new release: 0.10.0-stable

Bumps [pytest](https://github.com/pytest-dev/pytest) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/6.0.1...6.0.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.9.0-pre4
+current_version = 0.10.0-stable
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
@@ -15,6 +15,14 @@ values =
 	beta
 	stable
 
+[bumpversion:file:README.md]
+
+[bumpversion:file:docs/installation/docker-compose.md]
+
+[bumpversion:file:docs/installation/kubernetes.md]
+
+[bumpversion:file:docker-compose.yml]
+
 [bumpversion:file:helm/values.yaml]
 
 [bumpversion:file:helm/Chart.yaml]

.coveragerc

@@ -1,12 +1,10 @@
 [run]
 source = passbook
 omit =
-    */wsgi.py
+    */asgi.py
     manage.py
     */migrations/*
     */apps.py
-    passbook/management/commands/web.py
-    passbook/management/commands/worker.py
     docs/
 
 [report]

.fossa.yml

@@ -1,20 +0,0 @@
-# Generated by FOSSA CLI (https://github.com/fossas/fossa-cli)
-# Visit https://fossa.com to learn more
-
-version: 2
-cli:
-  server: https://app.fossa.com
-  fetcher: custom
-  project: git@github.com:BeryJu/passbook.git
-analyze:
-  modules:
-  - name: static
-    type: npm
-    target: passbook/static/static
-    path: passbook/static/static
-  - name: .
-    type: pip
-    target: .
-    path: .
-    options:
-      strategy: pipenv

.github/workflows/ci.yml

@@ -1,230 +0,0 @@
-name: passbook-ci
-on:
-  - push
-env:
-  POSTGRES_DB: passbook
-  POSTGRES_USER: passbook
-  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-
-jobs:
-  # Linting
-  pylint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev
-      - name: Lint with pylint
-        run: pipenv run pylint passbook
-  black:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev
-      - name: Lint with black
-        run: pipenv run black --check passbook
-  prospector:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev && pipenv install --dev prospector --skip-lock
-      - name: Lint with prospector
-        run: pipenv run prospector
-  bandit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev
-      - name: Lint with bandit
-        run: pipenv run bandit -r passbook
-  snyk:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@master
-    - name: Run Snyk to check for vulnerabilities
-      uses: snyk/actions/python@master
-      env:
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-  pyright:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-node@v1
-        with:
-          node-version: '12'
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install pyright
-        run: npm install -g pyright
-      - name: Show pyright version
-        run: pyright --version
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev
-      - name: Lint with pyright
-        run: pipenv run pyright
-  # Actual CI tests
-  migrations:
-    needs:
-      - pylint
-      - black
-      - prospector
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_DB: passbook
-          POSTGRES_USER: passbook
-          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:latest
-        ports:
-          - 6379:6379
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - name: Install dependencies
-        run: sudo pip install -U wheel pipenv && pipenv install --dev
-      - name: Run migrations
-        run: pipenv run ./manage.py migrate
-  coverage:
-    needs:
-      - pylint
-      - black
-      - prospector
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_DB: passbook
-          POSTGRES_USER: passbook
-          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-        ports:
-          - 5432:5432
-      redis:
-        image: redis:latest
-        ports:
-          - 6379:6379
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions/setup-python@v1
-        with:
-          python-version: '3.8'
-      - uses: actions/setup-node@v1
-        with:
-          node-version: '12'
-      - name: Install dependencies
-        run: |
-          sudo pip install -U wheel pipenv
-          pipenv install --dev
-      - name: Prepare Chrome node
-        run: |
-          cd e2e
-          docker-compose pull -q chrome
-          docker-compose up -d chrome
-      - name: Build static files for e2e test
-        run: |
-          cd passbook/static/static
-          yarn
-      - name: Run coverage
-        run: pipenv run coverage run ./manage.py test --failfast
-      - uses: actions/upload-artifact@v2
-        if: failure()
-        with:
-          path: out/
-      - name: Create XML Report
-        run: pipenv run coverage xml
-      - uses: codecov/codecov-action@v1
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-  # Build
-  build-server:
-    needs:
-      - migrations
-      - coverage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
-      - name: Building Docker Image
-        run: docker build
-          --no-cache
-          -t beryju/passbook:gh-${GITHUB_REF##*/}
-          -f Dockerfile .
-      - name: Push Docker Container to Registry
-        run: docker push beryju/passbook:gh-${GITHUB_REF##*/}
-  build-gatekeeper:
-    needs:
-      - migrations
-      - coverage
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
-      - name: Building Docker Image
-        run: |
-          cd gatekeeper
-          docker build \
-          --no-cache \
-          -t beryju/passbook-gatekeeper:gh-${GITHUB_REF##*/} \
-          -f Dockerfile .
-      - name: Push Docker Container to Registry
-        run: docker push beryju/passbook-gatekeeper:gh-${GITHUB_REF##*/}
-  build-static:
-    needs:
-      - migrations
-      - coverage
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_DB: passbook
-          POSTGRES_USER: passbook
-          POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-      redis:
-        image: redis:latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
-      - name: Building Docker Image
-        run: docker build
-          --no-cache
-          --network=$(docker network ls | grep github | awk '{print $1}')
-          -t beryju/passbook-static:gh-${GITHUB_REF##*/}
-          -f static.Dockerfile .
-      - name: Push Docker Container to Registry
-        run: docker push beryju/passbook-static:gh-${GITHUB_REF##*/}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,54 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master, admin-more-info, ci-deploy-dev, gh-pages, provider-saml-v2]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+  schedule:
+    - cron: '0 20 * * 2'
+
+jobs:
+  analyse:
+    name: Analyse
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      # Override language selection by uncommenting this and choosing your languages
+      # with:
+      #   languages: go, javascript, csharp, python, cpp, java
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/release.yml

@@ -1,6 +1,8 @@
-name: passbook-release
+name: passbook-on-release
+
 on:
-  release
+  release:
+    types: [published, created]
 
 jobs:
   # Build
@@ -16,17 +18,26 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/passbook:0.9.0-pre4
+          -t beryju/passbook:0.10.0-stable
           -t beryju/passbook:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook:0.9.0-pre4
+        run: docker push beryju/passbook:0.10.0-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook:latest
-  build-gatekeeper:
+  build-proxy:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v1
+      - uses: actions/setup-go@v2
+        with:
+          go-version: "^1.15"
+      - name: prepare go api client
+        run: |
+          cd proxy
+          go get -u github.com/go-swagger/go-swagger/cmd/swagger
+          swagger generate client -f ../swagger.yaml -A passbook -t pkg/
+          go build -v .
       - name: Docker Login Registry
         env:
           DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
@@ -34,16 +45,16 @@ jobs:
         run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
       - name: Building Docker Image
         run: |
-          cd gatekeeper
+          cd proxy
           docker build \
           --no-cache \
-          -t beryju/passbook-gatekeeper:0.9.0-pre4 \
-          -t beryju/passbook-gatekeeper:latest \
+          -t beryju/passbook-proxy:0.10.0-stable \
+          -t beryju/passbook-proxy:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-gatekeeper:0.9.0-pre4
+        run: docker push beryju/passbook-proxy:0.10.0-stable
       - name: Push Docker Container to Registry (latest)
-        run: docker push beryju/passbook-gatekeeper:latest
+        run: docker push beryju/passbook-proxy:latest
   build-static:
     runs-on: ubuntu-latest
     services:
@@ -66,11 +77,11 @@ jobs:
         run: docker build
           --no-cache
           --network=$(docker network ls | grep github | awk '{print $1}')
-          -t beryju/passbook-static:0.9.0-pre4
+          -t beryju/passbook-static:0.10.0-stable
           -t beryju/passbook-static:latest
           -f static.Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/passbook-static:0.9.0-pre4
+        run: docker push beryju/passbook-static:0.10.0-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/passbook-static:latest
   test-release:
@@ -85,4 +96,20 @@ jobs:
           docker-compose pull -q
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root server bash -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test"
+          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test passbook"
+  sentry-release:
+    needs:
+      - test-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Create a Sentry.io release
+        uses: tclindner/sentry-releases-action@v1.2.0
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: beryjuorg
+          SENTRY_PROJECT: passbook
+          SENTRY_URL: https://sentry.beryju.org
+        with:
+          tagName: 0.10.0-stable
+          environment: beryjuorg-prod

.github/workflows/tag.yml

@@ -1,10 +1,10 @@
+name: passbook-on-tag
+
 on:
   push:
     tags:
     - 'version/*'
 
-name: passbook-version-tag
-
 jobs:
   build:
     name: Create Release from Tag
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@master
       - name: Pre-release test
         run: |
+          export PASSBOOK_TAG=latest
           docker-compose pull -q
           docker build \
             --no-cache \
@@ -20,7 +21,7 @@ jobs:
             -f Dockerfile .
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root server bash -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test"
+          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test passbook"
       - name: Install Helm
         run: |
           apt update && apt install -y curl
@@ -30,7 +31,7 @@ jobs:
           helm dependency update helm/
           helm package helm/
           mv passbook-*.tgz passbook-chart.tgz
-      - name: Extract verison number
+      - name: Extract version number
         id: get_version
         uses: actions/github-script@0.2.0
         with:

.gitignore

@@ -196,3 +196,6 @@ local.env.yml
 ### Helm ###
 # Chart dependencies
 **/charts/*.tgz
+
+# Selenium Screenshots
+selenium_screenshots/**

.pylintrc

@@ -1,6 +1,6 @@
 [MASTER]
 
-disable=redefined-outer-name,arguments-differ,no-self-use,cyclic-import,fixme,locally-disabled,too-many-ancestors,too-few-public-methods,import-outside-toplevel,bad-continuation,signature-differs
+disable=arguments-differ,no-self-use,fixme,locally-disabled,too-many-ancestors,too-few-public-methods,import-outside-toplevel,bad-continuation,signature-differs,similarities,cyclic-import
 load-plugins=pylint_django,pylint.extensions.bad_builtin
 extension-pkg-whitelist=lxml
 const-rgx=[a-zA-Z0-9_]{1,40}$

Dockerfile

@@ -11,25 +11,22 @@ RUN pip install pipenv && \
 
 FROM python:3.8-slim-buster
 
-COPY --from=locker /app/requirements.txt /app/
-COPY --from=locker /app/requirements-dev.txt /app/
-
-WORKDIR /app/
+WORKDIR /
+COPY --from=locker /app/requirements.txt /
+COPY --from=locker /app/requirements-dev.txt /
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends postgresql-client-11 && \
+    apt-get install -y --no-install-recommends postgresql-client-11 build-essential && \
     rm -rf /var/lib/apt/ && \
-    pip install -r requirements.txt  --no-cache-dir && \
-    adduser --system --no-create-home --uid 1000 --group --home /app passbook
+    pip install -r /requirements.txt  --no-cache-dir && \
+    apt-get remove --purge -y build-essential && \
+    apt-get autoremove --purge && \
+    adduser --system --no-create-home --uid 1000 --group --home /passbook passbook
 
-COPY ./passbook/ /app/passbook
-COPY ./manage.py /app/
-COPY ./docker/uwsgi.ini /app/
-COPY ./docker/bootstrap.sh /bootstrap.sh
-COPY ./docker/wait_for_db.py /app/wait_for_db.py
-
-WORKDIR /app/
+COPY ./passbook/ /passbook
+COPY ./manage.py /
+COPY ./lifecycle/ /lifecycle
 
 USER passbook
 
-ENTRYPOINT [ "/bootstrap.sh" ]
+ENTRYPOINT [ "/lifecycle/bootstrap.sh" ]

Makefile

@@ -0,0 +1,26 @@
+all: lint-fix lint coverage gen
+
+coverage:
+	coverage run --concurrency=multiprocessing manage.py test --failfast
+	coverage combine
+	coverage html
+	coverage report
+
+lint-fix:
+	isort -rc .
+	black .
+
+lint:
+	pyright
+	bandit -r .
+	pylint passbook
+	prospector
+
+gen: coverage
+	./manage.py generate_swagger -o swagger.yaml -f yaml
+
+local-stack:
+	export PASSBOOK_TAG=testing
+	docker build -t beryju/passbook:testng .
+	docker-compose up -d
+	docker-compose run --rm server migrate

Pipfile

@@ -13,8 +13,6 @@ django-dbbackup = "*"
 django-filter = "*"
 django-guardian = "*"
 django-model-utils = "*"
-django-oauth-toolkit = "*"
-django-oidc-provider = "*"
 django-otp = "*"
 django-prometheus = "*"
 django-recaptcha = "*"
@@ -23,14 +21,15 @@ django-rest-framework = "*"
 django-storages = "*"
 djangorestframework-guardian = "*"
 drf-yasg = "*"
-kombu = "*"
+facebook-sdk = "*"
 ldap3 = "*"
 lxml = "*"
-oauthlib = "*"
 packaging = "*"
 psycopg2-binary = "*"
 pycryptodome = "*"
-pyuwsgi = "*"
+pyjwkest = "*"
+uvicorn = "*"
+gunicorn = "*"
 pyyaml = "*"
 qrcode = "*"
 requests-oauthlib = "*"
@@ -40,7 +39,10 @@ signxml = "*"
 structlog = "*"
 swagger-spec-validator = "*"
 urllib3 = {extras = ["secure"],version = "*"}
-facebook-sdk = "*"
+dacite = "*"
+channels = "*"
+channels-redis = "*"
+kubernetes = "*"
 
 [requires]
 python_version = "3.8"
@@ -48,16 +50,15 @@ python_version = "3.8"
 [dev-packages]
 autopep8 = "*"
 bandit = "*"
+black = "==19.10b0"
 bumpversion = "*"
 colorama = "*"
 coverage = "*"
 django-debug-toolbar = "*"
+docker = "*"
 pylint = "*"
 pylint-django = "*"
-unittest-xml-reporting = "*"
-black = "*"
 selenium = "*"
-docker = "*"
-
-[pipenv]
-allow_prereleases = true
+prospector = "*"
+pytest = "*"
+pytest-django = "*"

README.md

@@ -1,11 +1,11 @@
-<img src="passbook/static/static/passbook/logo.svg" height="50" alt="passbook logo"><img src="passbook/static/static/passbook/brand_inverted.svg" height="50" alt="passbook">
+<img src="docs/images/logo.svg" height="50" alt="passbook logo"><img src="docs/images/brand_inverted.svg" height="50" alt="passbook">
 
-![CI Build status](https://img.shields.io/github/workflow/status/beryju/passbook/passbook-ci?style=flat-square)
+[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/passbook/1?style=flat-square)](https://dev.azure.com/beryjuorg/passbook/_build?definitionId=1)
+![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/passbook/1?compact_message&style=flat-square)
+[![Code Coverage](https://img.shields.io/codecov/c/gh/beryju/passbook?style=flat-square)](https://codecov.io/gh/BeryJu/passbook)
 ![Docker pulls](https://img.shields.io/docker/pulls/beryju/passbook.svg?style=flat-square)
-![Docker pulls (gatekeeper)](https://img.shields.io/docker/pulls/beryju/passbook-gatekeeper.svg?style=flat-square)
 ![Latest version](https://img.shields.io/docker/v/beryju/passbook?sort=semver&style=flat-square)
 ![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/BeryJu/passbook?style=flat-square)
-![Code Coverage](https://img.shields.io/codecov/c/gh/beryju/passbook?style=flat-square)
 
 ## What is passbook?
 
@@ -20,12 +20,12 @@ wget https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml
 # Optionally enable Error-reporting
 # export PASSBOOK_ERROR_REPORTING=true
 # Optionally deploy a different version
-# export PASSBOOK_TAG=0.8.15-beta
+# export PASSBOOK_TAG=0.10.0-stable
 # If this is a productive installation, set a different PostgreSQL Password
 # export PG_PASS=$(pwgen 40 1)
 docker-compose pull
 docker-compose up -d
-docker-compose exec server ./manage.py migrate
+docker-compose run --rm server migrate
 ```
 
 For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://passbook.beryju.org//installation/kubernetes/)
@@ -50,31 +50,7 @@ pipenv sync -d
 ```
 
 Since passbook uses PostgreSQL-specific fields, you also need a local PostgreSQL instance to develop. passbook also uses redis for caching and message queueing.
-For these databases you can use [Postgres.app](https://postgresapp.com/) and [Redis.app](https://jpadilla.github.io/redisapp/) on macOS or use it via docker-comppose:
-
-```yaml
-version: '3.7'
-
-services:
-  postgresql:
-    container_name: postgres
-    image: postgres:11
-    volumes:
-    - db-data:/var/lib/postgresql/data
-    ports:
-    - 127.0.0.1:5432:5432
-    restart: always
-  redis:
-    container_name: redis
-    image: redis
-    ports:
-    - 127.0.0.1:6379:6379
-    restart: always
-
-volumes:
-  db-data:
-    driver: local
-```
+For these databases you can use [Postgres.app](https://postgresapp.com/) and [Redis.app](https://jpadilla.github.io/redisapp/) on macOS or use it the docker-compose file in `scripts/docker-compose.yml`.
 
 To tell passbook about these databases, create a file in the project root called `local.env.yml` with the following contents:
 
