filename = model.name
+        else:
+            _filename = str(model)
+        super().__init__(filename=_filename)
+        req = PolicyRequest(user=User())
+        req.obj = model
         if user:
             req.user = user
             self._context["user"] = user

authentik/core/management/commands/shell.py

@@ -7,9 +7,9 @@ from django.core.management.base import BaseCommand
 from django.db.models import Model
 from django.db.models.signals import post_save, pre_delete
 
-from authentik import __version__
+from authentik import get_full_version
 from authentik.core.models import User
-from authentik.events.middleware import IGNORED_MODELS
+from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
@@ -18,7 +18,7 @@ BANNER_TEXT = """### authentik shell ({authentik})
     node=platform.node(),
     python=platform.python_version(),
     arch=platform.machine(),
-    authentik=__version__,
+    authentik=get_full_version(),
 )
 
 
@@ -50,7 +50,7 @@ class Command(BaseCommand):
     # pylint: disable=unused-argument
     def post_save_handler(sender, instance: Model, created: bool, **_):
         """Signal handler for all object's post_save"""
-        if isinstance(instance, IGNORED_MODELS):
+        if not should_log_model(instance):
             return
 
         action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
@@ -66,7 +66,7 @@ class Command(BaseCommand):
     # pylint: disable=unused-argument
     def pre_delete_handler(sender, instance: Model, **_):
         """Signal handler for all object's pre_delete"""
-        if isinstance(instance, IGNORED_MODELS):  # pragma: no cover
+        if not should_log_model(instance):  # pragma: no cover
             return
 
         Event.new(EventAction.MODEL_DELETED, model=model_to_dict(instance)).set_user(

authentik/core/middleware.py

@@ -1,6 +1,6 @@
 """authentik admin Middleware to impersonate users"""
 from contextvars import ContextVar
-from typing import Callable
+from typing import Callable, Optional
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
@@ -13,9 +13,9 @@ RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
-CTX_REQUEST_ID = ContextVar(STRUCTLOG_KEY_PREFIX + "request_id", default=None)
-CTX_HOST = ContextVar(STRUCTLOG_KEY_PREFIX + "host", default=None)
-CTX_AUTH_VIA = ContextVar(STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
 
 
 class ImpersonateMiddleware:

authentik/core/migrations/0002_auto_20200523_1133.py

@@ -1,55 +0,0 @@
-# Generated by Django 3.0.6 on 2020-05-23 11:33
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_flows", "0003_auto_20200523_1133"),
-        ("authentik_core", "0001_initial"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="application",
-            name="skip_authorization",
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="authentication_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when authenticating existing users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_authentication",
-                to="authentik_flows.Flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="enrollment_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when enrolling new users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_enrollment",
-                to="authentik_flows.Flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="authorization_flow",
-            field=models.ForeignKey(
-                help_text="Flow used when authorizing this provider.",
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="provider_authorization",
-                to="authentik_flows.Flow",
-            ),
-        ),
-    ]

authentik/core/migrations/0003_default_user.py

@@ -1,57 +0,0 @@
-# Generated by Django 3.0.6 on 2020-05-23 16:40
-from os import environ
-
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from django.contrib.auth.hashers import make_password
-
-    User = apps.get_model("authentik_core", "User")
-    db_alias = schema_editor.connection.alias
-
-    akadmin, _ = User.objects.using(db_alias).get_or_create(
-        username="akadmin", email="root@localhost", name="authentik Default Admin"
-    )
-    password = None
-    if "TF_BUILD" in environ or settings.TEST:
-        password = "akadmin"  # noqa # nosec
-    if "AK_ADMIN_PASS" in environ:
-        password = environ["AK_ADMIN_PASS"]
-    if "AUTHENTIK_BOOTSTRAP_PASSWORD" in environ:
-        password = environ["AUTHENTIK_BOOTSTRAP_PASSWORD"]
-    if password:
-        akadmin.password = make_password(password)
-    else:
-        akadmin.password = make_password(None)
-    akadmin.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0002_auto_20200523_1133"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.RunPython(create_default_user),
-        migrations.AddField(
-            model_name="user",
-            name="is_superuser",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AddField(
-            model_name="user", name="is_staff", field=models.BooleanField(default=False)
-        ),
-    ]

authentik/core/migrations/0004_auto_20200703_2213.py

@@ -1,28 +0,0 @@
-# Generated by Django 3.0.7 on 2020-07-03 22:13
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0003_default_user"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="application",
-            options={
-                "verbose_name": "Application",
-                "verbose_name_plural": "Applications",
-            },
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (("reset_user_password", "Reset Password"),),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-    ]

authentik/core/migrations/0005_token_intent.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.0.7 on 2020-07-05 21:11
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0004_auto_20200703_2213"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]

authentik/core/migrations/0006_auto_20200709_1608.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.0.8 on 2020-07-09 16:08
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0005_token_intent"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="source",
-            name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
-        ),
-    ]

authentik/core/migrations/0007_auto_20200815_1841.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.1 on 2020-08-15 18:41
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0006_auto_20200709_1608"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="user",
-            name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
-        ),
-    ]

authentik/core/migrations/0008_auto_20200824_1532.py

@@ -1,36 +0,0 @@
-# Generated by Django 3.1 on 2020-08-24 15:32
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("auth", "0012_alter_user_first_name_max_length"),
-        ("authentik_core", "0007_auto_20200815_1841"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(
-                blank=True,
-                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
-                related_name="user_set",
-                related_query_name="user",
-                to="auth.Group",
-                verbose_name="groups",
-            ),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(to="authentik_core.Group"),
-        ),
-    ]

