release: 2021.8.5

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.10.2
+current_version = 2021.8.5
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -27,7 +27,7 @@ If applicable, add screenshots to help explain your problem.
 Output of docker-compose logs or kubectl logs respectively
 
 **Version and Deployment (please complete the following information):**
- - authentik version: [e.g. 2021.8.5]
+ - authentik version: [e.g. 0.10.0-stable]
  - Deployment: [e.g. docker-compose, helm]
 
 **Additional context**

.github/ISSUE_TEMPLATE/question.md

@@ -20,7 +20,7 @@ If applicable, add screenshots to help explain your problem.
 Output of docker-compose logs or kubectl logs respectively
 
 **Version and Deployment (please complete the following information):**
- - authentik version: [e.g. 2021.8.5]
+ - authentik version: [e.g. 0.10.0-stable]
  - Deployment: [e.g. docker-compose, helm]
 
 **Additional context**

.github/codespell-words.txt

@@ -1,3 +0,0 @@
-keypair
-keypairs
-hass

.github/workflows/ci-main.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -47,7 +47,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -65,7 +65,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -83,7 +83,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -117,7 +117,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -128,44 +128,30 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-        with:
-          fetch-depth: 0
       - uses: actions/setup-python@v2
         with:
           python-version: '3.9'
-      - name: prepare variables
-        id: ev
-        run: |
-          python ./scripts/gh_env.py
-      - id: cache-pipenv
-        uses: actions/cache@v2.1.6
-        with:
-          path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
       - name: checkout stable
         run: |
           # Copy current, latest config to local
           cp authentik/lib/default.yml local.env.yml
           git checkout $(git describe --abbrev=0 --match 'version/*')
+      - id: cache-pipenv
+        uses: actions/cache@v2.1.6
+        with:
+          path: ~/.local/share/virtualenvs
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
-        run: |
-          scripts/ci_prepare.sh
-          # Sync anyways since stable will have different dependencies
-          pipenv sync --dev
+        run: scripts/ci_prepare.sh
       - name: run migrations to stable
         run: pipenv run python -m lifecycle.migrate
       - name: checkout current code
         run: |
           set -x
-          git fetch
-          git checkout ${{ steps.ev.outputs.branchName }}
+          git checkout $GITHUB_REF
           pipenv sync --dev
-      - name: prepare
-        env:
-          INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
-        run: scripts/ci_prepare.sh
       - name: migrate to latest
         run: pipenv run python -m lifecycle.migrate
   test-unittest:
@@ -179,7 +165,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -208,7 +194,7 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
@@ -247,13 +233,13 @@ jobs:
         uses: actions/cache@v2.1.6
         with:
           path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
+          key: ${{ runner.os }}-pipenv-${{ hashFiles('**/Pipfile.lock') }}
       - name: prepare
         env:
           INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
         run: |
           scripts/ci_prepare.sh
-          docker-compose -f tests/e2e/docker-compose.yml up -d
+          docker-compose -f tests/e2e/ci.docker-compose.yml up -d
       - id: cache-web
         uses: actions/cache@v2.1.6
         with:
@@ -297,20 +283,20 @@ jobs:
         env:
           DOCKER_USERNAME: ${{ secrets.HARBOR_USERNAME }}
         run: |
-          python ./scripts/gh_env.py
+          python ./scripts/gh_do_set_branch.py
       - name: Login to Container Registry
         uses: docker/login-action@v1
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: beryju.org
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
       - name: Building Docker Image
         uses: docker/build-push-action@v2
         with:
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           tags: |
-            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}
-            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}
+            beryju.org/authentik/server:gh-${{ steps.ev.outputs.branchName }}
+            beryju.org/authentik/server:gh-${{ steps.ev.outputs.branchName }}-${{ steps.ev.outputs.timestamp }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}

.github/workflows/ci-outpost.yml

@@ -18,6 +18,9 @@ jobs:
       - uses: actions/setup-go@v2
         with:
           go-version: '^1.16.3'
+      - name: Generate API
+        run: |
+          make gen-outpost
       - name: Run linter
         run: |
           # Create folder structure for go embeds
@@ -41,6 +44,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1.2.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
       - name: prepare variables
@@ -48,22 +53,23 @@ jobs:
         env:
           DOCKER_USERNAME: ${{ secrets.HARBOR_USERNAME }}
         run: |
-          python ./scripts/gh_env.py
+          python ./scripts/gh_do_set_branch.py
       - name: Login to Container Registry
         uses: docker/login-action@v1
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: beryju.org
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
       - name: Building Docker Image
         uses: docker/build-push-action@v2
         with:
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           tags: |
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
+            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchName }}
+            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchName }}-${{ steps.ev.outputs.timestamp }}
+            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
           file: ${{ matrix.type }}.Dockerfile
+          platforms: linux/amd64,linux/arm64
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}

.github/workflows/ci-web.yml

@@ -61,7 +61,7 @@ jobs:
           npm install
       - name: Generate API
         run: make gen-web
-      - name: lit-analyse
+      - name: prettier
         run: |
           cd web
           npm run lit-analyse

.github/workflows/ghcr-retention.yml

@@ -1,22 +0,0 @@
-name: ghcr-retention
-
-on:
-  schedule:
-    - cron: '0 0 * * *'  # every day at midnight
-  workflow_dispatch:
-
-jobs:
-  clean-ghcr:
-    name: Delete old unused container images
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete 'dev' containers older than a week
-        uses: sondrelg/container-retention-policy@v1
-        with:
-          image-names: dev-server,dev-ldap,dev-proxy
-          cut-off: One week ago UTC
-          account-type: org
-          org-name: goauthentik
-          untagged-only: false
-          token: ${{ secrets.GHCR_CLEANUP_TOKEN }}
-          skip-tags: gh-next,gh-master

.github/workflows/release-publish.yml

@@ -3,6 +3,9 @@ name: authentik-on-release
 on:
   release:
     types: [published, created]
+  push:
+    branches:
+      - version-*
 
 jobs:
   # Build
@@ -30,14 +33,14 @@ jobs:
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
-            beryju/authentik:2021.10.2,
+            beryju/authentik:2021.8.5,
             beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2021.10.2,
+            ghcr.io/goauthentik/server:2021.8.5,
             ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
           context: .
       - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.10.2', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.8.5', 'rc') }}
         run: |
           docker pull beryju/authentik:latest
           docker tag beryju/authentik:latest beryju/authentik:stable
@@ -72,14 +75,14 @@ jobs:
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
-            beryju/authentik-proxy:2021.10.2,
+            beryju/authentik-proxy:2021.8.5,
             beryju/authentik-proxy:latest,
-            ghcr.io/goauthentik/proxy:2021.10.2,
+            ghcr.io/goauthentik/proxy:2021.8.5,
             ghcr.io/goauthentik/proxy:latest
           file: proxy.Dockerfile
           platforms: linux/amd64,linux/arm64
       - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.10.2', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.8.5', 'rc') }}
         run: |
           docker pull beryju/authentik-proxy:latest
           docker tag beryju/authentik-proxy:latest beryju/authentik-proxy:stable
@@ -114,14 +117,14 @@ jobs:
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
-            beryju/authentik-ldap:2021.10.2,
+            beryju/authentik-ldap:2021.8.5,
             beryju/authentik-ldap:latest,
-            ghcr.io/goauthentik/ldap:2021.10.2,
+            ghcr.io/goauthentik/ldap:2021.8.5,
             ghcr.io/goauthentik/ldap:latest
           file: ldap.Dockerfile
           platforms: linux/amd64,linux/arm64
       - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.10.2', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.8.5', 'rc') }}
         run: |
           docker pull beryju/authentik-ldap:latest
           docker tag beryju/authentik-ldap:latest beryju/authentik-ldap:stable
@@ -139,13 +142,15 @@ jobs:
       - uses: actions/checkout@v2
       - name: Run test suite in final docker images
         run: |
-          echo "PG_PASS=$(openssl rand -base64 32)" >> .env
-          echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
+          sudo apt-get install -y pwgen
+          echo "PG_PASS=$(pwgen 40 1)" >> .env
+          echo "AUTHENTIK_SECRET_KEY=$(pwgen 50 1)" >> .env
           docker-compose pull -q
           docker-compose up --no-start
           docker-compose start postgresql redis
           docker-compose run -u root server test
   sentry-release:
+    if: ${{ github.event_name == 'release' }}
     needs:
       - test-release
     runs-on: ubuntu-latest
@@ -170,7 +175,7 @@ jobs:
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          version: authentik@2021.10.2
+          version: authentik@2021.8.5
           environment: beryjuorg-prod
           sourcemaps: './web/dist'
           url_prefix: '~/static/dist'

.github/workflows/release-tag.yml

@@ -13,20 +13,21 @@ jobs:
       - uses: actions/checkout@v2
       - name: Pre-release test
         run: |
-          echo "PG_PASS=$(openssl rand -base64 32)" >> .env
-          echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
+          sudo apt-get install -y pwgen
+          echo "AUTHENTIK_TAG=latest" >> .env
+          echo "PG_PASS=$(pwgen 40 1)" >> .env
+          echo "AUTHENTIK_SECRET_KEY=$(pwgen 50 1)" >> .env
+          docker-compose pull -q
           docker build \
             --no-cache \
-            -t testing:latest \
+            -t ghcr.io/goauthentik/server:latest \
             -f Dockerfile .
-          echo "AUTHENTIK_IMAGE=testing" >> .env
-          echo "AUTHENTIK_TAG=latest" >> .env
           docker-compose up --no-start
           docker-compose start postgresql redis
           docker-compose run -u root server test
       - name: Extract version number
         id: get_version
-        uses: actions/github-script@v5
+        uses: actions/github-script@v4.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/translation-compile.yml

@@ -1,46 +0,0 @@
-name: authentik-backend-translate-compile
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - '/locale/'
-  schedule:
-  - cron: "0 */2 * * *"
-  workflow_dispatch:
-
-env:
-  POSTGRES_DB: authentik
-  POSTGRES_USER: authentik
-  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-
-jobs:
-  compile:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
-        with:
-          python-version: '3.9'
-      - id: cache-pipenv
-        uses: actions/cache@v2.1.6
-        with:
-          path: ~/.local/share/virtualenvs
-          key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
-      - name: prepare
-        env:
-          INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gettext
-          scripts/ci_prepare.sh
-      - name: run compile
-        run: pipenv run ./manage.py compilemessages
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: compile-backend-translation
-          commit-message: "core: compile backend translations"
-          title: "core: compile backend translations"
-          delete-branch: true
-          signoff: true

CONTRIBUTING.md

@@ -31,7 +31,7 @@ Basically, don't be a dickhead. This is an open-source non-profit project, that
 
 ## I don't want to read this whole thing I just have a question!!!
 
-Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://goauthentik.io/discord)
+Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://discord.gg/jg33eMhnj6)
 
 ## What should I know before I get started?
 
@@ -117,7 +117,7 @@ This section guides you through submitting a bug report for authentik. Following
 
 Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.
 
-This form will have the full stack trace of the error that occurred and shouldn't contain any sensitive data.
+This form will have the full stack trace of the error that ocurred and shouldn't contain any sensitive data.
 
 ### Suggesting Enhancements
 
@@ -131,7 +131,7 @@ When you are creating an enhancement suggestion, please fill in [the template](h
 
 authentik can be run locally, all though depending on which part you want to work on, different pre-requisites are required.
 
-This is documented in the [developer docs](https://goauthentik.io/developer-docs/?utm_source=github)
+This is documented in the [developer docs](https://goauthentik.io/developer-docs/)
 
 ### Pull Requests
 

Dockerfile

@@ -1,5 +1,5 @@
 # Stage 1: Lock python dependencies
-FROM docker.io/python:3.9-bullseye as locker
+FROM python:3.9-slim-buster as locker
 
 COPY ./Pipfile /app/
 COPY ./Pipfile.lock /app/
@@ -11,23 +11,38 @@ RUN pip install pipenv && \
     pipenv lock -r --dev-only > requirements-dev.txt
 
 # Stage 2: Build website
-FROM docker.io/node:16 as website-builder
+FROM node as website-builder
 
 COPY ./website /static/
 
 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build-docs-only
 
-# Stage 3: Build webui
-FROM docker.io/node:16 as web-builder
+# Stage 3: Generate API Client
+FROM openapitools/openapi-generator-cli as go-api-builder
+
+COPY ./schema.yml /local/schema.yml
+
+RUN	docker-entrypoint.sh generate \
+    --git-host goauthentik.io \
+    --git-repo-id outpost \
+    --git-user-id api \
+    -i /local/schema.yml \
+    -g go \
+    -o /local/api \
+    --additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true && \
+    rm -f /local/api/go.mod /local/api/go.sum
+
+# Stage 4: Build webui
+FROM node as web-builder
 
 COPY ./web /static/
 
 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build
 
-# Stage 4: Build go proxy
-FROM docker.io/golang:1.17.2-bullseye AS builder
+# Stage 5: Build go proxy
+FROM golang:1.17.0 AS builder
 
 WORKDIR /work
 
@@ -37,6 +52,7 @@ COPY --from=web-builder /static/dist/ /work/web/dist/
 COPY --from=web-builder /static/authentik/ /work/web/authentik/
 COPY --from=website-builder /static/help/ /work/website/help/
 
+COPY --from=go-api-builder /local/api api
 COPY ./cmd /work/cmd
 COPY ./web/static.go /work/web/static.go
 COPY ./website/static.go /work/website/static.go
@@ -46,8 +62,8 @@ COPY ./go.sum /work/go.sum
 
 RUN go build -o /work/authentik ./cmd/server/main.go
 
-# Stage 5: Run
-FROM docker.io/python:3.9-bullseye
+# Stage 6: Run
+FROM python:3.9-slim-buster
 
 WORKDIR /
 COPY --from=locker /app/requirements.txt /
@@ -59,7 +75,7 @@ ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 RUN apt-get update && \
     apt-get install -y --no-install-recommends curl ca-certificates gnupg git runit && \
     curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
-    echo "deb http://apt.postgresql.org/pub/repos/apt bullseye-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
+    echo "deb http://apt.postgresql.org/pub/repos/apt buster-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
     apt-get update && \
     apt-get install -y --no-install-recommends libpq-dev postgresql-client build-essential libxmlsec1-dev pkg-config libmaxminddb0 && \
     pip install -r /requirements.txt --no-cache-dir && \
@@ -80,11 +96,8 @@ COPY ./lifecycle/ /lifecycle
 COPY --from=builder /work/authentik /authentik-proxy
 
 USER authentik
-
 ENV TMPDIR /dev/shm/
-ENV PYTHONUNBUFFERED 1
+ENV PYTHONUBUFFERED 1
+ENV prometheus_multiproc_dir /dev/shm/
 ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
-
-HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "/lifecycle/ak", "healthcheck" ]
-
 ENTRYPOINT [ "/lifecycle/ak" ]

Makefile

@@ -20,23 +20,12 @@ test:
 lint-fix:
 	isort authentik tests lifecycle
 	black authentik tests lifecycle
-	codespell -I .github/codespell-words.txt -S 'web/src/locales/**' -w \
-		authentik \
-		internal \
-		cmd \
-		web/src \
-		website/src \
-		website/docs \
-		website/developer-docs
 
 lint:
+	pyright authentik tests lifecycle
 	bandit -r authentik tests lifecycle -x node_modules
 	pylint authentik tests lifecycle
 
-i18n-extract:
-	./manage.py makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
-	cd web && npm run extract
-
 gen-build:
 	./manage.py spectacular --file schema.yml
 
@@ -73,7 +62,7 @@ gen-outpost:
 		--additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true,disallowAdditionalPropertiesIfNotPresent=false
 	rm -f api/go.mod api/go.sum
 
-gen: gen-build gen-clean gen-web
+gen: gen-build gen-clean gen-web gen-outpost
 
 migrate:
 	python -m lifecycle.migrate

Pipfile

@@ -26,9 +26,9 @@ drf-spectacular = "*"
 facebook-sdk = "*"
 geoip2 = "*"
 gunicorn = "*"
-kubernetes = "==v19.15.0"
+kubernetes = "*"
 ldap3 = "*"
-lxml = "*"
+lxml = ">=4.6.3"
 packaging = "*"
 psycopg2-binary = "*"
 pycryptodome = "*"
@@ -48,14 +48,16 @@ duo-client = "*"
 ua-parser = "*"
 deepmerge = "*"
 colorama = "*"
-codespell = "*"
+
+[requires]
+python_version = "3.9"
 
 [dev-packages]
 bandit = "*"
-black = "==21.9b0"
+black = "==21.5b1"
 bump2version = "*"
 colorama = "*"
-coverage = {extras = ["toml"],version = "*"}
+coverage = "*"
 pylint = "*"
 pylint-django = "*"
 pytest = "*"

README.md

@@ -4,7 +4,7 @@
 
 ---
 
-[![Join Discord](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://goauthentik.io/discord)
+[![Join Discord](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://discord.gg/jg33eMhnj6)
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-main?label=core%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-main.yml)
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-outpost?label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-web?label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
@@ -20,9 +20,9 @@ authentik is an open-source Identity Provider focused on flexibility and versati
 
 ## Installation
 
-For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/?utm_source=github)
+For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/)
 
-For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/?utm_source=github)
+For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
 