@@ -84,7 +60,6 @@ postgresql:
   user: postgres
 
 log_level: debug
-error_reporting: false
 ```
 
 ## Security

SECURITY.md

@@ -10,4 +10,4 @@ As passbook is currently in a pre-stable, only the latest "stable" version is su
 
 ## Reporting a Vulnerability
 
-To report a vulnerability, send am email to [security@beryju.org](mailto:security@beryju.org)
+To report a vulnerability, send an email to [security@beryju.org](mailto:security@beryju.org)

azure-pipelines.yml

@@ -0,0 +1,303 @@
+trigger:
+  - master
+
+resources:
+  - repo: self
+
+variables:
+  POSTGRES_DB: passbook
+  POSTGRES_USER: passbook
+  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
+
+stages:
+  - stage: Lint
+    jobs:
+      - job: pylint
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run pylint passbook
+      - job: black
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run black --check passbook
+      - job: prospector
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+                pipenv install --dev prospector --skip-lock
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run prospector passbook
+      - job: bandit
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run bandit -r passbook
+      - job: pyright
+        pool:
+          vmImage: ubuntu-latest
+        steps:
+          - task: UseNode@1
+            inputs:
+              version: '12.x'
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: npm install -g pyright
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run pyright
+  - stage: Test
+    jobs:
+      - job: migrations
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: DockerCompose@0
+            displayName: Run services
+            inputs:
+              dockerComposeFile: 'scripts/ci.docker-compose.yml'
+              action: 'Run services'
+              buildImages: false
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            inputs:
+              script: pipenv run ./manage.py migrate
+      - job: coverage_unittest
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: DockerCompose@0
+            displayName: Run services
+            inputs:
+              dockerComposeFile: 'scripts/ci.docker-compose.yml'
+              action: 'Run services'
+              buildImages: false
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: CmdLine@2
+            displayName: Run full test suite
+            inputs:
+              script: |
+                pipenv run coverage run ./manage.py test passbook
+                mkdir output-unittest
+                mv unittest.xml output-unittest/unittest.xml
+                mv .coverage output-unittest/coverage
+          - task: PublishPipelineArtifact@1
+            inputs:
+              targetPath: 'output-unittest/'
+              artifact: 'coverage-unittest'
+              publishLocation: 'pipeline'
+      - job: coverage_e2e
+        pool:
+          name: coventry
+        steps:
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: DockerCompose@0
+            displayName: Run services
+            inputs:
+              dockerComposeFile: 'scripts/ci.docker-compose.yml'
+              action: 'Run services'
+              buildImages: false
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+          - task: DockerCompose@0
+            displayName: Run ChromeDriver
+            inputs:
+              dockerComposeFile: 'e2e/ci.docker-compose.yml'
+              action: 'Run a specific service'
+              serviceName: 'chrome'
+          - task: CmdLine@2
+            displayName: Build static files for e2e
+            inputs:
+              script: |
+                cd passbook/static/static
+                yarn
+          - task: CmdLine@2
+            displayName: Run full test suite
+            inputs:
+              script: pipenv run coverage run ./manage.py test e2e
+          - task: CmdLine@2
+            displayName: Prepare unittests and coverage for upload
+            inputs:
+              script: |
+                mkdir output-e2e
+                mv unittest.xml output-e2e/unittest.xml
+                mv .coverage output-e2e/coverage
+          - task: PublishPipelineArtifact@1
+            condition: failed()
+            displayName: Upload screenshots if selenium tests fail
+            inputs:
+              targetPath: 'selenium_screenshots/'
+              artifact: 'selenium screenshots'
+              publishLocation: 'pipeline'
+          - task: PublishPipelineArtifact@1
+            inputs:
+              targetPath: 'output-e2e/'
+              artifact: 'coverage-e2e'
+              publishLocation: 'pipeline'
+  - stage: test_combine
+    jobs:
+      - job: test_coverage_combine
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+          - task: DownloadPipelineArtifact@2
+            inputs:
+              buildType: 'current'
+              artifactName: 'coverage-e2e'
+              path: "coverage-e2e/"
+          - task: DownloadPipelineArtifact@2
+            inputs:
+              buildType: 'current'
+              artifactName: 'coverage-unittest'
+              path: "coverage-unittest/"
+          - task: UsePythonVersion@0
+            inputs:
+              versionSpec: '3.8'
+          - task: CmdLine@2
+            inputs:
+              script: |
+                sudo pip install -U wheel pipenv
+                pipenv install --dev
+                find .
+                pipenv run coverage combine coverage-e2e/coverage coverage-unittest/coverage
+                pipenv run coverage xml
+                pipenv run coverage html
+                find .
+          - task: PublishCodeCoverageResults@1
+            inputs:
+              codeCoverageTool: 'Cobertura'
+              summaryFileLocation: 'coverage.xml'
+              pathToSources: '$(System.DefaultWorkingDirectory)'
+          - task: PublishTestResults@2
+            condition: succeededOrFailed()
+            inputs:
+              testResultsFormat: 'JUnit'
+              testResultsFiles: |
+                coverage-e2e/unittest.xml
+                coverage-unittest/unittest.xml
+              mergeTestResults: true
+          - task: CmdLine@2
+            env:
+              CODECOV_TOKEN: $(CODECOV_TOKEN)
+            inputs:
+              script: bash <(curl -s https://codecov.io/bash)
+  - stage: Build
+    jobs:
+      - job: build_server
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+        - task: Docker@2
+          inputs:
+            containerRegistry: 'dockerhub'
+            repository: 'beryju/passbook'
+            command: 'buildAndPush'
+            Dockerfile: 'Dockerfile'
+            tags: 'gh-$(Build.SourceBranchName)'
+      - job: build_static
+        pool:
+          vmImage: 'ubuntu-latest'
+        steps:
+        - task: DockerCompose@0
+          displayName: Run services
+          inputs:
+            dockerComposeFile: 'scripts/ci.docker-compose.yml'
+            action: 'Run services'
+            buildImages: false
+        - task: Docker@2
+          inputs:
+            containerRegistry: 'dockerhub'
+            repository: 'beryju/passbook-static'
+            command: 'build'
+            Dockerfile: 'static.Dockerfile'
+            tags: 'gh-$(Build.SourceBranchName)'
+            arguments: "--network=beryjupassbook_default"
+        - task: Docker@2
+          inputs:
+            containerRegistry: 'dockerhub'
+            repository: 'beryju/passbook-static'
+            command: 'push'
+            tags: 'gh-$(Build.SourceBranchName)'
+  - stage: Deploy
+    jobs:
+      - job: deploy_dev
+        pool:
+          vmImage: 'ubuntu-latest'
+          steps:
+          - task: HelmDeploy@0
+            inputs:
+              connectionType: 'Kubernetes Service Connection'
+              kubernetesServiceConnection: 'k8s-beryjuorg-prd'
+              namespace: 'passbook-dev'
+              command: 'upgrade'
+              chartType: 'FilePath'
+              chartPath: 'helm/'
+              releaseName: 'passbook-dev'
+              recreate: true

docker-compose.yml

@@ -21,15 +21,14 @@ services:
     labels:
       - traefik.enable=false
   server:
-    image: beryju/passbook:${PASSBOOK_TAG:-latest}
-    command:
-      - uwsgi
-      - uwsgi.ini
+    image: beryju/passbook:${PASSBOOK_TAG:-0.10.0-stable}
+    command: server
     environment:
-      - PASSBOOK_REDIS__HOST=redis
-      - PASSBOOK_ERROR_REPORTING=${PASSBOOK_ERROR_REPORTING:-false}
-      - PASSBOOK_POSTGRESQL__HOST=postgresql
-      - PASSBOOK_POSTGRESQL__PASSWORD=${PG_PASS:-thisisnotagoodpassword}
+      PASSBOOK_REDIS__HOST: redis
+      PASSBOOK_ERROR_REPORTING: ${PASSBOOK_ERROR_REPORTING:-false}
+      PASSBOOK_POSTGRESQL__HOST: postgresql
+      PASSBOOK_POSTGRESQL__PASSWORD: ${PG_PASS:-thisisnotagoodpassword}
+      PASSBOOK_LOG_LEVEL: debug
     ports:
       - 8000
     networks:
@@ -39,30 +38,24 @@ services:
       - traefik.docker.network=internal
       - traefik.frontend.rule=PathPrefix:/
   worker:
-    image: beryju/passbook:${PASSBOOK_TAG:-latest}
-    command:
-      - celery
-      - worker
-      - --autoscale=10,3
-      - -E
-      - -B
-      - -A=passbook.root.celery
-      - -s=/tmp/celerybeat-schedule
+    image: beryju/passbook:${PASSBOOK_TAG:-0.10.0-stable}
+    command: worker
     networks:
       - internal
     labels:
       - traefik.enable=false
     environment:
-      - PASSBOOK_REDIS__HOST=redis
-      - PASSBOOK_ERROR_REPORTING=${PASSBOOK_ERROR_REPORTING:-false}
-      - PASSBOOK_POSTGRESQL__HOST=postgresql
-      - PASSBOOK_POSTGRESQL__PASSWORD=${PG_PASS:-thisisnotagoodpassword}
+      PASSBOOK_REDIS__HOST: redis
+      PASSBOOK_ERROR_REPORTING: ${PASSBOOK_ERROR_REPORTING:-false}
+      PASSBOOK_POSTGRESQL__HOST: postgresql
+      PASSBOOK_POSTGRESQL__PASSWORD: ${PG_PASS:-thisisnotagoodpassword}
+      PASSBOOK_LOG_LEVEL: debug
   static:
-    image: beryju/passbook-static:latest
+    image: beryju/passbook-static:${PASSBOOK_TAG:-0.10.0-stable}
     networks:
       - internal
     labels:
-      - traefik.frontend.rule=PathPrefix:/static, /robots.txt
+      - traefik.frontend.rule=PathPrefix:/static, /robots.txt, /favicon.ico
       - traefik.port=80
       - traefik.docker.network=internal
   traefik:

docker/bootstrap.sh

@@ -1,3 +0,0 @@
-#!/bin/bash -ex
-/app/wait_for_db.py
-"$@"

docker/uwsgi.ini

@@ -1,10 +0,0 @@
-[uwsgi]
-http = 0.0.0.0:8000
-wsgi-file = passbook/root/wsgi.py
-processes = 2
-master = true
-threads = 2
-enable-threads = true
-uid = passbook
-gid = passbook
-disable-logging = True

docs/build.sh

@@ -1,3 +0,0 @@
-#!/bin/bash -x
-pip install -U mkdocs mkdocs-material
-mkdocs gh-deploy

docs/expressions/index.md

@@ -53,3 +53,14 @@ Example:
 ```python
 other_user = pb_user_by(username="other_user")
 ```
+
+## Comparing IP Addresses
+
+To compare IP Addresses or check if an IP Address is within a given subnet, you can use the functions `ip_address('192.0.2.1')` and `ip_network('192.0.2.0/24')`. With these objects you can do [arithmetic operations](https://docs.python.org/3/library/ipaddress.html#operators).
+
+You can also check if an IP Address is within a subnet by writing the following:
+
+```python
+ip_address('192.0.2.1') in ip_network('192.0.2.0/24')
+# evaluates to True
+```

docs/flow/examples/enrollment-2-stage.json

@@ -0,0 +1,180 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "pk": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "slug": "default-enrollment-flow"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default enrollment Flow",
+                "title": "Welcome to passbook!",
+                "designation": "enrollment"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "cb954fd4-65a5-4ad9-b1ee-180ee9559cf4"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "username",
+                "label": "Username",
+                "type": "text",
+                "required": true,
+                "placeholder": "Username",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "7db91ee8-4290-4e08-8d39-63f132402515"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password",
+                "label": "Password",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "d30b5eb4-7787-4072-b1ba-65b46e928920"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password_repeat",
+                "label": "Password (repeat)",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password (repeat)",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "f78d977a-efa6-4cc2-9a0f-2621a9fd94d2"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "name",
+                "label": "Name",
+                "type": "text",
+                "required": true,
+                "placeholder": "Name",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "1ff91927-e33d-4615-95b0-c258e5f0df62"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "email",
+                "label": "Email",
+                "type": "email",
+                "required": true,
+                "placeholder": "Email",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "6c342b94-790d-425a-ae31-6196b6570722",
+                "name": "default-enrollment-prompt-second"
+            },
+            "model": "passbook_stages_prompt.promptstage",
+            "attrs": {
+                "fields": [
+                    "f78d977a-efa6-4cc2-9a0f-2621a9fd94d2",
+                    "1ff91927-e33d-4615-95b0-c258e5f0df62"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "20375f30-7fa7-4562-8f6e-0f61889f2963",
+                "name": "default-enrollment-prompt-first"
+            },
+            "model": "passbook_stages_prompt.promptstage",
+            "attrs": {
+                "fields": [
+                    "cb954fd4-65a5-4ad9-b1ee-180ee9559cf4",
+                    "7db91ee8-4290-4e08-8d39-63f132402515",
+                    "d30b5eb4-7787-4072-b1ba-65b46e928920"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "77090897-eb3f-40db-81e6-b4074b1998c4",
+                "name": "default-enrollment-user-login"
+            },
+            "model": "passbook_stages_user_login.userloginstage",
+            "attrs": {
+                "session_duration": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "a4090add-f483-4ac6-8917-10b493ef843e",
+                "name": "default-enrollment-user-write"
+            },
+            "model": "passbook_stages_user_write.userwritestage",
+            "attrs": {}
+        },
+        {
+            "identifiers": {
+                "pk": "34e1e7d5-8eed-4549-bc7a-305069ff7df0",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "20375f30-7fa7-4562-8f6e-0f61889f2963",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "e40467a6-3052-488c-a1b5-1ad7a80fe7b3",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "6c342b94-790d-425a-ae31-6196b6570722",
+                "order": 1
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "76bc594e-2715-49ab-bd40-994abd9a7b70",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "a4090add-f483-4ac6-8917-10b493ef843e",
+                "order": 2
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "2f324f6d-7646-4108-a6e2-e7f90985477f",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "77090897-eb3f-40db-81e6-b4074b1998c4",
+                "order": 3
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        }
+    ]
+}

docs/flow/examples/enrollment-email-verification.json

@@ -0,0 +1,223 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "pk": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "slug": "default-enrollment-flow"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default enrollment Flow",
+                "title": "Welcome to passbook!",
+                "designation": "enrollment"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "cb954fd4-65a5-4ad9-b1ee-180ee9559cf4"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "username",
+                "label": "Username",
+                "type": "text",
+                "required": true,
+                "placeholder": "Username",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "7db91ee8-4290-4e08-8d39-63f132402515"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password",
+                "label": "Password",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "d30b5eb4-7787-4072-b1ba-65b46e928920"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password_repeat",
+                "label": "Password (repeat)",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password (repeat)",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "f78d977a-efa6-4cc2-9a0f-2621a9fd94d2"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "name",
+                "label": "Name",
+                "type": "text",
+                "required": true,
+                "placeholder": "Name",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "1ff91927-e33d-4615-95b0-c258e5f0df62"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "email",
+                "label": "Email",
+                "type": "email",
+                "required": true,
+                "placeholder": "Email",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "9922212c-47a2-475a-9905-abeb5e621652"
+            },
+            "model": "passbook_policies_expression.expressionpolicy",
+            "attrs": {
+                "name": "policy-enrollment-password-equals",
+                "expression": "# Verifies that the passwords are equal\r\nreturn request.context['password'] == request.context['password_repeat']"
+            }
+        },{
+            "identifiers": {
+                "pk": "096e6282-6b30-4695-bd03-3b143eab5580",
+                "name": "default-enrollment-email-verficiation"
+            },
+            "model": "passbook_stages_email.emailstage",
+            "attrs": {
+                "host": "localhost",
+                "port": 25,
+                "username": "",
+                "use_tls": false,
+                "use_ssl": false,
+                "timeout": 10,
+                "from_address": "system@passbook.local",
+                "token_expiry": 30,
+                "subject": "passbook",
+                "template": "stages/email/for_email/account_confirmation.html"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "6c342b94-790d-425a-ae31-6196b6570722",
+                "name": "default-enrollment-prompt-second"
+            },
+            "model": "passbook_stages_prompt.promptstage",
+            "attrs": {
+                "fields": [
+                    "f78d977a-efa6-4cc2-9a0f-2621a9fd94d2",
+                    "1ff91927-e33d-4615-95b0-c258e5f0df62"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "20375f30-7fa7-4562-8f6e-0f61889f2963",
+                "name": "default-enrollment-prompt-first"
+            },
+            "model": "passbook_stages_prompt.promptstage",
+            "attrs": {
+                "fields": [
+                    "cb954fd4-65a5-4ad9-b1ee-180ee9559cf4",
+                    "7db91ee8-4290-4e08-8d39-63f132402515",
+                    "d30b5eb4-7787-4072-b1ba-65b46e928920"
+                ],
+                "validation_policies": [
+                    "9922212c-47a2-475a-9905-abeb5e621652"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "77090897-eb3f-40db-81e6-b4074b1998c4",
+                "name": "default-enrollment-user-login"
+            },
+            "model": "passbook_stages_user_login.userloginstage",
+            "attrs": {
+                "session_duration": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "a4090add-f483-4ac6-8917-10b493ef843e",
+                "name": "default-enrollment-user-write"
+            },
+            "model": "passbook_stages_user_write.userwritestage",
+            "attrs": {}
+        },
+        {
+            "identifiers": {
+                "pk": "34e1e7d5-8eed-4549-bc7a-305069ff7df0",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "20375f30-7fa7-4562-8f6e-0f61889f2963",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "e40467a6-3052-488c-a1b5-1ad7a80fe7b3",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "6c342b94-790d-425a-ae31-6196b6570722",
+                "order": 1
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "76bc594e-2715-49ab-bd40-994abd9a7b70",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "a4090add-f483-4ac6-8917-10b493ef843e",
+                "order": 2
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "1db34a14-8985-4184-b5c9-254cd585d94f",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "096e6282-6b30-4695-bd03-3b143eab5580",
+                "order": 3
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "2f324f6d-7646-4108-a6e2-e7f90985477f",
+                "target": "773c6673-e4a2-423f-8d32-95b7b4a41cf3",
+                "stage": "77090897-eb3f-40db-81e6-b4074b1998c4",
+                "order": 4
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        }
+    ]
+}

docs/flow/examples/examples.md

@@ -0,0 +1,49 @@
+# Example Flows
+
+!!! info
+    You can apply theses flows multiple times to stay updated, however this will discard all changes you've made.
+
+
+## Enrollment (2 Stage)
+
+Flow: right-click [here](enrollment-2-stage.json) and save the file.
+
+Sign-up flow for new users, which prompts them for their username, email, password and name. No verification is done. Users are also immediately logged on after this flow.
+
+## Enrollment with email verification
+
+Flow: right-click [here](enrollment-email-verification.json) and save the file.
+
+Same flow as above, with an extra email verification stage.
+
+You'll probably have to adjust the Email stage and set your connection details.
+
+## Two-factor Login
+
+Flow: right-click [here](login-2fa.json) and save the file.
+
+Login flow which follows the default pattern (username/email, then password), but also checks for the user's OTP token, if they have one configured
+
+## Login with conditional Captcha
+
+Flow: right-click [here](login-conditional-captcha.json) and save the file.
+
+Login flow which conditionally shows the users a captcha, based on the reputation of their IP and Username.
+
+By default, the captcha test keys are used. You can get a proper key [here](https://www.google.com/recaptcha/intro/v3.html)
+
+## Recovery with email verification
+
+Flow: right-click [here](recovery-email-verification.json) and save the file.
+
+Recovery flow, the user is sent an email after they've identified themselves. After they click on the link in the email, they are prompted for a new password and immediately logged on.
+
+## User deletion
+
+Flow: right-click [here](unenrollment.json) and save the file.
+
+Flow for users to delete their account,
+
+!!! warning
+    This is done without any warning.
+

docs/flow/examples/login-2fa.json

@@ -0,0 +1,111 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "slug": "default-authentication-flow",
+                "pk": "563ece21-e9a4-47e5-a264-23ffd923e393"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default Authentication Flow",
+                "title": "Welcome to passbook!",
+                "designation": "authentication"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "69d41125-3987-499b-8d74-ef27b54b88c8",
+                "name": "default-authentication-login"
+            },
+            "model": "passbook_stages_user_login.userloginstage",
+            "attrs": {
+                "session_duration": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "5f594f27-0def-488d-9855-fe604eb13de5",
+                "name": "default-authentication-identification"
+            },
+            "model": "passbook_stages_identification.identificationstage",
+            "attrs": {
+                "user_fields": [
+                    "email",
+                    "username"
+                ],
+                "template": "stages/identification/login.html",
+                "enrollment_flow": null,
+                "recovery_flow": null
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "37f709c3-8817-45e8-9a93-80a925d293c2",
+                "name": "default-authentication-flow-totp"
+            },
+            "model": "passbook_stages_otp_validate.otpvalidatestage",
+            "attrs": {}
+        },
+        {
+            "identifiers": {
+                "pk": "d8affa62-500c-4c5c-a01f-5835e1ffdf40",
+                "name": "default-authentication-password"
+            },
+            "model": "passbook_stages_password.passwordstage",
+            "attrs": {
+                "backends": [
+                    "django.contrib.auth.backends.ModelBackend"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "a3056482-b692-4e3a-93f1-7351c6a351c7",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "5f594f27-0def-488d-9855-fe604eb13de5",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "4e8538cf-3e18-4a68-82ae-6df6725fa2e6",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "d8affa62-500c-4c5c-a01f-5835e1ffdf40",
+                "order": 1
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "688aec6f-5622-42c6-83a5-d22072d7e798",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "37f709c3-8817-45e8-9a93-80a925d293c2",
+                "order": 2
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "f3fede3a-a9b5-4232-9ec7-be7ff4194b27",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "69d41125-3987-499b-8d74-ef27b54b88c8",
+                "order": 3
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        }
+    ]
+}

docs/flow/examples/login-conditional-captcha.json

@@ -0,0 +1,139 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "slug": "default-authentication-flow",
+                "pk": "563ece21-e9a4-47e5-a264-23ffd923e393"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default Authentication Flow",
+                "title": "Welcome to passbook!",
+                "designation": "authentication"
+            }
+        },
+        {
+            "identifiers": {
+                "name": "default-authentication-login",
+                "pk": "69d41125-3987-499b-8d74-ef27b54b88c8"
+            },
+            "model": "passbook_stages_user_login.userloginstage",
+            "attrs": {
+                "session_duration": 0
+            }
+        },
+        {
+            "identifiers": {
+                "name": "default-authentication-flow-captcha",
+                "pk": "a368cafc-1494-45e9-b75b-b5e7ac2bd3e4"
+            },
+            "model": "passbook_stages_captcha.captchastage",
+            "attrs": {
+                "public_key": "6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI",
+                "private_key": "6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe"
+            }
+        },
+        {
+            "identifiers": {
+                "name": "default-authentication-identification",
+                "pk": "5f594f27-0def-488d-9855-fe604eb13de5"
+            },
+            "model": "passbook_stages_identification.identificationstage",
+            "attrs": {
+                "user_fields": [
+                    "email",
+                    "username"
+                ],
+                "template": "stages/identification/login.html",
+                "enrollment_flow": null,
+                "recovery_flow": null
+            }
+        },
+        {
+            "identifiers": {
+                "name": "default-authentication-password",
+                "pk": "d8affa62-500c-4c5c-a01f-5835e1ffdf40"
+            },
+            "model": "passbook_stages_password.passwordstage",
+            "attrs": {
+                "backends": [
+                    "django.contrib.auth.backends.ModelBackend"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "a3056482-b692-4e3a-93f1-7351c6a351c7",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "5f594f27-0def-488d-9855-fe604eb13de5",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "4e8538cf-3e18-4a68-82ae-6df6725fa2e6",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "d8affa62-500c-4c5c-a01f-5835e1ffdf40",
+                "order": 1
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "3bcd6af0-48a6-4e18-87f3-d251a1a58226",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "a368cafc-1494-45e9-b75b-b5e7ac2bd3e4",
+                "order": 2
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "f3fede3a-a9b5-4232-9ec7-be7ff4194b27",
+                "target": "563ece21-e9a4-47e5-a264-23ffd923e393",
+                "stage": "69d41125-3987-499b-8d74-ef27b54b88c8",
+                "order": 3
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "688c9890-47ad-4327-a9e5-380e88d34be5"
+            },
+            "model": "passbook_policies_reputation.reputationpolicy",
+            "attrs": {
+                "name": "default-authentication-flow-conditional-captcha",
+                "check_ip": true,
+                "check_username": true,
+                "threshold": -5
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "02e4d220-3448-44db-822e-c5255cf7c250",
+                "policy": "688c9890-47ad-4327-a9e5-380e88d34be5",
+                "target": "3bcd6af0-48a6-4e18-87f3-d251a1a58226",
+                "order": 0
+            },
+            "model": "passbook_policies.policybinding",
+            "attrs": {
+                "enabled": true,
+                "timeout": 30
+            }
+        }
+    ]
+}

docs/flow/examples/login.md

@@ -1,36 +0,0 @@
-# Login Flow
-
-This document describes how a simple authentication flow can be created.
-
-This flow is created automatically when passbook is installed.
-
-1. Create an **Identification** stage
-
-    > Here you can select whichever fields the user can identify themselves with
-    > Select the Template **Default Login**, as this template shows the (optional) Flows
-    > Here you can also link optional enrollment and recovery flows.
-
-2. Create a **Password** stage
-
-    > Select the Backend you want the password to be checked against. Select "passbook-internal Userdatabase".
-
-3. Create a **User Login** stage
-
-    > This stage doesn't have any options.
-
-4. Create a flow
-
-    > Create a flow with the delegation of **Authentication**
-    > Assign a name and a slug. The slug is used in the URL when the flow is executed.
-
-5. Bind the stages to the flow
-
-    > Bind the **Identification** Stage with an order of 0
-    > Bind the **Password** Stage with an order of 1
-    > Bind the **User Login** Stage with an order of 2
-
-    ![](login.png)
-
-!!! notice
-
-    This flow can used by any user, authenticated and un-authenticated. This means any authenticated user that visits this flow can login again.

docs/flow/examples/recovery-email-verification.json

@@ -0,0 +1,198 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "pk": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "slug": "default-recovery-flow"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default recovery flow",
+                "title": "Reset your password",
+                "designation": "recovery"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "1ff91927-e33d-4615-95b0-c258e5f0df62"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "email",
+                "label": "Email",
+                "type": "email",
+                "required": true,
+                "placeholder": "Email",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "7db91ee8-4290-4e08-8d39-63f132402515"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password",
+                "label": "Password",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password",
+                "order": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "d30b5eb4-7787-4072-b1ba-65b46e928920"
+            },
+            "model": "passbook_stages_prompt.prompt",
+            "attrs": {
+                "field_key": "password_repeat",
+                "label": "Password (repeat)",
+                "type": "password",
+                "required": true,
+                "placeholder": "Password (repeat)",
+                "order": 1
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "cd042fc6-cc92-4b98-b7e6-f4729df798d8"
+            },
+            "model": "passbook_policies_expression.expressionpolicy",
+            "attrs": {
+                "name": "default-password-change-password-equal",
+                "expression": "# Check that both passwords are equal.\nreturn request.context['password'] == request.context['password_repeat']"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "e54045a7-6ecb-4ad9-ad37-28e72d8e565e",
+                "name": "default-recovery-identification"
+            },
+            "model": "passbook_stages_identification.identificationstage",
+            "attrs": {
+                "user_fields": [
+                    "email",
+                    "username"
+                ],
+                "template": "stages/identification/recovery.html",
+                "enrollment_flow": null,
+                "recovery_flow": null
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "3909fd60-b013-4668-8806-12e9507dab97",
+                "name": "default-recovery-user-write"
+            },
+            "model": "passbook_stages_user_write.userwritestage",
+            "attrs": {}
+        },
+        {
+            "identifiers": {
+                "pk": "66f948dc-3f74-42b2-b26b-b8b9df109efb",
+                "name": "default-recovery-email"
+            },
+            "model": "passbook_stages_email.emailstage",
+            "attrs": {
+                "host": "localhost",
+                "port": 25,
+                "username": "",
+                "use_tls": false,
+                "use_ssl": false,
+                "timeout": 10,
+                "from_address": "system@passbook.local",
+                "token_expiry": 30,
+                "subject": "passbook",
+                "template": "stages/email/for_email/password_reset.html"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "975d5502-1e22-4d10-b560-fbc5bd70ff4d",
+                "name": "default-password-change-prompt"
+            },
+            "model": "passbook_stages_prompt.promptstage",
+            "attrs": {
+                "fields": [
+                    "7db91ee8-4290-4e08-8d39-63f132402515",
+                    "d30b5eb4-7787-4072-b1ba-65b46e928920"
+                ],
+                "validation_policies": [
+                    "cd042fc6-cc92-4b98-b7e6-f4729df798d8"
+                ]
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "fcdd4206-0d35-4ad2-a59f-5a72422936bb",
+                "name": "default-recovery-user-login"
+            },
+            "model": "passbook_stages_user_login.userloginstage",
+            "attrs": {
+                "session_duration": 0
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "7af7558e-2196-4b9f-a08e-d38420b7cfbb",
+                "target": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "stage": "e54045a7-6ecb-4ad9-ad37-28e72d8e565e",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "29446fd6-dd93-4e92-9830-2d81debad5ae",
+                "target": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "stage": "66f948dc-3f74-42b2-b26b-b8b9df109efb",
+                "order": 1
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "1219d06e-2c06-4c5b-a162-78e3959c6cf0",
+                "target": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "stage": "975d5502-1e22-4d10-b560-fbc5bd70ff4d",
+                "order": 2
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "66de86ba-0707-46a0-8475-ff2e260d6935",
+                "target": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "stage": "3909fd60-b013-4668-8806-12e9507dab97",
+                "order": 3
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "9cec2334-d4a2-4895-a2b2-bc5ae4e9639a",
+                "target": "a5993183-89c0-43d2-a7f4-ddffb17baba7",
+                "stage": "fcdd4206-0d35-4ad2-a59f-5a72422936bb",
+                "order": 4
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        }
+    ]
+}

docs/flow/examples/unenrollment.json

@@ -0,0 +1,37 @@
+{
+    "version": 1,
+    "entries": [
+        {
+            "identifiers": {
+                "pk": "59a576ce-2f23-4a63-b63a-d18dc7e550f5",
+                "slug": "default-unenrollment-flow"
+            },
+            "model": "passbook_flows.flow",
+            "attrs": {
+                "name": "Default unenrollment flow",
+                "title": "Delete your account",
+                "designation": "unenrollment"
+            }
+        },
+        {
+            "identifiers": {
+                "pk": "c62ac2a4-2735-4a0f-abd0-8523d68c1209",
+                "name": "default-unenrollment-user-delete"
+            },
+            "model": "passbook_stages_user_delete.userdeletestage",
+            "attrs": {}
+        },
+        {
+            "identifiers": {
+                "pk": "eb9aff2b-b95d-40b3-ad08-233aa77bbcf3",
+                "target": "59a576ce-2f23-4a63-b63a-d18dc7e550f5",
+                "stage": "c62ac2a4-2735-4a0f-abd0-8523d68c1209",
+                "order": 0
+            },
+            "model": "passbook_flows.flowstagebinding",
+            "attrs": {
+                "re_evaluate_policies": false
+            }
+        }
+    ]
+}

docs/installation/docker-compose.md

@@ -16,15 +16,15 @@ wget https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml
 # Optionally enable Error-reporting
 # export PASSBOOK_ERROR_REPORTING=true
 # Optionally deploy a different version
-# export PASSBOOK_TAG=0.8.15-beta
+# export PASSBOOK_TAG=0.10.0-stable
 # If this is a productive installation, set a different PostgreSQL Password
 # export PG_PASS=$(pwgen 40 1)
 docker-compose pull
 docker-compose up -d
-docker-compose exec server ./manage.py migrate
+docker-compose run --rm server migrate
 ```
 
-The compose file references the current latest version, which can be overridden with the `SERVER_TAG` environment variable.
+The compose file statically references the latest version available at the time of downloading, which can be overridden with the `SERVER_TAG` environment variable.
 