authentik/core/migrations/0009_group_is_superuser.py

@@ -1,59 +0,0 @@
-# Generated by Django 3.1.1 on 2020-09-15 19:53
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    User = apps.get_model("authentik_core", "User")
-
-    # Creates a default admin group
-    group, _ = Group.objects.using(db_alias).get_or_create(
-        is_superuser=True,
-        defaults={
-            "name": "authentik Admins",
-        },
-    )
-    group.users.set(User.objects.filter(username="akadmin"))
-    group.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0008_auto_20200824_1532"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.AlterField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="group",
-            name="is_superuser",
-            field=models.BooleanField(
-                default=False, help_text="Users added to this group will be superusers."
-            ),
-        ),
-        migrations.RunPython(create_default_admin_group),
-        migrations.AlterModelManagers(
-            name="user",
-            managers=[
-                ("objects", authentik.core.models.UserManager()),
-            ],
-        ),
-    ]

authentik/core/migrations/0010_auto_20200917_1021.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.1.1 on 2020-09-17 10:21
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0009_group_is_superuser"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (
-                    ("reset_user_password", "Reset Password"),
-                    ("impersonate", "Can impersonate other users"),
-                ),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-    ]

authentik/core/migrations/0011_provider_name_temp.py

@@ -1,19 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 17:34
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0010_auto_20200917_1021"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="provider",
-            name="name_temp",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-    ]

authentik/core/migrations/0012_auto_20201003_1737.py

@@ -1,20 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 17:37
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0011_provider_name_temp"),
-        ("authentik_providers_oauth2", "0006_remove_oauth2provider_name"),
-        ("authentik_providers_saml", "0006_remove_samlprovider_name"),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="provider",
-            old_name="name_temp",
-            new_name="name",
-        ),
-    ]

authentik/core/migrations/0013_auto_20201003_2132.py

@@ -1,35 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 21:32
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0012_auto_20201003_1737"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="token",
-            name="identifier",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                ],
-                default="verification",
-            ),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together={("identifier", "user")},
-        ),
-    ]

authentik/core/migrations/0014_auto_20201018_1158.py

@@ -1,48 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-18 11:58
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def set_default_token_key(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "Token")
-
-    for token in Token.objects.using(db_alias).all():
-        token.key = token.pk.hex
-        token.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0013_auto_20201003_2132"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="token",
-            name="key",
-            field=models.TextField(default=authentik.core.models.default_token_key),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together=set(),
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_co_key_e45007_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
-        ),
-        migrations.RunPython(set_default_token_key),
-    ]

authentik/core/migrations/0015_application_icon.py

@@ -1,22 +0,0 @@
-# Generated by Django 3.1.3 on 2020-11-23 17:19
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0014_auto_20201018_1158"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="application",
-            name="meta_icon_url",
-        ),
-        migrations.AddField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
-        ),
-    ]

authentik/core/migrations/0016_auto_20201202_2234.py

@@ -1,34 +0,0 @@
-# Generated by Django 3.1.3 on 2020-12-02 22:34
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0015_application_icon"),
-    ]
-
-    operations = [
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_key_e45007_idx",
-        ),
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_identif_1a34a8_idx",
-        ),
-        migrations.RenameField(
-            model_name="user",
-            old_name="pb_groups",
-            new_name="ak_groups",
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_c_key_f71355_idx"),
-        ),
-    ]

authentik/core/migrations/0018_auto_20210330_1345.py

@@ -1,21 +0,0 @@
-# Generated by Django 3.1.7 on 2021-03-30 13:45
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0017_managed"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="token",
-            options={
-                "permissions": (("view_token_key", "View token's key"),),
-                "verbose_name": "Token",
-                "verbose_name_plural": "Tokens",
-            },
-        ),
-    ]

authentik/core/migrations/0019_source_managed.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.2 on 2021-04-09 14:06
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0018_auto_20210330_1345"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="source",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                unique=True,
-                verbose_name="Managed by authentik",
-            ),
-        ),
-    ]

authentik/core/migrations/0020_source_user_matching_mode.py

@@ -1,40 +0,0 @@
-# Generated by Django 3.2 on 2021-05-03 17:06
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0019_source_managed"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="source",
-            name="user_matching_mode",
-            field=models.TextField(
-                choices=[
-                    ("identifier", "Use the source-specific identifier"),
-                    (
-                        "email_link",
-                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
-                    ),
-                    (
-                        "email_deny",
-                        "Use the user's email address, but deny enrollment when the email address already exists.",
-                    ),
-                    (
-                        "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
-                    ),
-                    (
-                        "username_deny",
-                        "Use the user's username, but deny enrollment when the username already exists.",
-                    ),
-                ],
-                default="identifier",
-                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
-            ),
-        ),
-    ]

authentik/core/migrations/0021_alter_application_slug.py

@@ -1,20 +0,0 @@
-# Generated by Django 3.2.3 on 2021-05-14 08:48
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0020_source_user_matching_mode"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="slug",
-            field=models.SlugField(
-                help_text="Internal application name, used in URLs.", unique=True
-            ),
-        ),
-    ]

