release: 0.14.0-stable

.bumpversion.cfg

@@ -1,11 +1,9 @@
 [bumpversion]
-current_version = 2021.3.1
+current_version = 0.14.0-stable
 tag = True
 commit = True
-parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
-serialize = 
-	{major}.{minor}.{patch}-{release}
-	{major}.{minor}.{patch}
+parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-(?P<release>.*)
+serialize = {major}.{minor}.{patch}-{release}
 message = release: {new_version}
 tag_name = version/{new_version}
 
@@ -33,6 +31,6 @@ values =
 
 [bumpversion:file:authentik/__init__.py]
 
-[bumpversion:file:outpost/pkg/version.go]
+[bumpversion:file:proxy/pkg/version.go]
 
 [bumpversion:file:web/src/constants.ts]

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
 - package-ecosystem: gomod
-  directory: "/outpost"
+  directory: "/proxy"
   schedule:
     interval: daily
     time: "04:00"
@@ -16,14 +16,6 @@ updates:
   open-pull-requests-limit: 10
   assignees:
   - BeryJu
-- package-ecosystem: npm
-  directory: "/website"
-  schedule:
-    interval: daily
-    time: "04:00"
-  open-pull-requests-limit: 10
-  assignees:
-  - BeryJu
 - package-ecosystem: pip
   directory: "/"
   schedule:
@@ -41,7 +33,7 @@ updates:
   assignees:
   - BeryJu
 - package-ecosystem: docker
-  directory: "/outpost"
+  directory: "/proxy"
   schedule:
     interval: daily
     time: "04:00"

.github/workflows/release.yml

@@ -18,11 +18,11 @@ jobs:
       - name: Building Docker Image
         run: docker build
           --no-cache
-          -t beryju/authentik:2021.3.1
+          -t beryju/authentik:0.14.0-stable
           -t beryju/authentik:latest
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:2021.3.1
+        run: docker push beryju/authentik:0.14.0-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik:latest
   build-proxy:
@@ -34,7 +34,7 @@ jobs:
           go-version: "^1.15"
       - name: prepare go api client
         run: |
-          cd outpost
+          cd proxy
           go get -u github.com/go-swagger/go-swagger/cmd/swagger
           swagger generate client -f ../swagger.yaml -A authentik -t pkg/
           go build -v .
@@ -45,14 +45,14 @@ jobs:
         run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
       - name: Building Docker Image
         run: |
-          cd outpost/
+          cd proxy/
           docker build \
           --no-cache \
-          -t beryju/authentik-proxy:2021.3.1 \
+          -t beryju/authentik-proxy:0.14.0-stable \
           -t beryju/authentik-proxy:latest \
-          -f proxy.Dockerfile .
+          -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:2021.3.1
+        run: docker push beryju/authentik-proxy:0.14.0-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-proxy:latest
   build-static:
@@ -69,11 +69,11 @@ jobs:
           cd web/
           docker build \
           --no-cache \
-          -t beryju/authentik-static:2021.3.1 \
+          -t beryju/authentik-static:0.14.0-stable \
           -t beryju/authentik-static:latest \
           -f Dockerfile .
       - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:2021.3.1
+        run: docker push beryju/authentik-static:0.14.0-stable
       - name: Push Docker Container to Registry (latest)
         run: docker push beryju/authentik-static:latest
   test-release:
@@ -107,5 +107,5 @@ jobs:
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          tagName: 2021.3.1
+          tagName: 0.14.0-stable
           environment: beryjuorg-prod

.gitignore

@@ -201,4 +201,3 @@ local.env.yml
 selenium_screenshots/
 backups/
 media/
-*mmdb

Dockerfile

@@ -20,7 +20,7 @@ RUN apt-get update && \
     curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
     echo "deb http://apt.postgresql.org/pub/repos/apt buster-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends postgresql-client-12 postgresql-client-11 build-essential libxmlsec1-dev pkg-config libmaxminddb0 && \
+    apt-get install -y --no-install-recommends postgresql-client-12 postgresql-client-11 build-essential libxmlsec1-dev pkg-config && \
     apt-get clean && \
     pip install -r /requirements.txt --no-cache-dir && \
     apt-get remove --purge -y build-essential && \