 If you plan to use this setup for production, it is also advised to change the PostgreSQL password by setting `PG_PASS` to a password of your choice.
 

docs/installation/kubernetes.md

@@ -5,29 +5,31 @@ For a mid to high-load installation, Kubernetes is recommended. passbook is inst
 This installation automatically applies database migrations on startup. After the installation is done, you can use `pbadmin` as username and password.
 
 ```
-# Default values for passbook.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-# passbook version to use. Defaults to latest stable version
-# image:
-#   tag:
+###################################
+# Values directly affecting passbook
+###################################
+image:
+  name: beryju/passbook
+  name_static: beryju/passbook-static
+  tag: 0.10.0-stable
 
 nameOverride: ""
 
+serverReplicas: 1
+workerReplicas: 1
+
 config:
   # Optionally specify fixed secret_key, otherwise generated automatically
   # secret_key: _k*@6h2u2@q-dku57hhgzb7tnx*ba9wodcb^s9g0j59@=y(@_o
   # Enable error reporting
-  error_reporting: false
+  error_reporting:
+    enabled: false
+    environment: customer
+    send_pii: false
   # Log level used by web and worker
   # Can be either debug, info, warning, error
   log_level: warning
 
-# This Helm chart ships with built-in Prometheus ServiceMonitors and Rules.
-# This requires the CoreOS Prometheus Operator.
-monitoring:
-  enabled: false
-
 # Enable Database Backups to S3
 # backup:
 #   access_key: access-key
@@ -35,20 +37,15 @@ monitoring:
 #   bucket: s3-bucket
 #   host: s3-host
 
-ingress:
-  enabled: false
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  path: /
-  hosts:
-    - passbook.k8s.local
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - passbook.k8s.local
+###################################
+# Values controlling dependencies
+###################################
 
-# These settings configure the packaged PostgreSQL and Redis chart.
+install:
+  postgresql: true
+  redis: true
+
+# These values influence the bundled postgresql and redis charts, but are also used by passbook to connect
 postgresql:
   postgresqlDatabase: passbook
 
@@ -60,4 +57,16 @@ redis:
       enabled: false
     # https://stackoverflow.com/a/59189742
     disableCommands: []
+
+ingress:
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  path: /
+  hosts:
+    - passbook.k8s.local
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - passbook.k8s.local
 ```

docs/integrations/services/aws/index.md

@@ -16,6 +16,7 @@ Create an application in passbook and note the slug, as this will be used later.
 -   ACS URL: `https://signin.aws.amazon.com/saml`
 -   Audience: `urn:amazon:webservices`
 -   Issuer: `passbook`
+-   Binding: `Post`
 
 You can of course use a custom signing certificate, and adjust durations.
 

docs/outposts/deploy-docker-compose.md

@@ -0,0 +1,20 @@
+# Outpost deployment in docker-compose
+
+To deploy an outpost with docker-compose, use  this snippet in your docker-compose file.
+
+You can also run the outpost in a separate docker-compose project, you just have to ensure that the outpost container can reach your application container.
+
+```yaml
+version: 3.5
+
+services:
+  passbook_proxy:
+    image: beryju/passbook-proxy:0.10.0-stable
+    ports:
+      - 4180:4180
+      - 4443:4443
+    environment:
+      PASSBOOK_HOST: https://your-passbook.tld
+      PASSBOOK_INSECURE: 'true'
+      PASSBOOK_TOKEN: token-generated-by-passbook
+```

docs/outposts/deploy-kubernetes.md

@@ -0,0 +1,99 @@
+# Outpost deployment on Kubernetes
+
+Use the following manifest, replacing all values surrounded with `__`.
+
+Afterwards, configure the proxy provider to connect to `<service name>.<namespace>.svc.cluster.local`, and update your Ingress to connect to the `passbook-outpost` service.
+
+```yaml
+api_version: v1
+kind: secret
+metadata:
+  labels:
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: passbook.beryju.org
+    app.kubernetes.io/name: passbook-proxy
+    app.kubernetes.io/version: 0.10.0
+  name: passbook-outpost-api
+string_data:
+  passbook_host: '__PASSBOOK_URL__'
+  passbook_host_insecure: 'true'
+  token: '__PASSBOOK_TOKEN__'
+type: Opaque
+---
+api_version: apps/v1
+kind: deployment
+metadata:
+  labels:
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: passbook.beryju.org
+    app.kubernetes.io/name: passbook-proxy
+    app.kubernetes.io/version: 0.10.0
+  name: passbook-outpost
+spec:
+  selector:
+    match_labels:
+      app.kubernetes.io/instance: test
+      app.kubernetes.io/managed-by: passbook.beryju.org
+      app.kubernetes.io/name: passbook-proxy
+      app.kubernetes.io/version: 0.10.0
+    template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: test
+        app.kubernetes.io/managed-by: passbook.beryju.org
+        app.kubernetes.io/name: passbook-proxy
+        app.kubernetes.io/version: 0.10.0
+        spec:
+      containers:
+      -  env:
+        - name: PASSBOOK_HOST
+          value_from:
+            secret_key_ref:
+              key: passbook_host
+              name: passbook-outpost-api
+        - name: PASSBOOK_TOKEN
+          value_from:
+            secret_key_ref:
+              key: token
+              name: passbook-outpost-api
+        - name: PASSBOOK_INSECURE
+          value_from:
+            secret_key_ref:
+              key: passbook_host_insecure
+              name: passbook-outpost-api
+        image: beryju/passbook-proxy:0.10.0
+        name: proxy
+        ports:
+        - containerPort: 4180
+          name: http
+          protocol: TCP
+        - containerPort: 4443
+          name: http
+          protocol: TCP
+---
+api_version: v1
+kind: service
+metadata:
+  labels:
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: passbook.beryju.org
+    app.kubernetes.io/name: passbook-proxy
+    app.kubernetes.io/version: 0.10.0
+  name: passbook-outpost
+spec:
+  ports:
+  - name: http
+    port: 4180
+    protocol: TCP
+    targetPort: http
+  - name: https
+    port: 4443
+    protocol: TCP
+    targetPort: https
+  selector:
+    app.kubernetes.io/instance: test
+    app.kubernetes.io/managed-by: passbook.beryju.org
+    app.kubernetes.io/name: passbook-proxy
+    app.kubernetes.io/version: 0.10.0
+  type: ClusterIP
+```

docs/outposts/outposts.md

@@ -0,0 +1,14 @@
+# Outposts
+
+An outpost is a single deployment of a passbook component, which can be deployed in a completely separate environment. Currently, only the Proxy Provider is supported as outpost.
+
+![](outposts.png)
+
+Upon creation, a service account and a token is generated. The service account only has permissions to read the outpost and provider configuration. This token is used by the Outpost to connect to passbook.
+
+To deploy an outpost, see: <a name="deploy">
+
+- [Kubernetes](deploy-kubernetes.md)
+- [docker-compose](deploy-docker-compose.md)
+
+In future versions, this snippet will be automatically generated. You will also be able to deploy an outpost directly into a kubernetes cluster.

docs/policies/expression.md

@@ -26,5 +26,5 @@ return False
     - `request.obj`: A Django Model instance. This is only set if the policy is ran against an object.
     - `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.
 - `pb_is_sso_flow`: Boolean which is true if request was initiated by authenticating through an external provider.
-- `pb_client_ip`: Client's IP Address or '255.255.255.255' if no IP Address could be extracted.
+- `pb_client_ip`: Client's IP Address or '255.255.255.255' if no IP Address could be extracted. Can be [compared](../expressions/index.md#comparing-ip-addresses)
 - `pb_flow_plan`: Current Plan if Policy is called from the Flow Planner.

docs/property-mappings/index.md

@@ -19,3 +19,7 @@ LDAP Property Mappings are used when you define a LDAP Source. These mappings de
 - Autogenerated LDAP Mapping: sn -> last_name
 
 These are configured with most common LDAP setups.
+
+## Scope Mapping
+
+Scope Mappings are used by the OAuth2 Provider to map information from passbook to OAuth2/OpenID Claims.

docs/providers.md

@@ -1,24 +0,0 @@
-# Providers
-
-Providers allow external applications to authenticate against passbook and use its user information.
-
-## OpenID Provider
-
-This provider utilises the commonly used OpenID Connect variation of OAuth2.
-
-## OAuth2 Provider
-
-This provider is slightly different than the OpenID Provider. While it uses the same basic OAuth2 Protocol, it provides a GitHub-compatible endpoint. This allows you to integrate applications which don't support custom OpenID providers.
-The API exposes username, email, name, and groups in a GitHub-compatible format.
-This provider currently supports the following scopes:
-
-- `openid`: Access OpenID Userinfo
-- `userinfo`: Access OpenID Userinfo
-- `email`: Access OpenID Email
-- `user:email`: GitHub Compatibility: User Email
-- `read:org`: GitHub Compatibility: User Groups
-
-## SAML Provider
-
-This provider allows you to integrate enterprise software using the SAML2 Protocol. It supports signed requests and uses [Property Mappings](property-mappings/index.md#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose vendor-specific fields.
-Default fields are exposed through auto-generated Property Mappings, which are prefixed with "Autogenerated".

docs/providers/oauth2.md

@@ -0,0 +1,31 @@
+# OAuth2 Provider
+
+This provider supports both generic OAuth2 as well as OpenID Connect
+
+Scopes can be configured using Scope Mappings, a type of [Property Mappings](../property-mappings/index.md#scope-mapping).
+
+Endpoint | URL
+---------|---
+Authorization        | `/application/o/authorize/`
+Token                | `/application/o/token/`
+User Info            | `/application/o/userinfo/`
+End Session          | `/application/o/end-session/`
+Introspect           | `/application/o/end-session/`
+JWKS                 | `/application/o/<application slug>/jwks/`
+OpenID Configuration | `/application/o/<application slug>/.well-known/openid-configuration`
+
+## GitHub Compatibility
+
+This provider also exposes a GitHub-compatible endpoint. This endpoint can be used by applications, which support authenticating against GitHub Enterprise, but not generic OpenID Connect.
+
+To use any of the GitHub Compatibility scopes, you have to use the GitHub Compatibility Endpoints.
+
+
+Endpoint | URL
+---------|---
+Authorization        | `/login/oauth/authorize`
+Token                | `/login/oauth/access_token`
+User Info            | `/user`
+User Teams Info      | `/user/teams`
+
+To access the user's email address, a scope of `user:email` is required. To access their groups, `read:org` is required. Because these scopes are handled by a different endpoint, they are not customisable as a Scope Mapping.

docs/providers/proxy.md

@@ -0,0 +1,16 @@
+# Proxy Provider
+
+!!! info
+    This provider is to be used in conjunction with [Outposts](../outposts/outposts.md)
+
+This provider protects applications, which have no built-in support for OAuth2 or SAML. This is done by running a lightweight Reverse Proxy in front of the application, which authenticates the requests.
+
+passbook Proxy is based on [oauth2_proxy](https://github.com/oauth2-proxy/oauth2-proxy), but has been integrated more tightly with passbook.
+
+The Proxy these extra headers to the application:
+
+Header Name | Value
+-------------|-------
+X-Auth-Request-User | The user's unique identifier
+X-Auth-Request-Email | The user's email address
+X-Auth-Request-Preferred-Username | The user's username

docs/providers/saml.md

@@ -0,0 +1,12 @@
+# SAML Provider
+
+This provider allows you to integrate enterprise software using the SAML2 Protocol. It supports signed requests and uses [Property Mappings](../property-mappings/index.md#saml-property-mapping) to determine which fields are exposed and what values they return. This makes it possible to expose vendor-specific fields.
+Default fields are exposed through auto-generated Property Mappings, which are prefixed with "Autogenerated".
+
+
+Endpoint | URL
+---------|---
+SSO (Redirect binding) | `/application/saml/<application slug>/sso/binding/redirect/`
+SSO (POST binding) | `/application/saml/<application slug>/sso/binding/post/`
+IdP-initiated login | `/application/saml/<application slug>/sso/binding/init/`
+Metadata Download | `/application/saml/<application slug>/metadata/`

docs/upgrading/to-0.10.md

@@ -0,0 +1,73 @@
+# Upgrading to 0.10
+
+This update brings a lot of big features, such as:
+
+- New OAuth2/OpenID Provider
+
+  This new provider merges both OAuth2 and OpenID. It is based on the codebase of the old provider, which has been simplified and cleaned from the ground up. Support for Property Mappings has also been added. Because of this change, OpenID and OAuth2 Providers will have to be re-created.
+
+- Proxy Provider
+
+  Due to this new OAuth2 Provider, the Application Gateway Provider, now simply called "Proxy Provider" has been revamped as well. The new passbook Proxy integrates more tightly with passbook via the new Outposts system. The new proxy also supports multiple applications per proxy instance, can configure TLS based on passbook Keypairs, and more.
+
+  See [Proxy](../providers/proxy.md)
+
+- Outpost System
+
+  This is a new Object type, currently used only by the Proxy Provider. It manages the creation and permissions of service accounts, which are used by the outposts to communicate with passbook.
+
+  See [Outposts](../outposts/outposts.md)
+
+- Flow Import/Export
+
+  Flows can now be imported and exported. This feature can be used as a backup system, or to share complex flows with other people. Example flows have also been added to the documentation to help you get going with passbook.
+
+## Under the hood
+
+- passbook now runs on Django 3.1 and Channels with complete ASGI enabled
+- uwsgi has been replaced with Gunicorn and uvicorn
+- Elastic APM has been replaced with Sentry Performance metrics
+- Flow title is now configurable separately from the name
+- All logging output is now json
+
+## Upgrading
+
+### docker-compose
+
+The docker-compose file has been updated, please download the latest from `https://raw.githubusercontent.com/BeryJu/passbook/master/docker-compose.yml`.
+By default, the new compose file uses a fixed version to prevent unintended updates.
+
+Before updating the file, stop all containers. Then download the file, pull the new containers and start the database.
+
+```
+docker-compose down
+docker-compose pull
+docker-compose up --no-start
+docker-compose start redis postgrseql
+docker-compose run --rm server migrate
+docker-compose up -d
+```
+
+### Helm
+
+A few options have changed:
+
+- `error_reporting` was changed from a simple boolean to a dictionary:
+
+```yaml
+  error_reporting:
+    enabled: false
+    environment: customer
+    send_pii: false
+```
+
+- The `apm` and `monitoring` blocks have been removed.
+- `serverReplicas` and `workerReplicas` have been added
+
+### Upgrading
+
+This upgrade only applies if you are upgrading from a running 0.9 instance. Passbook detects this on startup, and automatically executes this upgrade.
+
+Because this upgrade brings the new OAuth2 Provider, the old providers will be lost in the process. Make sure to take note of the providers you want to bring over.
+
+Another side-effect of this upgrade is the change of OAuth2 URLs, see [here](../providers/oauth2.md).

docs/upgrading/to-0.9.md

@@ -1,4 +1,4 @@
-# Upgrading from 0.8.x
+# Upgrading to 0.9
 
 Due to some database changes that had to be rather sooner than later, there is no possibility to directly upgrade. You must extract the data before hand and import it again. It is recommended to spin up a second instance of passbook to do this.
 
@@ -6,13 +6,13 @@ To export data from your old instance, run this command:
 
 - docker-compose
 ```
-docker-compose exec server ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event
+docker-compose exec server ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
 docker cp passbook_server_1:/tmp/passbook_dump.json passbook_dump.json
 ```
 
 - kubernetes
 ```
-kubectl exec -it passbook-web-... -- ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event
+kubectl exec -it passbook-web-... -- ./manage.py dumpdata -o /tmp/passbook_dump.json passbook_core.User passbook_core.Group passbook_crypto.CertificateKeyPair passbook_audit.Event otp_totp.totpdevice otp_static.staticdevice otp_static.statictoken
 kubectl cp passbook-web-...:/tmp/passbook_dump.json passbook_dump.json
 ```
 

e2e/ci.docker-compose.yml

@@ -0,0 +1,8 @@
+version: '3.7'
+
+services:
+  chrome:
+    image: selenium/standalone-chrome:3.141.59-20200525
+    volumes:
+      - /dev/shm:/dev/shm
+    network_mode: host

e2e/docker-compose.yml

@@ -2,19 +2,8 @@ version: '3.7'
 
 services:
   chrome:
-    image: selenium/standalone-chrome-debug:3.141.59-20200525
+    image: selenium/standalone-chrome-debug:3.141.59-20200719
     volumes:
       - /dev/shm:/dev/shm
     network_mode: host
-
-  postgresql:
-    image: postgres:11
     restart: always
-    environment:
-      POSTGRES_HOST_AUTH_METHOD: trust
-      POSTGRES_DB: passbook
-    network_mode: host
-  redis:
-    image: redis
-    restart: always
-    network_mode: host