authentik/core/migrations/0022_authenticatedsession.py

@@ -1,58 +0,0 @@
-# Generated by Django 3.2.3 on 2021-05-29 22:14
-
-import uuid
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from django.contrib.sessions.backends.cache import KEY_PREFIX
-    from django.core.cache import cache
-
-    session_keys = cache.keys(KEY_PREFIX + "*")
-    cache.delete_many(session_keys)
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0021_alter_application_slug"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="AuthenticatedSession",
-            fields=[
-                (
-                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
-                ),
-                ("expiring", models.BooleanField(default=True)),
-                (
-                    "uuid",
-                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
-                ),
-                ("session_key", models.CharField(max_length=40)),
-                ("last_ip", models.TextField()),
-                ("last_user_agent", models.TextField(blank=True)),
-                ("last_used", models.DateTimeField(auto_now=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-            },
-        ),
-        migrations.RunPython(migrate_sessions),
-    ]

authentik/core/migrations/0023_alter_application_meta_launch_url.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-02 21:51
-
-from django.db import migrations, models
-
-import authentik.lib.models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0022_authenticatedsession"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_launch_url",
-            field=models.TextField(
-                blank=True,
-                default="",
-                validators=[authentik.lib.models.DomainlessURLValidator()],
-            ),
-        ),
-    ]

authentik/core/migrations/0023_source_authentik_c_slug_ccb2e5_idx_and_more.py

@@ -0,0 +1,21 @@
+# Generated by Django 4.1.2 on 2022-10-19 18:57
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0022_alter_group_parent"),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="source",
+            index=models.Index(fields=["slug"], name="authentik_c_slug_ccb2e5_idx"),
+        ),
+        migrations.AddIndex(
+            model_name="source",
+            index=models.Index(fields=["name"], name="authentik_c_name_affae6_idx"),
+        ),
+    ]

authentik/core/migrations/0024_alter_token_identifier.py

@@ -1,35 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-03 09:33
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-from django.db.models import Count
-
-
-def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "token")
-    identifiers = (
-        Token.objects.using(db_alias)
-        .values("identifier")
-        .annotate(identifier_count=Count("identifier"))
-        .filter(identifier_count__gt=1)
-    )
-    for ident in identifiers:
-        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0023_alter_application_meta_launch_url"),
-    ]
-
-    operations = [
-        migrations.RunPython(fix_duplicates),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255, unique=True),
-        ),
-    ]

authentik/core/migrations/0025_alter_application_meta_icon.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-05 19:04
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0024_alter_token_identifier"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
-        ),
-    ]

authentik/core/migrations/0026_alter_application_meta_icon.py

@@ -1,27 +0,0 @@
-# Generated by Django 3.2.5 on 2021-07-09 17:27
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0025_alter_application_meta_icon"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(
-                default=None, max_length=500, null=True, upload_to="application-icons/"
-            ),
-        ),
-        migrations.AlterModelOptions(
-            name="authenticatedsession",
-            options={
-                "verbose_name": "Authenticated Session",
-                "verbose_name_plural": "Authenticated Sessions",
-            },
-        ),
-    ]

authentik/core/migrations/0027_bootstrap_token.py

@@ -1,44 +0,0 @@
-# Generated by Django 3.2.5 on 2021-08-11 19:40
-from os import environ
-
-from django.apps.registry import Apps
-from django.db import migrations
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from authentik.core.models import TokenIntents
-
-    User = apps.get_model("authentik_core", "User")
-    Token = apps.get_model("authentik_core", "Token")
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    key = None
-    if "AK_ADMIN_TOKEN" in environ:
-        key = environ["AK_ADMIN_TOKEN"]
-    if "AUTHENTIK_BOOTSTRAP_TOKEN" in environ:
-        key = environ["AUTHENTIK_BOOTSTRAP_TOKEN"]
-    if not key:
-        return
-    Token.objects.using(db_alias).create(
-        identifier="authentik-bootstrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=key,
-    )
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0026_alter_application_meta_icon"),
-    ]
-
-    operations = [
-        migrations.RunPython(create_default_user_token),
-    ]

authentik/core/migrations/0028_alter_token_intent.py

@@ -1,26 +0,0 @@
-# Generated by Django 3.2.6 on 2021-08-23 14:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0027_bootstrap_token"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                    ("app_password", "Intent App Password"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]

authentik/core/models.py

@@ -472,6 +472,21 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     def __str__(self):
         return self.name
 
+    class Meta:
+
+        indexes = [
+            models.Index(
+                fields=[
+                    "slug",
+                ]
+            ),
+            models.Index(
+                fields=[
+                    "name",
+                ]
+            ),
+        ]
+
 
 class UserSourceConnection(SerializerModel, CreatedUpdatedModel):
     """Connection between User and Source."""
@@ -617,10 +632,9 @@ class PropertyMapping(SerializerModel, ManagedModel):
 
     def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
-        from authentik.core.expression import PropertyMappingEvaluator
+        from authentik.core.expression.evaluator import PropertyMappingEvaluator
 
-        evaluator = PropertyMappingEvaluator()
-        evaluator.set_context(user, request, self, **kwargs)
+        evaluator = PropertyMappingEvaluator(self, user, request, **kwargs)
         try:
             return evaluator.evaluate(self.expression)
         except Exception as exc:

authentik/core/templates/base/header_js.html

@@ -0,0 +1,20 @@
+<script>
+    window.authentik = {};
+    window.authentik.locale = "{{ tenant.default_locale }}";
+    window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
+    window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
+    window.addEventListener("DOMContentLoaded", () => {
+        {% for message in messages %}
+        window.dispatchEvent(
+            new CustomEvent("ak-message", {
+                bubbles: true,
+                composed: true,
+                detail: {
+                    level: "{{ message.tags|escapejs }}",
+                    message: "{{ message.message|escapejs }}",
+                },
+            }),
+        );
+        {% endfor %}
+    });
+</script>