Makefile

@@ -1,15 +1,20 @@
 all: lint-fix lint coverage gen
 
+test-full:
+	coverage run manage.py test --failfast -v 3 .
+	coverage html
+	coverage report
+
 test-integration:
 	k3d cluster create || exit 0
 	k3d kubeconfig write -o ~/.kube/config --overwrite
-	coverage run manage.py test -v 3 tests/integration
+	coverage run manage.py test --failfast -v 3 tests/integration
 
 test-e2e:
-	coverage run manage.py test -v 3 tests/e2e
+	coverage run manage.py test --failfast -v 3 tests/e2e
 
 coverage:
-	coverage run manage.py test -v 3 authentik
+	coverage run manage.py test --failfast -v 3 authentik
 	coverage html
 	coverage report
 

Pipfile

@@ -6,9 +6,6 @@ verify_ssl = true
 [packages]
 boto3 = "*"
 celery = "*"
-channels = "*"
-channels-redis = "*"
-dacite = "*"
 defusedxml = "*"
 django = "*"
 django-cors-middleware = "*"
@@ -18,33 +15,35 @@ django-guardian = "*"
 django-model-utils = "*"
 django-otp = "*"
 django-prometheus = "*"
+django-recaptcha = "*"
 django-redis = "*"
-django-storages = "*"
 djangorestframework = "*"
+django-storages = "*"
 djangorestframework-guardian = "*"
-docker = "*"
 drf_yasg2 = "*"
 facebook-sdk = "*"
-geoip2 = "*"
-gunicorn = "*"
-kubernetes = "*"
 ldap3 = "*"
 lxml = "*"
 packaging = "*"
 psycopg2-binary = "*"
 pycryptodome = "*"
 pyjwkest = "*"
+uvicorn = {extras = ["standard"],version = "*"}
+gunicorn = "*"
 pyyaml = "*"
+qrcode = "*"
 requests-oauthlib = "*"
 sentry-sdk = "*"
 service_identity = "*"
 structlog = "*"
 swagger-spec-validator = "*"
 urllib3 = {extras = ["secure"],version = "*"}
-uvicorn = {extras = ["standard"],version = "*"}
-webauthn = "*"
+dacite = "*"
+channels = "*"
+channels-redis = "*"
+kubernetes = "*"
+docker = "*"
 xmlsec = "*"
-twisted = "==20.3.0"
 
 [requires]
 python_version = "3.9"
@@ -56,7 +55,8 @@ black = "==20.8b1"
 bumpversion = "*"
 colorama = "*"
 coverage = "*"
-pylint = "<=2.6.0"
+django-debug-toolbar = "*"
+pylint = "*"
 pylint-django = "*"
 selenium = "*"
 prospector = "*"

README.md

@@ -1,10 +1,7 @@
-<p align="center">
-    <img src="https://goauthentik.io/img/icon_top_brand_colour.svg" height="150" alt="authentik logo">
-</p>
+<img src="https://goauthentik.io/img/icon_top_brand_colour.svg" height="250" alt="authentik logo">
 
 ---
 
-[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/KPnmtNWy)
 [![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/1?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=1)
 [![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/1?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=1)
 [![Code Coverage](https://img.shields.io/codecov/c/gh/beryju/authentik?style=flat-square)](https://codecov.io/gh/BeryJu/authentik)
@@ -24,10 +21,8 @@ For bigger setups, there is a Helm Chart in the `helm/` directory. This is docum
 
 ## Screenshots
 
-Light | Dark
---- | ---
-![](https://goauthentik.io/img/screen_apps_light.png) | ![](https://goauthentik.io/img/screen_apps_dark.png)
-![](https://goauthentik.io/img/screen_admin_light.png) | ![](https://goauthentik.io/img/screen_admin_dark.png)
+![](https://goauthentik.io/img/screen_apps.png)
+![](https://goauthentik.io/img/screen_admin.png)
 