e2e/passbook.side

@@ -1,498 +0,0 @@
-{
-  "id": "7d9b2407-1520-4c04-b040-68e8ada9aecc",
-  "version": "2.0",
-  "name": "passbook",
-  "url": "http://localhost:8000",
-  "tests": [{
-    "id": "94b39863-74ec-4b7d-98c5-2b380b6d2c55",
-    "name": "passbook login simple",
-    "commands": [{
-      "id": "e60e4382-4f96-44c3-ba06-5e18609c9c2b",
-      "comment": "",
-      "command": "open",
-      "target": "/flows/default-authentication-flow/?next=%2F",
-      "targets": [],
-      "value": ""
-    }, {
-      "id": "b2652f24-931e-45b0-b01d-2f0ac0f74db8",
-      "comment": "",
-      "command": "click",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": ""
-    }, {
-      "id": "f1930f8a-984a-4076-a925-20937bb2f8d3",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "admin@example.tld"
-    }, {
-      "id": "0b568ee3-1bed-4821-a3bc-f6b960dbed9d",
-      "comment": "",
-      "command": "sendKeys",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "${KEY_ENTER}"
-    }, {
-      "id": "6d98e479-2825-484d-996a-ccf350d2761f",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "pbadmin"
-    }, {
-      "id": "6f7abec6-ff44-4eb5-ae23-520c1c29a706",
-      "comment": "",
-      "command": "sendKeys",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "${KEY_ENTER}"
-    }, {
-      "id": "04c5876f-1405-4077-a98b-e911f09113d7",
-      "comment": "",
-      "command": "assertText",
-      "target": "xpath=//a[contains(@href, '/-/user/')]",
-      "targets": [
-        ["linkText=pbadmin", "linkText"],
-        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
-        ["xpath=//a[contains(text(),'pbadmin')]", "xpath:link"],
-        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
-        ["xpath=//div[2]/a", "xpath:position"],
-        ["xpath=//a[contains(.,'pbadmin')]", "xpath:innerText"]
-      ],
-      "value": "pbadmin"
-    }]
-  }, {
-    "id": "61948b3c-3012-4f97-aa52-bc8f34fec333",
-    "name": "passbook enroll simple",
-    "commands": [{
-      "id": "0f4884b3-4891-41bc-956d-1fa433e892e9",
-      "comment": "",
-      "command": "open",
-      "target": "/flows/default-authentication-flow/?next=%2F",
-      "targets": [],
-      "value": ""
-    }, {
-      "id": "84d3861f-a60c-4650-8689-535f82b39577",
-      "comment": "",
-      "command": "click",
-      "target": "linkText=Sign up.",
-      "targets": [
-        ["linkText=Sign up.", "linkText"],
-        ["css=.pf-c-login__main-footer-band-item > a", "css:finder"],
-        ["xpath=//a[contains(text(),'Sign up.')]", "xpath:link"],
-        ["xpath=//main[@id='flow-body']/footer/div/p/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/flows/default-enrollment-flow/')]", "xpath:href"],
-        ["xpath=//a", "xpath:position"],
-        ["xpath=//a[contains(.,'Sign up.')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "a32435ca-d84a-41e7-a915-fcbbc5f88341",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_username",
-      "targets": [
-        ["id=id_username", "id"],
-        ["name=username", "name"],
-        ["css=#id_username", "css:finder"],
-        ["xpath=//input[@id='id_username']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "foo"
-    }, {
-      "id": "3b5dcf53-8297-46c5-88b7-11c2eb25f34f",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "pbadmin"
-    }, {
-      "id": "e948d61c-dae6-4994-b56f-ff130892b342",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password_repeat",
-      "targets": [
-        ["id=id_password_repeat", "id"],
-        ["name=password_repeat", "name"],
-        ["css=#id_password_repeat", "css:finder"],
-        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[3]/input", "xpath:idRelative"],
-        ["xpath=//div[3]/input", "xpath:position"]
-      ],
-      "value": "pbadmin"
-    }, {
-      "id": "e7527bfc-ec74-4d96-86f0-5a3a55a59025",
-      "comment": "",
-      "command": "click",
-      "target": "css=.pf-c-button",
-      "targets": [
-        ["css=.pf-c-button", "css:finder"],
-        ["xpath=//button[@type='submit']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[4]/button", "xpath:idRelative"],
-        ["xpath=//button", "xpath:position"],
-        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "434b842c-a659-4ff5-aca8-06a6a3489597",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_name",
-      "targets": [
-        ["id=id_name", "id"],
-        ["name=name", "name"],
-        ["css=#id_name", "css:finder"],
-        ["xpath=//input[@id='id_name']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "some name"
-    }, {
-      "id": "cbc43a1b-2cfe-46e2-85bc-476fb32c6cb1",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_email",
-      "targets": [
-        ["id=id_email", "id"],
-        ["name=email", "name"],
-        ["css=#id_email", "css:finder"],
-        ["xpath=//input[@id='id_email']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "foo@bar.baz"
-    }, {
-      "id": "e74389a0-228b-4312-9677-e9add6358de3",
-      "comment": "",
-      "command": "click",
-      "target": "css=.pf-c-button",
-      "targets": [
-        ["css=.pf-c-button", "css:finder"],
-        ["xpath=//button[@type='submit']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[3]/button", "xpath:idRelative"],
-        ["xpath=//button", "xpath:position"],
-        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "3e22f9c2-5ebd-49c2-81b1-340fa0435bbc",
-      "comment": "",
-      "command": "click",
-      "target": "linkText=foo",
-      "targets": [
-        ["linkText=foo", "linkText"],
-        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
-        ["xpath=//a[contains(text(),'foo')]", "xpath:link"],
-        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
-        ["xpath=//div[2]/a", "xpath:position"],
-        ["xpath=//a[contains(.,'foo')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "60124cfd-f11c-4d7f-8b01-bef54c8cbd73",
-      "comment": "",
-      "command": "assertText",
-      "target": "xpath=//a[contains(@href, '/-/user/')]",
-      "targets": [
-        ["linkText=foo", "linkText"],
-        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
-        ["xpath=//a[contains(text(),'foo')]", "xpath:link"],
-        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
-        ["xpath=//div[2]/a", "xpath:position"],
-        ["xpath=//a[contains(.,'foo')]", "xpath:innerText"]
-      ],
-      "value": "foo"
-    }, {
-      "id": "429ee61b-9991-4919-8131-55f8e1bd9a0d",
-      "comment": "",
-      "command": "assertValue",
-      "target": "id=id_username",
-      "targets": [],
-      "value": "foo"
-    }, {
-      "id": "f6c50760-52ed-4c1d-b232-30f8afe144eb",
-      "comment": "",
-      "command": "assertText",
-      "target": "id=id_name",
-      "targets": [
-        ["id=id_name", "id"],
-        ["name=name", "name"],
-        ["css=#id_name", "css:finder"],
-        ["xpath=//input[@id='id_name']", "xpath:attributes"],
-        ["xpath=//main[@id='main-content']/section/div/div/div/div[2]/form/div[2]/div/input", "xpath:idRelative"],
-        ["xpath=//div[2]/div/input", "xpath:position"]
-      ],
-      "value": "some name"
-    }, {
-      "id": "b26905b5-89b5-4b41-abf5-a9f848f08622",
-      "comment": "",
-      "command": "assertText",
-      "target": "id=id_email",
-      "targets": [
-        ["id=id_email", "id"],
-        ["name=email", "name"],
-        ["css=#id_email", "css:finder"],
-        ["xpath=//input[@id='id_email']", "xpath:attributes"],
-        ["xpath=//main[@id='main-content']/section/div/div/div/div[2]/form/div[3]/div/input", "xpath:idRelative"],
-        ["xpath=//div[3]/div/input", "xpath:position"]
-      ],
-      "value": "foo@bar.baz"
-    }]
-  }, {
-    "id": "1a3172e0-ac23-4781-9367-19afccee4f4a",
-    "name": "flows stage setup password",
-    "commands": [{
-      "id": "77784f77-d840-4b3d-a42f-7928f02fb7e1",
-      "comment": "",
-      "command": "open",
-      "target": "/flows/default-authentication-flow/?next=%2F",
-      "targets": [],
-      "value": ""
-    }, {
-      "id": "783aa9a6-81e5-49c6-8789-2f360a5750b1",
-      "comment": "",
-      "command": "setWindowSize",
-      "target": "1699x1417",
-      "targets": [],
-      "value": ""
-    }, {
-      "id": "cb0cd63e-30e9-4443-af59-5345fe26dc88",
-      "comment": "",
-      "command": "click",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": ""
-    }, {
-      "id": "8466ded1-c5f6-451c-b63f-0889da38503a",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "pbadmin"
-    }, {
-      "id": "27383093-d01a-4416-8fc6-9caad4926cd3",
-      "comment": "",
-      "command": "sendKeys",
-      "target": "id=id_uid_field",
-      "targets": [
-        ["id=id_uid_field", "id"],
-        ["name=uid_field", "name"],
-        ["css=#id_uid_field", "css:finder"],
-        ["xpath=//input[@id='id_uid_field']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "${KEY_ENTER}"
-    }, {
-      "id": "4602745a-0ebb-4425-a841-a1ed4899659d",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "pbadmin"
-    }, {
-      "id": "d1ff4f81-d8f9-45dc-ad5d-f99b54c0cd18",
-      "comment": "",
-      "command": "sendKeys",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "${KEY_ENTER}"
-    }, {
-      "id": "014c8f57-7ef2-469c-b700-efa94ba81b66",
-      "comment": "",
-      "command": "click",
-      "target": "css=.pf-c-page__header",
-      "targets": [
-        ["css=.pf-c-page__header", "css:finder"],
-        ["xpath=//div[@id='page-default-nav-example']/header", "xpath:idRelative"],
-        ["xpath=//header", "xpath:position"]
-      ],
-      "value": ""
-    }, {
-      "id": "14e86b6f-6add-4bcc-913a-42b1e7322c79",
-      "comment": "",
-      "command": "click",
-      "target": "linkText=pbadmin",
-      "targets": [
-        ["linkText=pbadmin", "linkText"],
-        ["css=.pf-c-page__header-tools-group:nth-child(2) > .pf-c-button", "css:finder"],
-        ["xpath=//a[contains(text(),'pbadmin')]", "xpath:link"],
-        ["xpath=//div[@id='page-default-nav-example']/header/div[3]/div[2]/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/-/user/')]", "xpath:href"],
-        ["xpath=//div[2]/a", "xpath:position"],
-        ["xpath=//a[contains(.,'pbadmin')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "8280da13-632e-4cba-9e18-ecae0d57d052",
-      "comment": "",
-      "command": "click",
-      "target": "linkText=Change password",
-      "targets": [
-        ["linkText=Change password", "linkText"],
-        ["css=.pf-c-nav__section:nth-child(2) .pf-c-nav__link", "css:finder"],
-        ["xpath=//a[contains(text(),'Change password')]", "xpath:link"],
-        ["xpath=//nav[@id='page-default-nav-example-primary-nav']/section[2]/ul/li/a", "xpath:idRelative"],
-        ["xpath=//a[contains(@href, '/-/user/stage/password/b929b529-e384-4409-8d40-ac4a195fcab2/change/?next=%2F-%2Fuser%2F')]", "xpath:href"],
-        ["xpath=//section[2]/ul/li/a", "xpath:position"],
-        ["xpath=//a[contains(.,'Change password')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }, {
-      "id": "716d7e0c-79dc-469b-a31f-dceaa0765e9c",
-      "comment": "",
-      "command": "click",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": ""
-    }, {
-      "id": "77005d70-adf0-4add-8329-b092d43f829a",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password",
-      "targets": [
-        ["id=id_password", "id"],
-        ["name=password", "name"],
-        ["css=#id_password", "css:finder"],
-        ["xpath=//input[@id='id_password']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div/input", "xpath:idRelative"],
-        ["xpath=//div/input", "xpath:position"]
-      ],
-      "value": "test"
-    }, {
-      "id": "965ca365-99f4-45d1-97c3-c944269341b9",
-      "comment": "",
-      "command": "click",
-      "target": "id=id_password_repeat",
-      "targets": [
-        ["id=id_password_repeat", "id"],
-        ["name=password_repeat", "name"],
-        ["css=#id_password_repeat", "css:finder"],
-        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": ""
-    }, {
-      "id": "9b421468-c65e-4943-b6b1-1e80410a6b87",
-      "comment": "",
-      "command": "type",
-      "target": "id=id_password_repeat",
-      "targets": [
-        ["id=id_password_repeat", "id"],
-        ["name=password_repeat", "name"],
-        ["css=#id_password_repeat", "css:finder"],
-        ["xpath=//input[@id='id_password_repeat']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[2]/input", "xpath:idRelative"],
-        ["xpath=//div[2]/input", "xpath:position"]
-      ],
-      "value": "test"
-    }, {
-      "id": "572c1400-a0f2-499f-808a-18c1f56bf13f",
-      "comment": "",
-      "command": "click",
-      "target": "css=.pf-c-button",
-      "targets": [
-        ["css=.pf-c-button", "css:finder"],
-        ["xpath=//button[@type='submit']", "xpath:attributes"],
-        ["xpath=//main[@id='flow-body']/div/form/div[3]/button", "xpath:idRelative"],
-        ["xpath=//button", "xpath:position"],
-        ["xpath=//button[contains(.,'Continue')]", "xpath:innerText"]
-      ],
-      "value": ""
-    }]
-  }],
-  "suites": [{
-    "id": "495657fb-3f5e-4431-877c-4d0b248c0841",
-    "name": "Default Suite",
-    "persistSession": false,
-    "parallel": false,
-    "timeout": 300,
-    "tests": ["94b39863-74ec-4b7d-98c5-2b380b6d2c55"]
-  }],
-  "urls": ["http://localhost:8000/"],
-  "plugins": []
-}

e2e/test_flows_enroll.py

@@ -1,17 +1,16 @@
 """Test Enroll flow"""
-from time import sleep
+from sys import platform
+from typing import Any, Dict, Optional
+from unittest.case import skipUnless
 
 from django.test import override_settings
+from docker.types import Healthcheck
 from selenium.webdriver.common.by import By
 from selenium.webdriver.support import expected_conditions as ec
 
-from docker import DockerClient, from_env
-from docker.models.containers import Container
-from docker.types import Healthcheck
 from e2e.utils import USER, SeleniumTestCase
 from passbook.flows.models import Flow, FlowDesignation, FlowStageBinding
 from passbook.policies.expression.models import ExpressionPolicy
-from passbook.policies.models import PolicyBinding
 from passbook.stages.email.models import EmailStage, EmailTemplates
 from passbook.stages.identification.models import IdentificationStage
 from passbook.stages.prompt.models import FieldTypes, Prompt, PromptStage
@@ -19,37 +18,22 @@ from passbook.stages.user_login.models import UserLoginStage
 from passbook.stages.user_write.models import UserWriteStage
 
 
+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestFlowsEnroll(SeleniumTestCase):
     """Test Enroll flow"""
 
-    def setUp(self):
-        super().setUp()
-        self.container = self.setup_client()
-
-    def setup_client(self) -> Container:
-        """Setup test IdP container"""
-        client: DockerClient = from_env()
-        container = client.containers.run(
-            image="mailhog/mailhog",
-            detach=True,
-            network_mode="host",
-            auto_remove=True,
-            healthcheck=Healthcheck(
-                test=["CMD", "wget", "-s", "http://localhost:8025"],
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
+        return {
+            "image": "mailhog/mailhog:v1.0.1",
+            "detach": True,
+            "network_mode": "host",
+            "auto_remove": True,
+            "healthcheck": Healthcheck(
+                test=["CMD", "wget", "--spider", "http://localhost:8025"],
                 interval=5 * 100 * 1000000,
                 start_period=1 * 100 * 1000000,
             ),
-        )
-        while True:
-            container.reload()
-            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
-            if status == "healthy":
-                return container
-            sleep(1)
-
-    def tearDown(self):
-        self.container.kill()
-        super().tearDown()
+        }
 
     def test_enroll_2_step(self):
         """Test 2-step enroll flow"""
@@ -75,9 +59,16 @@ class TestFlowsEnroll(SeleniumTestCase):
             field_key="email", label="E-Mail", order=1, type=FieldTypes.EMAIL
         )
 
+        # Password checking policy
+        password_policy = ExpressionPolicy.objects.create(
+            name="policy-enrollment-password-equals",
+            expression="return request.context['password'] == request.context['password_repeat']",
+        )
+
         # Stages
         first_stage = PromptStage.objects.create(name="prompt-stage-first")
         first_stage.fields.set([username_prompt, password, password_repeat])
+        first_stage.validation_policies.set([password_policy])
         first_stage.save()
         second_stage = PromptStage.objects.create(name="prompt-stage-second")
         second_stage.fields.set([name_field, email])
@@ -85,15 +76,6 @@ class TestFlowsEnroll(SeleniumTestCase):
         user_write = UserWriteStage.objects.create(name="enroll-user-write")
         user_login = UserLoginStage.objects.create(name="enroll-user-login")
 
-        # Password checking policy
-        password_policy = ExpressionPolicy.objects.create(
-            name="policy-enrollment-password-equals",
-            expression="return request.context['password'] == request.context['password_repeat']",
-        )
-        PolicyBinding.objects.create(
-            target=first_stage, policy=password_policy, order=0
-        )
-
         flow = Flow.objects.create(
             name="default-enrollment-flow",
             slug="default-enrollment-flow",
@@ -105,10 +87,10 @@ class TestFlowsEnroll(SeleniumTestCase):
         ident_stage.enrollment_flow = flow
         ident_stage.save()
 
-        FlowStageBinding.objects.create(flow=flow, stage=first_stage, order=0)
-        FlowStageBinding.objects.create(flow=flow, stage=second_stage, order=1)
-        FlowStageBinding.objects.create(flow=flow, stage=user_write, order=2)
-        FlowStageBinding.objects.create(flow=flow, stage=user_login, order=3)
+        FlowStageBinding.objects.create(target=flow, stage=first_stage, order=0)
+        FlowStageBinding.objects.create(target=flow, stage=second_stage, order=1)
+        FlowStageBinding.objects.create(target=flow, stage=user_write, order=2)
+        FlowStageBinding.objects.create(target=flow, stage=user_login, order=3)
 
         self.driver.get(self.live_server_url)
         self.wait.until(
@@ -170,9 +152,16 @@ class TestFlowsEnroll(SeleniumTestCase):
             field_key="email", label="E-Mail", order=1, type=FieldTypes.EMAIL
         )
 
+        # Password checking policy
+        password_policy = ExpressionPolicy.objects.create(
+            name="policy-enrollment-password-equals",
+            expression="return request.context['password'] == request.context['password_repeat']",
+        )
+
         # Stages
         first_stage = PromptStage.objects.create(name="prompt-stage-first")
         first_stage.fields.set([username_prompt, password, password_repeat])
+        first_stage.validation_policies.set([password_policy])
         first_stage.save()
         second_stage = PromptStage.objects.create(name="prompt-stage-second")
         second_stage.fields.set([name_field, email])
@@ -186,15 +175,6 @@ class TestFlowsEnroll(SeleniumTestCase):
         user_write = UserWriteStage.objects.create(name="enroll-user-write")
         user_login = UserLoginStage.objects.create(name="enroll-user-login")
 
-        # Password checking policy
-        password_policy = ExpressionPolicy.objects.create(
-            name="policy-enrollment-password-equals",
-            expression="return request.context['password'] == request.context['password_repeat']",
-        )
-        PolicyBinding.objects.create(
-            target=first_stage, policy=password_policy, order=0
-        )
-
         flow = Flow.objects.create(
             name="default-enrollment-flow",
             slug="default-enrollment-flow",
@@ -206,11 +186,11 @@ class TestFlowsEnroll(SeleniumTestCase):
         ident_stage.enrollment_flow = flow
         ident_stage.save()
 
-        FlowStageBinding.objects.create(flow=flow, stage=first_stage, order=0)
-        FlowStageBinding.objects.create(flow=flow, stage=second_stage, order=1)
-        FlowStageBinding.objects.create(flow=flow, stage=user_write, order=2)
-        FlowStageBinding.objects.create(flow=flow, stage=email_stage, order=3)
-        FlowStageBinding.objects.create(flow=flow, stage=user_login, order=4)
+        FlowStageBinding.objects.create(target=flow, stage=first_stage, order=0)
+        FlowStageBinding.objects.create(target=flow, stage=second_stage, order=1)
+        FlowStageBinding.objects.create(target=flow, stage=user_write, order=2)
+        FlowStageBinding.objects.create(target=flow, stage=email_stage, order=3)
+        FlowStageBinding.objects.create(target=flow, stage=user_login, order=4)
 
         self.driver.get(self.live_server_url)
         self.driver.find_element(By.CSS_SELECTOR, "[role=enroll]").click()
@@ -221,21 +201,25 @@ class TestFlowsEnroll(SeleniumTestCase):
         self.driver.find_element(By.ID, "id_name").send_keys("some name")
         self.driver.find_element(By.ID, "id_email").send_keys("foo@bar.baz")
         self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
-        sleep(3)
+        # Wait for the success message so we know the email is sent
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, ".pf-c-form > p"))
+        )
 
         # Open Mailhog
         self.driver.get("http://localhost:8025")
 
         # Click on first message
+        self.wait.until(
+            ec.presence_of_element_located((By.CLASS_NAME, "msglist-message"))
+        )
         self.driver.find_element(By.CLASS_NAME, "msglist-message").click()
-        sleep(3)
         self.driver.switch_to.frame(self.driver.find_element(By.CLASS_NAME, "tab-pane"))
         self.driver.find_element(By.ID, "confirm").click()
         self.driver.close()
         self.driver.switch_to.window(self.driver.window_handles[0])
 
         # We're now logged in
-        sleep(3)
         self.wait.until(
             ec.presence_of_element_located(
                 (By.XPATH, "//a[contains(@href, '/-/user/')]")

e2e/test_flows_login.py

@@ -1,10 +1,14 @@
 """test default login flow"""
+from sys import platform
+from unittest.case import skipUnless
+
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
 from e2e.utils import USER, SeleniumTestCase
 
 
+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestFlowsLogin(SeleniumTestCase):
     """test default login flow"""
 

e2e/test_flows_stage_setup.py

@@ -1,25 +1,35 @@
 """test stage setup flows (password change)"""
-import string
-from random import SystemRandom
-from time import sleep
+from sys import platform
+from unittest.case import skipUnless
 
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
 from e2e.utils import USER, SeleniumTestCase
 from passbook.core.models import User
+from passbook.flows.models import Flow, FlowDesignation
+from passbook.providers.oauth2.generators import generate_client_secret
+from passbook.stages.password.models import PasswordStage
 
 
+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestFlowsStageSetup(SeleniumTestCase):
     """test stage setup flows"""
 
     def test_password_change(self):
         """test password change flow"""
-        new_password = "".join(
-            SystemRandom().choice(string.ascii_uppercase + string.digits)
-            for _ in range(8)
+        # Ensure that password stage has change_flow set
+        flow = Flow.objects.get(
+            slug="default-password-change", designation=FlowDesignation.STAGE_SETUP,
         )
 
+        stages = PasswordStage.objects.filter(name="default-authentication-password")
+        stage = stages.first()
+        stage.change_flow = flow
+        stage.save()
+
+        new_password = generate_client_secret()
+
         self.driver.get(
             f"{self.live_server_url}/flows/default-authentication-flow/?next=%2F"
         )
@@ -29,13 +39,14 @@ class TestFlowsStageSetup(SeleniumTestCase):
         self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
         self.driver.find_element(By.CSS_SELECTOR, ".pf-c-page__header").click()
         self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+        self.wait_for_url(self.url("passbook_core:user-settings"))
         self.driver.find_element(By.LINK_TEXT, "Change password").click()
         self.driver.find_element(By.ID, "id_password").send_keys(new_password)
         self.driver.find_element(By.ID, "id_password_repeat").click()
         self.driver.find_element(By.ID, "id_password_repeat").send_keys(new_password)
         self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
 
-        sleep(2)
+        self.wait_for_url(self.url("passbook_core:user-settings"))
         # Because USER() is cached, we need to get the user manually here
         user = User.objects.get(username=USER().username)
         self.assertTrue(user.check_password(new_password))

e2e/test_provider_oauth2_github.py

@@ -1,85 +1,77 @@
 """test OAuth Provider flow"""
-from time import sleep
+from sys import platform
+from typing import Any, Dict, Optional
+from unittest.case import skipUnless
 
-from oauth2_provider.generators import generate_client_id, generate_client_secret
+from docker.types import Healthcheck
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 
-from docker import DockerClient, from_env
-from docker.models.containers import Container
-from docker.types import Healthcheck
 from e2e.utils import USER, SeleniumTestCase
 from passbook.core.models import Application
 from passbook.flows.models import Flow
-from passbook.providers.oauth.models import OAuth2Provider
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.providers.oauth2.generators import (
+    generate_client_id,
+    generate_client_secret,
+)
+from passbook.providers.oauth2.models import ClientTypes, OAuth2Provider, ResponseTypes
 
 
-class TestProviderOAuth(SeleniumTestCase):
+@skipUnless(platform.startswith("linux"), "requires local docker")
+class TestProviderOAuth2Github(SeleniumTestCase):
     """test OAuth Provider flow"""
 
     def setUp(self):
-        super().setUp()
         self.client_id = generate_client_id()
         self.client_secret = generate_client_secret()
-        self.container = self.setup_client()
+        super().setUp()
 