 ## Screenshots
 
@@ -33,7 +33,7 @@ Light | Dark
 
 ## Development
 
-See [Development Documentation](https://goauthentik.io/developer-docs/?utm_source=github)
+See [Development Documentation](https://goauthentik.io/developer-docs/)
 
 ## Security
 

SECURITY.md

@@ -6,8 +6,8 @@
 
 | Version    | Supported          |
 | ---------- | ------------------ |
+| 2021.7.x   | :white_check_mark: |
 | 2021.8.x   | :white_check_mark: |
-| 2021.9.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

authentik/__init__.py

@@ -1,3 +1,3 @@
 """authentik"""
-__version__ = "2021.10.2"
+__version__ = "2021.8.5"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"

authentik/admin/api/system.py

@@ -84,7 +84,7 @@ class SystemSerializer(PassiveSerializer):
         return now()
 
     def get_embedded_outpost_host(self, request: Request) -> str:
-        """Get the FQDN configured on the embedded outpost"""
+        """Get the FQDN configured on the embeddded outpost"""
         outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
         if not outposts.exists():
             return ""

authentik/admin/api/workers.py

@@ -1,5 +1,4 @@
 """authentik administration overview"""
-from django.conf import settings
 from drf_spectacular.utils import extend_schema, inline_serializer
 from prometheus_client import Gauge
 from rest_framework.fields import IntegerField
@@ -22,7 +21,4 @@ class WorkerView(APIView):
     def get(self, request: Request) -> Response:
         """Get currently connected worker count."""
         count = len(CELERY_APP.control.ping(timeout=0.5))
-        # In debug we run with `CELERY_TASK_ALWAYS_EAGER`, so tasks are ran on the main process
-        if settings.DEBUG:
-            count += 1
         return Response({"count": count})

authentik/admin/apps.py

@@ -8,8 +8,3 @@ class AuthentikAdminConfig(AppConfig):
     name = "authentik.admin"
     label = "authentik_admin"
     verbose_name = "authentik Admin"
-
-    def ready(self):
-        from authentik.admin.tasks import clear_update_notifications
-
-        clear_update_notifications.delay()

authentik/admin/tasks.py

@@ -6,19 +6,12 @@ from django.core.cache import cache
 from django.core.validators import URLValidator
 from packaging.version import parse
 from prometheus_client import Info
-from requests import RequestException
+from requests import RequestException, get
 from structlog.stdlib import get_logger
 
 from authentik import ENV_GIT_HASH_KEY, __version__
-from authentik.events.models import Event, EventAction, Notification
-from authentik.events.monitored_tasks import (
-    MonitoredTask,
-    TaskResult,
-    TaskResultStatus,
-    prefill_task,
-)
-from authentik.lib.config import CONFIG
-from authentik.lib.utils.http import get_http_session
+from authentik.events.models import Event, EventAction
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
@@ -40,33 +33,15 @@ def _set_prom_info():
     )
 
 
-@CELERY_APP.task()
-def clear_update_notifications():
-    """Clear update notifications on startup if the notification was for the version
-    we're running now."""
-    for notification in Notification.objects.filter(event__action=EventAction.UPDATE_AVAILABLE):
-        if "new_version" not in notification.event.context:
-            continue
-        notification_version = notification.event.context["new_version"]
-        if notification_version == __version__:
-            notification.delete()
-
-
 @CELERY_APP.task(bind=True, base=MonitoredTask)
-@prefill_task()
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
-    if CONFIG.y_bool("disable_update_check"):
-        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
-        return
     try:
-        response = get_http_session().get(
-            "https://version.goauthentik.io/version.json",
-        )
+        response = get("https://api.github.com/repos/goauthentik/authentik/releases/latest")
         response.raise_for_status()
         data = response.json()
-        upstream_version = data.get("stable", {}).get("version")
+        tag_name = data.get("tag_name")
+        upstream_version = tag_name.split("/")[1]
         cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
         self.set_status(
             TaskResult(TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"])
@@ -83,7 +58,7 @@ def update_latest_version(self: MonitoredTask):
             ).exists():
                 return
             event_dict = {"new_version": upstream_version}
-            if match := re.search(URL_FINDER, data.get("stable", {}).get("changelog", "")):
+            if match := re.search(URL_FINDER, data.get("body", "")):
                 event_dict["message"] = f"Changelog: {match.group()}"
             Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
     except (RequestException, IndexError) as exc:

authentik/admin/tests/test_tasks.py

@@ -1,58 +1,81 @@
 """test admin tasks"""
+import json
+from dataclasses import dataclass
+from unittest.mock import Mock, patch
+
 from django.core.cache import cache
 from django.test import TestCase
-from requests_mock import Mocker
+from requests.exceptions import RequestException
 
 from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
 from authentik.events.models import Event, EventAction
 
-RESPONSE_VALID = {
-    "$schema": "https://version.goauthentik.io/schema.json",
-    "stable": {
-        "version": "99999999.9999999",
-        "changelog": "See https://goauthentik.io/test",
-        "reason": "bugfix",
-    },
-}
+
+@dataclass
+class MockResponse:
+    """Mock class to emulate the methods of requests's Response we need"""
+
+    status_code: int
+    response: str
+
+    def json(self) -> dict:
+        """Get json parsed response"""
+        return json.loads(self.response)
+
+    def raise_for_status(self):
+        """raise RequestException if status code is 400 or more"""
+        if self.status_code >= 400:
+            raise RequestException
+
+
+REQUEST_MOCK_VALID = Mock(
+    return_value=MockResponse(
+        200,
+        """{
+            "tag_name": "version/99999999.9999999",
+            "body": "https://goauthentik.io/test"
+        }""",
+    )
+)
+
+REQUEST_MOCK_INVALID = Mock(return_value=MockResponse(400, "{}"))
 
 
 class TestAdminTasks(TestCase):
     """test admin tasks"""
 
+    @patch("authentik.admin.tasks.get", REQUEST_MOCK_VALID)
     def test_version_valid_response(self):
         """Test Update checker with valid response"""
-        with Mocker() as mocker:
-            mocker.get("https://version.goauthentik.io/version.json", json=RESPONSE_VALID)
-            update_latest_version.delay().get()
-            self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
-            self.assertTrue(
+        update_latest_version.delay().get()
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
+        self.assertTrue(
+            Event.objects.filter(
+                action=EventAction.UPDATE_AVAILABLE,
+                context__new_version="99999999.9999999",
+                context__message="Changelog: https://goauthentik.io/test",
+            ).exists()
+        )
+        # test that a consecutive check doesn't create a duplicate event
+        update_latest_version.delay().get()
+        self.assertEqual(
+            len(
                 Event.objects.filter(
                     action=EventAction.UPDATE_AVAILABLE,
                     context__new_version="99999999.9999999",
                     context__message="Changelog: https://goauthentik.io/test",
-                ).exists()
-            )
-            # test that a consecutive check doesn't create a duplicate event
-            update_latest_version.delay().get()
-            self.assertEqual(
-                len(
-                    Event.objects.filter(
-                        action=EventAction.UPDATE_AVAILABLE,
-                        context__new_version="99999999.9999999",
-                        context__message="Changelog: https://goauthentik.io/test",
-                    )
-                ),
-                1,
-            )
+                )
+            ),
+            1,
+        )
 
+    @patch("authentik.admin.tasks.get", REQUEST_MOCK_INVALID)
     def test_version_error(self):
         """Test Update checker with invalid response"""
-        with Mocker() as mocker:
-            mocker.get("https://version.goauthentik.io/version.json", status_code=400)
-            update_latest_version.delay().get()
-            self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
-            self.assertFalse(
-                Event.objects.filter(
-                    action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
-                ).exists()
-            )
+        update_latest_version.delay().get()
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
+        self.assertFalse(
+            Event.objects.filter(
+                action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
+            ).exists()
+        )

authentik/api/authentication.py

@@ -9,7 +9,6 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from structlog.stdlib import get_logger
 
-from authentik.core.middleware import KEY_AUTH_VIA, LOCAL
 from authentik.core.models import Token, TokenIntents, User
 from authentik.outposts.models import Outpost
 
@@ -41,12 +40,11 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
         raise AuthenticationFailed("Malformed header")
     tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
     if not tokens.exists():
+        LOGGER.info("Authenticating via secret_key")
         user = token_secret_key(password)
         if not user:
             raise AuthenticationFailed("Token invalid/expired")
         return user
-    if hasattr(LOCAL, "authentik"):
-        LOCAL.authentik[KEY_AUTH_VIA] = "api_token"
     return tokens.first().user
 
 
@@ -60,8 +58,6 @@ def token_secret_key(value: str) -> Optional[User]:
     outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
     if not outposts:
         return None
-    if hasattr(LOCAL, "authentik"):
-        LOCAL.authentik[KEY_AUTH_VIA] = "secret_key"
     outpost = outposts.first()
     return outpost.user
 

authentik/api/authorization.py

@@ -33,12 +33,3 @@ class OwnerPermissions(BasePermission):
         if owner != request.user:
             return False
         return True
-
-
-class OwnerSuperuserPermissions(OwnerPermissions):
-    """Similar to OwnerPermissions, except always allow access for superusers"""
-
-    def has_object_permission(self, request: Request, view, obj: Model) -> bool:
-        if request.user.is_superuser:
-            return True
-        return super().has_object_permission(request, view, obj)

authentik/api/decorators.py

@@ -5,9 +5,6 @@ from typing import Callable, Optional
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
-from structlog.stdlib import get_logger
-
-LOGGER = get_logger()
 
 
 def permission_required(perm: Optional[str] = None, other_perms: Optional[list[str]] = None):
@@ -21,12 +18,10 @@ def permission_required(perm: Optional[str] = None, other_perms: Optional[list[s
             if perm:
                 obj = self.get_object()
                 if not request.user.has_perm(perm, obj):
-                    LOGGER.debug("denying access for object", user=request.user, perm=perm, obj=obj)
                     return self.permission_denied(request)
             if other_perms:
                 for other_perm in other_perms:
                     if not request.user.has_perm(other_perm):
-                        LOGGER.debug("denying access for other", user=request.user, perm=perm)
                         return self.permission_denied(request)
             return func(self, request, *args, **kwargs)
 

authentik/api/schema.py

@@ -11,7 +11,7 @@ from drf_spectacular.types import OpenApiTypes
 
 
 def build_standard_type(obj, **kwargs):
-    """Build a basic type with optional add owns."""
+    """Build a basic type with optional add ons."""
     schema = build_basic_type(obj)
     schema.update(kwargs)
     return schema
@@ -31,7 +31,7 @@ VALIDATION_ERROR = build_object_type(
         "non_field_errors": build_array_type(build_standard_type(OpenApiTypes.STR)),
         "code": build_standard_type(OpenApiTypes.STR),
     },
-    required=[],
+    required=["detail"],
     additionalProperties={},
 )
 

authentik/api/throttle.py

@@ -1,18 +0,0 @@
-"""Throttling classes"""
-from typing import Type
-
-from django.views import View
-from rest_framework.request import Request
-from rest_framework.throttling import ScopedRateThrottle
-
-
-class SessionThrottle(ScopedRateThrottle):
-    """Throttle based on session key"""
-
-    def allow_request(self, request: Request, view):
-        if request._request.user.is_superuser:
-            return True
-        return super().allow_request(request, view)
-
-    def get_cache_key(self, request: Request, view: Type[View]) -> str:
-        return f"authentik-throttle-session-{request._request.session.session_key}"

authentik/api/v3/config.py

@@ -63,7 +63,7 @@ class ConfigView(APIView):
 
     @extend_schema(responses={200: ConfigSerializer(many=False)})
     def get(self, request: Request) -> Response:
-        """Retrieve public configuration options"""
+        """Retrive public configuration options"""
         config = ConfigSerializer(
             {
                 "error_reporting_enabled": CONFIG.y("error_reporting.enabled"),

authentik/api/v3/sentry.py

@@ -0,0 +1,66 @@
+"""Sentry tunnel"""
+from json import loads
+
+from django.conf import settings
+from django.http.request import HttpRequest
+from django.http.response import HttpResponse
+from requests import post
+from requests.exceptions import RequestException
+from rest_framework.authentication import SessionAuthentication
+from rest_framework.parsers import BaseParser
+from rest_framework.permissions import AllowAny
+from rest_framework.request import Request
+from rest_framework.throttling import AnonRateThrottle
+from rest_framework.views import APIView
+
+from authentik.lib.config import CONFIG
+
+
+class PlainTextParser(BaseParser):
+    """Plain text parser."""
+
+    media_type = "text/plain"
+
+    def parse(self, stream, media_type=None, parser_context=None) -> str:
+        """Simply return a string representing the body of the request."""
+        return stream.read()
+
+
+class CsrfExemptSessionAuthentication(SessionAuthentication):
+    """CSRF-exempt Session authentication"""
+
+    def enforce_csrf(self, request: Request):
+        return  # To not perform the csrf check previously happening
+
+
+class SentryTunnelView(APIView):
+    """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+
+    serializer_class = None
+    parser_classes = [PlainTextParser]
+    throttle_classes = [AnonRateThrottle]
+    permission_classes = [AllowAny]
+    authentication_classes = [CsrfExemptSessionAuthentication]
+
+    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+        # Only allow usage of this endpoint when error reporting is enabled
+        if not CONFIG.y_bool("error_reporting.enabled", False):
+            return HttpResponse(status=400)
+        # Body is 2 json objects separated by \n
+        full_body = request.body
+        header = loads(full_body.splitlines()[0])
+        # Check that the DSN is what we expect
+        dsn = header.get("dsn", "")
+        if dsn != settings.SENTRY_DSN:
+            return HttpResponse(status=400)
+        response = post(
+            "https://sentry.beryju.org/api/8/envelope/",
+            data=full_body,
+            headers={"Content-Type": "application/octet-stream"},
+        )
+        try:
+            response.raise_for_status()
+        except RequestException:
+            return HttpResponse(status=500)
+        return HttpResponse(status=response.status_code)

authentik/api/v3/urls.py

@@ -11,27 +11,25 @@ from authentik.admin.api.tasks import TaskViewSet
 from authentik.admin.api.version import VersionView
 from authentik.admin.api.workers import WorkerView
 from authentik.api.v3.config import ConfigView
+from authentik.api.v3.sentry import SentryTunnelView
 from authentik.api.views import APIBrowserView
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
-from authentik.core.api.devices import DeviceViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
-from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
+from authentik.core.api.sources import SourceViewSet
 from authentik.core.api.tokens import TokenViewSet
 from authentik.core.api.users import UserViewSet
 from authentik.crypto.api import CertificateKeyPairViewSet
 from authentik.events.api.event import EventViewSet
 from authentik.events.api.notification import NotificationViewSet
-from authentik.events.api.notification_mapping import NotificationWebhookMappingViewSet
 from authentik.events.api.notification_rule import NotificationRuleViewSet
 from authentik.events.api.notification_transport import NotificationTransportViewSet
 from authentik.flows.api.bindings import FlowStageBindingViewSet
 from authentik.flows.api.flows import FlowViewSet
 from authentik.flows.api.stages import StageViewSet
-from authentik.flows.views.executor import FlowExecutorView
-from authentik.flows.views.inspector import FlowInspectorView
+from authentik.flows.views import FlowExecutorView
 from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.outposts.api.service_connections import (
     DockerServiceConnectionViewSet,
@@ -68,11 +66,6 @@ from authentik.stages.authenticator_duo.api import (
     DuoAdminDeviceViewSet,
     DuoDeviceViewSet,
 )
-from authentik.stages.authenticator_sms.api import (
-    AuthenticatorSMSStageViewSet,
-    SMSAdminDeviceViewSet,
-    SMSDeviceViewSet,
-)
 from authentik.stages.authenticator_static.api import (
     AuthenticatorStaticStageViewSet,
     StaticAdminDeviceViewSet,
@@ -105,7 +98,6 @@ from authentik.stages.user_write.api import UserWriteStageViewSet
 from authentik.tenants.api import TenantViewSet
 
 router = routers.DefaultRouter()
-router.include_format_suffixes = False
 
 router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
 router.register("admin/apps", AppsViewSet, basename="apps")
@@ -136,7 +128,6 @@ router.register("events/transports", NotificationTransportViewSet)
 router.register("events/rules", NotificationRuleViewSet)
 
 router.register("sources/all", SourceViewSet)
-router.register("sources/user_connections/all", UserSourceConnectionViewSet)
 router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
 router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
@@ -168,11 +159,8 @@ router.register("propertymappings/all", PropertyMappingViewSet)
 router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
 router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 router.register("propertymappings/scope", ScopeMappingViewSet)
-router.register("propertymappings/notification", NotificationWebhookMappingViewSet)
 