authentik/core/templates/error/generic.html

@@ -1,31 +0,0 @@
-{% extends 'base/skeleton.html' %}
-
-{% load i18n %}
-
-{% block head %}
-{{ block.super }}
-<style>
-    .pf-c-empty-state {
-        height: 100vh;
-    }
-</style>
-{% endblock %}
-
-{% block body %}
-<section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
-    <div class="pf-c-empty-state">
-        <div class="pf-c-empty-state__content">
-            <i class="fas fa-exclamation-circle pf-c-empty-state__icon" aria-hidden="true"></i>
-            <h1 class="pf-c-title pf-m-lg">
-                {% trans title %}
-            </h1>
-            <div class="pf-c-empty-state__body">
-                {% if message %}
-                <h3>{% trans message %}</h3>
-                {% endif %}
-            </div>
-            <a href="/" class="pf-c-button pf-m-primary pf-m-block">{% trans 'Go to home' %}</a>
-        </div>
-    </div>
-</section>
-{% endblock %}

authentik/core/templates/if/admin.html

@@ -4,15 +4,12 @@
 {% load i18n %}
 
 {% block head %}
-<script src="{% static 'dist/admin/AdminInterface.js' %}" type="module"></script>
+<script src="{% static 'dist/admin/AdminInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#18191a" media="(prefers-color-scheme: dark)">
 <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
-<script>
-window.authentik = {};
-window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
-</script>
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
+{% include "base/header_js.html" %}
 {% endblock %}
 
 {% block body %}

authentik/core/templates/if/error.html

@@ -0,0 +1,21 @@
+{% extends 'login/base_full.html' %}
+
+{% load static %}
+{% load i18n %}
+
+{% block title %}
+{{ tenant.branding_title }}
+{% endblock %}
+
+{% block card_title %}
+{% trans title %}
+{% endblock %}
+
+{% block card %}
+<form method="POST" class="pf-c-form">
+    <p>{% trans message %}</p>
+    <a id="ak-back-home" href="{% url 'authentik_core:root-redirect' %}" class="pf-c-button pf-m-primary">
+        {% trans 'Go home' %}
+    </a>
+</form>
+{% endblock %}

authentik/core/templates/if/flow.html

@@ -6,14 +6,13 @@
 {% block head_before %}
 {{ block.super }}
 <link rel="prefetch" href="{{ flow.background_url }}" />
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
 {% if flow.compatibility_mode and not inspector %}
 <script>ShadyDOM = { force: !navigator.webdriver };</script>
 {% endif %}
+{% include "base/header_js.html" %}
 <script>
-window.authentik = {};
-window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
 window.authentik.flow = {
     "layout": "{{ flow.layout }}",
 };
@@ -21,7 +20,7 @@ window.authentik.flow = {
 {% endblock %}
 
 {% block head %}
-<script src="{% static 'dist/flow/FlowInterface.js' %}" type="module"></script>
+<script src="{% static 'dist/flow/FlowInterface.js' %}?version={{ version }}" type="module"></script>
 <style>
 :root {
     --ak-flow-background: url("{{ flow.background_url }}");

authentik/core/templates/if/user.html

@@ -4,15 +4,12 @@
 {% load i18n %}
 
 {% block head %}
-<script src="{% static 'dist/user/UserInterface.js' %}" type="module"></script>
+<script src="{% static 'dist/user/UserInterface.js' %}?version={{ version }}" type="module"></script>
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: light)">
 <meta name="theme-color" content="#151515" media="(prefers-color-scheme: dark)">
-<script>
-window.authentik = {};
-window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
-</script>
+<link rel="icon" href="{{ tenant.branding_favicon }}">
+<link rel="shortcut icon" href="{{ tenant.branding_favicon }}">
+{% include "base/header_js.html" %}
 {% endblock %}
 
 {% block body %}

authentik/core/templates/login/base_full.html

@@ -6,6 +6,7 @@
 {% block head_before %}
 <link rel="prefetch" href="/static/dist/assets/images/flow_background.jpg" />
 <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}">
+{% include "base/header_js.html" %}
 {% endblock %}
 
 {% block head %}

authentik/core/tests/test_applications_api.py

@@ -5,8 +5,7 @@ from django.urls import reverse
 from rest_framework.test import APITestCase
 
 from authentik.core.models import Application
-from authentik.core.tests.utils import create_test_admin_user
-from authentik.flows.models import Flow
+from authentik.core.tests.utils import create_test_admin_user, create_test_flow
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.providers.oauth2.models import OAuth2Provider
@@ -20,10 +19,7 @@ class TestApplicationsAPI(APITestCase):
         self.provider = OAuth2Provider.objects.create(
             name="test",
             redirect_uris="http://some-other-domain",
-            authorization_flow=Flow.objects.create(
-                name="test",
-                slug="test",
-            ),
+            authorization_flow=create_test_flow(),
         )
         self.allowed = Application.objects.create(
             name="allowed",

authentik/core/tests/test_applications_views.py

@@ -4,8 +4,7 @@ from unittest.mock import MagicMock, patch
 from django.urls import reverse
 
 from authentik.core.models import Application
-from authentik.core.tests.utils import create_test_admin_user, create_test_tenant
-from authentik.flows.models import Flow, FlowDesignation
+from authentik.core.tests.utils import create_test_admin_user, create_test_flow, create_test_tenant
 from authentik.flows.tests import FlowTestCase
 from authentik.tenants.models import Tenant
 