 ## Development
 

SECURITY.md

@@ -2,11 +2,13 @@
 
 ## Supported Versions
 
-| Version    | Supported          |
-| ---------- | ------------------ |
-| 2021.1.x   | :white_check_mark: |
-| 2021.2.x   | :white_check_mark: |
-| 2021.3.x   | :white_check_mark: |
+As authentik is currently in a pre-stable, only the latest "stable" version is supported. After authentik 1.0, this will change.
+
+| Version  | Supported          |
+| -------- | ------------------ |
+| 0.11.x   | :white_check_mark: |
+| 0.12.x   | :white_check_mark: |
+| 0.13.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

authentik/__init__.py

@@ -1,2 +1,2 @@
 """authentik"""
-__version__ = "2021.3.1"
+__version__ = "0.14.0-stable"

authentik/admin/api/metrics.py

@@ -2,6 +2,7 @@
 import time
 from collections import Counter
 from datetime import timedelta
+from typing import Dict, List
 
 from django.db.models import Count, ExpressionWrapper, F, Model
 from django.db.models.fields import DurationField
@@ -18,7 +19,7 @@ from rest_framework.viewsets import ViewSet
 from authentik.events.models import Event, EventAction
 
 
-def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
+def get_events_per_1h(**filter_kwargs) -> List[Dict[str, int]]:
     """Get event count by hour in the last day, fill with zeros"""
     date_from = now() - timedelta(days=1)
     result = (
@@ -31,7 +32,7 @@ def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
         .annotate(count=Count("pk"))
         .order_by("age_hours")
     )
-    data = Counter({int(d["age_hours"]): d["count"] for d in result})
+    data = Counter({d["age_hours"]: d["count"] for d in result})
     results = []
     _now = now()
     for hour in range(0, -24, -1):

authentik/admin/api/tasks.py

@@ -7,14 +7,14 @@ from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
 from drf_yasg2.utils import swagger_auto_schema
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
+from rest_framework.fields import CharField, DateTimeField, IntegerField, ListField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import Serializer
 from rest_framework.viewsets import ViewSet
 
-from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus
+from authentik.lib.tasks import TaskInfo
 
 
 class TaskSerializer(Serializer):
@@ -24,10 +24,7 @@ class TaskSerializer(Serializer):
     task_description = CharField()
     task_finish_timestamp = DateTimeField(source="finish_timestamp")
 
-    status = ChoiceField(
-        source="result.status.name",
-        choices=[(x.name, x.name) for x in TaskResultStatus],
-    )
+    status = IntegerField(source="result.status.value")
     messages = ListField(source="result.messages")
 
     def create(self, validated_data: dict) -> Model:

authentik/admin/api/version.py

@@ -55,7 +55,7 @@ class VersionViewSet(ListModelMixin, GenericViewSet):
     def get_queryset(self):  # pragma: no cover
         return None
 
-    @swagger_auto_schema(responses={200: VersionSerializer(many=False)})
+    @swagger_auto_schema(responses={200: VersionSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """Get running and latest version."""
         return Response(VersionSerializer(True).data)

authentik/admin/forms/source.py

@@ -0,0 +1,19 @@
+"""authentik core source form fields"""
+
+SOURCE_FORM_FIELDS = [
+    "name",
+    "slug",
+    "enabled",
+    "authentication_flow",
+    "enrollment_flow",
+]
+SOURCE_SERIALIZER_FIELDS = [
+    "pk",
+    "name",
+    "slug",
+    "enabled",
+    "authentication_flow",
+    "enrollment_flow",
+    "verbose_name",
+    "verbose_name_plural",
+]

authentik/admin/tasks.py

@@ -1,22 +1,17 @@
 """authentik admin tasks"""
-import re
-
 from django.core.cache import cache
-from django.core.validators import URLValidator
 from packaging.version import parse
 from requests import RequestException, get
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik import __version__
 from authentik.events.models import Event, EventAction
-from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
 VERSION_CACHE_KEY = "authentik_latest_version"
-VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
-# Chop of the first ^ because we want to search the entire string
-URL_FINDER = URLValidator.regex.pattern[1:]
+VERSION_CACHE_TIMEOUT = 2 * 60 * 60  # 2 hours
 