-    def setup_client(self) -> Container:
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
         """Setup client grafana container which we test OAuth against"""
-        client: DockerClient = from_env()
-        container = client.containers.run(
-            image="grafana/grafana:latest",
-            detach=True,
-            network_mode="host",
-            auto_remove=True,
-            healthcheck=Healthcheck(
+        return {
+            "image": "grafana/grafana:7.1.0",
+            "detach": True,
+            "network_mode": "host",
+            "auto_remove": True,
+            "healthcheck": Healthcheck(
                 test=["CMD", "wget", "--spider", "http://localhost:3000"],
                 interval=5 * 100 * 1000000,
                 start_period=1 * 100 * 1000000,
             ),
-            environment={
+            "environment": {
                 "GF_AUTH_GITHUB_ENABLED": "true",
-                "GF_AUTH_GITHUB_allow_sign_up": "true",
+                "GF_AUTH_GITHUB_ALLOW_SIGN_UP": "true",
                 "GF_AUTH_GITHUB_CLIENT_ID": self.client_id,
                 "GF_AUTH_GITHUB_CLIENT_SECRET": self.client_secret,
                 "GF_AUTH_GITHUB_SCOPES": "user:email,read:org",
                 "GF_AUTH_GITHUB_AUTH_URL": self.url(
-                    "passbook_providers_oauth:github-authorize"
+                    "passbook_providers_oauth2_github:github-authorize"
                 ),
                 "GF_AUTH_GITHUB_TOKEN_URL": self.url(
-                    "passbook_providers_oauth:github-access-token"
+                    "passbook_providers_oauth2_github:github-access-token"
                 ),
                 "GF_AUTH_GITHUB_API_URL": self.url(
-                    "passbook_providers_oauth:github-user"
+                    "passbook_providers_oauth2_github:github-user"
                 ),
                 "GF_LOG_LEVEL": "debug",
             },
-        )
-        while True:
-            container.reload()
-            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
-            if status == "healthy":
-                return container
-            sleep(1)
-
-    def tearDown(self):
-        self.container.kill()
-        super().tearDown()
+        }
 
     def test_authorization_consent_implied(self):
         """test OAuth Provider flow (default authorization flow with implied consent)"""
-        sleep(1)
         # Bootstrap all needed objects
         authorization_flow = Flow.objects.get(
             slug="default-provider-authorization-implicit-consent"
         )
         provider = OAuth2Provider.objects.create(
             name="grafana",
-            client_type=OAuth2Provider.CLIENT_CONFIDENTIAL,
-            authorization_grant_type=OAuth2Provider.GRANT_AUTHORIZATION_CODE,
             client_id=self.client_id,
             client_secret=self.client_secret,
+            client_type=ClientTypes.CONFIDENTIAL,
+            response_type=ResponseTypes.CODE,
             redirect_uris="http://localhost:3000/login/github",
-            skip_authorization=True,
             authorization_flow=authorization_flow,
         )
         Application.objects.create(
@@ -101,42 +93,37 @@ class TestProviderOAuth(SeleniumTestCase):
             USER().username,
         )
         self.assertEqual(
-            self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
-            ).get_attribute("value"),
+            self.driver.find_element(By.CSS_SELECTOR, "input[name=name]").get_attribute(
+                "value"
+            ),
             USER().username,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+                By.CSS_SELECTOR, "input[name=email]"
             ).get_attribute("value"),
             USER().email,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+                By.CSS_SELECTOR, "input[name=login]"
             ).get_attribute("value"),
             USER().username,
         )
 
     def test_authorization_consent_explicit(self):
         """test OAuth Provider flow (default authorization flow with explicit consent)"""
-        sleep(1)
         # Bootstrap all needed objects
         authorization_flow = Flow.objects.get(
             slug="default-provider-authorization-explicit-consent"
         )
         provider = OAuth2Provider.objects.create(
             name="grafana",
-            client_type=OAuth2Provider.CLIENT_CONFIDENTIAL,
-            authorization_grant_type=OAuth2Provider.GRANT_AUTHORIZATION_CODE,
             client_id=self.client_id,
             client_secret=self.client_secret,
+            client_type=ClientTypes.CONFIDENTIAL,
+            response_type=ResponseTypes.CODE,
             redirect_uris="http://localhost:3000/login/github",
-            skip_authorization=True,
             authorization_flow=authorization_flow,
         )
         app = Application.objects.create(
@@ -158,12 +145,18 @@ class TestProviderOAuth(SeleniumTestCase):
             ).text,
         )
         self.assertEqual(
-            "GitHub Compatibility: User Email",
+            "GitHub Compatibility: Access you Email addresses",
             self.driver.find_element(
                 By.XPATH, "/html/body/div[2]/div/main/div/form/div[2]/ul/li[1]"
             ).text,
         )
-        self.driver.find_element(By.CSS_SELECTOR, "[type=submit]").click()
+        self.driver.find_element(
+            By.CSS_SELECTOR,
+            (
+                "form[action='/flows/b/default-provider-authorization-explicit-consent/'] "
+                "[type=submit]"
+            ),
+        ).click()
 
         self.wait_for_url("http://localhost:3000/?orgId=1")
         self.driver.find_element(By.XPATH, "//a[contains(@href, '/profile')]").click()
@@ -172,23 +165,57 @@ class TestProviderOAuth(SeleniumTestCase):
             USER().username,
         )
         self.assertEqual(
-            self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
-            ).get_attribute("value"),
+            self.driver.find_element(By.CSS_SELECTOR, "input[name=name]").get_attribute(
+                "value"
+            ),
             USER().username,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+                By.CSS_SELECTOR, "input[name=email]"
             ).get_attribute("value"),
             USER().email,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+                By.CSS_SELECTOR, "input[name=login]"
             ).get_attribute("value"),
             USER().username,
         )
+
+    def test_denied(self):
+        """test OAuth Provider flow (default authorization flow, denied)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            client_type=ClientTypes.CONFIDENTIAL,
+            response_type=ResponseTypes.CODE,
+            redirect_uris="http://localhost:3000/login/github",
+            authorization_flow=authorization_flow,
+        )
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--github").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "header > h1").text,
+            "Permission denied",
+        )

e2e/test_provider_oauth2_oidc.py

@@ -1,71 +1,77 @@
-"""test OpenID Provider flow"""
+"""test OAuth2 OpenID Provider flow"""
+from sys import platform
 from time import sleep
+from typing import Any, Dict, Optional
+from unittest.case import skipUnless
 
-from django.shortcuts import reverse
-from oauth2_provider.generators import generate_client_id, generate_client_secret
-from oidc_provider.models import Client, ResponseType
+from docker.types import Healthcheck
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 from selenium.webdriver.support import expected_conditions as ec
+from structlog import get_logger
 
-from docker import DockerClient, from_env
-from docker.models.containers import Container
-from docker.types import Healthcheck
-from e2e.utils import USER, SeleniumTestCase, ensure_rsa_key
+from e2e.utils import USER, SeleniumTestCase
 from passbook.core.models import Application
+from passbook.crypto.models import CertificateKeyPair
 from passbook.flows.models import Flow
-from passbook.providers.oidc.models import OpenIDProvider
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
+from passbook.providers.oauth2.constants import (
+    SCOPE_OPENID,
+    SCOPE_OPENID_EMAIL,
+    SCOPE_OPENID_PROFILE,
+)
+from passbook.providers.oauth2.generators import (
+    generate_client_id,
+    generate_client_secret,
+)
+from passbook.providers.oauth2.models import (
+    ClientTypes,
+    OAuth2Provider,
+    ResponseTypes,
+    ScopeMapping,
+)
+
+LOGGER = get_logger()
 
 
-class TestProviderOIDC(SeleniumTestCase):
-    """test OpenID Provider flow"""
+@skipUnless(platform.startswith("linux"), "requires local docker")
+class TestProviderOAuth2OIDC(SeleniumTestCase):
+    """test OAuth with OpenID Provider flow"""
 
     def setUp(self):
-        super().setUp()
         self.client_id = generate_client_id()
         self.client_secret = generate_client_secret()
-        self.container = self.setup_client()
+        super().setUp()
 
-    def setup_client(self) -> Container:
-        """Setup client grafana container which we test OIDC against"""
-        client: DockerClient = from_env()
-        container = client.containers.run(
-            image="grafana/grafana:latest",
-            detach=True,
-            network_mode="host",
-            auto_remove=True,
-            healthcheck=Healthcheck(
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
+        return {
+            "image": "grafana/grafana:7.1.0",
+            "detach": True,
+            "network_mode": "host",
+            "auto_remove": True,
+            "healthcheck": Healthcheck(
                 test=["CMD", "wget", "--spider", "http://localhost:3000"],
                 interval=5 * 100 * 1000000,
                 start_period=1 * 100 * 1000000,
             ),
-            environment={
+            "environment": {
                 "GF_AUTH_GENERIC_OAUTH_ENABLED": "true",
                 "GF_AUTH_GENERIC_OAUTH_CLIENT_ID": self.client_id,
                 "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET": self.client_secret,
                 "GF_AUTH_GENERIC_OAUTH_SCOPES": "openid email profile",
                 "GF_AUTH_GENERIC_OAUTH_AUTH_URL": (
-                    self.live_server_url + reverse("passbook_providers_oidc:authorize")
+                    self.url("passbook_providers_oauth2:authorize")
                 ),
                 "GF_AUTH_GENERIC_OAUTH_TOKEN_URL": (
-                    self.live_server_url + reverse("oidc_provider:token")
+                    self.url("passbook_providers_oauth2:token")
                 ),
                 "GF_AUTH_GENERIC_OAUTH_API_URL": (
-                    self.live_server_url + reverse("oidc_provider:userinfo")
+                    self.url("passbook_providers_oauth2:userinfo")
                 ),
                 "GF_LOG_LEVEL": "debug",
             },
-        )
-        while True:
-            container.reload()
-            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
-            if status == "healthy":
-                return container
-            sleep(1)
-
-    def tearDown(self):
-        self.container.kill()
-        super().tearDown()
+        }
 
     def test_redirect_uri_error(self):
         """test OpenID Provider flow (invalid redirect URI, check error message)"""
@@ -74,23 +80,22 @@ class TestProviderOIDC(SeleniumTestCase):
         authorization_flow = Flow.objects.get(
             slug="default-provider-authorization-implicit-consent"
         )
-        client = Client.objects.create(
+        provider = OAuth2Provider.objects.create(
             name="grafana",
-            client_type="confidential",
+            client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
-            _redirect_uris="http://localhost:3000/",
-            _scope="openid userinfo",
+            rsa_key=CertificateKeyPair.objects.first(),
+            redirect_uris="http://localhost:3000/",
+            authorization_flow=authorization_flow,
+            response_type=ResponseTypes.CODE,
         )
-        # At least one of these objects must exist
-        ensure_rsa_key()
-        # This response_code object might exist or not, depending on the order the tests are run
-        rp_type, _ = ResponseType.objects.get_or_create(value="code")
-        client.response_types.set([rp_type])
-        client.save()
-        provider = OpenIDProvider.objects.create(
-            oidc_client=client, authorization_flow=authorization_flow,
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+            )
         )
+        provider.save()
         Application.objects.create(
             name="Grafana", slug="grafana", provider=provider,
         )
@@ -115,25 +120,22 @@ class TestProviderOIDC(SeleniumTestCase):
         authorization_flow = Flow.objects.get(
             slug="default-provider-authorization-implicit-consent"
         )
-        client = Client.objects.create(
+        provider = OAuth2Provider.objects.create(
             name="grafana",
-            client_type="confidential",
+            client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
-            _redirect_uris="http://localhost:3000/login/generic_oauth",
-            _scope="openid profile email",
-            reuse_consent=False,
-            require_consent=False,
+            rsa_key=CertificateKeyPair.objects.first(),
+            redirect_uris="http://localhost:3000/login/generic_oauth",
+            authorization_flow=authorization_flow,
+            response_type=ResponseTypes.CODE,
         )
-        # At least one of these objects must exist
-        ensure_rsa_key()
-        # This response_code object might exist or not, depending on the order the tests are run
-        rp_type, _ = ResponseType.objects.get_or_create(value="code")
-        client.response_types.set([rp_type])
-        client.save()
-        provider = OpenIDProvider.objects.create(
-            oidc_client=client, authorization_flow=authorization_flow,
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+            )
         )
+        provider.save()
         Application.objects.create(
             name="Grafana", slug="grafana", provider=provider,
         )
@@ -151,23 +153,20 @@ class TestProviderOIDC(SeleniumTestCase):
             USER().name,
         )
         self.assertEqual(
-            self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
-            ).get_attribute("value"),
+            self.driver.find_element(By.CSS_SELECTOR, "input[name=name]").get_attribute(
+                "value"
+            ),
             USER().name,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+                By.CSS_SELECTOR, "input[name=email]"
             ).get_attribute("value"),
             USER().email,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+                By.CSS_SELECTOR, "input[name=login]"
             ).get_attribute("value"),
             USER().email,
         )
@@ -179,25 +178,22 @@ class TestProviderOIDC(SeleniumTestCase):
         authorization_flow = Flow.objects.get(
             slug="default-provider-authorization-explicit-consent"
         )
-        client = Client.objects.create(
+        provider = OAuth2Provider.objects.create(
             name="grafana",
-            client_type="confidential",
+            authorization_flow=authorization_flow,
+            response_type=ResponseTypes.CODE,
+            client_type=ClientTypes.CONFIDENTIAL,
             client_id=self.client_id,
             client_secret=self.client_secret,
-            _redirect_uris="http://localhost:3000/login/generic_oauth",
-            _scope="openid profile email",
-            reuse_consent=False,
-            require_consent=False,
+            rsa_key=CertificateKeyPair.objects.first(),
+            redirect_uris="http://localhost:3000/login/generic_oauth",
         )
-        # At least one of these objects must exist
-        ensure_rsa_key()
-        # This response_code object might exist or not, depending on the order the tests are run
-        rp_type, _ = ResponseType.objects.get_or_create(value="code")
-        client.response_types.set([rp_type])
-        client.save()
-        provider = OpenIDProvider.objects.create(
-            oidc_client=client, authorization_flow=authorization_flow,
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+            )
         )
+        provider.save()
         app = Application.objects.create(
             name="Grafana", slug="grafana", provider=provider,
         )
@@ -219,6 +215,7 @@ class TestProviderOIDC(SeleniumTestCase):
         self.wait.until(
             ec.presence_of_element_located((By.CSS_SELECTOR, "[type=submit]"))
         )
+        sleep(1)
         self.driver.find_element(By.CSS_SELECTOR, "[type=submit]").click()
 
         self.wait.until(
@@ -232,23 +229,64 @@ class TestProviderOIDC(SeleniumTestCase):
             USER().name,
         )
         self.assertEqual(
-            self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[1]/div/input",
-            ).get_attribute("value"),
+            self.driver.find_element(By.CSS_SELECTOR, "input[name=name]").get_attribute(
+                "value"
+            ),
             USER().name,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[2]/div/input",
+                By.CSS_SELECTOR, "input[name=email]"
             ).get_attribute("value"),
             USER().email,
         )
         self.assertEqual(
             self.driver.find_element(
-                By.XPATH,
-                "/html/body/grafana-app/div/div/div/react-profile-wrapper/form[1]/div[3]/div/input",
+                By.CSS_SELECTOR, "input[name=login]"
             ).get_attribute("value"),
             USER().email,
         )
+
+    def test_authorization_denied(self):
+        """test OpenID Provider flow (default authorization with access deny)"""
+        sleep(1)
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-explicit-consent"
+        )
+        provider = OAuth2Provider.objects.create(
+            name="grafana",
+            authorization_flow=authorization_flow,
+            response_type=ResponseTypes.CODE,
+            client_type=ClientTypes.CONFIDENTIAL,
+            client_id=self.client_id,
+            client_secret=self.client_secret,
+            rsa_key=CertificateKeyPair.objects.first(),
+            redirect_uris="http://localhost:3000/login/generic_oauth",
+        )
+        provider.property_mappings.set(
+            ScopeMapping.objects.filter(
+                scope_name__in=[SCOPE_OPENID, SCOPE_OPENID_EMAIL, SCOPE_OPENID_PROFILE]
+            )
+        )
+        provider.save()
+        app = Application.objects.create(
+            name="Grafana", slug="grafana", provider=provider,
+        )
+
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+        self.driver.get("http://localhost:3000")
+        self.driver.find_element(By.CLASS_NAME, "btn-service--oauth").click()
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "header > h1").text,
+            "Permission denied",
+        )

e2e/test_provider_saml.py

@@ -1,25 +1,31 @@
 """test SAML Provider flow"""
+from sys import platform
 from time import sleep
-
-from selenium.webdriver.common.by import By
-from selenium.webdriver.common.keys import Keys
+from unittest.case import skipUnless
 
 from docker import DockerClient, from_env
 from docker.models.containers import Container
 from docker.types import Healthcheck
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+from structlog import get_logger
+
 from e2e.utils import USER, SeleniumTestCase
 from passbook.core.models import Application
 from passbook.crypto.models import CertificateKeyPair
 from passbook.flows.models import Flow
-from passbook.lib.utils.reflection import class_to_path
+from passbook.policies.expression.models import ExpressionPolicy
+from passbook.policies.models import PolicyBinding
 from passbook.providers.saml.models import (
     SAMLBindings,
     SAMLPropertyMapping,
     SAMLProvider,
 )
-from passbook.providers.saml.processors.generic import GenericProcessor
+
+LOGGER = get_logger()
 
 
+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestProviderSAML(SeleniumTestCase):
     """test SAML Provider flow"""
 
@@ -54,12 +60,9 @@ class TestProviderSAML(SeleniumTestCase):
             status = container.attrs.get("State", {}).get("Health", {}).get("Status")
             if status == "healthy":
                 return container
+            LOGGER.info("Container failed healthcheck")
             sleep(1)
 
-    def tearDown(self):
-        self.container.kill()
-        super().tearDown()
-
     def test_sp_initiated_implicit(self):
         """test SAML Provider flow SP-initiated flow (implicit consent)"""
         # Bootstrap all needed objects
@@ -68,7 +71,6 @@ class TestProviderSAML(SeleniumTestCase):
         )
         provider: SAMLProvider = SAMLProvider.objects.create(
             name="saml-test",
-            processor_path=class_to_path(GenericProcessor),
             acs_url="http://localhost:9009/saml/acs",
             audience="passbook-e2e",
             issuer="passbook-e2e",
@@ -102,7 +104,6 @@ class TestProviderSAML(SeleniumTestCase):
         )
         provider: SAMLProvider = SAMLProvider.objects.create(
             name="saml-test",
-            processor_path=class_to_path(GenericProcessor),
             acs_url="http://localhost:9009/saml/acs",
             audience="passbook-e2e",
             issuer="passbook-e2e",
@@ -144,7 +145,6 @@ class TestProviderSAML(SeleniumTestCase):
         )
         provider: SAMLProvider = SAMLProvider.objects.create(
             name="saml-test",
-            processor_path=class_to_path(GenericProcessor),
             acs_url="http://localhost:9009/saml/acs",
             audience="passbook-e2e",
             issuer="passbook-e2e",
@@ -174,3 +174,40 @@ class TestProviderSAML(SeleniumTestCase):
             self.driver.find_element(By.XPATH, "/html/body/pre").text,
             f"Hello, {USER().name}!",
         )
+
+    def test_sp_initiated_denied(self):
+        """test SAML Provider flow SP-initiated flow (Policy denies access)"""
+        # Bootstrap all needed objects
+        authorization_flow = Flow.objects.get(
+            slug="default-provider-authorization-implicit-consent"
+        )
+        negative_policy = ExpressionPolicy.objects.create(
+            name="negative-static", expression="return False"
+        )
+        provider: SAMLProvider = SAMLProvider.objects.create(
+            name="saml-test",
+            acs_url="http://localhost:9009/saml/acs",
+            audience="passbook-e2e",
+            issuer="passbook-e2e",
+            sp_binding=SAMLBindings.POST,
+            authorization_flow=authorization_flow,
+            signing_kp=CertificateKeyPair.objects.first(),
+        )
+        provider.property_mappings.set(SAMLPropertyMapping.objects.all())
+        provider.save()
+        app = Application.objects.create(
+            name="SAML", slug="passbook-saml", provider=provider,
+        )
+        PolicyBinding.objects.create(target=app, policy=negative_policy, order=0)
+        self.container = self.setup_client(provider)
+        self.driver.get("http://localhost:9009/")
+        self.driver.find_element(By.ID, "id_uid_field").click()
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_uid_field").send_keys(Keys.ENTER)
+        self.driver.find_element(By.ID, "id_password").send_keys(USER().username)
+        self.driver.find_element(By.ID, "id_password").send_keys(Keys.ENTER)
+        self.wait_for_url(self.url("passbook_flows:denied"))
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, "header > h1").text,
+            "Permission denied",
+        )

e2e/test_source_oauth.py

@@ -0,0 +1,242 @@
+"""test OAuth Source"""
+from os.path import abspath
+from sys import platform
+from time import sleep
+from typing import Any, Dict, Optional
+from unittest.case import skipUnless
+
+from django.test import override_settings
+from docker.models.containers import Container
+from docker.types import Healthcheck
+from selenium.webdriver.common.by import By
+from selenium.webdriver.common.keys import Keys
+from selenium.webdriver.support import expected_conditions as ec
+from structlog import get_logger
+from yaml import safe_dump
+
+from e2e.utils import SeleniumTestCase
+from passbook.flows.models import Flow
+from passbook.providers.oauth2.generators import generate_client_secret
+from passbook.sources.oauth.models import OAuthSource
+
+TOKEN_URL = "http://127.0.0.1:5556/dex/token"
+CONFIG_PATH = "/tmp/dex.yml"
+LOGGER = get_logger()
+
+
+@skipUnless(platform.startswith("linux"), "requires local docker")
+class TestSourceOAuth(SeleniumTestCase):
+    """test OAuth Source flow"""
+
+    container: Container
+
+    def setUp(self):
+        self.client_secret = generate_client_secret()
+        self.prepare_dex_config()
+        super().setUp()
+
+    def prepare_dex_config(self):
+        """Since Dex does not document which environment
+        variables can be used to configure clients"""
+        config = {
+            "enablePasswordDB": True,
+            "issuer": "http://127.0.0.1:5556/dex",
+            "logger": {"level": "debug"},
+            "staticClients": [
+                {
+                    "id": "example-app",
+                    "name": "Example App",
+                    "redirectURIs": [
+                        self.url(
+                            "passbook_sources_oauth:oauth-client-callback",
+                            source_slug="dex",
+                        )
+                    ],
+                    "secret": self.client_secret,
+                }
+            ],
+            "staticPasswords": [
+                {
+                    "email": "admin@example.com",
+                    # hash for password
+                    "hash": "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W",
+                    "userID": "08a8684b-db88-4b73-90a9-3cd1661f5466",
+                    "username": "admin",
+                }
+            ],
+            "storage": {"config": {"file": "/tmp/dex.db"}, "type": "sqlite3"},
+            "web": {"http": "0.0.0.0:5556"},
+        }
+        with open(CONFIG_PATH, "w+") as _file:
+            safe_dump(config, _file)
+
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
+        return {
+            "image": "quay.io/dexidp/dex:v2.24.0",
+            "detach": True,
+            "network_mode": "host",
+            "auto_remove": True,
+            "command": "serve /config.yml",
+            "healthcheck": Healthcheck(
+                test=["CMD", "wget", "--spider", "http://localhost:5556/dex/healthz"],
+                interval=5 * 100 * 1000000,
+                start_period=1 * 100 * 1000000,
+            ),
+            "volumes": {abspath(CONFIG_PATH): {"bind": "/config.yml", "mode": "ro"}},
+        }
+
+    def create_objects(self):
+        """Create required objects"""
+        # Bootstrap all needed objects
+        authentication_flow = Flow.objects.get(slug="default-source-authentication")
+        enrollment_flow = Flow.objects.get(slug="default-source-enrollment")
+
+        OAuthSource.objects.create(
+            name="dex",
+            slug="dex",
+            authentication_flow=authentication_flow,
+            enrollment_flow=enrollment_flow,
+            provider_type="openid-connect",
+            authorization_url="http://127.0.0.1:5556/dex/auth",
+            access_token_url=TOKEN_URL,
+            profile_url="http://127.0.0.1:5556/dex/userinfo",
+            consumer_key="example-app",
+            consumer_secret=self.client_secret,
+        )
+
+    def test_oauth_enroll(self):
+        """test OAuth Source With With OIDC"""
+        self.create_objects()
+        self.driver.get(self.live_server_url)
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+
+        # Now we should be at the IDP, wait for the login field
+        self.wait.until(ec.presence_of_element_located((By.ID, "login")))
+        self.driver.find_element(By.ID, "login").send_keys("admin@example.com")
+        self.driver.find_element(By.ID, "password").send_keys("password")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "button[type=submit]"))
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "button[type=submit]").click()
+
+        self.wait.until(ec.presence_of_element_located((By.NAME, "username")))
+        # At this point we've been redirected back
+        # and we're asked for the username
+        self.driver.find_element(By.NAME, "username").click()
+        self.driver.find_element(By.NAME, "username").send_keys("foo")
+        self.driver.find_element(By.NAME, "username").send_keys(Keys.ENTER)
+
+        # Wait until we've loaded the user info page
+        self.wait.until(ec.presence_of_element_located((By.LINK_TEXT, "foo")))
+        self.driver.find_element(By.LINK_TEXT, "foo").click()
+
+        self.wait_for_url(self.url("passbook_core:user-settings"))
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").text,
+            "foo",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), "foo"
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_name").get_attribute("value"), "admin",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_email").get_attribute("value"),
+            "admin@example.com",
+        )
+
+    @override_settings(SESSION_COOKIE_SAMESITE="strict")
+    def test_oauth_samesite_strict(self):
+        """test OAuth Source With SameSite set to strict
+        (=will fail because session is not carried over)"""
+        self.create_objects()
+        self.driver.get(self.live_server_url)
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+
+        # Now we should be at the IDP, wait for the login field
+        self.wait.until(ec.presence_of_element_located((By.ID, "login")))
+        self.driver.find_element(By.ID, "login").send_keys("admin@example.com")
+        self.driver.find_element(By.ID, "password").send_keys("password")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "button[type=submit]"))
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "button[type=submit]").click()
+
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, ".pf-c-alert__title"))
+        )
+        self.assertEqual(
+            self.driver.find_element(By.CSS_SELECTOR, ".pf-c-alert__title").text,
+            "Authentication Failed.",
+        )
+
+    def test_oauth_enroll_auth(self):
+        """test OAuth Source With With OIDC (enroll and authenticate again)"""
+        self.test_oauth_enroll()
+        # We're logged in at the end of this, log out and re-login
+        self.driver.find_element(By.CSS_SELECTOR, "[aria-label=logout]").click()
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        sleep(1)
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+        sleep(1)
+        # Now we should be at the IDP, wait for the login field
+        self.wait.until(ec.presence_of_element_located((By.ID, "login")))
+        self.driver.find_element(By.ID, "login").send_keys("admin@example.com")
+        self.driver.find_element(By.ID, "password").send_keys("password")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located((By.CSS_SELECTOR, "button[type=submit]"))
+        )
+        self.driver.find_element(By.CSS_SELECTOR, "button[type=submit]").click()
+
+        # Wait until we've loaded the user info page
+        self.wait.until(ec.presence_of_element_located((By.LINK_TEXT, "foo")))
+        self.driver.find_element(By.LINK_TEXT, "foo").click()
+
+        self.wait_for_url(self.url("passbook_core:user-settings"))
+        self.assertEqual(
+            self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").text,
+            "foo",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), "foo"
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_name").get_attribute("value"), "admin",
+        )
+        self.assertEqual(
+            self.driver.find_element(By.ID, "id_email").get_attribute("value"),
+            "admin@example.com",
+        )

e2e/test_source_saml.py

@@ -1,18 +1,22 @@
 """test SAML Source"""
+from sys import platform
 from time import sleep
+from typing import Any, Dict, Optional
+from unittest.case import skipUnless
 