@@ -21,11 +20,7 @@ class TestApplicationsViews(FlowTestCase):
 
     def test_check_redirect(self):
         """Test redirect"""
-        empty_flow = Flow.objects.create(
-            name="foo",
-            slug="foo",
-            designation=FlowDesignation.AUTHENTICATION,
-        )
+        empty_flow = create_test_flow()
         tenant: Tenant = create_test_tenant()
         tenant.flow_authentication = empty_flow
         tenant.save()
@@ -49,11 +44,7 @@ class TestApplicationsViews(FlowTestCase):
     def test_check_redirect_auth(self):
         """Test redirect"""
         self.client.force_login(self.user)
-        empty_flow = Flow.objects.create(
-            name="foo",
-            slug="foo",
-            designation=FlowDesignation.AUTHENTICATION,
-        )
+        empty_flow = create_test_flow()
         tenant: Tenant = create_test_tenant()
         tenant.flow_authentication = empty_flow
         tenant.save()

authentik/core/tests/test_source_flow_manager.py

@@ -6,7 +6,7 @@ from guardian.utils import get_anonymous_user
 
 from authentik.core.models import SourceUserMatchingModes, User
 from authentik.core.sources.flow_manager import Action
-from authentik.flows.models import Flow, FlowDesignation
+from authentik.core.tests.utils import create_test_flow
 from authentik.lib.generators import generate_id
 from authentik.lib.tests.utils import get_request
 from authentik.policies.denied import AccessDeniedResponse
@@ -152,9 +152,7 @@ class TestSourceFlowManager(TestCase):
         """Test error handling when a source selected flow is non-applicable due to a policy"""
         self.source.user_matching_mode = SourceUserMatchingModes.USERNAME_LINK
 
-        flow = Flow.objects.create(
-            name="test", slug="test", title="test", designation=FlowDesignation.ENROLLMENT
-        )
+        flow = create_test_flow()
         policy = ExpressionPolicy.objects.create(
             name="false", expression="""ak_message("foo");return False"""
         )

authentik/core/tests/test_users_api.py

@@ -159,7 +159,6 @@ class TestUsersAPI(APITestCase):
         response = self.client.get(
             reverse("authentik_api:user-paths"),
         )
-        print(response.content)
         self.assertEqual(response.status_code, 200)
         self.assertJSONEqual(response.content.decode(), {"paths": ["users"]})
 

authentik/core/tests/utils.py

@@ -44,13 +44,15 @@ def create_test_tenant() -> Tenant:
     return Tenant.objects.create(domain=uid, default=True)
 
 
-def create_test_cert() -> CertificateKeyPair:
+def create_test_cert(use_ec_private_key=False) -> CertificateKeyPair:
     """Generate a certificate for testing"""
-    builder = CertificateBuilder()
+    builder = CertificateBuilder(
+        use_ec_private_key=use_ec_private_key,
+    )
     builder.common_name = "goauthentik.io"
     builder.build(
         subject_alt_names=["goauthentik.io"],
         validity_days=360,
     )
-    builder.name = generate_id()
+    builder.common_name = generate_id()
     return builder.save()

authentik/core/views/error.py

@@ -32,7 +32,7 @@ class BadRequestView(TemplateView):
     extra_context = {"title": "Bad Request"}
 
     response_class = BadRequestTemplateResponse
-    template_name = "error/generic.html"
+    template_name = "if/error.html"
 
 
 class ForbiddenView(TemplateView):
@@ -41,7 +41,7 @@ class ForbiddenView(TemplateView):
     extra_context = {"title": "Forbidden"}
 
     response_class = ForbiddenTemplateResponse
-    template_name = "error/generic.html"
+    template_name = "if/error.html"
 
 
 class NotFoundView(TemplateView):
@@ -50,7 +50,7 @@ class NotFoundView(TemplateView):
     extra_context = {"title": "Not Found"}
 
     response_class = NotFoundTemplateResponse
-    template_name = "error/generic.html"
+    template_name = "if/error.html"
 
 
 class ServerErrorView(TemplateView):
@@ -59,7 +59,7 @@ class ServerErrorView(TemplateView):
     extra_context = {"title": "Server Error"}
 
     response_class = ServerErrorTemplateResponse
-    template_name = "error/generic.html"
+    template_name = "if/error.html"
 
     # pylint: disable=useless-super-delegation
     def dispatch(self, *args, **kwargs):  # pragma: no cover

authentik/crypto/api.py

@@ -1,4 +1,5 @@
 """Crypto API Views"""
+from datetime import datetime
 from typing import Optional
 
 from cryptography.hazmat.backends import default_backend
@@ -12,10 +13,11 @@ from django_filters.filters import BooleanFilter
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField, DateTimeField, IntegerField, SerializerMethodField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer, ValidationError
+from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
@@ -33,7 +35,10 @@ LOGGER = get_logger()
 class CertificateKeyPairSerializer(ModelSerializer):
     """CertificateKeyPair Serializer"""
 
-    cert_expiry = DateTimeField(source="certificate.not_valid_after", read_only=True)
+    fingerprint_sha256 = SerializerMethodField()
+    fingerprint_sha1 = SerializerMethodField()
+
+    cert_expiry = SerializerMethodField()
     cert_subject = SerializerMethodField()
     private_key_available = SerializerMethodField()
     private_key_type = SerializerMethodField()
@@ -41,8 +46,35 @@ class CertificateKeyPairSerializer(ModelSerializer):
     certificate_download_url = SerializerMethodField()
     private_key_download_url = SerializerMethodField()
 