 
 @CELERY_APP.task(bind=True, base=MonitoredTask)
@@ -44,10 +39,7 @@ def update_latest_version(self: MonitoredTask):
                 context__new_version=upstream_version,
             ).exists():
                 return
-            event_dict = {"new_version": upstream_version}
-            if match := re.search(URL_FINDER, data.get("body", "")):
-                event_dict["message"] = f"Changelog: {match.group()}"
-            Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
+            Event.new(EventAction.UPDATE_AVAILABLE, new_version=upstream_version).save()
     except (RequestException, IndexError) as exc:
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))

authentik/admin/templates/administration/certificatekeypair/generate.html

@@ -1,14 +0,0 @@
-{% extends base_template|default:"generic/form.html" %}
-
-{% load authentik_utils %}
-{% load i18n %}
-
-{% block above_form %}
-<h1>
-    {% trans 'Generate Certificate-Key Pair' %}
-</h1>
-{% endblock %}
-
-{% block action %}
-{% trans 'Generate Certificate-Key Pair' %}
-{% endblock %}

authentik/admin/templates/administration/certificatekeypair/list.html

@@ -0,0 +1,116 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-key"></i>
+            {% trans 'Certificate-Key Pairs' %}
+        </h1>
+        <p>{% trans "Import certificates of external providers or create certificates to sign requests with." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:certificatekeypair-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Private Key available' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Fingerprint' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for kp in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ kp.name }}</div>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {% if kp.key_data is not None %}
+                            {% trans 'Yes' %}
+                            {% else %}
+                            {% trans 'No' %}
+                            {% endif %}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <code>{{ kp.fingerprint }}</code>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:certificatekeypair-update' pk=kp.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:certificatekeypair-delete' pk=kp.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-key pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Certificates.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any certificates." %}
+                {% else %}
+                    {% trans 'Currently no certificates exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:certificatekeypair-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/flow/list.html

@@ -0,0 +1,135 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-process-automation"></i>
+            {% trans 'Flows' %}
+        </h1>
+        <p>{% trans "Flows describe a chain of Stages to authenticate, enroll or recover a user. Stages are chosen based on policies applied to them." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:flow-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <ak-modal-button href="{% url 'authentik_admin:flow-import' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                            {% trans 'Import' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Identifier' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Designation' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Stages' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Policies' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for flow in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <a href="/flows/{{ flow.slug }}">
+                            <div><code>{{ flow.slug }}</code></div>
+                            <small>{{ flow.name }}</small>
+                        </a>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ flow.designation }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ flow.stages.all|length }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ flow.policies.all|length }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:flow-update' pk=flow.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:flow-delete' pk=flow.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <a class="pf-c-button pf-m-secondary ak-root-link" href="{% url 'authentik_admin:flow-execute' pk=flow.pk %}?next={{ request.get_full_path }}">{% trans 'Execute' %}</a>
+                        <a class="pf-c-button pf-m-secondary ak-root-link" href="{% url 'authentik_admin:flow-export' pk=flow.pk %}?next={{ request.get_full_path }}">{% trans 'Export' %}</a>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-process-automation pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Flows.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any flows." %}
+                {% else %}
+                    {% trans 'Currently no flows exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:flow-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+                <ak-modal-button href="{% url 'authentik_admin:flow-import' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                        {% trans 'Import' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/group/list.html

@@ -0,0 +1,114 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-users"></i>
+            {% trans 'Groups' %}
+        </h1>
+        <p>{% trans "Group users together and give them permissions based on the membership." %}
+        </p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:group-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Parent' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Members' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for group in object_list %}
+                <tr role="row">
+                    <td role="cell">
+                        <span>
+                            {{ group.name }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ group.parent }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ group.users.all|length }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:group-update' pk=group.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:group-delete' pk=group.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-users pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Groups.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any groups." %}
+                {% else %}
+                    {% trans 'Currently no group exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:group-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/outpost/list.html