-router.register("authenticators/all", DeviceViewSet, basename="device")
 router.register("authenticators/duo", DuoDeviceViewSet)
-router.register("authenticators/sms", SMSDeviceViewSet)
 router.register("authenticators/static", StaticDeviceViewSet)
 router.register("authenticators/totp", TOTPDeviceViewSet)
 router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
@@ -181,11 +169,6 @@ router.register(
     DuoAdminDeviceViewSet,
     basename="admin-duodevice",
 )
-router.register(
-    "authenticators/admin/sms",
-    SMSAdminDeviceViewSet,
-    basename="admin-smsdevice",
-)
 router.register(
     "authenticators/admin/static",
     StaticAdminDeviceViewSet,
@@ -200,7 +183,6 @@ router.register(
 
 router.register("stages/all", StageViewSet)
 router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
-router.register("stages/authenticator/sms", AuthenticatorSMSStageViewSet)
 router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
 router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
 router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
@@ -243,11 +225,7 @@ urlpatterns = (
             FlowExecutorView.as_view(),
             name="flow-executor",
         ),
-        path(
-            "flows/inspector/<slug:flow_slug>/",
-            FlowInspectorView.as_view(),
-            name="flow-inspector",
-        ),
+        path("sentry/", SentryTunnelView.as_view(), name="sentry"),
         path("schema/", cache_page(86400)(SpectacularAPIView.as_view()), name="schema"),
     ]
 )

authentik/core/api/authenticated_sessions.py

@@ -11,7 +11,6 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import GenericViewSet
 from ua_parser import user_agent_parser
 
-from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.models import AuthenticatedSession
 from authentik.events.geo import GEOIP_READER, GeoIPDict
@@ -103,8 +102,11 @@ class AuthenticatedSessionViewSet(
     search_fields = ["user__username", "last_ip", "last_user_agent"]
     filterset_fields = ["user__username", "last_ip", "last_user_agent"]
     ordering = ["user__username"]
-    permission_classes = [OwnerSuperuserPermissions]
-    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
+    filter_backends = [
+        DjangoFilterBackend,
+        OrderingFilter,
+        SearchFilter,
+    ]
 
     def get_queryset(self):
         user = self.request.user if self.request else get_anonymous_user()

authentik/core/api/devices.py

@@ -1,36 +0,0 @@
-"""Authenticator Devices API Views"""
-from django_otp import devices_for_user
-from django_otp.models import Device
-from drf_spectacular.utils import extend_schema
-from rest_framework.fields import CharField, IntegerField, SerializerMethodField
-from rest_framework.permissions import IsAuthenticated
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.viewsets import ViewSet
-
-from authentik.core.api.utils import MetaNameSerializer
-
-
-class DeviceSerializer(MetaNameSerializer):
-    """Serializer for Duo authenticator devices"""
-
-    pk = IntegerField()
-    name = CharField()
-    type = SerializerMethodField()
-
-    def get_type(self, instance: Device) -> str:
-        """Get type of device"""
-        return instance._meta.label
-
-
-class DeviceViewSet(ViewSet):
-    """Viewset for authenticator devices"""
-
-    serializer_class = DeviceSerializer
-    permission_classes = [IsAuthenticated]
-
-    @extend_schema(responses={200: DeviceSerializer(many=True)})
-    def list(self, request: Request) -> Response:
-        """Get all devices for current user"""
-        devices = devices_for_user(request.user)
-        return Response(DeviceSerializer(devices, many=True).data)

authentik/core/api/groups.py

@@ -2,7 +2,7 @@
 from django.db.models.query import QuerySet
 from django_filters.filters import ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
-from rest_framework.fields import CharField, JSONField
+from rest_framework.fields import BooleanField, CharField, JSONField
 from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
@@ -15,6 +15,7 @@ from authentik.core.models import Group, User
 class GroupMemberSerializer(ModelSerializer):
     """Stripped down user serializer to show relevant users for groups"""
 
+    is_superuser = BooleanField(read_only=True)
     avatar = CharField(read_only=True)
     attributes = JSONField(validators=[is_dict], required=False)
     uid = CharField(read_only=True)
@@ -28,6 +29,7 @@ class GroupMemberSerializer(ModelSerializer):
             "name",
             "is_active",
             "last_login",
+            "is_superuser",
             "email",
             "avatar",
             "attributes",

authentik/core/api/sources.py

@@ -1,21 +1,18 @@
 """Source API Views"""
 from typing import Iterable
 
-from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
-from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
-from authentik.api.authorization import OwnerFilter, OwnerPermissions
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
-from authentik.core.models import Source, UserSourceConnection
+from authentik.core.models import Source
 from authentik.core.types import UserSettingSerializer
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.engine import PolicyEngine
@@ -98,9 +95,7 @@ class SourceViewSet(
     @action(detail=False, pagination_class=None, filter_backends=[])
     def user_settings(self, request: Request) -> Response:
         """Get all sources the user can configure"""
-        _all_sources: Iterable[Source] = (
-            Source.objects.filter(enabled=True).select_subclasses().order_by("name")
-        )
+        _all_sources: Iterable[Source] = Source.objects.filter(enabled=True).select_subclasses()
         matching_sources: list[UserSettingSerializer] = []
         for source in _all_sources:
             user_settings = source.ui_user_settings
@@ -116,39 +111,3 @@ class SourceViewSet(
                 LOGGER.warning(source_settings.errors)
             matching_sources.append(source_settings.validated_data)
         return Response(matching_sources)
-
-
-class UserSourceConnectionSerializer(SourceSerializer):
-    """OAuth Source Serializer"""
-
-    source = SourceSerializer(read_only=True)
-
-    class Meta:
-        model = UserSourceConnection
-        fields = [
-            "pk",
-            "user",
-            "source",
-            "created",
-        ]
-        extra_kwargs = {
-            "user": {"read_only": True},
-            "created": {"read_only": True},
-        }
-
-
-class UserSourceConnectionViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    mixins.DestroyModelMixin,
-    UsedByMixin,
-    mixins.ListModelMixin,
-    GenericViewSet,
-):
-    """User-source connection Viewset"""
-
-    queryset = UserSourceConnection.objects.all()
-    serializer_class = UserSourceConnectionSerializer
-    permission_classes = [OwnerPermissions]
-    filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]
-    ordering = ["pk"]

authentik/core/api/tokens.py

@@ -2,19 +2,15 @@
 from typing import Any
 
 from django.http.response import Http404
-from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema
-from guardian.shortcuts import get_anonymous_user
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField
-from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
@@ -82,25 +78,14 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
         "description",
         "expires",
         "expiring",
-        "managed",
     ]
-    ordering = ["identifier", "expires"]
-    permission_classes = [OwnerSuperuserPermissions]
-    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
-
-    def get_queryset(self):
-        user = self.request.user if self.request else get_anonymous_user()
-        if user.is_superuser:
-            return super().get_queryset()
-        return super().get_queryset().filter(user=user.pk)
+    ordering = ["expires"]
 
     def perform_create(self, serializer: TokenSerializer):
-        if not self.request.user.is_superuser:
-            return serializer.save(
-                user=self.request.user,
-                expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
-            )
-        return super().perform_create(serializer)
+        serializer.save(
+            user=self.request.user,
+            expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
+        )
 
     @permission_required("authentik_core.view_token_key")
     @extend_schema(

authentik/core/api/users.py

@@ -1,5 +1,4 @@
 """User API Views"""
-from datetime import timedelta
 from json import loads
 from typing import Optional
 
@@ -8,8 +7,6 @@ from django.db.transaction import atomic
 from django.db.utils import IntegrityError
 from django.urls import reverse_lazy
 from django.utils.http import urlencode
-from django.utils.text import slugify
-from django.utils.timezone import now
 from django.utils.translation import gettext as _
 from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
@@ -22,7 +19,7 @@ from drf_spectacular.utils import (
 )
 from guardian.shortcuts import get_anonymous_user, get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, DictField, JSONField, SerializerMethodField
+from rest_framework.fields import CharField, JSONField, SerializerMethodField
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -45,8 +42,6 @@ from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
 from authentik.core.models import (
-    USER_ATTRIBUTE_CHANGE_EMAIL,
-    USER_ATTRIBUTE_CHANGE_USERNAME,
     USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
     Group,
@@ -92,9 +87,6 @@ class UserSerializer(ModelSerializer):
             "attributes",
             "uid",
         ]
-        extra_kwargs = {
-            "name": {"allow_blank": True},
-        }
 
 
 class UserSelfSerializer(ModelSerializer):
@@ -103,41 +95,8 @@ class UserSelfSerializer(ModelSerializer):
 
     is_superuser = BooleanField(read_only=True)
     avatar = CharField(read_only=True)
-    groups = SerializerMethodField()
+    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
     uid = CharField(read_only=True)
-    settings = DictField(source="attributes.settings", default=dict)
-
-    @extend_schema_field(
-        ListSerializer(
-            child=inline_serializer(
-                "UserSelfGroups",
-                {"name": CharField(read_only=True), "pk": CharField(read_only=True)},
-            )
-        )
-    )
-    def get_groups(self, _: User):
-        """Return only the group names a user is member of"""
-        for group in self.instance.ak_groups.all():
-            yield {
-                "name": group.name,
-                "pk": group.pk,
-            }
-
-    def validate_email(self, email: str):
-        """Check if the user is allowed to change their email"""
-        if self.instance.group_attributes().get(USER_ATTRIBUTE_CHANGE_EMAIL, True):
-            return email
-        if email != self.instance.email:
-            raise ValidationError("Not allowed to change email.")
-        return email
-
-    def validate_username(self, username: str):
-        """Check if the user is allowed to change their username"""
-        if self.instance.group_attributes().get(USER_ATTRIBUTE_CHANGE_USERNAME, True):
-            return username
-        if username != self.instance.username:
-            raise ValidationError("Not allowed to change username.")
-        return username
 
     class Meta:
 
@@ -152,11 +111,9 @@ class UserSelfSerializer(ModelSerializer):
             "email",
             "avatar",
             "uid",
-            "settings",
         ]
         extra_kwargs = {
             "is_active": {"read_only": True},
-            "name": {"allow_blank": True},
         }
 
 
@@ -248,7 +205,6 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     """User Viewset"""
 
     queryset = User.objects.none()
-    ordering = ["username"]
     serializer_class = UserSerializer
     search_fields = ["username", "name", "is_active", "email"]
     filterset_class = UsersFilter
@@ -315,10 +271,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                     )
                     group.users.add(user)
                 token = Token.objects.create(
-                    identifier=slugify(f"service-account-{username}-password"),
+                    identifier=f"service-account-{username}-password",
                     intent=TokenIntents.INTENT_APP_PASSWORD,
                     user=user,
-                    expires=now() + timedelta(days=360),
                 )
                 return Response({"username": user.username, "token": token.key})
             except (IntegrityError) as exc:
@@ -329,14 +284,13 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     # pylint: disable=invalid-name
     def me(self, request: Request) -> Response:
         """Get information about current user"""
-        serializer = SessionUserSerializer(
-            data={"user": UserSelfSerializer(instance=request.user).data}
-        )
+        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
         if SESSION_IMPERSONATE_USER in request._request.session:
             serializer.initial_data["original"] = UserSelfSerializer(
-                instance=request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
+                request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
             ).data
-        return Response(serializer.initial_data)
+        serializer.is_valid()
+        return Response(serializer.data)
 
     @extend_schema(request=UserSelfSerializer, responses={200: SessionUserSerializer(many=False)})
     @action(
@@ -350,13 +304,15 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         """Allow users to change information on their own profile"""
         data = UserSelfSerializer(instance=User.objects.get(pk=request.user.pk), data=request.data)
         if not data.is_valid():
-            return Response(data.errors, status=400)
+            return Response(data.errors)
         new_user = data.save()
         # If we're impersonating, we need to update that user object
         # since it caches the full object
         if SESSION_IMPERSONATE_USER in request.session:
             request.session[SESSION_IMPERSONATE_USER] = new_user
-        return Response({"user": data.data})
+        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
+        serializer.is_valid()
+        return Response(serializer.data)
 
     @permission_required("authentik_core.view_user", ["authentik_events.view_event"])
     @extend_schema(responses={200: UserMetricsSerializer(many=False)})

authentik/core/auth.py

@@ -8,7 +8,7 @@ from django.http.request import HttpRequest
 from authentik.core.models import Token, TokenIntents, User
 from authentik.events.utils import cleanse_dict, sanitize_dict
 from authentik.flows.planner import FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_PLAN
+from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
 
 

authentik/core/middleware.py

@@ -10,9 +10,6 @@ SESSION_IMPERSONATE_USER = "authentik_impersonate_user"
 SESSION_IMPERSONATE_ORIGINAL_USER = "authentik_impersonate_original_user"
 LOCAL = local()
 RESPONSE_HEADER_ID = "X-authentik-id"
-KEY_AUTH_VIA = "auth_via"
-KEY_USER = "user"
-INTERNAL_HEADER_PREFIX = "X-authentik-internal-"
 
 
 class ImpersonateMiddleware:
@@ -53,17 +50,15 @@ class RequestIDMiddleware:
             }
         response = self.get_response(request)
         response[RESPONSE_HEADER_ID] = request.request_id
-        if auth_via := LOCAL.authentik.get(KEY_AUTH_VIA, None):
-            response[INTERNAL_HEADER_PREFIX + KEY_AUTH_VIA] = auth_via
-        response[INTERNAL_HEADER_PREFIX + KEY_USER] = request.user.username
-        for key in list(LOCAL.authentik.keys()):
-            del LOCAL.authentik[key]
+        del LOCAL.authentik["request_id"]
+        del LOCAL.authentik["host"]
         return response
 
 
 # pylint: disable=unused-argument
-def structlog_add_request_id(logger: Logger, method_name: str, event_dict: dict):
+def structlog_add_request_id(logger: Logger, method_name: str, event_dict):
     """If threadlocal has authentik defined, add request_id to log"""
     if hasattr(LOCAL, "authentik"):
-        event_dict.update(LOCAL.authentik)
+        event_dict["request_id"] = LOCAL.authentik.get("request_id", "")
+        event_dict["host"] = LOCAL.authentik.get("host", "")
     return event_dict

authentik/core/migrations/0002_auto_20200523_1133_squashed_0011_provider_name_temp.py

@@ -1,221 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:16
-
-from os import environ
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin, _ = User.objects.using(db_alias).get_or_create(
-        username="akadmin", email="root@localhost", name="authentik Default Admin"
-    )
-    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
-    else:
-        akadmin.set_unusable_password()
-    akadmin.save()
-
-
-def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    User = apps.get_model("authentik_core", "User")
-
-    # Creates a default admin group
-    group, _ = Group.objects.using(db_alias).get_or_create(
-        is_superuser=True,
-        defaults={
-            "name": "authentik Admins",
-        },
-    )
-    group.users.set(User.objects.filter(username="akadmin"))
-    group.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0002_auto_20200523_1133"),
-        ("authentik_core", "0003_default_user"),
-        ("authentik_core", "0004_auto_20200703_2213"),
-        ("authentik_core", "0005_token_intent"),
-        ("authentik_core", "0006_auto_20200709_1608"),
-        ("authentik_core", "0007_auto_20200815_1841"),
-        ("authentik_core", "0008_auto_20200824_1532"),
-        ("authentik_core", "0009_group_is_superuser"),
-        ("authentik_core", "0010_auto_20200917_1021"),
-        ("authentik_core", "0011_provider_name_temp"),
-    ]
-
-    dependencies = [
-        ("authentik_core", "0001_initial"),
-        ("authentik_flows", "0003_auto_20200523_1133"),
-        ("auth", "0012_alter_user_first_name_max_length"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="application",
-            name="skip_authorization",
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="authentication_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when authenticating existing users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_authentication",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="enrollment_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when enrolling new users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_enrollment",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="authorization_flow",
-            field=models.ForeignKey(
-                help_text="Flow used when authorizing this provider.",
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="provider_authorization",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.RunPython(
-            code=create_default_user,
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="is_superuser",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="is_staff",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AlterModelOptions(
-            name="application",
-            options={"verbose_name": "Application", "verbose_name_plural": "Applications"},
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (("reset_user_password", "Reset Password"),),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[("verification", "Intent Verification"), ("api", "Intent Api")],
-                default="verification",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="source",
-            name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
-        ),
-        migrations.AlterField(
-            model_name="user",
-            name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="groups",
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(
-                blank=True,
-                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
-                related_name="user_set",
-                related_query_name="user",
-                to="auth.Group",
-                verbose_name="groups",
-            ),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="group",
-            name="is_superuser",
-            field=models.BooleanField(
-                default=False, help_text="Users added to this group will be superusers."
-            ),
-        ),
-        migrations.RunPython(
-            code=create_default_admin_group,
-        ),
-        migrations.AlterModelManagers(
-            name="user",
-            managers=[
-                ("objects", authentik.core.models.UserManager()),
-            ],
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (
-                    ("reset_user_password", "Reset Password"),
-                    ("impersonate", "Can impersonate other users"),
-                ),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="name_temp",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-    ]

authentik/core/migrations/0012_auto_20201003_1737_squashed_0016_auto_20201202_2234.py