-    def get_cert_subject(self, instance: CertificateKeyPair) -> str:
+    @property
+    def _should_include_details(self) -> bool:
+        request: Request = self.context.get("request", None)
+        if not request:
+            return True
+        return str(request.query_params.get("include_details", "true")).lower() == "true"
+
+    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> Optional[str]:
+        "Get certificate Hash (SHA256)"
+        if not self._should_include_details:
+            return None
+        return instance.fingerprint_sha256
+
+    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> Optional[str]:
+        "Get certificate Hash (SHA1)"
+        if not self._should_include_details:
+            return None
+        return instance.fingerprint_sha1
+
+    def get_cert_expiry(self, instance: CertificateKeyPair) -> Optional[datetime]:
+        "Get certificate expiry"
+        if not self._should_include_details:
+            return None
+        return DateTimeField().to_representation(instance.certificate.not_valid_after)
+
+    def get_cert_subject(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get certificate subject as full rfc4514"""
+        if not self._should_include_details:
+            return None
         return instance.certificate.subject.rfc4514_string()
 
     def get_private_key_available(self, instance: CertificateKeyPair) -> bool:
@@ -51,6 +83,8 @@ class CertificateKeyPairSerializer(ModelSerializer):
 
     def get_private_key_type(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get the private key's type, if set"""
+        if not self._should_include_details:
+            return None
         key = instance.private_key
         if key:
             return key.__class__.__name__.replace("_", "").lower().replace("privatekey", "")
@@ -170,6 +204,14 @@ class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
     ordering = ["name"]
     search_fields = ["name"]
 
+    @extend_schema(
+        parameters=[
+            OpenApiParameter("include_details", bool, default=True),
+        ]
+    )
+    def list(self, request, *args, **kwargs):
+        return super().list(request, *args, **kwargs)
+
     @permission_required(None, ["authentik_crypto.add_certificatekeypair"])
     @extend_schema(
         request=CertificateGenerationSerializer(),

authentik/crypto/apps.py

@@ -2,7 +2,7 @@
 from datetime import datetime
 from typing import TYPE_CHECKING, Optional
 
-from authentik.blueprints.manager import ManagedAppConfig
+from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
 
 if TYPE_CHECKING:

authentik/crypto/builder.py

@@ -6,7 +6,8 @@ from typing import Optional
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
+from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES
 from cryptography.x509.oid import NameOID
 
 from authentik import __version__
@@ -18,7 +19,10 @@ class CertificateBuilder:
 
     common_name: str
 
-    def __init__(self):
+    _use_ec_private_key: bool
+
+    def __init__(self, use_ec_private_key=False):
+        self._use_ec_private_key = use_ec_private_key
         self.__public_key = None
         self.__private_key = None
         self.__builder = None
@@ -26,7 +30,7 @@ class CertificateBuilder:
         self.common_name = "authentik Self-signed Certificate"
         self.cert = CertificateKeyPair()
 
-    def save(self) -> Optional[CertificateKeyPair]:
+    def save(self) -> CertificateKeyPair:
         """Save generated certificate as model"""
         if not self.__certificate:
             raise ValueError("Certificated hasn't been built yet")
@@ -36,6 +40,14 @@ class CertificateBuilder:
         self.cert.save()
         return self.cert
 
+    def generate_private_key(self) -> PRIVATE_KEY_TYPES:
+        """Generate private key"""
+        if self._use_ec_private_key:
+            return ec.generate_private_key(curve=ec.SECP256R1)
+        return rsa.generate_private_key(
+            public_exponent=65537, key_size=4096, backend=default_backend()
+        )
+
     def build(
         self,
         validity_days: int = 365,
@@ -43,9 +55,7 @@ class CertificateBuilder:
     ):
         """Build self-signed certificate"""
         one_day = datetime.timedelta(1, 0, 0)
-        self.__private_key = rsa.generate_private_key(
-            public_exponent=65537, key_size=4096, backend=default_backend()
-        )
+        self.__private_key = self.generate_private_key()
         self.__public_key = self.__private_key.public_key()
         alt_names: list[x509.GeneralName] = [x509.DNSName(x) for x in subject_alt_names or []]
         self.__builder = (

authentik/crypto/management/commands/import_certificate.py

@@ -0,0 +1,51 @@
+"""Import certificate"""
+from sys import exit as sys_exit
+
+from django.core.management.base import BaseCommand, no_translations
+from rest_framework.exceptions import ValidationError
+from structlog.stdlib import get_logger
+
+from authentik.crypto.api import CertificateKeyPairSerializer
+from authentik.crypto.models import CertificateKeyPair
+
+LOGGER = get_logger()
+
+
+class Command(BaseCommand):
+    """Import certificate"""
+
+    @no_translations
+    def handle(self, *args, **options):
+        """Import certificate"""
+        keypair = CertificateKeyPair.objects.filter(name=options["name"]).first()
+        dirty = False
+        if not keypair:
+            keypair = CertificateKeyPair(name=options["name"])
+            dirty = True
+        with open(options["certificate"], mode="r", encoding="utf-8") as _cert:
+            cert_data = _cert.read()
+            if keypair.certificate_data != cert_data:
+                dirty = True
+            keypair.certificate_data = cert_data
+        if options["private_key"]:
+            with open(options["private_key"], mode="r", encoding="utf-8") as _key:
+                key_data = _key.read()
+                if keypair.key_data != key_data:
+                    dirty = True
+                keypair.key_data = key_data
+        # Validate that cert and key are actually PEM and valid
+        serializer = CertificateKeyPairSerializer(instance=keypair)
+        try:
+            serializer.validate_certificate_data(keypair.certificate_data)
+            if keypair.key_data != "":
+                serializer.validate_key_data(keypair.key_data)
+        except ValidationError as exc:
+            self.stderr.write(str(exc))
+            sys_exit(1)
+        if dirty:
+            keypair.save()
+
+    def add_arguments(self, parser):
+        parser.add_argument("--certificate", type=str, required=True)
+        parser.add_argument("--private-key", type=str, required=False)
+        parser.add_argument("--name", type=str, required=True)