@@ -0,0 +1,149 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load humanize %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-zone"></i>
+            {% trans 'Outposts' %}
+        </h1>
+        <p>{% trans "Outposts are deployments of authentik components to support different environments and protocols, like reverse proxies." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:outpost-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Providers' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Health' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Version' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for outpost in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <span>{{ outpost.name }}</span>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ outpost.providers.all.select_subclasses|join:", " }}
+                        </span>
+                    </td>
+                    {% with states=outpost.state %}
+                    {% if states|length > 0 %}
+                        <td role="cell">
+                            {% for state in states %}
+                            <div>
+                                {% if state.last_seen %}
+                                <i class="fas fa-check pf-m-success"></i> {{ state.last_seen|naturaltime }}
+                                {% else %}
+                                <i class="fas fa-times pf-m-danger"></i> {% trans 'Unhealthy' %}
+                                {% endif %}
+                            </div>
+                            {% endfor %}
+                        </td>
+                        <td role="cell">
+                            {% for state in states %}
+                                <div>
+                                    {% if not state.version %}
+                                    <i class="fas fa-question-circle"></i>
+                                    {% elif state.version_outdated %}
+                                    <i class="fas fa-times pf-m-danger"></i> {% blocktrans with is=state.version should=state.version_should %}{{ is }}, should be {{ should }}{% endblocktrans %}
+                                    {% else %}
+                                    <i class="fas fa-check pf-m-success"></i> {{ state.version }}
+                                    {% endif %}
+                                </div>
+                            {% endfor %}
+                        </td>
+                    {% else %}
+                        <td role="cell">
+                            <i class="fas fa-question-circle"></i>
+                        </td>
+                        <td role="cell">
+                            <i class="fas fa-question-circle"></i>
+                        </td>
+                    {% endif %}
+                    {% endwith %}
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:outpost-update' pk=outpost.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:outpost-delete' pk=outpost.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% get_htmls outpost as htmls %}
+                        {% for html in htmls %}
+                        {{ html|safe }}
+                        {% endfor %}
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-map-marker pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Outposts.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any outposts." %}
+                {% else %}
+                    {% trans 'Currently no outposts exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:outpost-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/outpost_service_connection/list.html

@@ -0,0 +1,154 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load humanize %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon-integration"></i>
+            {% trans 'Outpost Service-Connections' %}
+        </h1>
+        <p>{% trans "Outpost Service-Connections define how authentik connects to external platforms to manage and deploy Outposts." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:outpost-service-connection-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Local?' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Status' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for sc in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <span>{{ sc.name }}</span>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ sc|verbose_name }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ sc.local|yesno:"Yes,No" }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {% if sc.state.healthy %}
+                            <i class="fas fa-check pf-m-success"></i> {{ sc.state.version }}
+                            {% else %}
+                            <i class="fas fa-times pf-m-danger"></i> {% trans 'Unhealthy' %}
+                            {% endif %}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:outpost-service-connection-update' pk=sc.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:outpost-service-connection-delete' pk=sc.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-map-marker pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Outpost Service Connections.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any outposts." %}
+                {% else %}
+                    {% trans 'Currently no service connections exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:outpost-service-connection-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/policy/list.html

@@ -0,0 +1,148 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-infrastructure"></i>
+            {% trans 'Policies' %}
+        </h1>
+        <p>{% trans "Allow users to use Applications based on properties, enforce Password Criteria and selectively apply Stages." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:policy-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </ak-dropdown>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for policy in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ policy.name }}</div>
+                            {% if not policy.bindings.exists and not policy.promptstage_set.exists %}
+                            <i class="pf-icon pf-icon-warning-triangle"></i>
+                            <small>{% trans 'Warning: Policy is not assigned.' %}</small>
+                            {% else %}
+                            <i class="pf-icon pf-icon-ok"></i>
+                            <small>{% blocktrans with object_count=policy.bindings.all|length %}Assigned to {{ object_count }} objects.{% endblocktrans %}</small>
+                            {% endif %}
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ policy|verbose_name }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:policy-update' pk=policy.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:policy-test' pk=policy.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Test' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:policy-delete' pk=policy.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-infrastructure pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Policies.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any policies." %}
+                {% else %}
+                    {% trans 'Currently no policies exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:policy-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/policy/test.html

@@ -3,42 +3,7 @@
 {% load i18n %}
 
 {% block above_form %}
-<h1>{% blocktrans with policy=policy %}Test {{ policy }}{% endblocktrans %}</h1>
-{% endblock %}
-
-{% block beneath_form %}
-{% if result %}
-<div class="pf-c-form__group ">
-    <div class="pf-c-form__group-label">
-        <label class="pf-c-form__label" for="context-1">
-            <span class="pf-c-form__label-text">{% trans 'Passing' %}</span>
-        </label>
-    </div>
-    <div class="pf-c-form__group-label">
-        <div class="c-form__horizontal-group">
-            <span class="pf-c-form__label-text">{{ result.passing|yesno:"Yes,No" }}</span>
-        </div>
-    </div>
-</div>
-<div class="pf-c-form__group ">
-    <div class="pf-c-form__group-label">
-        <label class="pf-c-form__label" for="context-1">
-            <span class="pf-c-form__label-text">{% trans 'Messages' %}</span>
-        </label>
-    </div>
-    <div class="pf-c-form__group-label">
-        <div class="c-form__horizontal-group">
-            <ul>
-                {% for m in result.messages %}
-                <li><span class="pf-c-form__label-text">{{ m }}</span></li>
-                {% empty %}
-                <li><span class="pf-c-form__label-text">-</span></li>
-                {% endfor %}
-            </ul>
-        </div>
-    </div>
-</div>
-{% endif %}
+<h1>{% blocktrans with policy=policy %}Test policy {{ policy }}{% endblocktrans %}</h1>
 {% endblock %}
 