+from docker.types import Healthcheck
 from selenium.webdriver.common.by import By
 from selenium.webdriver.common.keys import Keys
 from selenium.webdriver.support import expected_conditions as ec
+from structlog import get_logger
 
-from docker import DockerClient, from_env
-from docker.models.containers import Container
-from docker.types import Healthcheck
 from e2e.utils import SeleniumTestCase
 from passbook.crypto.models import CertificateKeyPair
 from passbook.flows.models import Flow
 from passbook.sources.saml.models import SAMLBindingTypes, SAMLSource
 
+LOGGER = get_logger()
+
 IDP_CERT = """-----BEGIN CERTIFICATE-----
 MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NYMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
 BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
@@ -35,53 +39,66 @@ NKUfJyX8qIG5md1YUeT6GBW9Bm2/1/RiO24JTaYlfLdKK9TYb8sG5B+OLab2DImG
 aQ==
 -----END CERTIFICATE-----"""
 
+IDP_KEY = """-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNQIWjOA1vWHUz
+SPM1FIKOE4GdH65VtWlpZ9dghH4CFYN0R7mvJj4KBq86Dxt8vJvLMV16GVh0NGCR
+50QH8aMbxonDTqXSoXiMM4DDSQTKBYK7aZwftc7FG35gAfdNUdr8e7VbdaPOShuq
+qotDyCQpZYzbt86ABnoaJ5okE3pUFIwxw97LcdYsGZz5Ngma/V1to7aMeEqHyl8r
+DRbXZUzw/U8g7yC/g+G7+64liJ4FYqLEETLLSUePKLFgUJHXbF2HgIDjur3nxlEa
+ecNQYVUTVCGBFpwkI5n1t3m32avwotpUFhMImjkRETyPKZpvl0+p7mop8mwJmKpa
+CVuNSj23AgMBAAECggEABn4I/B20xxXcNzASiVZJvua9DdRHtmxTlkLznBj0x2oY
+y1/Nbs3d3oFRn5uEuhBZOTcphsgwdRSHDXZsP3gUObew+d2N/zieUIj8hLDVlvJP
+rU/s4U/l53Q0LiNByE9ThvL+zJLPCKJtd5uHZjB5fFm69+Q7gu8xg4xHIub+0pP5
+PHanmHCDrbgNN/oqlar4FZ2MXTgekW6Amyc/koE9hIn4Baa2Ke/B/AUGY4pMRLqp
+TArt+GTVeWeoFY9QACUpaHpJhGb/Piou6tlU57e42cLoki1f0+SARsBBKyXA7BB1
+1fMH10KQYFA68dTYWlKzQau/K4xaqg4FKmtwF66GQQKBgQD9OpNUS7oRxMHVJaBR
+TNWW+V1FXycqojekFpDijPb2X5CWV16oeWgaXp0nOHFdy9EWs3GtGpfZasaRVHsX
+SHtPh4Nb8JqHdGE0/CD6t0+4Dns8Bn9cSqtdQB7R3Jn7IMXi9X/U8LDKo+A18/Jq
+V8VgUngMny9YjMkQIbK8TRWkYQKBgQDPf4nxO6ju+tOHHORQty3bYDD0+OV3I0+L
+0yz0uPreryBVi9nY43KakH52D7UZEwwsBjjGXD+WH8xEsmBWsGNXJu025PvzIJoz
+lAEiXvMp/NmYp+tY4rDmO8RhyVocBqWHzh38m0IFOd4ByFD5nLEDrA3pDVo0aNgY
+n0GwRysZFwKBgQDkCj3m6ZMUsUWEty+aR0EJhmKyODBDOnY09IVhH2S/FexVFzUN
+LtfK9206hp/Awez3Ln2uT4Zzqq5K7fMzUniJdBWdVB004l8voeXpIe9OZuwfcBJ9
+gFi1zypx/uFDv421BzQpBN+QfOdKbvbdQVFjnqCxbSDr80yVlGMrI5fbwQKBgG09
+oRrepO7EIO8GN/GCruLK/ptKGkyhy3Q6xnVEmdb47hX7ncJA5IoZPmrblCVSUNsw
+n11XHabksL8OBgg9rt8oQEThQv/aDzTOW9aDlJNragejiBTwq99aYeZ1gjo1CZq4
+2jKubpCfyZC4rGDtrIfZYi1q+S2UcQhtd8DdhwQbAoGAAM4EpDA4yHB5yiek1p/o
+CbqRCta/Dx6Eyo0KlNAyPuFPAshupG4NBx7mT2ASfL+2VBHoi6mHSri+BDX5ryYF
+fMYvp7URYoq7w7qivRlvvEg5yoYrK13F2+Gj6xJ4jEN9m0KdM/g3mJGq0HBTIQrp
+Sm75WXsflOxuTn08LbgGc4s=
+-----END PRIVATE KEY-----"""
 
+
+@skipUnless(platform.startswith("linux"), "requires local docker")
 class TestSourceSAML(SeleniumTestCase):
     """test SAML Source flow"""
 
-    def setUp(self):
-        super().setUp()
-        self.container = self.setup_client()
-
-    def setup_client(self) -> Container:
-        """Setup test IdP container"""
-        client: DockerClient = from_env()
-        container = client.containers.run(
-            image="kristophjunge/test-saml-idp",
-            detach=True,
-            network_mode="host",
-            auto_remove=True,
-            healthcheck=Healthcheck(
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
+        return {
+            "image": "kristophjunge/test-saml-idp:1.15",
+            "detach": True,
+            "network_mode": "host",
+            "auto_remove": True,
+            "healthcheck": Healthcheck(
                 test=["CMD", "curl", "http://localhost:8080"],
                 interval=5 * 100 * 1000000,
                 start_period=1 * 100 * 1000000,
             ),
-            environment={
+            "environment": {
                 "SIMPLESAMLPHP_SP_ENTITY_ID": "entity-id",
                 "SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE": (
                     f"{self.live_server_url}/source/saml/saml-idp-test/acs/"
                 ),
             },
-        )
-        while True:
-            container.reload()
-            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
-            if status == "healthy":
-                return container
-            sleep(1)
-
-    def tearDown(self):
-        self.container.kill()
-        super().tearDown()
+        }
 
     def test_idp_redirect(self):
         """test SAML Source With redirect binding"""
-        sleep(1)
         # Bootstrap all needed objects
         authentication_flow = Flow.objects.get(slug="default-source-authentication")
         enrollment_flow = Flow.objects.get(slug="default-source-enrollment")
         keypair = CertificateKeyPair.objects.create(
-            name="test-idp-cert", certificate_data=IDP_CERT
+            name="test-idp-cert", certificate_data=IDP_CERT, key_data=IDP_KEY,
         )
 
         SAMLSource.objects.create(
@@ -125,3 +142,107 @@ class TestSourceSAML(SeleniumTestCase):
         self.assertNotEqual(
             self.driver.find_element(By.ID, "id_username").get_attribute("value"), ""
         )
+
+    def test_idp_post(self):
+        """test SAML Source With post binding"""
+        # Bootstrap all needed objects
+        authentication_flow = Flow.objects.get(slug="default-source-authentication")
+        enrollment_flow = Flow.objects.get(slug="default-source-enrollment")
+        keypair = CertificateKeyPair.objects.create(
+            name="test-idp-cert", certificate_data=IDP_CERT, key_data=IDP_KEY,
+        )
+
+        SAMLSource.objects.create(
+            name="saml-idp-test",
+            slug="saml-idp-test",
+            authentication_flow=authentication_flow,
+            enrollment_flow=enrollment_flow,
+            issuer="entity-id",
+            sso_url="http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
+            binding_type=SAMLBindingTypes.POST,
+            signing_kp=keypair,
+        )
+
+        self.driver.get(self.live_server_url)
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+        sleep(1)
+        self.driver.find_element(By.CSS_SELECTOR, ".pf-c-button").click()
+
+        # Now we should be at the IDP, wait for the username field
+        self.wait.until(ec.presence_of_element_located((By.ID, "username")))
+        self.driver.find_element(By.ID, "username").send_keys("user1")
+        self.driver.find_element(By.ID, "password").send_keys("user1pass")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.XPATH, "//a[contains(@href, '/-/user/')]")
+            )
+        )
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+
+        # Wait until we've loaded the user info page
+        self.wait.until(ec.presence_of_element_located((By.ID, "id_username")))
+        self.assertNotEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), ""
+        )
+
+    def test_idp_post_auto(self):
+        """test SAML Source With post binding (auto redirect)"""
+        # Bootstrap all needed objects
+        authentication_flow = Flow.objects.get(slug="default-source-authentication")
+        enrollment_flow = Flow.objects.get(slug="default-source-enrollment")
+        keypair = CertificateKeyPair.objects.create(
+            name="test-idp-cert", certificate_data=IDP_CERT, key_data=IDP_KEY,
+        )
+
+        SAMLSource.objects.create(
+            name="saml-idp-test",
+            slug="saml-idp-test",
+            authentication_flow=authentication_flow,
+            enrollment_flow=enrollment_flow,
+            issuer="entity-id",
+            sso_url="http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
+            binding_type=SAMLBindingTypes.POST_AUTO,
+            signing_kp=keypair,
+        )
+
+        self.driver.get(self.live_server_url)
+
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.CLASS_NAME, "pf-c-login__main-footer-links-item-link")
+            )
+        )
+        self.driver.find_element(
+            By.CLASS_NAME, "pf-c-login__main-footer-links-item-link"
+        ).click()
+
+        # Now we should be at the IDP, wait for the username field
+        self.wait.until(ec.presence_of_element_located((By.ID, "username")))
+        self.driver.find_element(By.ID, "username").send_keys("user1")
+        self.driver.find_element(By.ID, "password").send_keys("user1pass")
+        self.driver.find_element(By.ID, "password").send_keys(Keys.ENTER)
+
+        # Wait until we're logged in
+        self.wait.until(
+            ec.presence_of_element_located(
+                (By.XPATH, "//a[contains(@href, '/-/user/')]")
+            )
+        )
+        self.driver.find_element(By.XPATH, "//a[contains(@href, '/-/user/')]").click()
+
+        # Wait until we've loaded the user info page
+        self.wait.until(ec.presence_of_element_located((By.ID, "id_username")))
+        self.assertNotEqual(
+            self.driver.find_element(By.ID, "id_username").get_attribute("value"), ""
+        )

e2e/utils.py

@@ -3,15 +3,17 @@ from functools import lru_cache
 from glob import glob
 from importlib.util import module_from_spec, spec_from_file_location
 from inspect import getmembers, isfunction
-from os import makedirs
-from time import time
+from os import environ, makedirs
+from time import sleep, time
+from typing import Any, Dict, Optional
 
-from Cryptodome.PublicKey import RSA
 from django.apps import apps
 from django.contrib.staticfiles.testing import StaticLiveServerTestCase
 from django.db import connection, transaction
 from django.db.utils import IntegrityError
 from django.shortcuts import reverse
+from docker import DockerClient, from_env
+from docker.models.containers import Container
 from selenium import webdriver
 from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
 from selenium.webdriver.remote.webdriver import WebDriver
@@ -28,28 +30,38 @@ def USER() -> User:  # noqa
     return User.objects.get(username="pbadmin")
 
 
-def ensure_rsa_key():
-    """Ensure that at least one RSAKey Object exists, create one if none exist"""
-    from oidc_provider.models import RSAKey
-
-    if not RSAKey.objects.exists():
-        key = RSA.generate(2048)
-        rsakey = RSAKey(key=key.exportKey("PEM").decode("utf8"))
-        rsakey.save()
-
-
 class SeleniumTestCase(StaticLiveServerTestCase):
     """StaticLiveServerTestCase which automatically creates a Webdriver instance"""
 
+    container: Optional[Container] = None
+
     def setUp(self):
         super().setUp()
-        makedirs("out", exist_ok=True)
+        makedirs("selenium_screenshots/", exist_ok=True)
         self.driver = self._get_driver()
         self.driver.maximize_window()
-        self.driver.implicitly_wait(300)
-        self.wait = WebDriverWait(self.driver, 500)
+        self.driver.implicitly_wait(10)
+        self.wait = WebDriverWait(self.driver, 30)
         self.apply_default_data()
         self.logger = get_logger()
+        if specs := self.get_container_specs():
+            self.container = self._start_container(specs)
+
+    def _start_container(self, specs: Dict[str, Any]) -> Container:
+        client: DockerClient = from_env()
+        container = client.containers.run(**specs)
+        while True:
+            container.reload()
+            status = container.attrs.get("State", {}).get("Health", {}).get("Status")
+            if status == "healthy":
+                return container
+            self.logger.info("Container failed healthcheck")
+            sleep(1)
+
+    def get_container_specs(self) -> Optional[Dict[str, Any]]:
+        """Optionally get container specs which will launched on setup, wait for the container to
+        be healthy, and deleted again on tearDown"""
+        return None
 
     def _get_driver(self) -> WebDriver:
         return webdriver.Remote(
@@ -58,11 +70,18 @@ class SeleniumTestCase(StaticLiveServerTestCase):
         )
 
     def tearDown(self):
-        self.driver.save_screenshot(f"out/{self.__class__.__name__}_{time()}.png")
+        if "TF_BUILD" in environ:
+            screenshot_file = (
+                f"selenium_screenshots/{self.__class__.__name__}_{time()}.png"
+            )
+            self.driver.save_screenshot(screenshot_file)
+            self.logger.warning("Saved screenshot", file=screenshot_file)
         for line in self.driver.get_log("browser"):
             self.logger.warning(
                 line["message"], source=line["source"], level=line["level"]
             )
+        if self.container:
+            self.container.kill()
         self.driver.quit()
         super().tearDown()
 

gatekeeper/Dockerfile

@@ -1,8 +0,0 @@
-FROM quay.io/oauth2-proxy/oauth2-proxy
-
-COPY templates /templates
-
-ENV OAUTH2_PROXY_EMAIL_DOMAINS=*
-ENV OAUTH2_PROXY_PROVIDER=oidc
-ENV OAUTH2_PROXY_CUSTOM_TEMPLATES_DIR=/templates
-ENV OAUTH2_PROXY_HTTP_ADDRESS=:4180

gatekeeper/templates/error.html

@@ -1,18 +0,0 @@
-{{define "error.html"}}
-<!DOCTYPE html>
-<html lang="en" charset="utf-8">
-
-<head>
-    <title>{{.Title}}</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
-</head>
-
-<body>
-    <h2>{{.Title}}</h2>
-    <p>{{.Message}}</p>
-    <hr>
-    <p><a href="{{.ProxyPrefix}}/sign_in">Sign In</a></p>
-</body>
-
-</html>
-{{end}}

gatekeeper/templates/sign_in.html

@@ -1,119 +0,0 @@
-{{define "sign_in.html"}}
-<!DOCTYPE html>
-<html lang="en" charset="utf-8">
-<head>
-    <title>Sign In with passbook</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
-    <style>
-        body {
-            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
-            font-size: 14px;
-            line-height: 1.42857143;
-            color: #333;
-            background: #f0f0f0;
-        }
-
-        .signin {
-            display: block;
-            margin: 20px auto;
-            max-width: 400px;
-            background: #fff;
-            border: 1px solid #ccc;
-            border-radius: 10px;
-            padding: 20px;
-        }
-
-        .center {
-            text-align: center;
-        }
-
-        .btn {
-            color: #fff;
-            background-color: #428bca;
-            border: 1px solid #357ebd;
-            -webkit-border-radius: 4;
-            -moz-border-radius: 4;
-            border-radius: 4px;
-            font-size: 14px;
-            padding: 6px 12px;
-            text-decoration: none;
-            cursor: pointer;
-        }
-
-        .btn:hover {
-            background-color: #3071a9;
-            border-color: #285e8e;
-            text-decoration: none;
-        }
-
-        label {
-            display: inline-block;
-            max-width: 100%;
-            margin-bottom: 5px;
-            font-weight: 700;
-        }
-
-        input {
-            display: block;
-            width: 100%;
-            height: 34px;
-            padding: 6px 12px;
-            font-size: 14px;
-            line-height: 1.42857143;
-            color: #555;
-            background-color: #fff;
-            background-image: none;
-            border: 1px solid #ccc;
-            border-radius: 4px;
-            -webkit-box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
-            box-shadow: inset 0 1px 1px rgba(0, 0, 0, .075);
-            -webkit-transition: border-color ease-in-out .15s, -webkit-box-shadow ease-in-out .15s;
-            -o-transition: border-color ease-in-out .15s, box-shadow ease-in-out .15s;
-            transition: border-color ease-in-out .15s, box-shadow ease-in-out .15s;
-            margin: 0;
-            box-sizing: border-box;
-        }
-
-        footer {
-            display: block;
-            font-size: 10px;
-            color: #aaa;
-            text-align: center;
-            margin-bottom: 10px;
-        }
-
-        footer a {
-            display: inline-block;
-            height: 25px;
-            line-height: 25px;
-            color: #aaa;
-            text-decoration: underline;
-        }
-
-        footer a:hover {
-            color: #aaa;
-        }
-    </style>
-</head>
-
-<body>
-    <div class="signin center">
-        <form method="GET" action="{{.ProxyPrefix}}/start">
-            <input type="hidden" name="rd" value="{{.Redirect}}">
-            <button type="submit" class="btn">Sign in with passbook</button><br />
-        </form>
-    </div>
-    <script>
-        if (window.location.hash) {
-            (function () {
-                var inputs = document.getElementsByName('rd');
-                for (var i = 0; i < inputs.length; i++) {
-                    inputs[i].value += window.location.hash;
-                }
-            })();
-        }
-    </script>
-</body>
-
-</html>
-{{end}}

helm/Chart.lock

@@ -1,9 +1,9 @@
 dependencies:
 - name: postgresql
-  repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 6.5.8
+  repository: https://charts.bitnami.com/bitnami
+  version: 9.3.2
 - name: redis
-  repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 9.5.1
-digest: sha256:f18b5dc8d0be13d584407405c60d10b6b84d25f7fa8aaa3dd0e5385c38f5c516
-generated: "2019-12-14T13:33:48.4341939Z"
+  repository: https://charts.bitnami.com/bitnami
+  version: 10.7.16
+digest: sha256:fd31e2e2b9ff17a5ed906a77a4f15ffa1ab7f5aecaea1e5db77f0d199ae4f19e
+generated: "2020-08-25T17:57:49.684549+02:00"

helm/Chart.yaml

@@ -1,6 +1,15 @@
-apiVersion: v1
-appVersion: "0.9.0-pre4"
+apiVersion: v2
+appVersion: "0.10.0-stable"
 description: A Helm chart for passbook.
 name: passbook
-version: "0.9.0-pre4"
-icon: https://git.beryju.org/uploads/-/system/project/avatar/108/logo.png
+version: "0.10.0-stable"
+icon: https://github.com/BeryJu/passbook/blob/master/docs/images/logo.svg
+dependencies:
+  - name: postgresql
+    version: 9.3.2
+    repository: https://charts.bitnami.com/bitnami
+    condition: install.postgresql
+  - name: redis
+    version: 10.7.16
+    repository: https://charts.bitnami.com/bitnami
+    condition: install.redis

helm/requirements.lock

@@ -1,9 +0,0 @@
-dependencies:
-- name: postgresql
-  repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 6.5.8
-- name: redis
-  repository: https://kubernetes-charts.storage.googleapis.com/
-  version: 9.5.1
-digest: sha256:476834fb82f66bc7242c4a5e7343d0a859d8307cb301256beb0eb749983014e4
-generated: "2019-11-07T10:21:30.902415+01:00"

helm/requirements.yaml

@@ -1,7 +0,0 @@
-dependencies:
-- name: postgresql
-  version: 6.5.8
-  repository: https://kubernetes-charts.storage.googleapis.com/
-- name: redis
-  version: 9.5.1
-  repository: https://kubernetes-charts.storage.googleapis.com/

helm/templates/NOTES.txt

@@ -1,19 +1,5 @@
-1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
+1. Access passbook using the following URL:
 {{- range .Values.ingress.hosts }}
   http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }}
 {{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "passbook.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get svc -w {{ include "passbook.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "passbook.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "passbook.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl port-forward $POD_NAME 8080:8000
-{{- end }}
+2. Login to passbook using the user "pbadmin" and the password "pbadmin".