@@ -1,118 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-12 15:36
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def set_default_token_key(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "Token")
-
-    for token in Token.objects.using(db_alias).all():
-        token.key = token.pk.hex
-        token.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0012_auto_20201003_1737"),
-        ("authentik_core", "0013_auto_20201003_2132"),
-        ("authentik_core", "0014_auto_20201018_1158"),
-        ("authentik_core", "0015_application_icon"),
-        ("authentik_core", "0016_auto_20201202_2234"),
-    ]
-
-    dependencies = [
-        ("authentik_providers_saml", "0006_remove_samlprovider_name"),
-        ("authentik_providers_oauth2", "0006_remove_oauth2provider_name"),
-        ("authentik_core", "0011_provider_name_temp"),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="provider",
-            old_name="name_temp",
-            new_name="name",
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="identifier",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                ],
-                default="verification",
-            ),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together={("identifier", "user")},
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="key",
-            field=models.TextField(default=authentik.core.models.default_token_key),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together=set(),
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_co_key_e45007_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
-        ),
-        migrations.RunPython(
-            code=set_default_token_key,
-        ),
-        migrations.RemoveField(
-            model_name="application",
-            name="meta_icon_url",
-        ),
-        migrations.AddField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
-        ),
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_key_e45007_idx",
-        ),
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_identif_1a34a8_idx",
-        ),
-        migrations.RenameField(
-            model_name="user",
-            old_name="pb_groups",
-            new_name="ak_groups",
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_c_key_f71355_idx"),
-        ),
-    ]

authentik/core/migrations/0018_auto_20210330_1345_squashed_0028_alter_token_intent.py

@@ -1,210 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:12
-
-import uuid
-from os import environ
-
-import django.core.validators
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-from django.db.models import Count
-
-import authentik.core.models
-
-
-def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    from django.contrib.sessions.backends.cache import KEY_PREFIX
-    from django.core.cache import cache
-
-    session_keys = cache.keys(KEY_PREFIX + "*")
-    cache.delete_many(session_keys)
-
-
-def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "token")
-    identifiers = (
-        Token.objects.using(db_alias)
-        .values("identifier")
-        .annotate(identifier_count=Count("identifier"))
-        .filter(identifier_count__gt=1)
-    )
-    for ident in identifiers:
-        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
-
-
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import Token, TokenIntents, User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    if "AK_ADMIN_TOKEN" not in environ:
-        return
-    Token.objects.using(db_alias).create(
-        identifier="authentik-boostrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=environ["AK_ADMIN_TOKEN"],
-    )
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0018_auto_20210330_1345"),
-        ("authentik_core", "0019_source_managed"),
-        ("authentik_core", "0020_source_user_matching_mode"),
-        ("authentik_core", "0021_alter_application_slug"),
-        ("authentik_core", "0022_authenticatedsession"),
-        ("authentik_core", "0023_alter_application_meta_launch_url"),
-        ("authentik_core", "0024_alter_token_identifier"),
-        ("authentik_core", "0025_alter_application_meta_icon"),
-        ("authentik_core", "0026_alter_application_meta_icon"),
-        ("authentik_core", "0027_bootstrap_token"),
-        ("authentik_core", "0028_alter_token_intent"),
-    ]
-
-    dependencies = [
-        ("authentik_core", "0017_managed"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="token",
-            options={
-                "permissions": (("view_token_key", "View token's key"),),
-                "verbose_name": "Token",
-                "verbose_name_plural": "Tokens",
-            },
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                unique=True,
-                verbose_name="Managed by authentik",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="user_matching_mode",
-            field=models.TextField(
-                choices=[
-                    ("identifier", "Use the source-specific identifier"),
-                    (
-                        "email_link",
-                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
-                    ),
-                    (
-                        "email_deny",
-                        "Use the user's email address, but deny enrollment when the email address already exists.",
-                    ),
-                    (
-                        "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
-                    ),
-                    (
-                        "username_deny",
-                        "Use the user's username, but deny enrollment when the username already exists.",
-                    ),
-                ],
-                default="identifier",
-                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="slug",
-            field=models.SlugField(
-                help_text="Internal application name, used in URLs.", unique=True
-            ),
-        ),
-        migrations.CreateModel(
-            name="AuthenticatedSession",
-            fields=[
-                (
-                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
-                ),
-                ("expiring", models.BooleanField(default=True)),
-                ("uuid", models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False)),
-                ("session_key", models.CharField(max_length=40)),
-                ("last_ip", models.TextField()),
-                ("last_user_agent", models.TextField(blank=True)),
-                ("last_used", models.DateTimeField(auto_now=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-            },
-        ),
-        migrations.RunPython(
-            code=migrate_sessions,
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_launch_url",
-            field=models.TextField(
-                blank=True, default="", validators=[django.core.validators.URLValidator()]
-            ),
-        ),
-        migrations.RunPython(
-            code=fix_duplicates,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255, unique=True),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(
-                default=None, max_length=500, null=True, upload_to="application-icons/"
-            ),
-        ),
-        migrations.AlterModelOptions(
-            name="authenticatedsession",
-            options={
-                "verbose_name": "Authenticated Session",
-                "verbose_name_plural": "Authenticated Sessions",
-            },
-        ),
-        migrations.RunPython(
-            code=create_default_user_token,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                    ("app_password", "Intent App Password"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]

authentik/core/migrations/0020_source_user_matching_mode.py

@@ -26,7 +26,7 @@ class Migration(migrations.Migration):
                     ),
                     (
                         "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
+                        "Link to a user with identical username address. Can have security implications when a username is used with another source.",
                     ),
                     (
                         "username_deny",

authentik/core/models.py

@@ -39,8 +39,6 @@ USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
 USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_SOURCES = "goauthentik.io/user/sources"
 USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
-USER_ATTRIBUTE_CHANGE_USERNAME = "goauthentik.io/user/can-change-username"
-USER_ATTRIBUTE_CHANGE_EMAIL = "goauthentik.io/user/can-change-email"
 USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
 
 GRAVATAR_URL = "https://secure.gravatar.com"
@@ -285,7 +283,7 @@ class SourceUserMatchingModes(models.TextChoices):
     )
     USERNAME_LINK = "username_link", _(
         (
-            "Link to a user with identical username. Can have security implications "
+            "Link to a user with identical username address. Can have security implications "
             "when a username is used with another source."
         )
     )

authentik/core/sources/flow_manager.py

@@ -22,7 +22,7 @@ from authentik.flows.planner import (
     PLAN_CONTEXT_SSO,
     FlowPlanner,
 )
-from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_GET, SESSION_KEY_PLAN
+from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_GET, SESSION_KEY_PLAN
 from authentik.lib.utils.urls import redirect_with_qs
 from authentik.policies.utils import delete_none_keys
 from authentik.stages.password import BACKEND_INBUILT
@@ -184,7 +184,7 @@ class SourceFlowManager:
         # Ensure redirect is carried through when user was trying to
         # authorize application
         final_redirect = self.request.session.get(SESSION_KEY_GET, {}).get(
-            NEXT_ARG_NAME, "authentik_core:if-user"
+            NEXT_ARG_NAME, "authentik_core:if-admin"
         )
         kwargs.update(
             {
@@ -243,9 +243,9 @@ class SourceFlowManager:
             return self.handle_auth_user(connection)
         return redirect(
             reverse(
-                "authentik_core:if-user",
+                "authentik_core:if-admin",
             )
-            + f"#/settings;page-{self.source.slug}"
+            + f"#/user;page-{self.source.slug}"
         )
 
     def handle_enroll(

authentik/core/sources/stage.py

@@ -28,7 +28,3 @@ class PostUserEnrollmentStage(StageView):
             source=connection.source,
         ).from_http(self.request)
         return self.executor.stage_ok()
-
-    def post(self, request: HttpRequest) -> HttpResponse:
-        """Wrapper for post requests"""
-        return self.get(request)

authentik/core/tasks.py

@@ -6,7 +6,6 @@ from os import environ
 from boto3.exceptions import Boto3Error
 from botocore.exceptions import BotoCoreError, ClientError
 from dbbackup.db.exceptions import CommandConnectorError
-from django.conf import settings
 from django.contrib.humanize.templatetags.humanize import naturaltime
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core import management
@@ -16,12 +15,7 @@ from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from structlog.stdlib import get_logger
 
 from authentik.core.models import AuthenticatedSession, ExpiringModel
-from authentik.events.monitored_tasks import (
-    MonitoredTask,
-    TaskResult,
-    TaskResultStatus,
-    prefill_task,
-)
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.config import CONFIG
 from authentik.root.celery import CELERY_APP
 
@@ -29,7 +23,6 @@ LOGGER = get_logger()
 
 
 @CELERY_APP.task(bind=True, base=MonitoredTask)
-@prefill_task()
 def clean_expired_models(self: MonitoredTask):
     """Remove expired objects"""
     messages = []
@@ -56,25 +49,23 @@ def clean_expired_models(self: MonitoredTask):
     self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL, messages))
 
 
-def should_backup() -> bool:
-    """Check if we should be doing backups"""
-    if SERVICE_HOST_ENV_NAME in environ and not CONFIG.y("postgresql.s3_backup.bucket"):
-        LOGGER.info("Running in k8s and s3 backups are not configured, skipping")
-        return False
-    if not CONFIG.y_bool("postgresql.backup.enabled"):
-        return False
-    if settings.DEBUG:
-        return False
-    return True
-
-
 @CELERY_APP.task(bind=True, base=MonitoredTask)
-@prefill_task()
 def backup_database(self: MonitoredTask):  # pragma: no cover
     """Database backup"""
     self.result_timeout_hours = 25
-    if not should_backup():
-        self.set_status(TaskResult(TaskResultStatus.UNKNOWN, ["Backups are not configured."]))
+    if SERVICE_HOST_ENV_NAME in environ and not CONFIG.y("postgresql.s3_backup"):
+        LOGGER.info("Running in k8s and s3 backups are not configured, skipping")
+        self.set_status(
+            TaskResult(
+                TaskResultStatus.WARNING,
+                [
+                    (
+                        "Skipping backup as authentik is running in Kubernetes "
+                        "without S3 backups configured."
+                    ),
+                ],
+            )
+        )
         return
     try:
         start = datetime.now()

authentik/core/templates/base/skeleton.html

@@ -8,15 +8,16 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:tenant.branding_title %}{% endblock %}</title>
-        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-base.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}">
+        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-base.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}?v={{ ak_version }}">
         {% block head_before %}
         {% endblock %}
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
-        <script src="{% static 'dist/poly.js' %}" type="module"></script>
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}?v={{ ak_version }}">
+        <script src="{% static 'dist/poly.js' %}?v={{ ak_version }}" type="module"></script>
+        <script>window["polymerSkipLoadingFontRoboto"] = true;</script>
         {% block head %}
         {% endblock %}
     </head>

authentik/core/templates/if/admin.html

@@ -4,7 +4,7 @@
 {% load i18n %}
 
 {% block head %}
-<script src="{% static 'dist/AdminInterface.js' %}" type="module"></script>
+<script src="{% static 'dist/AdminInterface.js' %}?v={{ ak_version }}" type="module"></script>
 {% endblock %}
 
 {% block body %}

authentik/core/templates/if/end_session.html

@@ -21,7 +21,7 @@ You've logged out of {{ application }}.
         {% endblocktrans %}
     </p>
 
-    <a id="ak-back-home" href="{% url 'authentik_core:root-redirect' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
+    <a id="ak-back-home" href="{% url 'authentik_core:if-admin' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
 
     <a id="logout" href="{% url 'authentik_flows:default-invalidation' %}" class="pf-c-button pf-m-secondary">{% trans 'Log out of authentik' %}</a>
 

authentik/core/templates/if/flow.html

@@ -4,14 +4,13 @@
 {% load i18n %}
 
 {% block head_before %}
-{{ block.super }}
-{% if flow.compatibility_mode and not inspector %}
+{% if flow.compatibility_mode %}
 <script>ShadyDOM = { force: !navigator.webdriver };</script>
 {% endif %}
 {% endblock %}
 
 {% block head %}
-<script src="{% static 'dist/FlowInterface.js' %}" type="module"></script>
+<script src="{% static 'dist/FlowInterface.js' %}?v={{ ak_version }}" type="module"></script>
 <style>
 .pf-c-background-image::before {
     --ak-flow-background: url("{{ flow.background_url }}");

authentik/core/templates/if/user.html

@@ -1,28 +0,0 @@
-{% extends "base/skeleton.html" %}
-
-{% load static %}
-{% load i18n %}
-
-{% block head %}
-<script src="{% static 'dist/UserInterface.js' %}" type="module"></script>
-{% endblock %}
-
-{% block body %}
-<ak-message-container></ak-message-container>
-<ak-interface-user>
-    <section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
-        <div class="pf-c-empty-state" style="height: 100vh;">
-            <div class="pf-c-empty-state__content">
-                <span class="pf-c-spinner pf-m-xl pf-c-empty-state__icon" role="progressbar" aria-valuetext="{% trans 'Loading...' %}">
-                    <span class="pf-c-spinner__clipper"></span>
-                    <span class="pf-c-spinner__lead-ball"></span>
-                    <span class="pf-c-spinner__tail-ball"></span>
-                </span>
-                <h1 class="pf-c-title pf-m-lg">
-                    {% trans "Loading..." %}
-                </h1>
-            </div>
-        </div>
-    </section>
-</ak-interface-user>
-{% endblock %}

authentik/core/templates/login/base_full.html

@@ -4,7 +4,7 @@
 {% load i18n %}
 
 {% block head_before %}
-<link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}">
+<link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}?v={{ ak_version }}">
 {% endblock %}
 
 {% block head %}
@@ -61,7 +61,7 @@
                 {% endfor %}
                 {% if tenant.branding_title != "authentik" %}
                 <li>
-                    <a href="https://goauthentik.io?utm_source=authentik">
+                    <a href="https://goauthentik.io">
                         {% trans 'Powered by authentik' %}
                     </a>
                 </li>

authentik/core/tests/test_impersonation.py

@@ -58,4 +58,4 @@ class TestImpersonation(TestCase):
         self.client.force_login(self.other_user)
 
         response = self.client.get(reverse("authentik_core:impersonate-end"))
-        self.assertRedirects(response, reverse("authentik_core:if-user"))
+        self.assertRedirects(response, reverse("authentik_core:if-admin"))

authentik/core/tests/test_token_api.py

@@ -1,6 +1,4 @@
 """Test token API"""
-from json import loads
-
 from django.urls.base import reverse
 from django.utils.timezone import now
 from guardian.shortcuts import get_anonymous_user
@@ -15,8 +13,7 @@ class TestTokenAPI(APITestCase):
 
     def setUp(self) -> None:
         super().setUp()
-        self.user = User.objects.create(username="testuser")
-        self.admin = User.objects.get(username="akadmin")
+        self.user = User.objects.get(username="akadmin")
         self.client.force_login(self.user)
 
     def test_token_create(self):
@@ -58,29 +55,3 @@ class TestTokenAPI(APITestCase):
         clean_expired_models.delay().get()
         token.refresh_from_db()
         self.assertNotEqual(key, token.key)
-
-    def test_list(self):
-        """Test Token List (Test normal authentication)"""
-        token_should: Token = Token.objects.create(
-            identifier="test", expiring=False, user=self.user
-        )
-        Token.objects.create(identifier="test-2", expiring=False, user=get_anonymous_user())
-        response = self.client.get(reverse(("authentik_api:token-list")))
-        body = loads(response.content)
-        self.assertEqual(len(body["results"]), 1)
-        self.assertEqual(body["results"][0]["identifier"], token_should.identifier)
-
-    def test_list_admin(self):
-        """Test Token List (Test with admin auth)"""
-        self.client.force_login(self.admin)
-        token_should: Token = Token.objects.create(
-            identifier="test", expiring=False, user=self.user
-        )
-        token_should_not: Token = Token.objects.create(
-            identifier="test-2", expiring=False, user=get_anonymous_user()
-        )
-        response = self.client.get(reverse(("authentik_api:token-list")))
-        body = loads(response.content)
-        self.assertEqual(len(body["results"]), 2)
-        self.assertEqual(body["results"][0]["identifier"], token_should.identifier)
-        self.assertEqual(body["results"][1]["identifier"], token_should_not.identifier)

authentik/core/tests/test_token_auth.py

@@ -4,7 +4,7 @@ from django.test import TestCase
 from authentik.core.auth import TokenBackend
 from authentik.core.models import Token, TokenIntents, User
 from authentik.flows.planner import FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_PLAN
+from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.lib.tests.utils import get_request
 
 

authentik/core/tests/test_users_api.py

@@ -2,7 +2,7 @@
 from django.urls.base import reverse
 from rest_framework.test import APITestCase
 
-from authentik.core.models import USER_ATTRIBUTE_CHANGE_EMAIL, USER_ATTRIBUTE_CHANGE_USERNAME, User
+from authentik.core.models import User
 from authentik.flows.models import Flow, FlowDesignation
 from authentik.stages.email.models import EmailStage
 from authentik.tenants.models import Tenant
@@ -15,34 +15,6 @@ class TestUsersAPI(APITestCase):
         self.admin = User.objects.get(username="akadmin")
         self.user = User.objects.create(username="test-user")
 