 {% block action %}

authentik/admin/templates/administration/policy_binding/list.html

@@ -0,0 +1,119 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-infrastructure"></i>
+            {% trans 'Policy Bindings' %}
+        </h1>
+        <p>{% trans "Bind existing Policies to Models accepting policies." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:policy-binding-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Policy' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Enabled' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Order' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Timeout' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for pbm in object_list %}
+                    <tr role="role">
+                        <td>
+                            {{ pbm }}
+                            <small>
+                                {{ pbm|fieldtype }}
+                            </small>
+                        </td>
+                        <td></td>
+                        <td></td>
+                        <td></td>
+                        <td></td>
+                    </tr>
+                    {% for binding in pbm.bindings %}
+                    <tr class="row pf-c-table__expandable-row pf-m-expanded">
+                        <th role="cell">
+                            <div>{{ binding.policy }}</div>
+                            <small>
+                                {{ binding.policy|fieldtype }}
+                            </small>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.enabled }}</div>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.order }}</div>
+                        </th>
+                        <th role="cell">
+                            <div>{{ binding.timeout }}</div>
+                        </th>
+                        <td>
+                            <ak-modal-button href="{% url 'authentik_admin:policy-binding-update' pk=binding.pk %}">
+                                <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                    {% trans 'Edit' %}
+                                </ak-spinner-button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                            <ak-modal-button href="{% url 'authentik_admin:policy-binding-delete' pk=binding.pk %}">
+                                <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                    {% trans 'Delete' %}
+                                </ak-spinner-button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </td>
+                    </tr>
+                    {% endfor %}
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Policy Bindings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no policy bindings exist. Click the button below to create one.' %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:policy-binding-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/property_mapping/list.html

@@ -0,0 +1,139 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-blueprint"></i>
+            {% trans 'Property Mappings' %}
+        </h1>
+        <p>{% trans "Control how authentik exposes and interprets information." %}
+        </p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:property-mapping-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for property_mapping in object_list %}
+                <tr role="row">
+                    <td role="cell">
+                        <span>
+                            {{ property_mapping.name }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ property_mapping|verbose_name }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:property-mapping-update' pk=property_mapping.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:property-mapping-delete' pk=property_mapping.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-blueprint pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Property Mappings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any property mappings." %}
+                {% else %}
+                    {% trans 'Currently no property mappings exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:property-mapping-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/provider/list.html

@@ -0,0 +1,170 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-integration"></i>
+            {% trans 'Providers' %}
+        </h1>
+        <p>{% trans "Provide support for protocols like SAML and OAuth to assigned applications." %}
+    </p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:provider-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:provider-saml-from-metadata' %}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {% trans 'SAML Provider from Metadata' %}<br>
+                                        <small>
+                                            {% trans "Create a SAML Provider by importing its Metadata." %}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                        </ul>
+                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for provider in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ provider.name }}</div>
+                            {% if not provider.application %}
+                            <i class="pf-icon pf-icon-warning-triangle"></i>
+                            <small>{% trans 'Warning: Provider not assigned to any application.' %}</small>
+                            {% else %}
+                            <i class="pf-icon pf-icon-ok"></i>
+                            <small>
+                                {% blocktrans with app=provider.application %}
+                                    Assigned to application {{ app }}.
+                                {% endblocktrans %}
+                            </small>
+                            {% endif %}
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ provider|verbose_name }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:provider-update' pk=provider.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:provider-delete' pk=provider.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% get_links provider as links %}
+                        {% for name, href in links.items %}
+                            <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
+                        {% endfor %}
+                        {% get_htmls provider as htmls %}
+                        {% for html in htmls %}
+                            {{ html|safe }}
+                        {% endfor %}
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon-integration pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Providers.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any providers." %}
+                {% else %}
+                    {% trans 'Currently no providers exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:provider-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/source/list.html