authentik/crypto/models.py

@@ -6,12 +6,7 @@ from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric.ec import (
-    EllipticCurvePrivateKey,
-    EllipticCurvePublicKey,
-)
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPublicKey
+from cryptography.hazmat.primitives.asymmetric.types import PRIVATE_KEY_TYPES, PUBLIC_KEY_TYPES
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509 import Certificate, load_pem_x509_certificate
 from django.db import models
@@ -42,8 +37,8 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     )
 
     _cert: Optional[Certificate] = None
-    _private_key: Optional[RSAPrivateKey | EllipticCurvePrivateKey | Ed25519PrivateKey] = None
-    _public_key: Optional[RSAPublicKey | EllipticCurvePublicKey | Ed25519PublicKey] = None
+    _private_key: Optional[PRIVATE_KEY_TYPES] = None
+    _public_key: Optional[PUBLIC_KEY_TYPES] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -61,7 +56,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> Optional[RSAPublicKey | EllipticCurvePublicKey | Ed25519PublicKey]:
+    def public_key(self) -> Optional[PUBLIC_KEY_TYPES]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -70,7 +65,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> Optional[RSAPrivateKey | EllipticCurvePrivateKey | Ed25519PrivateKey]:
+    ) -> Optional[PRIVATE_KEY_TYPES]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tests.py

@@ -1,5 +1,6 @@
 """Crypto tests"""
 import datetime
+from json import loads
 from os import makedirs
 from tempfile import TemporaryDirectory
 
@@ -86,13 +87,35 @@ class TestCrypto(APITestCase):
 
     def test_list(self):
         """Test API List"""
+        cert = create_test_cert()
         self.client.force_login(create_test_admin_user())
         response = self.client.get(
             reverse(
                 "authentik_api:certificatekeypair-list",
             )
+            + f"?name={cert.name}"
         )
         self.assertEqual(200, response.status_code)
+        body = loads(response.content.decode())
+        api_cert = [x for x in body["results"] if x["name"] == cert.name][0]
+        self.assertEqual(api_cert["fingerprint_sha1"], cert.fingerprint_sha1)
+        self.assertEqual(api_cert["fingerprint_sha256"], cert.fingerprint_sha256)
+
+    def test_list_without_details(self):
+        """Test API List (no details)"""
+        cert = create_test_cert()
+        self.client.force_login(create_test_admin_user())
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-list",
+            )
+            + f"?name={cert.name}&include_details=false"
+        )
+        self.assertEqual(200, response.status_code)
+        body = loads(response.content.decode())
+        api_cert = [x for x in body["results"] if x["name"] == cert.name][0]
+        self.assertEqual(api_cert["fingerprint_sha1"], None)
+        self.assertEqual(api_cert["fingerprint_sha256"], None)
 
     def test_certificate_download(self):
         """Test certificate export (download)"""

authentik/events/api/notification_transports.py

@@ -85,16 +85,18 @@ class NotificationTransportViewSet(UsedByMixin, ModelViewSet):
         """Send example notification using selected transport. Requires
         Modify permissions."""
         transport: NotificationTransport = self.get_object()
+        event = Event.new(
+            action="notification_test",
+            user=get_user(request.user),
+            app=self.__class__.__module__,
+            context={"foo": "bar"},
+        )
+        event.save()
         notification = Notification(
             severity=NotificationSeverity.NOTICE,
             body=f"Test Notification from transport {transport.name}",
             user=request.user,
-            event=Event(
-                action="Test",
-                user=get_user(request.user),
-                app=self.__class__.__module__,
-                context={"foo": "bar"},
-            ),
+            event=event,
         )
         try:
             response = NotificationTransportTestSerializer(

authentik/events/apps.py

@@ -1,7 +1,7 @@
 """authentik events app"""
 from prometheus_client import Gauge
 
-from authentik.blueprints.manager import ManagedAppConfig
+from authentik.blueprints.apps import ManagedAppConfig
 
 GAUGE_TASKS = Gauge(
     "authentik_system_tasks",

authentik/events/middleware.py

@@ -19,7 +19,7 @@ from authentik.flows.models import FlowToken
 from authentik.lib.sentry import before_send
 from authentik.lib.utils.errors import exception_to_string
 
-IGNORED_MODELS = [
+IGNORED_MODELS = (
     Event,
     Notification,
     UserObjectPermission,
@@ -27,12 +27,14 @@ IGNORED_MODELS = [
     StaticToken,
     Session,
     FlowToken,
-]
-if settings.DEBUG:
-    from silk.models import Request, Response, SQLQuery
+)
 