-    def test_update_self(self):
-        """Test update_self"""
-        self.client.force_login(self.admin)
-        response = self.client.put(
-            reverse("authentik_api:user-update-self"), data={"username": "foo", "name": "foo"}
-        )
-        self.assertEqual(response.status_code, 200)
-
-    def test_update_self_username_denied(self):
-        """Test update_self"""
-        self.admin.attributes[USER_ATTRIBUTE_CHANGE_USERNAME] = False
-        self.admin.save()
-        self.client.force_login(self.admin)
-        response = self.client.put(
-            reverse("authentik_api:user-update-self"), data={"username": "foo", "name": "foo"}
-        )
-        self.assertEqual(response.status_code, 400)
-
-    def test_update_self_email_denied(self):
-        """Test update_self"""
-        self.admin.attributes[USER_ATTRIBUTE_CHANGE_EMAIL] = False
-        self.admin.save()
-        self.client.force_login(self.admin)
-        response = self.client.put(
-            reverse("authentik_api:user-update-self"), data={"email": "foo", "name": "foo"}
-        )
-        self.assertEqual(response.status_code, 400)
-
     def test_metrics(self):
         """Test user's metrics"""
         self.client.force_login(self.admin)

authentik/core/urls.py

@@ -12,7 +12,7 @@ from authentik.core.views.session import EndSessionView
 urlpatterns = [
     path(
         "",
-        login_required(RedirectView.as_view(pattern_name="authentik_core:if-user")),
+        login_required(RedirectView.as_view(pattern_name="authentik_core:if-admin")),
         name="root-redirect",
     ),
     # Impersonation
@@ -32,11 +32,6 @@ urlpatterns = [
         ensure_csrf_cookie(TemplateView.as_view(template_name="if/admin.html")),
         name="if-admin",
     ),
-    path(
-        "if/user/",
-        ensure_csrf_cookie(TemplateView.as_view(template_name="if/user.html")),
-        name="if-user",
-    ),
     path(
         "if/flow/<slug:flow_slug>/",
         ensure_csrf_cookie(FlowInterfaceView.as_view()),

authentik/core/views/impersonate.py

@@ -28,7 +28,7 @@ class ImpersonateInitView(View):
 
         Event.new(EventAction.IMPERSONATION_STARTED).from_http(request, user_to_be)
 
-        return redirect("authentik_core:if-user")
+        return redirect("authentik_core:if-admin")
 
 
 class ImpersonateEndView(View):
@@ -41,7 +41,7 @@ class ImpersonateEndView(View):
             or SESSION_IMPERSONATE_ORIGINAL_USER not in request.session
         ):
             LOGGER.debug("Can't end impersonation", user=request.user)
-            return redirect("authentik_core:if-user")
+            return redirect("authentik_core:if-admin")
 
         original_user = request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
 

authentik/core/views/interface.py

@@ -14,5 +14,4 @@ class FlowInterfaceView(TemplateView):
 
     def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
         kwargs["flow"] = get_object_or_404(Flow, slug=self.kwargs.get("flow_slug"))
-        kwargs["inspector"] = "inspector" in self.request.GET
         return super().get_context_data(**kwargs)

authentik/crypto/api.py

@@ -99,7 +99,6 @@ class CertificateKeyPairSerializer(ModelSerializer):
             "private_key_available",
             "certificate_download_url",
             "private_key_download_url",
-            "managed",
         ]
         extra_kwargs = {
             "key_data": {"write_only": True},
@@ -135,13 +134,13 @@ class CertificateKeyPairFilter(FilterSet):
 
     class Meta:
         model = CertificateKeyPair
-        fields = ["name", "managed"]
+        fields = ["name"]
 
 
 class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
     """CertificateKeyPair Viewset"""
 
-    queryset = CertificateKeyPair.objects.exclude(managed__isnull=False)
+    queryset = CertificateKeyPair.objects.all()
     serializer_class = CertificateKeyPairSerializer
     filterset_class = CertificateKeyPairFilter
 

authentik/crypto/apps.py

@@ -1,6 +1,4 @@
 """authentik crypto app config"""
-from importlib import import_module
-
 from django.apps import AppConfig
 
 
@@ -10,6 +8,3 @@ class AuthentikCryptoConfig(AppConfig):
     name = "authentik.crypto"
     label = "authentik_crypto"
     verbose_name = "authentik Crypto"
-
-    def ready(self):
-        import_module("authentik.crypto.managed")

authentik/crypto/builder.py

@@ -24,17 +24,16 @@ class CertificateBuilder:
         self.__builder = None
         self.__certificate = None
         self.common_name = "authentik Self-signed Certificate"
-        self.cert = CertificateKeyPair()
 
     def save(self) -> Optional[CertificateKeyPair]:
         """Save generated certificate as model"""
         if not self.__certificate:
             raise ValueError("Certificated hasn't been built yet")
-        self.cert.name = self.common_name
-        self.cert.certificate_data = self.certificate
-        self.cert.key_data = self.private_key
-        self.cert.save()
-        return self.cert
+        return CertificateKeyPair.objects.create(
+            name=self.common_name,
+            certificate_data=self.certificate,
+            key_data=self.private_key,
+        )
 
     def build(
         self,

authentik/crypto/managed.py

@@ -1,40 +0,0 @@
-"""Crypto managed objects"""
-from datetime import datetime
-from typing import Optional
-
-from authentik.crypto.builder import CertificateBuilder
-from authentik.crypto.models import CertificateKeyPair
-from authentik.managed.manager import ObjectManager
-
-MANAGED_KEY = "goauthentik.io/crypto/jwt-managed"
-
-
-class CryptoManager(ObjectManager):
-    """Crypto managed objects"""
-
-    def _create(self, cert: Optional[CertificateKeyPair] = None):
-        builder = CertificateBuilder()
-        builder.common_name = "goauthentik.io"
-        builder.build(
-            subject_alt_names=["goauthentik.io"],
-            validity_days=360,
-        )
-        if not cert:
-            cert = CertificateKeyPair()
-        cert.certificate_data = builder.certificate
-        cert.key_data = builder.private_key
-        cert.name = "authentik Internal JWT Certificate"
-        cert.managed = MANAGED_KEY
-        cert.save()
-
-    def reconcile(self):
-        certs = CertificateKeyPair.objects.filter(managed=MANAGED_KEY)
-        if not certs.exists():
-            self._create()
-            return []
-        cert: CertificateKeyPair = certs.first()
-        now = datetime.now()
-        if now < cert.certificate.not_valid_before or now > cert.certificate.not_valid_after:
-            self._create(cert)
-            return []
-        return []

authentik/crypto/migrations/0003_certificatekeypair_managed.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-09 17:05
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_crypto", "0002_create_self_signed_kp"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="certificatekeypair",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                unique=True,
-                verbose_name="Managed by authentik",
-            ),
-        ),
-    ]

authentik/crypto/models.py

@@ -13,10 +13,9 @@ from django.db import models
 from django.utils.translation import gettext_lazy as _
 
 from authentik.lib.models import CreatedUpdatedModel
-from authentik.managed.models import ManagedModel
 
 
-class CertificateKeyPair(ManagedModel, CreatedUpdatedModel):
+class CertificateKeyPair(CreatedUpdatedModel):
     """CertificateKeyPair that can be used for signing or encrypting if `key_data`
     is set, otherwise it can be used to verify remote data."""
 
@@ -79,7 +78,9 @@ class CertificateKeyPair(ManagedModel, CreatedUpdatedModel):
     @property
     def kid(self):
         """Get Key ID used for JWKS"""
-        return md5(self.key_data.encode("utf-8")).hexdigest() if self.key_data else ""  # nosec
+        return "{0}".format(
+            md5(self.key_data.encode("utf-8")).hexdigest() if self.key_data else ""  # nosec
+        )
 
     def __str__(self) -> str:
         return f"Certificate-Key Pair {self.name}"

authentik/events/api/notification_mapping.py

@@ -1,28 +0,0 @@
-"""NotificationWebhookMapping API Views"""
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import ModelViewSet
-
-from authentik.core.api.used_by import UsedByMixin
-from authentik.events.models import NotificationWebhookMapping
-
-
-class NotificationWebhookMappingSerializer(ModelSerializer):
-    """NotificationWebhookMapping Serializer"""
-
-    class Meta:
-
-        model = NotificationWebhookMapping
-        fields = [
-            "pk",
-            "name",
-            "expression",
-        ]
-
-
-class NotificationWebhookMappingViewSet(UsedByMixin, ModelViewSet):
-    """NotificationWebhookMapping Viewset"""
-
-    queryset = NotificationWebhookMapping.objects.all()
-    serializer_class = NotificationWebhookMappingSerializer
-    filterset_fields = ["name"]
-    ordering = ["name"]

authentik/events/api/notification_transport.py

@@ -1,10 +1,7 @@
 """NotificationTransport API Views"""
-from typing import Any
-
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField, ListField, SerializerMethodField
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -32,14 +29,6 @@ class NotificationTransportSerializer(ModelSerializer):
         """Return selected mode with a UI Label"""
         return TransportMode(instance.mode).label
 
-    def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
-        """Ensure the required fields are set."""
-        mode = attrs.get("mode")
-        if mode in [TransportMode.WEBHOOK, TransportMode.WEBHOOK_SLACK]:
-            if "webhook_url" not in attrs or attrs.get("webhook_url", "") == "":
-                raise ValidationError("Webhook URL may not be empty.")
-        return attrs
-
     class Meta:
 
         model = NotificationTransport
@@ -49,7 +38,6 @@ class NotificationTransportSerializer(ModelSerializer):
             "mode",
             "mode_verbose",
             "webhook_url",
-            "webhook_mapping",
             "send_once",
         ]
 

authentik/events/migrations/0001_squashed_0019_alter_notificationtransport_webhook_url.py

@@ -1,831 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:01
-
-import uuid
-from datetime import timedelta
-from typing import Iterable
-
-import django.core.validators
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.events.models
-from authentik.events.models import EventAction, NotificationSeverity, TransportMode
-
-
-def convert_user_to_json(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    Event = apps.get_model("authentik_events", "Event")
-
-    db_alias = schema_editor.connection.alias
-    for event in Event.objects.all():
-        event.delete()
-        # Because event objects cannot be updated, we have to re-create them
-        event.pk = None
-        event.user_json = authentik.events.models.get_user(event.user) if event.user else {}
-        event._state.adding = True
-        event.save()
-
-
-def notify_configuration_error(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-configuration-error",
-        defaults={"action": EventAction.CONFIGURATION_ERROR},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-configuration-error",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy,
-        defaults={
-            "order": 0,
-        },
-    )
-
-
-def notify_update(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-update",
-        defaults={"action": EventAction.UPDATE_AVAILABLE},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-update",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy,
-        defaults={
-            "order": 0,
-        },
-    )
-
-
-def notify_exception(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
-    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
-    )
-
-    policy_policy_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-policy-exception",
-        defaults={"action": EventAction.POLICY_EXCEPTION},
-    )
-    policy_pm_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
-        name="default-match-property-mapping-exception",
-        defaults={"action": EventAction.PROPERTY_MAPPING_EXCEPTION},
-    )
-    trigger, _ = NotificationRule.objects.using(db_alias).update_or_create(
-        name="default-notify-exception",
-        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
-    )
-    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
-    )
-    trigger.save()
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy_policy_exc,
-        defaults={
-            "order": 0,
-        },
-    )
-    PolicyBinding.objects.using(db_alias).update_or_create(
-        target=trigger,
-        policy=policy_pm_exc,
-        defaults={
-            "order": 1,
-        },
-    )
-
-
-def transport_email_global(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")
-
-    NotificationTransport.objects.using(db_alias).update_or_create(
-        name="default-email-transport",
-        defaults={"mode": TransportMode.EMAIL},
-    )
-
-
-def token_view_to_secret_view(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from authentik.events.models import EventAction
-
-    db_alias = schema_editor.connection.alias
-    Event = apps.get_model("authentik_events", "Event")
-
-    events = Event.objects.using(db_alias).filter(action="token_view")
-
-    for event in events:
-        event.context["secret"] = event.context.pop("token")
-        event.action = EventAction.SECRET_VIEW
-
-    Event.objects.using(db_alias).bulk_update(events, ["context", "action"])
-
-
-# Taken from https://stackoverflow.com/questions/3173320/text-progress-bar-in-the-console
-def progress_bar(
-    iterable: Iterable,
-    prefix="Writing: ",
-    suffix=" finished",
-    decimals=1,
-    length=100,
-    fill="█",
-    print_end="\r",
-):
-    """
-    Call in a loop to create terminal progress bar
-    @params:
-        iteration   - Required  : current iteration (Int)
-        total       - Required  : total iterations (Int)
-        prefix      - Optional  : prefix string (Str)
-        suffix      - Optional  : suffix string (Str)
-        decimals    - Optional  : positive number of decimals in percent complete (Int)
-        length      - Optional  : character length of bar (Int)
-        fill        - Optional  : bar fill character (Str)
-        print_end   - Optional  : end character (e.g. "\r", "\r\n") (Str)
-    """
-    total = len(iterable)
-    if total < 1:
-        return
-
-    def print_progress_bar(iteration):
-        """Progress Bar Printing Function"""
-        percent = ("{0:." + str(decimals) + "f}").format(100 * (iteration / float(total)))
-        filledLength = int(length * iteration // total)
-        bar = fill * filledLength + "-" * (length - filledLength)
-        print(f"\r{prefix} |{bar}| {percent}% {suffix}", end=print_end)
-
-    # Initial Call
-    print_progress_bar(0)
-    # Update Progress Bar
-    for i, item in enumerate(iterable):
-        yield item
-        print_progress_bar(i + 1)
-    # Print New Line on Complete
-    print()
-
-
-def update_expires(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Event = apps.get_model("authentik_events", "event")
-    all_events = Event.objects.using(db_alias).all()
-    if all_events.count() < 1:
-        return
-
-    print("\nAdding expiry to events, this might take a couple of minutes...")
-    for event in progress_bar(all_events):
-        event.expires = event.created + timedelta(days=365)
-        event.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_events", "0001_initial"),
-        ("authentik_events", "0002_auto_20200918_2116"),
-        ("authentik_events", "0003_auto_20200917_1155"),
-        ("authentik_events", "0004_auto_20200921_1829"),
-        ("authentik_events", "0005_auto_20201005_2139"),
-        ("authentik_events", "0006_auto_20201017_2024"),
-        ("authentik_events", "0007_auto_20201215_0939"),
-        ("authentik_events", "0008_auto_20201220_1651"),
-        ("authentik_events", "0009_auto_20201227_1210"),
-        ("authentik_events", "0010_notification_notificationtransport_notificationrule"),
-        ("authentik_events", "0011_notification_rules_default_v1"),
-        ("authentik_events", "0012_auto_20210202_1821"),
-        ("authentik_events", "0013_auto_20210209_1657"),
-        ("authentik_events", "0014_expiry"),
-        ("authentik_events", "0015_alter_event_action"),
-        ("authentik_events", "0016_add_tenant"),
-        ("authentik_events", "0017_alter_event_action"),
-        ("authentik_events", "0018_auto_20210911_2217"),
-        ("authentik_events", "0019_alter_notificationtransport_webhook_url"),
-    ]
-
-    initial = True
-
-    dependencies = [
-        ("authentik_policies", "0004_policy_execution_logging"),
-        ("authentik_core", "0016_auto_20201202_2234"),
-        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
-        ("authentik_policies_event_matcher", "0003_auto_20210110_1907"),
-        ("authentik_core", "0028_alter_token_intent"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Event",
-            fields=[
-                (
-                    "event_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                (
-                    "action",
-                    models.TextField(
-                        choices=[
-                            ("LOGIN", "login"),
-                            ("LOGIN_FAILED", "login_failed"),
-                            ("LOGOUT", "logout"),
-                            ("AUTHORIZE_APPLICATION", "authorize_application"),
-                            ("SUSPICIOUS_REQUEST", "suspicious_request"),
-                            ("SIGN_UP", "sign_up"),
-                            ("PASSWORD_RESET", "password_reset"),
-                            ("INVITE_CREATED", "invitation_created"),
-                            ("INVITE_USED", "invitation_used"),
-                            ("IMPERSONATION_STARTED", "impersonation_started"),
-                            ("IMPERSONATION_ENDED", "impersonation_ended"),
-                            ("CUSTOM", "custom"),
-                        ]
-                    ),
-                ),
-                ("date", models.DateTimeField(auto_now_add=True)),
-                ("app", models.TextField()),
-                ("context", models.JSONField(blank=True, default=dict)),
-                ("client_ip", models.GenericIPAddressField(null=True)),
-                ("created", models.DateTimeField(auto_now_add=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-                ("user_json", models.JSONField(default=dict)),
-            ],
-            options={
-                "verbose_name": "Event",
-                "verbose_name_plural": "Events",
-            },
-        ),
-        migrations.RunPython(
-            code=convert_user_to_json,
-        ),
-        migrations.RemoveField(
-            model_name="event",
-            name="user",
-        ),
-        migrations.RenameField(
-            model_name="event",
-            old_name="user_json",
-            new_name="user",
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("sign_up", "Sign Up"),
-                    ("authorize_application", "Authorize Application"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("invitation_created", "Invite Created"),
-                    ("invitation_used", "Invite Used"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("invitation_created", "Invite Created"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.RemoveField(
-            model_name="event",
-            name="date",
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("token_view", "Token View"),
-                    ("invitation_created", "Invite Created"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("token_view", "Token View"),
-                    ("invitation_created", "Invite Created"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("token_view", "Token View"),
-                    ("invitation_created", "Invite Created"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("token_view", "Token View"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.CreateModel(
-            name="NotificationTransport",
-            fields=[
-                (
-                    "uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                ("name", models.TextField(unique=True)),
-                (
-                    "mode",
-                    models.TextField(
-                        choices=[
-                            ("webhook", "Generic Webhook"),
-                            ("webhook_slack", "Slack Webhook (Slack/Discord)"),
-                            ("email", "Email"),
-                        ]
-                    ),
-                ),
-                ("webhook_url", models.TextField(blank=True)),
-            ],
-            options={
-                "verbose_name": "Notification Transport",
-                "verbose_name_plural": "Notification Transports",
-            },
-        ),
-        migrations.CreateModel(
-            name="NotificationRule",
-            fields=[
-                (
-                    "policybindingmodel_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_policies.policybindingmodel",
-                    ),
-                ),
-                ("name", models.TextField(unique=True)),
-                (
-                    "severity",
-                    models.TextField(
-                        choices=[("notice", "Notice"), ("warning", "Warning"), ("alert", "Alert")],
-                        default="notice",
-                        help_text="Controls which severity level the created notifications will have.",
-                    ),
-                ),
-                (
-                    "group",
-                    models.ForeignKey(
-                        blank=True,
-                        help_text="Define which group of users this notification should be sent and shown to. If left empty, Notification won't ben sent.",
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        to="authentik_core.group",
-                    ),
-                ),
-                (
-                    "transports",
-                    models.ManyToManyField(
-                        help_text="Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI.",
-                        to="authentik_events.NotificationTransport",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Notification Rule",
-                "verbose_name_plural": "Notification Rules",
-            },
-            bases=("authentik_policies.policybindingmodel",),
-        ),
-        migrations.CreateModel(
-            name="Notification",
-            fields=[
-                (
-                    "uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                (
-                    "severity",
-                    models.TextField(
-                        choices=[("notice", "Notice"), ("warning", "Warning"), ("alert", "Alert")]
-                    ),
-                ),
-                ("body", models.TextField()),
-                ("created", models.DateTimeField(auto_now_add=True)),
-                ("seen", models.BooleanField(default=False)),
-                (
-                    "event",
-                    models.ForeignKey(
-                        blank=True,
-                        null=True,
-                        on_delete=django.db.models.deletion.SET_NULL,
-                        to="authentik_events.event",
-                    ),
-                ),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Notification",
-                "verbose_name_plural": "Notifications",
-            },
-        ),
-        migrations.RunPython(
-            code=transport_email_global,
-        ),
-        migrations.RunPython(
-            code=notify_configuration_error,
-        ),
-        migrations.RunPython(
-            code=notify_update,
-        ),
-        migrations.RunPython(
-            code=notify_exception,
-        ),
-        migrations.AddField(
-            model_name="notificationtransport",
-            name="send_once",
-            field=models.BooleanField(
-                default=False,
-                help_text="Only send notification once, for example when sending a webhook into a chat channel.",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("token_view", "Token View"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("secret_view", "Secret View"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.RunPython(
-            code=token_view_to_secret_view,
-        ),
-        migrations.AddField(
-            model_name="event",
-            name="expires",
-            field=models.DateTimeField(default=authentik.events.models.default_event_duration),
-        ),
-        migrations.AddField(
-            model_name="event",
-            name="expiring",
-            field=models.BooleanField(default=True),
-        ),
-        migrations.RunPython(
-            code=update_expires,
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("secret_view", "Secret View"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("email_sent", "Email Sent"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AddField(
-            model_name="event",
-            name="tenant",
-            field=models.JSONField(blank=True, default=authentik.events.models.default_tenant),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("secret_view", "Secret View"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("system_exception", "System Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("email_sent", "Email Sent"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.AlterField(
-            model_name="event",
-            name="action",
-            field=models.TextField(
-                choices=[
-                    ("login", "Login"),
-                    ("login_failed", "Login Failed"),
-                    ("logout", "Logout"),
-                    ("user_write", "User Write"),
-                    ("suspicious_request", "Suspicious Request"),
-                    ("password_set", "Password Set"),
-                    ("secret_view", "Secret View"),
-                    ("secret_rotate", "Secret Rotate"),
-                    ("invitation_used", "Invite Used"),
-                    ("authorize_application", "Authorize Application"),
-                    ("source_linked", "Source Linked"),
-                    ("impersonation_started", "Impersonation Started"),
-                    ("impersonation_ended", "Impersonation Ended"),
-                    ("policy_execution", "Policy Execution"),
-                    ("policy_exception", "Policy Exception"),
-                    ("property_mapping_exception", "Property Mapping Exception"),
-                    ("system_task_execution", "System Task Execution"),
-                    ("system_task_exception", "System Task Exception"),
-                    ("system_exception", "System Exception"),
-                    ("configuration_error", "Configuration Error"),
-                    ("model_created", "Model Created"),
-                    ("model_updated", "Model Updated"),
-                    ("model_deleted", "Model Deleted"),
-                    ("email_sent", "Email Sent"),
-                    ("update_available", "Update Available"),
-                    ("custom_", "Custom Prefix"),
-                ]
-            ),
-        ),
-        migrations.CreateModel(
-            name="NotificationWebhookMapping",
-            fields=[
-                (
-                    "propertymapping_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_core.propertymapping",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Notification Webhook Mapping",
-                "verbose_name_plural": "Notification Webhook Mappings",
-            },
-            bases=("authentik_core.propertymapping",),
-        ),
-        migrations.AddField(
-            model_name="notificationtransport",
-            name="webhook_mapping",
-            field=models.ForeignKey(
-                default=None,
-                null=True,
-                on_delete=django.db.models.deletion.SET_DEFAULT,
-                to="authentik_events.notificationwebhookmapping",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="notificationtransport",
-            name="webhook_url",
-            field=models.TextField(blank=True, validators=[django.core.validators.URLValidator()]),
-        ),
-    ]