@@ -0,0 +1,153 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-middleware"></i>
+            {% trans 'Source' %}
+        </h1>
+        <p>{% trans "External Sources which can be used to get Identities into authentik, for example Social Providers like Twiter and GitHub or Enterprise Providers like ADFS and LDAP." %}
+        </p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:source-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Additional Info' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for source in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <a href="/sources/{{ source.slug }}/">
+                            <div>{{ source.name }}</div>
+                            {% if not source.enabled %}
+                            <small>{% trans 'Disabled' %}</small>
+                            {% endif %}
+                        </a>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ source|fieldtype }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ source.ui_additional_info|default:""|safe }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:source-update' pk=source.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:source-delete' pk=source.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% get_links source as links %}
+                        {% for name, href in links %}
+                            <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
+                        {% endfor %}
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-middleware pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Sources.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any sources." %}
+                {% else %}
+                    {% trans 'Currently no sources exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:source-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/stage/list.html

@@ -0,0 +1,148 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-plugged"></i>
+            {% trans 'Stages' %}
+        </h1>
+        <p>{% trans "Stages are single steps of a Flow that a user is guided through." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-dropdown class="pf-c-dropdown">
+                        <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                            <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                            <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                        </button>
+                        <ul class="pf-c-dropdown__menu" hidden>
+                            {% for type, name in types.items %}
+                            <li>
+                                <ak-modal-button href="{% url 'authentik_admin:stage-create' %}?type={{ type }}">
+                                    <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                        {{ name|verbose_name }}<br>
+                                        <small>
+                                            {{ name|doc }}
+                                        </small>
+                                    </button>
+                                    <div slot="modal"></div>
+                                </ak-modal-button>
+                            </li>
+                            {% endfor %}
+                        </ul>
+                    </ak-dropdown>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Flows' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for stage in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ stage.name }}</div>
+                            <small>{{ stage|verbose_name }}</small>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <ul>
+                            {% for flow in stage.flow_set.all %}
+                            <li>{{ flow.slug }}<</li>
+                            {% empty %}
+                            <li>-</li>
+                            {% endfor %}
+                        </ul>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:stage-update' pk=stage.stage_uuid %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:stage-delete' pk=stage.stage_uuid %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% get_links stage as links %}
+                        {% for name, href in links.items %}
+                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
+                        {% endfor %}
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-plugged pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Stages.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any stages." %}
+                {% else %}
+                    {% trans 'Currently no stages exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-dropdown class="pf-c-dropdown">
+                    <button class="pf-m-primary pf-c-dropdown__toggle" type="button">
+                        <span class="pf-c-dropdown__toggle-text">{% trans 'Create' %}</span>
+                        <i class="fas fa-caret-down pf-c-dropdown__toggle-icon" aria-hidden="true"></i>
+                    </button>
+                    <ul class="pf-c-dropdown__menu" hidden>
+                        {% for type, name in types.items %}
+                        <li>
+                            <ak-modal-button href="{% url 'authentik_admin:stage-create' %}?type={{ type }}">
+                                <button slot="trigger" class="pf-c-dropdown__menu-item">
+                                    {{ name|verbose_name }}<br>
+                                    <small>
+                                        {{ name|doc }}
+                                    </small>
+                                </button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </li>
+                        {% endfor %}
+                    </ul>
+                </ak-dropdown>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/stage_binding/list.html