helm/templates/configmap.yaml

@@ -3,21 +3,17 @@ kind: ConfigMap
 metadata:
   name: {{ include "passbook.fullname" . }}-config
 data:
-  config.yml: |
-    postgresql:
-      host: "{{ .Release.Name }}-postgresql"
-      name: "{{ .Values.postgresql.postgresqlDatabase }}"
-      user: postgres
-      {{- if .Values.backup }}
-      backup:
-        access_key: "{{ .Values.backup.access_key }}"
-        secret_key: "{{ .Values.backup.secret_key }}"
-        bucket: "{{ .Values.backup.bucket }}"
-        host: "{{ .Values.backup.host }}"
-      {{- end}}
-    redis:
-      host: "{{ .Release.Name }}-redis-master"
-      cache_db: 0
-      message_queue_db: 1
-    error_reporting: {{ .Values.config.error_reporting }}
-    log_level: "{{ .Values.config.log_level }}"
+  POSTGRESQL__HOST: "{{ .Release.Name }}-postgresql"
+  POSTGRESQL__NAME: "{{ .Values.postgresql.postgresqlDatabase }}"
+  POSTGRESQL__USER: "{{ .Values.postgresql.postgresqlUsername }}"
+  {{- if .Values.backup }}
+  POSTGRESQL__BACKUP__ACCESS_KEY: "{{ .Values.backup.access_key }}"
+  POSTGRESQL__BACKUP__SECRET_KEY: "{{ .Values.backup.secret_key }}"
+  POSTGRESQL__BACKUP__BUCKET: "{{ .Values.backup.bucket }}"
+  POSTGRESQL__BACKUP__HOST: "{{ .Values.backup.host }}"
+  {{- end}}
+  REDIS__HOST: "{{ .Release.Name }}-redis-master"
+  ERROR_REPORTING__ENABLED: "{{ .Values.config.error_reporting.enabled }}"
+  ERROR_REPORTING__ENVIRONMENT: "{{ .Values.config.error_reporting.environment }}"
+  ERROR_REPORTING__SEND_PII: "{{ .Values.config.error_reporting.send_pii }}"
+  LOG_LEVEL: "{{ .Values.config.log_level }}"

helm/templates/ingress.yaml

@@ -1,4 +1,3 @@
-{{- if .Values.ingress.enabled -}}
 {{- $fullName := include "passbook.fullname" . -}}
 apiVersion: extensions/v1beta1
 kind: Ingress
@@ -41,5 +40,8 @@ spec:
             backend:
               serviceName: {{ $fullName }}-static
               servicePort: http
+          - path: /favicon.ico
+            backend:
+              serviceName: {{ $fullName }}-static
+              servicePort: http
   {{- end }}
-{{- end }}

helm/templates/prom-rules.yaml

@@ -1,121 +0,0 @@
-{{- if .Values.monitoring.enabled -}}
----
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: {{ include "passbook.fullname" . }}-static-rules
-  labels:
-    app.kubernetes.io/name: {{ include "passbook.name" . }}
-    helm.sh/chart: {{ include "passbook.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-spec:
-  groups:
-  - name: Aggregate request counters
-    rules:
-      - record: job:django_http_requests_before_middlewares_total:sum_rate30s
-        expr: sum(rate(django_http_requests_before_middlewares_total[30s])) by (job)
-      - record: job:django_http_requests_unknown_latency_total:sum_rate30s
-        expr: sum(rate(django_http_requests_unknown_latency_total[30s])) by (job)
-      - record: job:django_http_ajax_requests_total:sum_rate30s
-        expr: sum(rate(django_http_ajax_requests_total[30s])) by (job)
-      - record: job:django_http_responses_before_middlewares_total:sum_rate30s
-        expr: sum(rate(django_http_responses_before_middlewares_total[30s])) by (job)
-      - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
-        expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s])) by (job)
-      - record: job:django_http_requests_body_total_bytes:sum_rate30s
-        expr: sum(rate(django_http_requests_body_total_bytes[30s])) by (job)
-      - record: job:django_http_responses_streaming_total:sum_rate30s
-        expr: sum(rate(django_http_responses_streaming_total[30s])) by (job)
-      - record: job:django_http_responses_body_total_bytes:sum_rate30s
-        expr: sum(rate(django_http_responses_body_total_bytes[30s])) by (job)
-      - record: job:django_http_requests_total:sum_rate30s
-        expr: sum(rate(django_http_requests_total_by_method[30s])) by (job)
-      - record: job:django_http_requests_total_by_method:sum_rate30s
-        expr: sum(rate(django_http_requests_total_by_method[30s])) by (job,method)
-      - record: job:django_http_requests_total_by_transport:sum_rate30s
-        expr: sum(rate(django_http_requests_total_by_transport[30s])) by (job,transport)
-      - record: job:django_http_requests_total_by_view:sum_rate30s
-        expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view)
-      - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
-        expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view,transport,method)
-      - record: job:django_http_responses_total_by_templatename:sum_rate30s
-        expr: sum(rate(django_http_responses_total_by_templatename[30s])) by (job,templatename)
-      - record: job:django_http_responses_total_by_status:sum_rate30s
-        expr: sum(rate(django_http_responses_total_by_status[30s])) by (job,status)
-      - record: job:django_http_responses_total_by_status_name_method:sum_rate30s
-        expr: sum(rate(django_http_responses_total_by_status_name_method[30s])) by (job,status,name,method)
-      - record: job:django_http_responses_total_by_charset:sum_rate30s
-        expr: sum(rate(django_http_responses_total_by_charset[30s])) by (job,charset)
-      - record: job:django_http_exceptions_total_by_type:sum_rate30s
-        expr: sum(rate(django_http_exceptions_total_by_type[30s])) by (job,type)
-      - record: job:django_http_exceptions_total_by_view:sum_rate30s
-        expr: sum(rate(django_http_exceptions_total_by_view[30s])) by (job,view)
-  - name: Aggregate latency histograms
-    rules:
-      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-        expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "50"
-      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-        expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "95"
-      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-        expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "99"
-      - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-        expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "99.9"
-      - record: job:django_http_requests_latency_seconds:quantile_rate30s
-        expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "50"
-      - record: job:django_http_requests_latency_seconds:quantile_rate30s
-        expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "95"
-      - record: job:django_http_requests_latency_seconds:quantile_rate30s
-        expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "99"
-      - record: job:django_http_requests_latency_seconds:quantile_rate30s
-        expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-        labels:
-          quantile: "99.9"
-  - name: Aggregate model operations
-    rules:
-      - record: job:django_model_inserts_total:sum_rate1m
-        expr: sum(rate(django_model_inserts_total[1m])) by (job, model)
-      - record: job:django_model_updates_total:sum_rate1m
-        expr: sum(rate(django_model_updates_total[1m])) by (job, model)
-      - record: job:django_model_deletes_total:sum_rate1m
-        expr: sum(rate(django_model_deletes_total[1m])) by (job, model)
-  - name: Aggregate database operations
-    rules:
-      - record: job:django_db_new_connections_total:sum_rate30s
-        expr: sum(rate(django_db_new_connections_total[30s])) by (alias, vendor)
-      - record: job:django_db_new_connection_errors_total:sum_rate30s
-        expr: sum(rate(django_db_new_connection_errors_total[30s])) by (alias, vendor)
-      - record: job:django_db_execute_total:sum_rate30s
-        expr: sum(rate(django_db_execute_total[30s])) by (alias, vendor)
-      - record: job:django_db_execute_many_total:sum_rate30s
-        expr: sum(rate(django_db_execute_many_total[30s])) by (alias, vendor)
-      - record: job:django_db_errors_total:sum_rate30s
-        expr: sum(rate(django_db_errors_total[30s])) by (alias, vendor, type)
-  - name: Aggregate migrations
-    rules:
-      - record: job:django_migrations_applied_total:max
-        expr: max(django_migrations_applied_total) by (job, connection)
-      - record: job:django_migrations_unapplied_total:max
-        expr: max(django_migrations_unapplied_total) by (job, connection)
-  - name: Alerts
-    rules:
-      - alert: UnappliedMigrations
-        expr: job:django_migrations_unapplied_total:max > 0
-        for: 1m
-        labels:
-          severity: testing
-{{- end }}

helm/templates/static-deployment.yaml

@@ -7,23 +7,23 @@ metadata:
     helm.sh/chart: {{ include "passbook.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    k8s.passbook.io/component: static
+    k8s.passbook.beryju.org/component: static
 spec:
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "passbook.name" . }}
       app.kubernetes.io/instance: {{ .Release.Name }}
-      k8s.passbook.io/component: static
+      k8s.passbook.beryju.org/component: static
   template:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "passbook.name" . }}
         app.kubernetes.io/instance: {{ .Release.Name }}
-        k8s.passbook.io/component: static
+        k8s.passbook.beryju.org/component: static
     spec:
       containers:
         - name: {{ .Chart.Name }}-static
-          image: "beryju/passbook-static:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.name_static }}:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

helm/templates/static-service.yaml

@@ -7,7 +7,7 @@ metadata:
     helm.sh/chart: {{ include "passbook.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    k8s.passbook.io/component: static
+    k8s.passbook.beryju.org/component: static
 spec:
   type: ClusterIP
   ports:
@@ -18,4 +18,4 @@ spec:
   selector:
     app.kubernetes.io/name: {{ include "passbook.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
-    k8s.passbook.io/component: static
+    k8s.passbook.beryju.org/component: static

helm/templates/static-sm.yaml

@@ -1,17 +0,0 @@
-{{- if .Values.monitoring.enabled -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  labels:
-    app.kubernetes.io/name: {{ include "passbook.name" . }}
-    helm.sh/chart: {{ include "passbook.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-  name: {{ include "passbook.fullname" . }}-static-monitoring
-spec:
-  endpoints:
-  - port: http
-  selector:
-    matchLabels:
-      k8s.passbook.io/component: static
-{{- end }}

helm/templates/web-deployment.yaml

@@ -7,35 +7,26 @@ metadata:
     helm.sh/chart: {{ include "passbook.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    k8s.passbook.io/component: web
+    k8s.passbook.beryju.org/component: web
 spec:
-  replicas: 2
+  replicas: {{ .Values.serverReplicas }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "passbook.name" . }}
       app.kubernetes.io/instance: {{ .Release.Name }}
-      k8s.passbook.io/component: web
+      k8s.passbook.beryju.org/component: web
   template:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "passbook.name" . }}
         app.kubernetes.io/instance: {{ .Release.Name }}
-        k8s.passbook.io/component: web
+        k8s.passbook.beryju.org/component: web
     spec:
-      volumes:
-        - name: config-volume
-          configMap:
-            name: {{ include "passbook.fullname" . }}-config
       initContainers:
         - name: passbook-database-migrations
-          image: "beryju/passbook:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.name }}:{{ .Values.image.tag }}"
           imagePullPolicy: Always
-          args:
-            - ./manage.py
-            - migrate
-          volumeMounts:
-            - mountPath: /etc/passbook
-              name: config-volume
+          args: [migrate]
           envFrom:
             - configMapRef:
                 name: {{ include "passbook.fullname" . }}-config
@@ -58,14 +49,9 @@ spec:
                   key: postgresql-password
       containers:
         - name: {{ .Chart.Name }}
-          image: "beryju/passbook:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.name }}:{{ .Values.image.tag }}"
           imagePullPolicy: Always
-          args:
-            - uwsgi
-            - uwsgi.ini
-          volumeMounts:
-            - mountPath: /etc/passbook
-              name: config-volume
+          args: [server]
           envFrom:
             - configMapRef:
                 name: {{ include "passbook.fullname" . }}-config
@@ -74,18 +60,18 @@ spec:
             - name: PASSBOOK_SECRET_KEY
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "passbook.fullname" . }}-secret-key
-                  key: secret_key
+                  name: "{{ include "passbook.fullname" . }}-secret-key"
+                  key: "secret_key"
             - name: PASSBOOK_REDIS__PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: "{{ .Release.Name }}-redis"
-                  key: redis-password
+                  key: "redis-password"
             - name: PASSBOOK_POSTGRESQL__PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: "{{ .Release.Name }}-postgresql"
-                  key: postgresql-password
+                  key: "postgresql-password"
           ports:
             - name: http
               containerPort: 8000

helm/templates/web-service.yaml

@@ -7,7 +7,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     helm.sh/chart: {{ include "passbook.chart" . }}
-    k8s.passbook.io/component: web
+    k8s.passbook.beryju.org/component: web
 spec:
   type: ClusterIP
   ports:
@@ -18,4 +18,4 @@ spec:
   selector:
     app.kubernetes.io/name: {{ include "passbook.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
-    k8s.passbook.io/component: web
+    k8s.passbook.beryju.org/component: web

helm/templates/web-sm.yaml

@@ -1,26 +0,0 @@
-{{- if .Values.monitoring.enabled -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  labels:
-    app.kubernetes.io/name: {{ include "passbook.name" . }}
-    helm.sh/chart: {{ include "passbook.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-  name: {{ include "passbook.fullname" . }}-web-monitoring
-spec:
-  endpoints:
-  - basicAuth:
-      password:
-        name: {{ include "passbook.fullname" . }}-secret-key
-        key: secret_key
-      username:
-        name: {{ include "passbook.fullname" . }}-secret-key
-        key: monitoring_username
-    port: http
-    path: /metrics/
-    interval: 10s
-  selector:
-    matchLabels:
-      k8s.passbook.io/component: web
-{{- end }}

helm/templates/worker-deployment.yaml

@@ -7,60 +7,46 @@ metadata:
     helm.sh/chart: {{ include "passbook.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
-    k8s.passbook.io/component: worker
+    k8s.passbook.beryju.org/component: worker
 spec:
-  replicas: 1
+  replicas: {{ .Values.workerReplicas }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ include "passbook.name" . }}
       app.kubernetes.io/instance: {{ .Release.Name }}
-      k8s.passbook.io/component: worker
+      k8s.passbook.beryju.org/component: worker
   template:
     metadata:
       labels:
         app.kubernetes.io/name: {{ include "passbook.name" . }}
         app.kubernetes.io/instance: {{ .Release.Name }}
-        k8s.passbook.io/component: worker
+        k8s.passbook.beryju.org/component: worker
     spec:
-      volumes:
-        - name: config-volume
-          configMap:
-            name: {{ include "passbook.fullname" . }}-config
       containers:
         - name: {{ .Chart.Name }}
-          image: "beryju/passbook:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.name }}:{{ .Values.image.tag }}"
           imagePullPolicy: IfNotPresent
-          args:
-            - celery
-            - worker
-            - --autoscale=10,3
-            - -E
-            - -B
-            - -A=passbook.root.celery
-            - -s=/tmp/celerybeat-schedule
-          volumeMounts:
-            - mountPath: /etc/passbook
-              name: config-volume
+          args: [worker]
           envFrom:
             - configMapRef:
-                name: {{ include "passbook.fullname" . }}-config
-              prefix: PASSBOOK_
+                name: "{{ include "passbook.fullname" . }}-config"
+              prefix: "PASSBOOK_"
           env:
             - name: PASSBOOK_SECRET_KEY
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "passbook.fullname" . }}-secret-key
+                  name: "{{ include "passbook.fullname" . }}-secret-key"
                   key: secret_key
             - name: PASSBOOK_REDIS__PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: "{{ .Release.Name }}-redis"
-                  key: redis-password
+                  key: "redis-password"
             - name: PASSBOOK_POSTGRESQL__PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: "{{ .Release.Name }}-postgresql"
-                  key: postgresql-password
+                  key: "postgresql-password"
           resources:
             requests:
               cpu: 150m

helm/values.yaml

@@ -1,25 +1,28 @@
-# Default values for passbook.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
+###################################
+# Values directly affecting passbook
+###################################
 image:
-  tag: 0.9.0-pre4
+  name: beryju/passbook
+  name_static: beryju/passbook-static
+  tag: 0.10.0-stable
 
 nameOverride: ""
 
+serverReplicas: 1
+workerReplicas: 1
+
 config:
   # Optionally specify fixed secret_key, otherwise generated automatically
   # secret_key: _k*@6h2u2@q-dku57hhgzb7tnx*ba9wodcb^s9g0j59@=y(@_o
   # Enable error reporting
-  error_reporting: false
+  error_reporting:
+    enabled: false
+    environment: customer
+    send_pii: false
   # Log level used by web and worker
   # Can be either debug, info, warning, error
   log_level: warning
 
-# This Helm chart ships with built-in Prometheus ServiceMonitors and Rules.
-# This requires the CoreOS Prometheus Operator.
-monitoring:
-  enabled: false
-
 # Enable Database Backups to S3
 # backup:
 #   access_key: access-key
@@ -27,20 +30,15 @@ monitoring:
 #   bucket: s3-bucket
 #   host: s3-host
 
-ingress:
-  enabled: false
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  path: /
-  hosts:
-    - passbook.k8s.local
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - passbook.k8s.local
+###################################
+# Values controlling dependencies
+###################################
 
-# These settings configure the packaged PostgreSQL and Redis chart.
+install:
+  postgresql: true
+  redis: true
+
+# These values influence the bundled postgresql and redis charts, but are also used by passbook to connect
 postgresql:
   postgresqlDatabase: passbook
 
@@ -52,3 +50,15 @@ redis:
       enabled: false
     # https://stackoverflow.com/a/59189742
     disableCommands: []
+
+ingress:
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  path: /
+  hosts:
+    - passbook.k8s.local
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - passbook.k8s.local

lifecycle/bootstrap.sh

@@ -0,0 +1,14 @@
+#!/bin/bash -e
+python -m lifecycle.wait_for_db
+printf '{"event": "Bootstrap completed", "level": "info", "logger": "bootstrap", "command": "%s"}\n' "$@"
+if [[ "$1" == "server" ]]; then
+    gunicorn -c /lifecycle/gunicorn.conf.py passbook.root.asgi:application
+elif [[ "$1" == "worker" ]]; then
+    celery worker --autoscale=10,3 -E -B -A=passbook.root.celery -s=/tmp/celerybeat-schedule
+elif [[ "$1" == "migrate" ]]; then
+    # Run system migrations first, run normal migrations after
+    python -m lifecycle.migrate
+    python -m manage migrate
+else
+    python -m manage "$@"
+fi

lifecycle/gunicorn.conf.py

@@ -0,0 +1,51 @@
+"""Gunicorn config"""
+from multiprocessing import cpu_count
+from pathlib import Path
+
+import structlog
+
+bind = "0.0.0.0:8000"
+
+user = "passbook"
+group = "passbook"
+
+worker_class = "uvicorn.workers.UvicornWorker"
+# Docker containers don't have /tmp as tmpfs
+worker_tmp_dir = "/dev/shm"
+
+logconfig_dict = {
+    "version": 1,
+    "disable_existing_loggers": False,
+    "formatters": {
+        "json_formatter": {
+            "()": structlog.stdlib.ProcessorFormatter,
+            "processor": structlog.processors.JSONRenderer(),
+            "foreign_pre_chain": [
+                structlog.stdlib.add_log_level,
+                structlog.stdlib.add_logger_name,
+                structlog.processors.TimeStamper(),
+                structlog.processors.StackInfoRenderer(),
+                structlog.processors.format_exc_info,
+            ],
+        }
+    },
+    "handlers": {
+        "error_console": {
+            "class": "logging.StreamHandler",
+            "formatter": "json_formatter",
+        },
+        "console": {"class": "logging.StreamHandler", "formatter": "json_formatter"},
+    },
+    "loggers": {
+        "uvicorn": {"handlers": ["console"], "level": "WARNING", "propagate": False},
+        "gunicorn": {"handlers": ["console"], "level": "INFO", "propagate": False},
+    },
+}
+
+# if we're running in kubernetes, use fixed workers because we can scale with more pods
+# otherwise (assume docker-compose), use as much as we can
+if Path("/var/run/secrets/kubernetes.io").exists():
+    workers = 2
+else:
+    worker = cpu_count()
+threads = 4

lifecycle/migrate.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python
+"""System Migration handler"""
+from importlib.util import module_from_spec, spec_from_file_location
+from inspect import getmembers, isclass
+from pathlib import Path
+from typing import Any
+
+from psycopg2 import connect
+from structlog import get_logger
+
+from passbook.lib.config import CONFIG
+
+LOGGER = get_logger()
+
+
+class BaseMigration:
+    """Base System Migration"""
+
+    cur: Any
+    con: Any
+
+    def __init__(self, cur: Any, con: Any):
+        self.cur = cur
+        self.con = con
+
+    def needs_migration(self) -> bool:
+        """Return true if Migration needs to be run"""
+        return False
+
+    def run(self):
+        """Run the actual migration"""
+
+
+if __name__ == "__main__":
+
+    conn = connect(
+        dbname=CONFIG.y("postgresql.name"),
+        user=CONFIG.y("postgresql.user"),
+        password=CONFIG.y("postgresql.password"),
+        host=CONFIG.y("postgresql.host"),
+    )
+    curr = conn.cursor()
+
+    for migration in Path(__file__).parent.absolute().glob("system_migrations/*.py"):
+        spec = spec_from_file_location("lifecycle.system_migrations", migration)
+        mod = module_from_spec(spec)
+        # pyright: reportGeneralTypeIssues=false
+        spec.loader.exec_module(mod)
+
+        for _, sub in getmembers(mod, isclass):
+            migration = sub(curr, conn)
+            if migration.needs_migration():
+                LOGGER.info("Migration needs to be applied", migration=sub)
+                migration.run()
+                LOGGER.info("Migration finished applying", migration=sub)

lifecycle/system_migrations/to_0_10.py

@@ -0,0 +1,50 @@
+from os import system
+
+from lifecycle.migrate import BaseMigration
+
+SQL_STATEMENT = """delete from django_migrations where app = 'passbook_stages_prompt';
+drop table passbook_stages_prompt_prompt cascade;
+drop table passbook_stages_prompt_promptstage cascade;
+drop table passbook_stages_prompt_promptstage_fields;
+drop table corsheaders_corsmodel cascade;
+drop table oauth2_provider_accesstoken cascade;
+drop table oauth2_provider_grant cascade;
+drop table oauth2_provider_refreshtoken cascade;
+drop table oidc_provider_client cascade;
+drop table oidc_provider_client_response_types cascade;
+drop table oidc_provider_code cascade;
+drop table oidc_provider_responsetype cascade;
+drop table oidc_provider_rsakey cascade;
+drop table oidc_provider_token cascade;
+drop table oidc_provider_userconsent cascade;
+drop table passbook_providers_app_gw_applicationgatewayprovider cascade;
+delete from django_migrations where app = 'passbook_flows' and name = '0008_default_flows';
+delete from django_migrations where app = 'passbook_flows' and name = '0009_source_flows';
+delete from django_migrations where app = 'passbook_flows' and name = '0010_provider_flows';
+delete from django_migrations where app = 'passbook_stages_password' and
+name = '0002_passwordstage_change_flow';"""
+
+
+class To010Migration(BaseMigration):
+    def needs_migration(self) -> bool:
+        self.cur.execute(
+            "select * from information_schema.tables where table_name='oidc_provider_client'"
+        )
+        return bool(self.cur.rowcount)
+
+    def system_crit(self, command):
+        retval = system(command)  # nosec
+        if retval != 0:
+            raise Exception("Migration error")
+
+    def run(self):
+        self.cur.execute(SQL_STATEMENT)
+        self.con.commit()
+        self.system_crit("./manage.py migrate passbook_stages_prompt")
+        self.system_crit("./manage.py migrate passbook_flows 0008_default_flows --fake")
+        self.system_crit("./manage.py migrate passbook_flows 0009_source_flows --fake")
+        self.system_crit(
+            "./manage.py migrate passbook_flows 0010_provider_flows --fake"
+        )
+        self.system_crit("./manage.py migrate passbook_flows")
+        self.system_crit("./manage.py migrate passbook_stages_password --fake")

mkdocs.yml

@@ -10,8 +10,7 @@ nav:
     - Kubernetes: installation/kubernetes.md
   - Flows:
       Overview: flow/flows.md
-      Examples:
-        - Login: flow/examples/login.md
+      Examples: flow/examples/examples.md
   - Stages:
       - Captcha Stage: flow/stages/captcha/index.md
       - Dummy Stage: flow/stages/dummy/index.md
@@ -27,7 +26,14 @@ nav:
       - User Logout Stage: flow/stages/user_logout.md
       - User Write Stage: flow/stages/user_write.md
   - Sources: sources.md
-  - Providers: providers.md
+  - Providers:
+    - OAuth2: providers/oauth2.md
+    - SAML: providers/saml.md
+    - Proxy: providers/proxy.md
+  - Outposts:
+    - Overview: outposts/outposts.md
+    - Deploy on docker-compose: outposts/deploy-docker-compose.md
+    - Deploy on Kubernetes: outposts/deploy-kubernetes.md
   - Expressions:
     - Overview: expressions/index.md
     - Reference:
@@ -46,7 +52,9 @@ nav:
         - Harbor: integrations/services/harbor/index.md
         - Sentry: integrations/services/sentry/index.md
         - Ansible Tower/AWX: integrations/services/tower-awx/index.md
-  - Upgrading from v0.8.x: upgrading-from-0.8.x.md
+  - Upgrading:
+    - to 0.9: upgrading/to-0.9.md
+    - to 0.10: upgrading/to-0.10.md
 
 repo_name: "BeryJu/passbook"
 repo_url: https://github.com/BeryJu/passbook

passbook/__init__.py

@@ -1,2 +1,2 @@
 """passbook"""
-__version__ = "0.9.0-pre4"
+__version__ = "0.10.0-stable"

passbook/admin/fields.py

@@ -33,7 +33,7 @@ class YAMLString(str):
     """YAML String type"""
 