authentik/events/migrations/0018_auto_20210911_2217.py

@@ -1,46 +0,0 @@
-# Generated by Django 3.2.6 on 2021-09-11 22:17
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0028_alter_token_intent"),
-        ("authentik_events", "0017_alter_event_action"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="NotificationWebhookMapping",
-            fields=[
-                (
-                    "propertymapping_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_core.propertymapping",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Notification Webhook Mapping",
-                "verbose_name_plural": "Notification Webhook Mappings",
-            },
-            bases=("authentik_core.propertymapping",),
-        ),
-        migrations.AddField(
-            model_name="notificationtransport",
-            name="webhook_mapping",
-            field=models.ForeignKey(
-                default=None,
-                null=True,
-                on_delete=django.db.models.deletion.SET_DEFAULT,
-                to="authentik_events.notificationwebhookmapping",
-            ),
-        ),
-    ]

authentik/events/migrations/0019_alter_notificationtransport_webhook_url.py

@@ -1,19 +0,0 @@
-# Generated by Django 3.2.7 on 2021-10-04 15:31
-
-import django.core.validators
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_events", "0018_auto_20210911_2217"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="notificationtransport",
-            name="webhook_url",
-            field=models.TextField(blank=True, validators=[django.core.validators.URLValidator()]),
-        ),
-    ]

authentik/events/models.py

@@ -2,26 +2,24 @@
 from datetime import timedelta
 from inspect import getmodule, stack
 from smtplib import SMTPException
-from typing import TYPE_CHECKING, Optional, Type, Union
+from typing import Optional, Union
 from uuid import uuid4
 
 from django.conf import settings
-from django.core.validators import URLValidator
 from django.db import models
 from django.http import HttpRequest
-from django.http.request import QueryDict
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
-from requests import RequestException
+from requests import RequestException, post
 from structlog.stdlib import get_logger
 
 from authentik import __version__
 from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
-from authentik.core.models import ExpiringModel, Group, PropertyMapping, User
+from authentik.core.models import ExpiringModel, Group, User
 from authentik.events.geo import GEOIP_READER
 from authentik.events.utils import cleanse_dict, get_user, model_to_dict, sanitize_dict
 from authentik.lib.sentry import SentryIgnoredException
-from authentik.lib.utils.http import get_client_ip, get_http_session
+from authentik.lib.utils.http import get_client_ip
 from authentik.lib.utils.time import timedelta_from_string
 from authentik.policies.models import PolicyBindingModel
 from authentik.stages.email.utils import TemplateEmailMessage
@@ -29,8 +27,6 @@ from authentik.tenants.models import Tenant
 from authentik.tenants.utils import DEFAULT_TENANT
 
 LOGGER = get_logger("authentik.events")
-if TYPE_CHECKING:
-    from rest_framework.serializers import Serializer
 
 
 def default_event_duration():
@@ -141,9 +137,8 @@ class Event(ExpiringModel):
         `user` arguments optionally overrides user from requests."""
         if request:
             self.context["http_request"] = {
-                "path": request.path,
+                "path": request.get_full_path(),
                 "method": request.method,
-                "args": QueryDict(request.META.get("QUERY_STRING", "")),
             }
         if hasattr(request, "tenant"):
             tenant: Tenant = request.tenant
@@ -224,10 +219,7 @@ class NotificationTransport(models.Model):
     name = models.TextField(unique=True)
     mode = models.TextField(choices=TransportMode.choices)
 
-    webhook_url = models.TextField(blank=True, validators=[URLValidator()])
-    webhook_mapping = models.ForeignKey(
-        "NotificationWebhookMapping", on_delete=models.SET_DEFAULT, null=True, default=None
-    )
+    webhook_url = models.TextField(blank=True)
     send_once = models.BooleanField(
         default=False,
         help_text=_(
@@ -247,22 +239,15 @@ class NotificationTransport(models.Model):
 
     def send_webhook(self, notification: "Notification") -> list[str]:
         """Send notification to generic webhook"""
-        default_body = {
-            "body": notification.body,
-            "severity": notification.severity,
-            "user_email": notification.user.email,
-            "user_username": notification.user.username,
-        }
-        if self.webhook_mapping:
-            default_body = self.webhook_mapping.evaluate(
-                user=notification.user,
-                request=None,
-                notification=notification,
-            )
         try:
-            response = get_http_session().post(
+            response = post(
                 self.webhook_url,
-                json=default_body,
+                json={
+                    "body": notification.body,
+                    "severity": notification.severity,
+                    "user_email": notification.user.email,
+                    "user_username": notification.user.username,
+                },
             )
             response.raise_for_status()
         except RequestException as exc:
@@ -312,7 +297,7 @@ class NotificationTransport(models.Model):
         if notification.event:
             body["attachments"][0]["title"] = notification.event.action
         try:
-            response = get_http_session().post(self.webhook_url, json=body)
+            response = post(self.webhook_url, json=body)
             response.raise_for_status()
         except RequestException as exc:
             text = exc.response.text if exc.response else str(exc)
@@ -429,25 +414,3 @@ class NotificationRule(PolicyBindingModel):
 
         verbose_name = _("Notification Rule")
         verbose_name_plural = _("Notification Rules")
-
-
-class NotificationWebhookMapping(PropertyMapping):
-    """Modify the schema and layout of the webhook being sent"""
-
-    @property
-    def component(self) -> str:
-        return "ak-property-mapping-notification-form"
-
-    @property
-    def serializer(self) -> Type["Serializer"]:
-        from authentik.events.api.notification_mapping import NotificationWebhookMappingSerializer
-
-        return NotificationWebhookMappingSerializer
-
-    def __str__(self):
-        return f"Notification Webhook Mapping {self.name}"
-
-    class Meta:
-
-        verbose_name = _("Notification Webhook Mapping")
-        verbose_name_plural = _("Notification Webhook Mappings")

authentik/events/monitored_tasks.py

@@ -3,13 +3,12 @@ from dataclasses import dataclass, field
 from datetime import datetime
 from enum import Enum
 from timeit import default_timer
+from traceback import format_tb
 from typing import Any, Optional
 
 from celery import Task
 from django.core.cache import cache
-from django.utils.translation import gettext_lazy as _
 from prometheus_client import Gauge
-from structlog.stdlib import get_logger
 
 from authentik.events.models import Event, EventAction
 from authentik.lib.utils.errors import exception_to_string
@@ -20,8 +19,6 @@ GAUGE_TASKS = Gauge(
     ["task_name", "task_uid", "status"],
 )
 
-LOGGER = get_logger()
-
 
 class TaskResultStatus(Enum):
     """Possible states of tasks"""
@@ -29,7 +26,6 @@ class TaskResultStatus(Enum):
     SUCCESSFUL = 1
     WARNING = 2
     ERROR = 4
-    UNKNOWN = 8
 
 
 @dataclass
@@ -46,7 +42,8 @@ class TaskResult:
 
     def with_error(self, exc: Exception) -> "TaskResult":
         """Since errors might not always be pickle-able, set the traceback"""
-        self.messages.extend(exception_to_string(exc).splitlines())
+        self.messages.extend(format_tb(exc.__traceback__))
+        self.messages.append(str(exc))
         return self
 
 
@@ -81,7 +78,7 @@ class TaskInfo:
     @staticmethod
     def by_name(name: str) -> Optional["TaskInfo"]:
         """Get TaskInfo Object by name"""
-        return cache.get(f"task_{name}", None)
+        return cache.get(f"task_{name}")
 
     def delete(self):
         """Delete task info from cache"""
@@ -112,30 +109,6 @@ class TaskInfo:
         cache.set(key, self, timeout=timeout_hours * 60 * 60)
 
 
-def prefill_task():
-    """Ensure a task's details are always in cache, so it can always be triggered via API"""
-
-    def inner_wrap(func):
-        status = TaskInfo.by_name(func.__name__)
-        if status:
-            return func
-        TaskInfo(
-            task_name=func.__name__,
-            task_description=func.__doc__,
-            result=TaskResult(TaskResultStatus.UNKNOWN, messages=[_("Task has not been run yet.")]),
-            task_call_module=func.__module__,
-            task_call_func=func.__name__,
-            # We don't have real values for these attributes but they cannot be null
-            start_timestamp=default_timer(),
-            finish_timestamp=default_timer(),
-            finish_time=datetime.now(),
-        ).save(86400)
-        LOGGER.debug("prefilled task", task_name=func.__name__)
-        return func
-
-    return inner_wrap
-
-
 class MonitoredTask(Task):
     """Task which can save its state to the cache"""
 

authentik/events/signals.py

@@ -12,7 +12,7 @@ from authentik.core.signals import password_changed
 from authentik.events.models import Event, EventAction
 from authentik.events.tasks import event_notification_handler
 from authentik.flows.planner import PLAN_CONTEXT_SOURCE, FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_PLAN
+from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.stages.invitation.models import Invitation
 from authentik.stages.invitation.signals import invitation_used
 from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS

authentik/events/tasks.py

@@ -98,9 +98,7 @@ def notification_transport(self: MonitoredTask, notification_pk: int, transport_
         notification: Notification = Notification.objects.filter(pk=notification_pk).first()
         if not notification:
             return
-        transport = NotificationTransport.objects.filter(pk=transport_pk).first()
-        if not transport:
-            return
+        transport: NotificationTransport = NotificationTransport.objects.get(pk=transport_pk)
         transport.send(notification)
         self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
     except NotificationTransportError as exc:

authentik/events/tests/test_api.py

@@ -4,13 +4,7 @@ from django.urls import reverse
 from rest_framework.test import APITestCase
 
 from authentik.core.models import User
-from authentik.events.models import (
-    Event,
-    EventAction,
-    Notification,
-    NotificationSeverity,
-    TransportMode,
-)
+from authentik.events.models import Event, EventAction, Notification, NotificationSeverity
 
 
 class TestEventsAPI(APITestCase):
@@ -47,23 +41,3 @@ class TestEventsAPI(APITestCase):
         )
         notification.refresh_from_db()
         self.assertTrue(notification.seen)
-
-    def test_transport(self):
-        """Test transport API"""
-        response = self.client.post(
-            reverse("authentik_api:notificationtransport-list"),
-            data={
-                "name": "foo-with",
-                "mode": TransportMode.WEBHOOK,
-                "webhook_url": "http://foo.com",
-            },
-        )
-        self.assertEqual(response.status_code, 201)
-        response = self.client.post(
-            reverse("authentik_api:notificationtransport-list"),
-            data={
-                "name": "foo-without",
-                "mode": TransportMode.WEBHOOK,
-            },
-        )
-        self.assertEqual(response.status_code, 400)

authentik/events/utils.py

@@ -77,7 +77,7 @@ def sanitize_dict(source: dict[Any, Any]) -> dict[Any, Any]:
     final_dict = {}
     for key, value in source.items():
         if is_dataclass(value):
-            # Because asdict calls `copy.deepcopy(obj)` on everything that's not tuple/dict,
+            # Because asdict calls `copy.deepcopy(obj)` on everything thats not tuple/dict,
             # and deepcopy doesn't work with HttpRequests (neither django nor rest_framework).
             # Currently, the only dataclass that actually holds an http request is a PolicyRequest
             if isinstance(value, PolicyRequest):

authentik/flows/api/flows.py

@@ -32,7 +32,7 @@ from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner, cach
 from authentik.flows.transfer.common import DataclassEncoder
 from authentik.flows.transfer.exporter import FlowExporter
 from authentik.flows.transfer.importer import FlowImporter
-from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
+from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.lib.views import bad_request_message
 
 LOGGER = get_logger()
@@ -108,7 +108,6 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
     queryset = Flow.objects.all()
     serializer_class = FlowSerializer
     lookup_field = "slug"
-    ordering = ["slug", "name"]
     search_fields = ["name", "slug", "designation", "title"]
     filterset_fields = ["flow_uuid", "name", "slug", "designation"]
 