-    IGNORED_MODELS += [Request, Response, SQLQuery]
-IGNORED_MODELS = tuple(IGNORED_MODELS)
+
+def should_log_model(model: Model) -> bool:
+    """Return true if operation on `model` should be logged"""
+    if model.__module__.startswith("silk"):
+        return False
+    return not isinstance(model, IGNORED_MODELS)
 
 
 class AuditMiddleware:
@@ -109,7 +111,7 @@ class AuditMiddleware:
         user: User, request: HttpRequest, sender, instance: Model, created: bool, **_
     ):
         """Signal handler for all object's post_save"""
-        if isinstance(instance, IGNORED_MODELS):
+        if not should_log_model(instance):
             return
 
         action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
@@ -119,7 +121,7 @@ class AuditMiddleware:
     # pylint: disable=unused-argument
     def pre_delete_handler(user: User, request: HttpRequest, sender, instance: Model, **_):
         """Signal handler for all object's pre_delete"""
-        if isinstance(instance, IGNORED_MODELS):  # pragma: no cover
+        if not should_log_model(instance):  # pragma: no cover
             return
 
         EventNewThread(

authentik/events/migrations/0001_initial.py

@@ -1,70 +0,0 @@
-# Generated by Django 3.0.6 on 2020-05-19 22:08
-
-import uuid
-
-import django.db.models.deletion
-from django.conf import settings
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    initial = True
-
-    dependencies = [
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Event",
-            fields=[
-                (
-                    "event_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4,
-                        editable=False,
-                        primary_key=True,
-                        serialize=False,
-                    ),
-                ),
-                (
-                    "action",
-                    models.TextField(
-                        choices=[
-                            ("LOGIN", "login"),
-                            ("LOGIN_FAILED", "login_failed"),
-                            ("LOGOUT", "logout"),
-                            ("AUTHORIZE_APPLICATION", "authorize_application"),
-                            ("SUSPICIOUS_REQUEST", "suspicious_request"),
-                            ("SIGN_UP", "sign_up"),
-                            ("PASSWORD_RESET", "password_reset"),
-                            ("INVITE_CREATED", "invitation_created"),
-                            ("INVITE_USED", "invitation_used"),
-                            ("CUSTOM", "custom"),
-                        ]
-                    ),
-                ),
-                ("date", models.DateTimeField(auto_now_add=True)),
-                ("app", models.TextField()),
-                (
-                    "context",
-                    models.JSONField(blank=True, default=dict),
-                ),
-                ("client_ip", models.GenericIPAddressField(null=True)),
-                ("created", models.DateTimeField(auto_now_add=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Event",
-                "verbose_name_plural": "Events",
-            },
-        ),
-    ]

authentik/events/migrations/0001_squashed_0019_alter_notificationtransport_webhook_url.py

@@ -28,126 +28,6 @@ def convert_user_to_json(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
         event.save()
 
 
-def notify_configuration_error(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-configuration-error",
-        defaults={"action": EventAction.CONFIGURATION_ERROR},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-configuration-error",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy,
-        defaults={
-            "order": 0,
-        },
-    )
-
-
-def notify_update(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-update",
-        defaults={"action": EventAction.UPDATE_AVAILABLE},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-update",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy,
-        defaults={
-            "order": 0,
-        },
-    )
-
-
-def notify_exception(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy_policy_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-policy-exception",
-        defaults={"action": EventAction.POLICY_EXCEPTION},
-    )
-    policy_pm_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-property-mapping-exception",
-        defaults={"action": EventAction.PROPERTY_MAPPING_EXCEPTION},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-exception",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy_policy_exc,
-        defaults={
-            "order": 0,
-        },
-    )
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy_pm_exc,
-        defaults={
-            "order": 1,
-        },
-    )
-
-
-def transport_email_global(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    NotificationTransport.objects.using(db_alias).update_or_create(
-        name="default-email-transport",
-        defaults={"mode": TransportMode.EMAIL},
-    )
-
-
 def token_view_to_secret_view(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
     from authentik.events.models import EventAction
 
@@ -432,18 +312,6 @@ class Migration(migrations.Migration):
                 "verbose_name_plural": "Notifications",
             },
         ),
-        migrations.RunPython(
-            code=transport_email_global,
-        ),
-        migrations.RunPython(
-            code=notify_configuration_error,
-        ),
-        migrations.RunPython(
-            code=notify_update,
-        ),
-        migrations.RunPython(
-            code=notify_exception,
-        ),
         migrations.AddField(
             model_name="notificationtransport",
             name="send_once",

authentik/events/migrations/0002_alter_notificationtransport_mode.py

@@ -22,4 +22,8 @@ class Migration(migrations.Migration):
                 default="local",
             ),
         ),
+        migrations.AlterModelOptions(
+            name="notificationwebhookmapping",
+            options={"verbose_name": "Webhook Mapping", "verbose_name_plural": "Webhook Mappings"},
+        ),
     ]

authentik/events/migrations/0002_auto_20200918_2116.py

@@ -1,33 +0,0 @@
-# Generated by Django 3.1.1 on 2020-09-18 21:16
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_events", "0001_initial"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("LOGIN", "login"),
-                    ("LOGIN_FAILED", "login_failed"),
-                    ("LOGOUT", "logout"),
-                    ("AUTHORIZE_APPLICATION", "authorize_application"),
-                    ("SUSPICIOUS_REQUEST", "suspicious_request"),
-                    ("SIGN_UP", "sign_up"),
-                    ("PASSWORD_RESET", "password_reset"),
-                    ("INVITE_CREATED", "invitation_created"),
-                    ("INVITE_USED", "invitation_used"),
-                    ("IMPERSONATION_STARTED", "impersonation_started"),
-                    ("IMPERSONATION_ENDED", "impersonation_ended"),
-                    ("CUSTOM", "custom"),
-                ]
-            ),
-        ),
-    ]