 
-class YAMLField(forms.CharField):
+class YAMLField(forms.JSONField):
     """Django's JSON Field converted to YAML"""
 
     default_error_messages = {

passbook/admin/templates/administration/base.html

@@ -46,6 +46,12 @@
                         {% trans 'Providers' %}
                     </a>
                 </li>
+                <li class="pf-c-nav__item">
+                    <a href="{% url 'passbook_admin:outposts' %}"
+                        class="pf-c-nav__link {% is_active 'passbook_admin:outposts' 'passbook_admin:outpost-create' 'passbook_admin:outpost-update' 'passbook_admin:outpost-delete' %}">
+                        {% trans 'Outposts' %}
+                    </a>
+                </li>
                 <li class="pf-c-nav__item">
                     <a href="{% url 'passbook_admin:property-mappings' %}"
                         class="pf-c-nav__link {% is_active 'passbook_admin:property-mappings' 'passbook_admin:property-mapping-create' 'passbook_admin:property-mapping-update' 'passbook_admin:property-mapping-delete' %}">
@@ -122,15 +128,21 @@
                         {% trans 'Certificates' %}
                     </a>
                 </li>
+                <li class="pf-c-nav__item">
+                    <a href="{% url 'passbook_admin:tokens' %}"
+                        class="pf-c-nav__link {% is_active 'passbook_admin:tokens' 'passbook_admin:token-delete' %}">
+                        {% trans 'Tokens' %}
+                    </a>
+                </li>
                 <li class="pf-c-nav__item">
                     <a href="{% url 'passbook_admin:users' %}"
-                        class="pf-c-nav__link {% is_active 'passbook_admin:users' 'passbook_admin:user-update' 'passbook_admin:user-delete' %}">
+                        class="pf-c-nav__link {% is_active 'passbook_admin:users' 'passbook_admin:user-create' 'passbook_admin:user-update' 'passbook_admin:user-delete' %}">
                         {% trans 'Users' %}
                     </a>
                 </li>
                 <li class="pf-c-nav__item">
                     <a href="{% url 'passbook_admin:groups' %}"
-                        class="pf-c-nav__link {% is_active 'passbook_admin:groups' 'passbook_admin:group-update' 'passbook_admin:group-delete' %}">
+                        class="pf-c-nav__link {% is_active 'passbook_admin:groups' 'passbook_admin:group-create' 'passbook_admin:group-update' 'passbook_admin:group-delete' %}">
                         {% trans 'Groups' %}
                     </a>
                 </li>

passbook/admin/templates/administration/debug/request.html

@@ -1,36 +0,0 @@
-{% extends "administration/base.html" %}
-
-{% load i18n %}
-{% load passbook_utils %}
-
-{% block content %}
-<section class="pf-c-page__main-section pf-m-light">
-    <div class="pf-c-content">
-        <h1>
-            <i class="pf-icon pf-icon-applications"></i>
-            {% trans 'Request' %}
-        </h1>
-    </div>
-</section>
-<section class="pf-c-page__main-section pf-m-no-padding-mobile">
-    <div class="pf-c-card">
-        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
-            <thead>
-                <tr role="row">
-                    <th role="columnheader" scope="col" style="min-width: 150px;">{% trans 'Key' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Value' %}</th>
-                </tr>
-            </thead>
-            <tbody role="rowgroup">
-                {% for key, value in request_dict.items %}
-                <tr role="row">
-                    <td role="cell">{{ key }}</td>
-                    <td role="cell">{{ value }}</td>
-                </tr>
-                {% endfor %}
-            </tbody>
-        </table>
-    </div>
-</section>
-</div>
-{% endblock %}

passbook/admin/templates/administration/flow/import.html

@@ -0,0 +1,13 @@
+{% extends base_template|default:"generic/form.html" %}
+
+{% load i18n %}
+
+{% block above_form %}
+<h1>
+{% trans 'Import Flow' %}
+</h1>
+{% endblock %}
+
+{% block action %}
+{% trans 'Import Flow' %}
+{% endblock %}

passbook/admin/templates/administration/flow/list.html

@@ -20,6 +20,7 @@
             <div class="pf-c-toolbar__content">
                 <div class="pf-c-toolbar__bulk-select">
                     <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                    <a href="{% url 'passbook_admin:flow-import' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-secondary" type="button">{% trans 'Import' %}</a>
                 </div>
                 {% include 'partials/pagination.html' %}
             </div>
@@ -62,6 +63,7 @@
                         <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:flow-update' pk=flow.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
                         <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:flow-delete' pk=flow.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
                         <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:flow-execute' pk=flow.pk %}?next={{ request.get_full_path }}">{% trans 'Execute' %}</a>
+                        <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:flow-export' pk=flow.pk %}?next={{ request.get_full_path }}">{% trans 'Export' %}</a>
                     </td>
                 </tr>
                 {% endfor %}
@@ -81,6 +83,7 @@
                     {% trans 'Currently no flows exist. Click the button below to create one.' %}
                 </div>
                 <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                <a href="{% url 'passbook_admin:flow-import' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Import' %}</a>
             </div>
         </div>
         {% endif %}

passbook/admin/templates/administration/outpost/list.html

@@ -0,0 +1,97 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load humanize %}
+{% load passbook_utils %}
+
+{% block head %}
+{{ block.super }}
+<style>
+.pf-m-success {
+    color: var(--pf-global--success-color--100);
+}
+.pf-m-danger {
+    color: var(--pf-global--danger-color--100);
+}
+</style>
+{% endblock %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="fas fa-map-marker"></i>
+            {% trans 'Outposts' %}
+        </h1>
+        <p>{% trans "Outposts are deployments of passbook components to support different environments and protocols, like reverse proxies." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <a href="{% url 'passbook_admin:flow-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Providers' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Health' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for outpost in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <a href="{% url 'passbook_outposts:setup' outpost_pk=outpost.pk %}">{{ outpost.name }}</a>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ outpost.providers.all.select_subclasses|join:", " }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        {% with health=outpost.health %}
+                        {% if health %}
+                            <i class="fas fa-check pf-m-success"></i> {{ health|naturaltime }}
+                        {% else %}
+                            <i class="fas fa-times pf-m-danger"></i> Unhealthy
+                        {% endif %}
+                        {% endwith %}
+                    </td>
+                    <td>
+                        <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:outpost-update' pk=outpost.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
+                        <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:outpost-delete' pk=outpost.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
+                        <a href="https://passbook.beryju.org/outposts/outposts/#deploy">{% trans 'Deploy' %}</a>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Outposts.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no outposts exist. Click the button below to create one.' %}
+                </div>
+                <a href="{% url 'passbook_admin:outpost-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

passbook/admin/templates/administration/overview.html

@@ -10,29 +10,33 @@
 </section>
 <section class="pf-c-page__main-section">
     <div class="pf-l-gallery pf-m-gutter">
-        <a href="{% url 'passbook_admin:applications' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:applications' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-applications"></i> {% trans 'Applications' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ application_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ application_count }}
+                </p>
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:sources' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:sources' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-middleware"></i> {% trans 'Sources' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ source_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ source_count }}
+                </p>
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:providers' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:providers' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-plugged"></i> {% trans 'Providers' %}
@@ -40,15 +44,19 @@
             </div>
             <div class="pf-c-card__body">
                 {% if providers_without_application.exists %}
-                <i class="pf-icon pf-icon-warning-triangle"></i> {{ provider_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-exclamation-triangle"></i> {{ provider_count }}
+                </p>
                 <p>{% trans 'Warning: At least one Provider has no application assigned.' %}</p>
                 {% else %}
-                <i class="pf-icon pf-icon-ok"></i> {{ provider_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ provider_count }}
+                </p>
                 {% endif %}
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-plugged"></i> {% trans 'Stages' %}
@@ -56,26 +64,32 @@
             </div>
             <div class="pf-c-card__body">
                 {% if stage_count < 1 %}
-                <i class="pficon-error-circle-o"></i> {{ stage_count }}
+                <p class="aggregate-status">
+                    <i class="pficon-error-circle-o"></i> {{ stage_count }}
+                </p>
                 <p>{% trans 'No Stages configured. No Users will be able to login.' %}"></p>
                 {% else %}
-                <i class="pf-icon pf-icon-ok"></i> {{ stage_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ stage_count }}
+                </p>
                 {% endif %}
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:stages' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-topology"></i> {% trans 'Flows' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ flow_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ flow_count }}
+                </p>
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:policies' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:policies' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-infrastructure"></i> {% trans 'Policies' %}
@@ -83,58 +97,71 @@
             </div>
             <div class="pf-c-card__body">
                 {% if policies_without_binding %}
-                <i class="pf-icon pf-icon-warning-triangle"></i> {{ policy_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-exclamation-triangle"></i> {{ policy_count }}
+                </p>
                 <p>{% trans 'Policies without binding exist.' %}</p>
                 {% else %}
-                <i class="pf-icon pf-icon-ok"></i> {{ policy_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ policy_count }}
+                </p>
                 {% endif %}
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:stage-invitations' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:stage-invitations' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-migration"></i> {% trans 'Invitation' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ invitation_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ invitation_count }}
+                </p>
             </div>
         </a>
 
-        <a href="{% url 'passbook_admin:users' %}" class="pf-c-card pf-m-hoverable pf-m-compact">
+        <a href="{% url 'passbook_admin:users' %}" class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-user"></i> {% trans 'Users' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
-                <i class="pf-icon pf-icon-ok"></i> {{ user_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ user_count }}
+                </p>
             </div>
         </a>
 
-        <div class="pf-c-card pf-m-hoverable pf-m-compact">
+        <div class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-bundle"></i> {% trans 'Version' %}
                 </div>
             </div>
             <div class="pf-c-card__body">
+                <p class="aggregate-status">
+                    {% if version >= version_latest %}
+                    <i class="fa fa-check-circle"></i> {{ version }}
+                    {% else %}
+                    <i class="fa fa-exclamation-triangle"></i> {{ version }}
+                    {% endif %}
+                </p>
                 {% if version >= version_latest %}
-                <i class="pf-icon pf-icon-ok"></i>
-                    {% blocktrans with version=version %}
-                    {{ version }} (Up-to-date!)
+                    {% blocktrans %}
+                    Up-to-date!
                     {% endblocktrans %}
                 {% else %}
-                <i class="pf-icon pf-icon-warning-triangle"></i>
-                    {% blocktrans with version=version latest=version_latest %}
-                    {{ version }} ({{ latest }} is available!)
+                    {% blocktrans with latest=version_latest %}
+                    {{ latest }} is available!
                     {% endblocktrans %}
                 {% endif %}
             </div>
         </div>
 
-        <div class="pf-c-card pf-m-hoverable pf-m-compact">
+        <div class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-server"></i> {% trans 'Workers' %}
@@ -142,15 +169,19 @@
             </div>
             <div class="pf-c-card__body">
                 {% if worker_count < 1 %}
-                <i class="pf-icon pf-icon-warning-triangle"></i> {{ worker_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-exclamation-triangle"></i> {{ worker_count }}
+                </p>
                 <p>{% trans 'No workers connected.' %}</p>
                 {% else %}
-                <i class="pf-icon pf-icon-ok"></i> {{ worker_count }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ worker_count }}
+                </p>
                 {% endif %}
             </div>
         </div>
 
-        <a class="pf-c-card pf-m-hoverable pf-m-compact" data-target="modal" data-modal="clearCacheModalRoot">
+        <a class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact" data-target="modal" data-modal="clearCacheModalRoot">
             <div class="pf-c-card__header">
                 <div class="pf-c-card__header-main">
                     <i class="pf-icon pf-icon-server"></i> {% trans 'Cached Policies' %}
@@ -158,13 +189,37 @@
             </div>
             <div class="pf-c-card__body">
                 {% if cached_policies < 1 %}
-                <i class="pf-icon pf-icon-warning-triangle"></i> {{ cached_policies }}
+                <p class="aggregate-status">
+                    <i class="fa fa-exclamation-triangle"></i> {{ cached_policies }}
+                </p>
                 <p>{% trans 'No policies cached. Users may experience slow response times.' %}</p>
                 {% else %}
-                <i class="pf-icon pf-icon-ok"></i> {{ cached_policies }}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ cached_policies }}
+                </p>
                 {% endif %}
             </div>
         </a>
+
+        <div class="pf-c-card pf-c-card-aggregate pf-m-hoverable pf-m-compact">
+            <div class="pf-c-card__header">
+                <div class="pf-c-card__header-main">
+                    <i class="pf-icon pf-icon-server"></i> {% trans 'Cached Flows' %}
+                </div>
+            </div>
+            <div class="pf-c-card__body">
+                {% if cached_flows < 1 %}
+                <p class="aggregate-status">
+                    <span class="fa fa-exclamation-triangle"></span> {{ cached_flows }}
+                </p>
+                <p>{% trans 'No flows cached.' %}</p>
+                {% else %}
+                <p class="aggregate-status">
+                    <i class="fa fa-check-circle"></i> {{ cached_flows }}
+                </p>
+                {% endif %}
+            </div>
+        </div>
     </section>
 </div>
 <div class="pf-c-backdrop" id="clearCacheModalRoot" hidden>
@@ -173,7 +228,9 @@
             <button data-modal-close class="pf-c-button pf-m-plain" type="button" aria-label="Close dialog">
                 <i class="fas fa-times" aria-hidden="true"></i>
             </button>
-            <h1 class="pf-c-title pf-m-2xl" id="modal-title">{% trans 'Clear Cache' %}?</h1>
+            <div class="pf-c-modal-box__header">
+                <h1 class="pf-c-title pf-m-2xl" id="modal-title">{% trans 'Clear Cache' %}?</h1>
+            </div>
             <div class="pf-c-modal-box__body" id="modal-description">
                 <form method="post" id="clearForm">
                     {% csrf_token %}

passbook/admin/templates/administration/policy_binding/list.html

@@ -28,29 +28,50 @@
         <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
             <thead>
                 <tr role="row">
-                    <th role="columnheader" scope="col">{% trans 'Enabled' %}</th>
                     <th role="columnheader" scope="col">{% trans 'Policy' %}</th>
-                    <th role="columnheader" scope="col">{% trans 'Target' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Enabled' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Order' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Timeout' %}</th>
                     <th role="cell"></th>
                 </tr>
             </thead>
-            <tbody role="rowgroup" class="pf-m-expanded">
-                {% for binding in object_list %}
-                <tr role="row pf-c-table__expandable-row pf-m-expanded">
-                    <th role="cell">
-                        <div>{{ binding.enabled }}</div>
-                    </th>
-                    <th role="cell">
-                        <div>{{ binding.policy }}</div>
-                    </th>
-                    <th role="cell">
-                        <div>{{ binding.target|verbose_name }}</div>
-                    </th>
-                    <td>
-                        <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:policy-binding-update' pk=binding.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
-                        <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:policy-binding-delete' pk=binding.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
-                    </td>
-                </tr>
+            <tbody role="rowgroup">
+                {% for pbm in object_list %}
+                    <tr role="role">
+                        <td>
+                            {{ pbm }}
+                            <small>
+                                {{ pbm|fieldtype }}
+                            </small>
+                        </td>
+                        <td></td>
+                        <td></td>
+                        <td></td>
+                        <td></td>
+                    </tr>
+                    {% for binding in pbm.bindings %}
+                    <tr class="row pf-c-table__expandable-row pf-m-expanded">
+                        <th role="cell">
+                            <div>{{ binding.policy }}</div>
+                            <small>
+                                {{ binding.policy|fieldtype }}
+                            </small>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.enabled }}</div>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.order }}</div>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.timeout }}</div>
+                        </th>
+                        <td class="pb-table-action" role="cell">
+                            <a class="pf-c-button pf-m-secondary" href="{% url 'passbook_admin:policy-binding-update' pk=binding.pk %}?back={{ request.get_full_path }}">{% trans 'Edit' %}</a>
+                            <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:policy-binding-delete' pk=binding.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
+                        </td>
+                    </tr>
+                    {% endfor %}
                 {% endfor %}
             </tbody>
         </table>

passbook/admin/templates/administration/stage_binding/list.html

@@ -35,7 +35,7 @@
                 </tr>
             </thead>
             <tbody role="rowgroup">
-                {% regroup object_list by flow as grouped_bindings %}
+                {% regroup object_list by target as grouped_bindings %}
                 {% for flow in grouped_bindings %}
                     <tr role="role">
                         <td>
@@ -56,9 +56,9 @@
                         </td>
                         <th role="columnheader">
                             <div>
-                                <div>{{ binding.flow.slug }}</div>
+                                <div>{{ binding.target.slug }}</div>
                                 <small>
-                                    {{ binding.flow.name }}
+                                    {{ binding.target.name }}
                                 </small>
                             </div>
                         </th>

passbook/admin/templates/administration/token/list.html

@@ -0,0 +1,86 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load passbook_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="fas fa-key"></i>
+            {% trans 'Tokens' %}
+        </h1>
+        <p>{% trans "Tokens are used throughout passbook for Email validation stages, Recovery keys and API access." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Token' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'User' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expires?' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expiry Date' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for token in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ token.pk.hex }}</div>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ token.user }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ token.expiring|yesno:"Yes,No" }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {% if not token.expiring %}
+                            -
+                            {% else %}
+                            {{ token.expires }}
+                            {% endif %}
+                        </span>
+                    </td>
+                    <td>
+                        <a class="pf-c-button pf-m-danger" href="{% url 'passbook_admin:token-delete' pk=token.pk %}?back={{ request.get_full_path }}">{% trans 'Delete' %}</a>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-toolbar" id="page-layout-table-simple-toolbar-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Tokens.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no tokens exist.' %}
+                </div>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

passbook/admin/templates/generic/form.html

@@ -30,7 +30,7 @@
         <div class="pf-l-stack__item">
             <div class="pf-c-card">
                 <div class="pf-c-card__body">
-                    <form action="" method="post" class="pf-c-form pf-m-horizontal">
+                    <form action="" method="post" class="pf-c-form pf-m-horizontal" enctype="multipart/form-data">
                         {% include 'partials/form_horizontal.html' with form=form %}
                         {% block beneath_form %}
                         {% endblock %}

passbook/admin/templates/generic/update.html

@@ -12,7 +12,7 @@
 {% endblock %}
 
 {% block action %}
-{% blocktrans with type=form|form_verbose_name|title %}
+{% blocktrans with type=form|form_verbose_name %}
 Update {{ type }}
 {% endblocktrans %}
 {% endblock %}

passbook/admin/tests.py

@@ -1,12 +1,15 @@
 """admin tests"""
+from importlib import import_module
 from typing import Callable
 
+from django.forms import ModelForm
 from django.shortcuts import reverse
 from django.test import Client, TestCase
 from django.urls.exceptions import NoReverseMatch
 
 from passbook.admin.urls import urlpatterns
 from passbook.core.models import User
+from passbook.lib.utils.reflection import get_apps
 
 
 class TestAdmin(TestCase):
@@ -34,4 +37,28 @@ def generic_view_tester(view_name: str) -> Callable:
 
 for url in urlpatterns:
     method_name = url.name.replace("-", "_")
-    setattr(TestAdmin, f"test_{method_name}", generic_view_tester(url.name))
+    setattr(TestAdmin, f"test_view_{method_name}", generic_view_tester(url.name))
+
+
+def generic_form_tester(form: ModelForm) -> Callable:
+    """Test a form"""
+
+    def tester(self: TestAdmin):
+        form_inst = form()
+        self.assertFalse(form_inst.is_valid())
+
+    return tester
+
+
+# Load the forms module from every app, so we have all forms loaded
+for app in get_apps():
+    module = app.__module__.replace(".apps", ".forms")
+    try:
+        import_module(module)
+    except ImportError:
+        pass
+
+for form_class in ModelForm.__subclasses__():
+    setattr(
+        TestAdmin, f"test_form_{form_class.__name__}", generic_form_tester(form_class)
+    )

passbook/admin/urls.py

@@ -4,9 +4,9 @@ from django.urls import path
 from passbook.admin.views import (
     applications,
     certificate_key_pair,
-    debug,
     flows,
     groups,
+    outposts,
     overview,
     policies,
     policies_bindings,
@@ -17,6 +17,7 @@ from passbook.admin.views import (
     stages_bindings,
     stages_invitations,
     stages_prompts,
+    tokens,
     users,
 )
 
@@ -41,6 +42,13 @@ urlpatterns = [
         applications.ApplicationDeleteView.as_view(),
         name="application-delete",
     ),
+    # Tokens
+    path("tokens/", tokens.TokenListView.as_view(), name="tokens"),
+    path(
+        "tokens/<uuid:pk>/delete/",
+        tokens.TokenDeleteView.as_view(),
+        name="token-delete",
+    ),
     # Sources
     path("sources/", sources.SourceListView.as_view(), name="sources"),
     path("sources/create/", sources.SourceCreateView.as_view(), name="source-create"),
@@ -184,6 +192,7 @@ urlpatterns = [
     # Flows
     path("flows/", flows.FlowListView.as_view(), name="flows"),
     path("flows/create/", flows.FlowCreateView.as_view(), name="flow-create",),
+    path("flows/import/", flows.FlowImportView.as_view(), name="flow-import",),
     path(
         "flows/<uuid:pk>/update/", flows.FlowUpdateView.as_view(), name="flow-update",
     ),
@@ -192,6 +201,9 @@ urlpatterns = [
         flows.FlowDebugExecuteView.as_view(),
         name="flow-execute",
     ),
+    path(
+        "flows/<uuid:pk>/export/", flows.FlowExportView.as_view(), name="flow-export",
+    ),
     path(
         "flows/<uuid:pk>/delete/", flows.FlowDeleteView.as_view(), name="flow-delete",
     ),
@@ -227,13 +239,17 @@ urlpatterns = [
         name="user-password-reset",
     ),
     # Groups
-    path("group/", groups.GroupListView.as_view(), name="group"),
-    path("group/create/", groups.GroupCreateView.as_view(), name="group-create"),
+    path("groups/", groups.GroupListView.as_view(), name="groups"),
+    path("groups/create/", groups.GroupCreateView.as_view(), name="group-create"),
     path(
-        "group/<uuid:pk>/update/", groups.GroupUpdateView.as_view(), name="group-update"
+        "groups/<uuid:pk>/update/",
+        groups.GroupUpdateView.as_view(),
+        name="group-update",
     ),
     path(
-        "group/<uuid:pk>/delete/", groups.GroupDeleteView.as_view(), name="group-delete"
+        "groups/<uuid:pk>/delete/",
+        groups.GroupDeleteView.as_view(),
+        name="group-delete",
     ),
     # Certificate-Key Pairs
     path(
@@ -256,8 +272,19 @@ urlpatterns = [
         certificate_key_pair.CertificateKeyPairDeleteView.as_view(),
         name="certificatekeypair-delete",
     ),
-    # Groups
-    path("groups/", groups.GroupListView.as_view(), name="groups"),
-    # Debug
-    path("debug/request/", debug.DebugRequestView.as_view(), name="debug-request"),
+    # Outposts
+    path("outposts/", outposts.OutpostListView.as_view(), name="outposts",),
+    path(
+        "outposts/create/", outposts.OutpostCreateView.as_view(), name="outpost-create",
+    ),
+    path(
+        "outposts/<uuid:pk>/update/",
+        outposts.OutpostUpdateView.as_view(),
+        name="outpost-update",
+    ),
+    path(
+        "outposts/<uuid:pk>/delete/",
+        outposts.OutpostDeleteView.as_view(),
+        name="outpost-delete",
+    ),
 ]