@@ -334,9 +333,6 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
     # pylint: disable=unused-argument
     def execute(self, request: Request, slug: str):
         """Execute flow for current user"""
-        # Because we pre-plan the flow here, and not in the planner, we need to manually clear
-        # the history of the inspector
-        request.session[SESSION_KEY_HISTORY] = []
         flow: Flow = self.get_object()
         planner = FlowPlanner(flow)
         planner.use_cache = False

authentik/flows/api/stages.py

@@ -1,4 +1,6 @@
 """Flow Stage API Views"""
+from typing import Iterable
+
 from django.urls.base import reverse
 from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
@@ -13,7 +15,7 @@ from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.types import UserSettingSerializer
 from authentik.flows.api.flows import FlowSerializer
-from authentik.flows.models import ConfigurableStage, Stage
+from authentik.flows.models import Stage
 from authentik.lib.utils.reflection import all_subclasses
 
 LOGGER = get_logger()
@@ -84,11 +86,9 @@ class StageViewSet(
     @action(detail=False, pagination_class=None, filter_backends=[])
     def user_settings(self, request: Request) -> Response:
         """Get all stages the user can configure"""
-        stages = []
-        for configurable_stage in all_subclasses(ConfigurableStage):
-            stages += list(configurable_stage.objects.all().order_by("name"))
+        _all_stages: Iterable[Stage] = Stage.objects.all().select_subclasses()
         matching_stages: list[dict] = []
-        for stage in stages:
+        for stage in _all_stages:
             user_settings = stage.ui_user_settings
             if not user_settings:
                 continue

authentik/flows/migrations/0001_squashed_0007_auto_20200703_2059.py

@@ -1,180 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:08
-
-import uuid
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_flows", "0001_initial"),
-        ("authentik_flows", "0003_auto_20200523_1133"),
-        ("authentik_flows", "0006_auto_20200629_0857"),
-        ("authentik_flows", "0007_auto_20200703_2059"),
-    ]
-
-    initial = True
-
-    dependencies = [
-        ("authentik_policies", "0001_initial"),
-        ("authentik_policies", "0002_auto_20200528_1647"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="Flow",
-            fields=[
-                (
-                    "flow_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                ("name", models.TextField()),
-                ("slug", models.SlugField(unique=True)),
-                (
-                    "designation",
-                    models.CharField(
-                        choices=[
-                            ("authentication", "Authentication"),
-                            ("invalidation", "Invalidation"),
-                            ("enrollment", "Enrollment"),
-                            ("unenrollment", "Unrenollment"),
-                            ("recovery", "Recovery"),
-                            ("password_change", "Password Change"),
-                        ],
-                        max_length=100,
-                    ),
-                ),
-                (
-                    "pbm",
-                    models.OneToOneField(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        related_name="+",
-                        to="authentik_policies.policybindingmodel",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Flow",
-                "verbose_name_plural": "Flows",
-            },
-            bases=("authentik_policies.policybindingmodel",),
-        ),
-        migrations.CreateModel(
-            name="Stage",
-            fields=[
-                (
-                    "stage_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                ("name", models.TextField()),
-            ],
-        ),
-        migrations.CreateModel(
-            name="FlowStageBinding",
-            fields=[
-                (
-                    "policybindingmodel_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        to="authentik_policies.policybindingmodel",
-                    ),
-                ),
-                (
-                    "fsb_uuid",
-                    models.UUIDField(
-                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
-                    ),
-                ),
-                (
-                    "re_evaluate_policies",
-                    models.BooleanField(
-                        default=False,
-                        help_text="When this option is enabled, the planner will re-evaluate policies bound to this.",
-                    ),
-                ),
-                ("order", models.IntegerField()),
-                (
-                    "target",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="authentik_flows.flow"
-                    ),
-                ),
-                (
-                    "stage",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="authentik_flows.stage"
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "Flow Stage Binding",
-                "verbose_name_plural": "Flow Stage Bindings",
-                "ordering": ["order", "target"],
-                "unique_together": {("target", "stage", "order")},
-            },
-            bases=("authentik_policies.policybindingmodel",),
-        ),
-        migrations.AddField(
-            model_name="flow",
-            name="stages",
-            field=models.ManyToManyField(
-                blank=True, through="authentik_flows.FlowStageBinding", to="authentik_flows.Stage"
-            ),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="designation",
-            field=models.CharField(
-                choices=[
-                    ("authentication", "Authentication"),
-                    ("authorization", "Authorization"),
-                    ("invalidation", "Invalidation"),
-                    ("enrollment", "Enrollment"),
-                    ("unenrollment", "Unrenollment"),
-                    ("recovery", "Recovery"),
-                    ("password_change", "Password Change"),
-                ],
-                max_length=100,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="designation",
-            field=models.CharField(
-                choices=[
-                    ("authentication", "Authentication"),
-                    ("authorization", "Authorization"),
-                    ("invalidation", "Invalidation"),
-                    ("enrollment", "Enrollment"),
-                    ("unenrollment", "Unrenollment"),
-                    ("recovery", "Recovery"),
-                    ("stage_setup", "Stage Setup"),
-                ],
-                max_length=100,
-            ),
-        ),
-        migrations.RenameField(
-            model_name="flow",
-            old_name="pbm",
-            new_name="policybindingmodel_ptr",
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="policybindingmodel_ptr",
-            field=models.OneToOneField(
-                auto_created=True,
-                on_delete=django.db.models.deletion.CASCADE,
-                parent_link=True,
-                to="authentik_policies.policybindingmodel",
-            ),
-        ),
-    ]

authentik/flows/migrations/0012_auto_20200908_1542_squashed_0017_auto_20210329_1334.py

@@ -1,171 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:08
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.lib.models
-from authentik.flows.models import FlowDesignation
-
-
-def update_flow_designation(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    Flow = apps.get_model("authentik_flows", "Flow")
-    db_alias = schema_editor.connection.alias
-
-    for flow in Flow.objects.using(db_alias).all():
-        if flow.designation == "stage_setup":
-            flow.designation = FlowDesignation.STAGE_CONFIGURATION
-            flow.save()
-
-
-# First stage for default-source-enrollment flow (prompt stage)
-# needs to have its policy re-evaluated
-def update_default_source_enrollment_flow_binding(
-    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
-):
-    Flow = apps.get_model("authentik_flows", "Flow")
-    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
-    db_alias = schema_editor.connection.alias
-
-    flows = Flow.objects.using(db_alias).filter(slug="default-source-enrollment")
-    if not flows.exists():
-        return
-    flow = flows.first()
-
-    binding = FlowStageBinding.objects.get(target=flow, order=0)
-    binding.re_evaluate_policies = True
-    binding.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_flows", "0012_auto_20200908_1542"),
-        ("authentik_flows", "0013_auto_20200924_1605"),
-        ("authentik_flows", "0014_auto_20200925_2332"),
-        ("authentik_flows", "0015_flowstagebinding_evaluate_on_plan"),
-        ("authentik_flows", "0016_auto_20201202_1307"),
-        ("authentik_flows", "0017_auto_20210329_1334"),
-    ]
-
-    dependencies = [
-        ("authentik_flows", "0011_flow_title"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="flowstagebinding",
-            name="stage",
-            field=authentik.lib.models.InheritanceForeignKey(
-                on_delete=django.db.models.deletion.CASCADE, to="authentik_flows.stage"
-            ),
-        ),
-        migrations.AlterField(
-            model_name="stage",
-            name="name",
-            field=models.TextField(unique=True),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="designation",
-            field=models.CharField(
-                choices=[
-                    ("authentication", "Authentication"),
-                    ("authorization", "Authorization"),
-                    ("invalidation", "Invalidation"),
-                    ("enrollment", "Enrollment"),
-                    ("unenrollment", "Unrenollment"),
-                    ("recovery", "Recovery"),
-                    ("stage_configuration", "Stage Configuration"),
-                ],
-                max_length=100,
-            ),
-        ),
-        migrations.RunPython(
-            code=update_flow_designation,
-        ),
-        migrations.AlterModelOptions(
-            name="flowstagebinding",
-            options={
-                "ordering": ["target", "order"],
-                "verbose_name": "Flow Stage Binding",
-                "verbose_name_plural": "Flow Stage Bindings",
-            },
-        ),
-        migrations.AlterField(
-            model_name="flowstagebinding",
-            name="re_evaluate_policies",
-            field=models.BooleanField(
-                default=False,
-                help_text="When this option is enabled, the planner will re-evaluate policies bound to this binding.",
-            ),
-        ),
-        migrations.RunPython(
-            code=update_default_source_enrollment_flow_binding,
-        ),
-        migrations.AlterField(
-            model_name="flowstagebinding",
-            name="re_evaluate_policies",
-            field=models.BooleanField(
-                default=False, help_text="Evaluate policies when the Stage is present to the user."
-            ),
-        ),
-        migrations.AddField(
-            model_name="flowstagebinding",
-            name="evaluate_on_plan",
-            field=models.BooleanField(
-                default=True,
-                help_text="Evaluate policies during the Flow planning process. Disable this for input-based policies.",
-            ),
-        ),
-        migrations.AddField(
-            model_name="flow",
-            name="background",
-            field=models.FileField(
-                blank=True,
-                default="../static/dist/assets/images/flow_background.jpg",
-                help_text="Background shown during execution",
-                upload_to="flow-backgrounds/",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="designation",
-            field=models.CharField(
-                choices=[
-                    ("authentication", "Authentication"),
-                    ("authorization", "Authorization"),
-                    ("invalidation", "Invalidation"),
-                    ("enrollment", "Enrollment"),
-                    ("unenrollment", "Unrenollment"),
-                    ("recovery", "Recovery"),
-                    ("stage_configuration", "Stage Configuration"),
-                ],
-                help_text="Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.",
-                max_length=100,
-            ),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="slug",
-            field=models.SlugField(help_text="Visible in the URL.", unique=True),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="title",
-            field=models.TextField(help_text="Shown as the Title in Flow pages."),
-        ),
-        migrations.AlterModelOptions(
-            name="flow",
-            options={
-                "permissions": [
-                    ("export_flow", "Can export a Flow"),
-                    ("view_flow_cache", "View Flow's cache metrics"),
-                    ("clear_flow_cache", "Clear Flow's cache metrics"),
-                ],
-                "verbose_name": "Flow",
-                "verbose_name_plural": "Flows",
-            },
-        ),
-    ]

authentik/flows/migrations/0019_alter_flow_background_squashed_0024_alter_flow_compatibility_mode.py

@@ -1,64 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:10
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_flows", "0019_alter_flow_background"),
-        ("authentik_flows", "0020_flow_compatibility_mode"),
-        ("authentik_flows", "0021_flowstagebinding_invalid_response_action"),
-        ("authentik_flows", "0022_alter_flowstagebinding_invalid_response_action"),
-        ("authentik_flows", "0023_alter_flow_background"),
-        ("authentik_flows", "0024_alter_flow_compatibility_mode"),
-    ]
-
-    dependencies = [
-        ("authentik_flows", "0018_oob_flows"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="flow",
-            name="background",
-            field=models.FileField(
-                default=None,
-                help_text="Background shown during execution",
-                null=True,
-                upload_to="flow-backgrounds/",
-            ),
-        ),
-        migrations.AddField(
-            model_name="flowstagebinding",
-            name="invalid_response_action",
-            field=models.TextField(
-                choices=[
-                    ("retry", "Retry"),
-                    ("restart", "Restart"),
-                    ("restart_with_context", "Restart With Context"),
-                ],
-                default="retry",
-                help_text="Configure how the flow executor should handle an invalid response to a challenge. RETRY returns the error message and a similar challenge to the executor. RESTART restarts the flow from the beginning, and RESTART_WITH_CONTEXT restarts the flow while keeping the current context.",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="flow",
-            name="background",
-            field=models.FileField(
-                default=None,
-                help_text="Background shown during execution",
-                max_length=500,
-                null=True,
-                upload_to="flow-backgrounds/",
-            ),
-        ),
-        migrations.AddField(
-            model_name="flow",
-            name="compatibility_mode",
-            field=models.BooleanField(
-                default=False,
-                help_text="Enable compatibility mode, increases compatibility with password managers on mobile devices.",
-            ),
-        ),
-    ]

authentik/flows/planner.py

@@ -57,11 +57,11 @@ class FlowPlan:
     markers: list[StageMarker] = field(default_factory=list)
 
     def append_stage(self, stage: Stage, marker: Optional[StageMarker] = None):
-        """Append `stage` to all stages, optionally with stage marker"""
+        """Append `stage` to all stages, optionall with stage marker"""
         return self.append(FlowStageBinding(stage=stage), marker)
 
     def append(self, binding: FlowStageBinding, marker: Optional[StageMarker] = None):
-        """Append `stage` to all stages, optionally with stage marker"""
+        """Append `stage` to all stages, optionall with stage marker"""
         self.bindings.append(binding)
         self.markers.append(marker or StageMarker())
 

authentik/flows/signals.py

@@ -1,6 +1,6 @@
 """authentik flow signals"""
 from django.core.cache import cache
-from django.db.models.signals import post_save, pre_delete
+from django.db.models.signals import post_save
 from django.dispatch import receiver
 from structlog.stdlib import get_logger
 
@@ -15,7 +15,6 @@ def delete_cache_prefix(prefix: str) -> int:
 
 
 @receiver(post_save)
-@receiver(pre_delete)
 # pylint: disable=unused-argument
 def invalidate_flow_cache(sender, instance, **_):
     """Invalidate flow cache when flow is updated"""

authentik/flows/stage.py

@@ -18,7 +18,7 @@ from authentik.flows.challenge import (
 )
 from authentik.flows.models import InvalidResponseAction
 from authentik.flows.planner import PLAN_CONTEXT_APPLICATION, PLAN_CONTEXT_PENDING_USER
-from authentik.flows.views.executor import FlowExecutorView
+from authentik.flows.views import FlowExecutorView
 
 PLAN_CONTEXT_PENDING_USER_IDENTIFIER = "pending_user_identifier"
 LOGGER = get_logger()

authentik/flows/tests/test_inspector.py

@@ -1,93 +0,0 @@
-"""Flow inspector tests"""
-
-from json import loads
-
-from django.test.client import RequestFactory
-from django.urls.base import reverse
-from rest_framework.test import APITestCase
-
-from authentik.core.models import User
-from authentik.flows.challenge import ChallengeTypes
-from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding, InvalidResponseAction
-from authentik.stages.dummy.models import DummyStage
-from authentik.stages.identification.models import IdentificationStage, UserFields
-
-
-class TestFlowInspector(APITestCase):
-    """Test inspector"""
-
-    def setUp(self):
-        self.request_factory = RequestFactory()
-        self.admin = User.objects.get(username="akadmin")
-        self.client.force_login(self.admin)
-
-    def test(self):
-        """test inspector"""
-        flow = Flow.objects.create(
-            name="test-full",
-            slug="test-full",
-            designation=FlowDesignation.AUTHENTICATION,
-        )
-
-        # Stage 1 is an identification stage
-        ident_stage = IdentificationStage.objects.create(
-            name="ident",
-            user_fields=[UserFields.USERNAME],
-        )
-        FlowStageBinding.objects.create(
-            target=flow,
-            stage=ident_stage,
-            order=1,
-            invalid_response_action=InvalidResponseAction.RESTART_WITH_CONTEXT,
-        )
-        FlowStageBinding.objects.create(
-            target=flow, stage=DummyStage.objects.create(name="dummy2"), order=1
-        )
-
-        res = self.client.get(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-        )
-        self.assertJSONEqual(
-            res.content,
-            {
-                "component": "ak-stage-identification",
-                "flow_info": {
-                    "background": flow.background_url,
-                    "cancel_url": reverse("authentik_flows:cancel"),
-                    "title": "",
-                },
-                "type": ChallengeTypes.NATIVE.value,
-                "password_fields": False,
-                "primary_action": "Log in",
-                "sources": [],
-                "show_source_labels": False,
-                "user_fields": ["username"],
-            },
-        )
-
-        ins = self.client.get(
-            reverse("authentik_api:flow-inspector", kwargs={"flow_slug": flow.slug}),
-        )
-        content = loads(ins.content)
-        self.assertEqual(content["is_completed"], False)
-        self.assertEqual(content["current_plan"]["current_stage"]["stage_obj"]["name"], "ident")
-        self.assertEqual(
-            content["current_plan"]["next_planned_stage"]["stage_obj"]["name"], "dummy2"
-        )
-
-        self.client.post(
-            reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
-            {"uid_field": "akadmin"},
-            follow=True,
-        )
-
-        ins = self.client.get(
-            reverse("authentik_api:flow-inspector", kwargs={"flow_slug": flow.slug}),
-        )
-        content = loads(ins.content)
-        self.assertEqual(content["is_completed"], False)
-        self.assertEqual(content["plans"][0]["current_stage"]["stage_obj"]["name"], "ident")
-        self.assertEqual(content["current_plan"]["current_stage"]["stage_obj"]["name"], "dummy2")
-        self.assertEqual(
-            content["current_plan"]["plan_context"]["pending_user"]["username"], "akadmin"
-        )

authentik/flows/tests/test_stage_views.py

@@ -1,31 +0,0 @@
-"""stage view tests"""
-from typing import Callable, Type
-
-from django.test import RequestFactory, TestCase
-
-from authentik.flows.stage import StageView
-from authentik.flows.views.executor import FlowExecutorView
-from authentik.lib.utils.reflection import all_subclasses
-
-
-class TestViews(TestCase):
-    """Generic model properties tests"""
-
-    def setUp(self) -> None:
-        self.factory = RequestFactory()
-        self.exec = FlowExecutorView(request=self.factory.get("/"))
-
-
-def view_tester_factory(view_class: Type[StageView]) -> Callable:
-    """Test a form"""
-
-    def tester(self: TestViews):
-        model_class = view_class(self.exec)
-        self.assertIsNotNone(model_class.post)
-        self.assertIsNotNone(model_class.get)
-
-    return tester
-
-
-for view in all_subclasses(StageView):
-    setattr(TestViews, f"test_view_{view.__name__}", view_tester_factory(view))

authentik/flows/tests/test_views.py

@@ -14,7 +14,7 @@ from authentik.flows.markers import ReevaluateMarker, StageMarker
 from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding, InvalidResponseAction
 from authentik.flows.planner import FlowPlan, FlowPlanner
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, StageView
-from authentik.flows.views.executor import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
+from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
 from authentik.lib.config import CONFIG
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
@@ -38,13 +38,13 @@ TO_STAGE_RESPONSE_MOCK = MagicMock(side_effect=to_stage_response)
 
 
 class TestFlowExecutor(APITestCase):
-    """Test executor"""
+    """Test views logic"""
 
     def setUp(self):
         self.request_factory = RequestFactory()
 
     @patch(
-        "authentik.flows.views.executor.to_stage_response",
+        "authentik.flows.views.to_stage_response",
         TO_STAGE_RESPONSE_MOCK,
     )
     def test_existing_plan_diff_flow(self):
@@ -62,7 +62,7 @@ class TestFlowExecutor(APITestCase):
         session.save()
 
         cancel_mock = MagicMock()
-        with patch("authentik.flows.views.executor.FlowExecutorView.cancel", cancel_mock):
+        with patch("authentik.flows.views.FlowExecutorView.cancel", cancel_mock):
             response = self.client.get(
                 reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}),
             )
@@ -70,7 +70,7 @@ class TestFlowExecutor(APITestCase):
             self.assertEqual(cancel_mock.call_count, 2)
 
     @patch(
-        "authentik.flows.views.executor.to_stage_response",
+        "authentik.flows.views.to_stage_response",
         TO_STAGE_RESPONSE_MOCK,
     )
     @patch(
@@ -105,7 +105,7 @@ class TestFlowExecutor(APITestCase):
         )
 
     @patch(
-        "authentik.flows.views.executor.to_stage_response",
+        "authentik.flows.views.to_stage_response",
         TO_STAGE_RESPONSE_MOCK,
     )
     def test_invalid_empty_flow(self):
@@ -124,7 +124,7 @@ class TestFlowExecutor(APITestCase):
         self.assertEqual(response.url, reverse("authentik_core:root-redirect"))
 
     @patch(
-        "authentik.flows.views.executor.to_stage_response",
+        "authentik.flows.views.to_stage_response",
         TO_STAGE_RESPONSE_MOCK,
     )
     def test_invalid_flow_redirect(self):
@@ -175,7 +175,7 @@ class TestFlowExecutor(APITestCase):
         self.assertEqual(len(plan.bindings), 1)
 
     @patch(
-        "authentik.flows.views.executor.to_stage_response",
+        "authentik.flows.views.to_stage_response",
         TO_STAGE_RESPONSE_MOCK,
     )
     def test_reevaluate_remove_last(self):
@@ -438,7 +438,7 @@ class TestFlowExecutor(APITestCase):
 
         # third request, this should trigger the re-evaluate
         # A get request will evaluate the policies and this will return stage 4
-        # but it won't save it, hence we can't check the plan
+        # but it won't save it, hence we cant' check the plan
         response = self.client.get(exec_url)
         self.assertEqual(response.status_code, 200)
         self.assertJSONEqual(
@@ -545,7 +545,6 @@ class TestFlowExecutor(APITestCase):
                 "password_fields": False,
                 "primary_action": "Log in",
                 "sources": [],
-                "show_source_labels": False,
                 "user_fields": [UserFields.E_MAIL],
             },
         )

authentik/flows/tests/test_views_helper.py

@@ -4,7 +4,7 @@ from django.urls import reverse
 
 from authentik.flows.models import Flow, FlowDesignation
 from authentik.flows.planner import FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_PLAN
+from authentik.flows.views import SESSION_KEY_PLAN
 
 
 class TestHelperView(TestCase):

authentik/flows/transfer/common.py

@@ -11,7 +11,7 @@ from authentik.lib.sentry import SentryIgnoredException
 
 
 def get_attrs(obj: SerializerModel) -> dict[str, Any]:
-    """Get object's attributes via their serializer, and convert it to a normal dict"""
+    """Get object's attributes via their serializer, and covert it to a normal dict"""
     data = dict(obj.serializer(obj).data)
     to_remove = (
         "policies",

authentik/flows/urls.py

@@ -2,7 +2,7 @@
 from django.urls import path
 
 from authentik.flows.models import FlowDesignation
-from authentik.flows.views.executor import CancelView, ConfigureFlowInitView, ToDefaultFlow
+from authentik.flows.views import CancelView, ConfigureFlowInitView, ToDefaultFlow
 
 urlpatterns = [
     path(

authentik/flows/views.py

@@ -1,5 +1,4 @@
 """authentik multi-stage authentication engine"""
-from copy import deepcopy
 from traceback import format_tb
 from typing import Any, Optional
 
@@ -15,7 +14,12 @@ from django.utils.decorators import method_decorator
 from django.views.decorators.clickjacking import xframe_options_sameorigin
 from django.views.generic import View
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, PolymorphicProxySerializer, extend_schema
+from drf_spectacular.utils import (
+    OpenApiParameter,
+    OpenApiResponse,
+    PolymorphicProxySerializer,
+    extend_schema,
+)
 from rest_framework.permissions import AllowAny
 from rest_framework.views import APIView
 from sentry_sdk import capture_exception
@@ -53,7 +57,6 @@ NEXT_ARG_NAME = "next"
 SESSION_KEY_PLAN = "authentik_flows_plan"
 SESSION_KEY_APPLICATION_PRE = "authentik_flows_application_pre"
 SESSION_KEY_GET = "authentik_flows_get"
-SESSION_KEY_HISTORY = "authentik_flows_history"
 
 
 def challenge_types():
@@ -128,12 +131,12 @@ class FlowExecutorView(APIView):
 
     # pylint: disable=unused-argument, too-many-return-statements
     def dispatch(self, request: HttpRequest, flow_slug: str) -> HttpResponse:
-        # Early check if there's an active Plan for the current session
+        # Early check if theres an active Plan for the current session
         if SESSION_KEY_PLAN in self.request.session:
             self.plan = self.request.session[SESSION_KEY_PLAN]
             if self.plan.flow_pk != self.flow.pk.hex:
                 self._logger.warning(
-                    "f(exec): Found existing plan for other flow, deleting plan",
+                    "f(exec): Found existing plan for other flow, deleteing plan",
                 )
                 # Existing plan is deleted from session and instance
                 self.plan = None
@@ -142,7 +145,6 @@ class FlowExecutorView(APIView):
 
         # Don't check session again as we've either already loaded the plan or we need to plan
         if not self.plan:
-            request.session[SESSION_KEY_HISTORY] = []
             self._logger.debug("f(exec): No active Plan found, initiating planner")
             try:
                 self.plan = self._initiate_plan()
@@ -211,6 +213,9 @@ class FlowExecutorView(APIView):
                 serializers=challenge_types(),
                 resource_type_field_name="component",
             ),
+            404: OpenApiResponse(
+                description="No Token found"
+            ),  # This error can be raised by the email stage
         },
         request=OpenApiTypes.NONE,
         parameters=[
@@ -324,7 +329,6 @@ class FlowExecutorView(APIView):
             "f(exec): Stage ok",
             stage_class=class_to_path(self.current_stage_view.__class__),
         )
-        self.request.session.get(SESSION_KEY_HISTORY, []).append(deepcopy(self.plan))
         self.plan.pop()
         self.request.session[SESSION_KEY_PLAN] = self.plan
         if self.plan.bindings:
@@ -372,10 +376,6 @@ class FlowExecutorView(APIView):
             SESSION_KEY_APPLICATION_PRE,
             SESSION_KEY_PLAN,
             SESSION_KEY_GET,
-            # We don't delete the history on purpose, as a user might
-            # still be inspecting it.
-            # It's only deleted on a fresh executions
-            # SESSION_KEY_HISTORY,
         ]
         for key in keys_to_delete:
             if key in self.request.session:
@@ -441,7 +441,7 @@ class ToDefaultFlow(View):
             plan: FlowPlan = self.request.session[SESSION_KEY_PLAN]
             if plan.flow_pk != flow.pk.hex:
                 LOGGER.warning(
-                    "f(def): Found existing plan for other flow, deleting plan",
+                    "f(def): Found existing plan for other flow, deleteing plan",
                     flow_slug=flow.slug,
                 )
                 del self.request.session[SESSION_KEY_PLAN]

authentik/flows/views/inspector.py

@@ -1,119 +0,0 @@
-"""Flow Inspector"""
-from hashlib import sha256
-from typing import Any
-
-from django.conf import settings
-from django.http.request import HttpRequest
-from django.http.response import HttpResponse
-from django.shortcuts import get_object_or_404
-from django.utils.decorators import method_decorator
-from django.views.decorators.clickjacking import xframe_options_sameorigin
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
-from rest_framework.fields import BooleanField, ListField, SerializerMethodField
-from rest_framework.permissions import IsAdminUser
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-from structlog.stdlib import BoundLogger, get_logger
-
-from authentik.core.api.utils import PassiveSerializer
-from authentik.events.utils import sanitize_dict
-from authentik.flows.api.bindings import FlowStageBindingSerializer
-from authentik.flows.models import Flow
-from authentik.flows.planner import FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
-
-
-class FlowInspectorPlanSerializer(PassiveSerializer):
-    """Serializer for an active FlowPlan"""
-
-    current_stage = SerializerMethodField()
-    next_planned_stage = SerializerMethodField(required=False)
-    plan_context = SerializerMethodField()
-    session_id = SerializerMethodField()
-
-    def get_current_stage(self, plan: FlowPlan) -> FlowStageBindingSerializer:
-        """Get the current stage"""
-        return FlowStageBindingSerializer(instance=plan.bindings[0]).data
-
-    def get_next_planned_stage(self, plan: FlowPlan) -> FlowStageBindingSerializer:
-        """Get the next planned stage"""
-        if len(plan.bindings) < 2:
-            return FlowStageBindingSerializer().data
-        return FlowStageBindingSerializer(instance=plan.bindings[1]).data
-
-    def get_plan_context(self, plan: FlowPlan) -> dict[str, Any]:
-        """Get the plan's context, sanitized"""
-        return sanitize_dict(plan.context)
-
-    # pylint: disable=unused-argument
-    def get_session_id(self, plan: FlowPlan) -> str:
-        """Get a unique session ID"""
-        request: Request = self.context["request"]
-        return sha256(
-            f"{request._request.session.session_key}-{settings.SECRET_KEY}".encode("ascii")
-        ).hexdigest()
-
-
-class FlowInspectionSerializer(PassiveSerializer):
-    """Serializer for inspect endpoint"""
-
-    plans = ListField(child=FlowInspectorPlanSerializer())
-    current_plan = FlowInspectorPlanSerializer(required=False)
-    is_completed = BooleanField()
-
-
-@method_decorator(xframe_options_sameorigin, name="dispatch")
-class FlowInspectorView(APIView):
-    """Flow inspector API"""
-
-    permission_classes = [IsAdminUser]
-
-    flow: Flow
-    _logger: BoundLogger
-
-    def setup(self, request: HttpRequest, flow_slug: str):
-        super().setup(request, flow_slug=flow_slug)
-        self.flow = get_object_or_404(Flow.objects.select_related(), slug=flow_slug)
-        self._logger = get_logger().bind(flow_slug=flow_slug)
-
-    # pylint: disable=unused-argument, too-many-return-statements
-    def dispatch(self, request: HttpRequest, flow_slug: str) -> HttpResponse:
-        if SESSION_KEY_HISTORY not in self.request.session:
-            return HttpResponse(status=400)
-        return super().dispatch(request, flow_slug=flow_slug)
-
-    @extend_schema(
-        responses={
-            200: FlowInspectionSerializer(),
-            400: OpenApiResponse(
-                description="No flow plan in session."
-            ),  # This error can be raised by the email stage
-        },
-        request=OpenApiTypes.NONE,
-        operation_id="flows_inspector_get",
-    )
-    def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
-        """Get current flow state and record it"""
-        plans = []
-        for plan in request.session[SESSION_KEY_HISTORY]:
-            plan_serializer = FlowInspectorPlanSerializer(
-                instance=plan, context={"request": request}
-            )
-            plans.append(plan_serializer.data)
-        is_completed = False
-        if SESSION_KEY_PLAN in request.session:
-            current_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
-        else:
-            current_plan = request.session[SESSION_KEY_HISTORY][-1]
-            is_completed = True
-        current_serializer = FlowInspectorPlanSerializer(
-            instance=current_plan, context={"request": request}
-        )
-        response = {
-            "plans": plans,
-            "current_plan": current_serializer.data,
-            "is_completed": is_completed,
-        }
-        return Response(response)

authentik/lib/default.yml

@@ -5,23 +5,11 @@ postgresql:
   user: authentik
   port: 5432
   password: 'env://POSTGRES_PASSWORD'
-  backup:
-    enabled: true
-  s3_backup:
-    access_key: ""
-    secret_key: ""
-    bucket: ""
-    region: eu-central-1
-    host: ""
-    location: ""
-    insecure_skip_verify: false
 
 web:
   listen: 0.0.0.0:9000
   listen_tls: 0.0.0.0:9443
-  listen_metrics: 0.0.0.0:9300
   load_local_files: false
-  outpost_port_offset: 0
 
 redis:
   host: localhost
@@ -64,16 +52,14 @@ outposts:
   # %(type)s: Outpost type; proxy, ldap, etc
   # %(version)s: Current version; 2021.4.1
   # %(build_hash)s: Build hash if you're running a beta version
-  container_image_base: env://AUTHENTIK_OUTPOSTS__DOCKER_IMAGE_BASE?goauthentik.io/%(type)s:%(version)s
+  docker_image_base: "ghcr.io/goauthentik/%(type)s:%(version)s"
 
-cookie_domain: null
-disable_update_check: false
 avatars: env://AUTHENTIK_AUTHENTIK__AVATARS?gravatar
 geoip: "./GeoLite2-City.mmdb"
 
 # Can't currently be configured via environment variables, only yaml
 footer_links:
   - name: Documentation
-    href: https://goauthentik.io/docs/?utm_source=authentik
+    href: https://goauthentik.io/docs/
   - name: authentik Website
-    href: https://goauthentik.io/?utm_source=authentik
+    href: https://goauthentik.io/

authentik/lib/expression/evaluator.py

@@ -4,13 +4,13 @@ from textwrap import indent
 from typing import Any, Iterable, Optional
 
 from django.core.exceptions import FieldError
+from requests import Session
 from rest_framework.serializers import ValidationError
 from sentry_sdk.hub import Hub
 from sentry_sdk.tracing import Span
 from structlog.stdlib import get_logger
 
 from authentik.core.models import User
-from authentik.lib.utils.http import get_http_session
 
 LOGGER = get_logger()
 
@@ -35,7 +35,7 @@ class BaseEvaluator:
             "ak_is_group_member": BaseEvaluator.expr_is_group_member,
             "ak_user_by": BaseEvaluator.expr_user_by,
             "ak_logger": get_logger(),
-            "requests": get_http_session(),
+            "requests": Session(),
         }
         self._context = {}
         self._filename = "BaseEvalautor"

authentik/lib/sentry.py

@@ -93,7 +93,6 @@ def before_send(event: dict, hint: dict) -> Optional[dict]:
     if "exc_info" in hint:
         _, exc_value, _ = hint["exc_info"]
         if isinstance(exc_value, ignored_classes):
-            LOGGER.debug("dropping exception", exception=exc_value)
             return None
     if "logger" in event:
         if event["logger"] in [

authentik/lib/tests/test_config.py

@@ -32,7 +32,7 @@ class TestConfig(TestCase):
         config = ConfigLoader()
         environ["foo"] = "bar"
         self.assertEqual(config.parse_uri("env://foo"), "bar")
-        self.assertEqual(config.parse_uri("env://foo?bar"), "bar")
+        self.assertEqual(config.parse_uri("env://fo?bar"), "bar")
 
     def test_uri_file(self):
         """Test URI parsing (file load)"""

authentik/lib/tests/test_http.py

@@ -27,7 +27,7 @@ class TestHTTP(TestCase):
         token = Token.objects.create(
             identifier="test", user=self.user, intent=TokenIntents.INTENT_API
         )
-        # Invalid, non-existent token
+        # Invalid, non-existant token
         request = self.factory.get(
             "/",
             **{
@@ -36,7 +36,7 @@ class TestHTTP(TestCase):
             },
         )
         self.assertEqual(get_client_ip(request), "127.0.0.1")
-        # Invalid, user doesn't have permissions
+        # Invalid, user doesn't have permisions
         request = self.factory.get(
             "/",
             **{