@@ -0,0 +1,125 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-infrastructure"></i>
+            {% trans 'Stage Bindings' %}
+        </h1>
+        <p>{% trans "Bind existing Stages to Flows." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:stage-binding-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Order' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Stage Type' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% regroup object_list by target as grouped_bindings %}
+                {% for flow in grouped_bindings %}
+                    <tr role="role">
+                        <td>
+                            {% blocktrans with slug=flow.grouper.slug %}
+                            Flow {{ slug }}
+                            {% endblocktrans %}
+                        </td>
+                        <td></td>
+                        <td></td>
+                        <td></td>
+                    </tr>
+                    {% for binding in flow.list %}
+                    <tr class="pf-c-table__expandable-row pf-m-expanded" role="row">
+                        <td role="cell">
+                            <span>
+                                {{ binding.order }}
+                            </span>
+                        </td>
+                        <th role="columnheader">
+                            <div>
+                                <div>{{ binding.target.slug }}</div>
+                                <small>
+                                    {{ binding.target.name }}
+                                </small>
+                            </div>
+                        </th>
+                        <td role="cell">
+                            <div>
+                                <div>
+                                    {{ binding.stage.name }}
+                                </div>
+                                <small>
+                                    {{ binding.stage }}
+                                </small>
+                            </div>
+                        </td>
+                        <td>
+                            <ak-modal-button href="{% url 'authentik_admin:stage-binding-update' pk=binding.pk %}">
+                                <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                    {% trans 'Update' %}
+                                </ak-spinner-button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                            <ak-modal-button href="{% url 'authentik_admin:stage-binding-delete' pk=binding.pk %}">
+                                <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                    {% trans 'Delete' %}
+                                </ak-spinner-button>
+                                <div slot="modal"></div>
+                            </ak-modal-button>
+                        </td>
+                    </tr>
+                    {% endfor %}
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Flow-Stage Bindings.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans 'Currently no flow-stage bindings exist. Click the button below to create one.' %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:stage-binding-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/stage_invitation/list.html

@@ -0,0 +1,109 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-migration"></i>
+            {% trans 'Invitations' %}
+        </h1>
+        <p>{% trans "Create Invitation Links to enroll Users, and optionally force specific attributes of their account." %}
+        </p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:stage-invitation-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'ID' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Created by' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expiry' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for invitation in object_list %}
+                <tr role="row">
+                    <td role="cell">
+                        <span>
+                            {{ invitation.invite_uuid }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ invitation.created_by }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ invitation.expiry|default:"-" }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:stage-invitation-delete' pk=invitation.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-migration pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Invitations.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any invitations." %}
+                {% else %}
+                    {% trans 'Currently no invitations exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:stage-invitation-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/stage_prompt/list.html

@@ -0,0 +1,130 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+{% load admin_reflection %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-plugged"></i>
+            {% trans 'Prompts' %}
+        </h1>
+        <p>{% trans "Single Prompts that can be used for Prompt Stages." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:stage-prompt-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Field' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Label' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Type' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Order' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Flows' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for prompt in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ prompt.field_key }}</div>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <div>
+                            {{ prompt.label }}
+                        </div>
+                    </td>
+                    <td role="cell">
+                        <div>
+                            {{ prompt.type }}
+                        </div>
+                    </td>
+                    <td role="cell">
+                        <div>
+                            {{ prompt.order }}
+                        </div>
+                    </td>
+                    <td role="cell">
+                        <ul>
+                            {% for flow in prompt.flow_set.all %}
+                            <li>{{ flow.slug }}</li>
+                            {% empty %}
+                            <li>-</li>
+                            {% endfor %}
+                        </ul>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:stage-prompt-update' pk=prompt.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Update' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-modal-button href="{% url 'authentik_admin:stage-prompt-delete' pk=prompt.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% get_links prompt as links %}
+                        {% for name, href in links.items %}
+                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{{ href }}?back={{ request.get_full_path }}">{% trans name %}</a>
+                        {% endfor %}
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-plugged pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Stage Prompts.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any stage prompts." %}
+                {% else %}
+                    {% trans 'Currently no stage prompts exist. Click the button below to create one.' %}
+                {% endif %}
+                </div>
+                <a href="{% url 'authentik_admin:stage-prompt-create' %}?back={{ request.get_full_path }}" class="pf-c-button pf-m-primary" type="button">{% trans 'Create' %}</a>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/task/list.html

@@ -0,0 +1,84 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load humanize %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-automation"></i>
+            {% trans 'System Tasks' %}
+        </h1>
+        <p>{% trans "Long-running operations which authentik executes in the background." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                    {% trans 'Refresh' %}
+                </button>
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Identifier' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Description' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Last Run' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Status' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Messages' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for task in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <pre>{{ task.task_name }}</pre>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ task.task_description }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ task.finish_timestamp|naturaltime }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {% if task.result.status == task_successful %}
+                            <i class="fas fa-check pf-m-success"></i> {% trans 'Successful' %}
+                            {% elif task.result.status == task_warning %}
+                            <i class="fas fa-exclamation-triangle pf-m-warning"></i> {% trans 'Warning' %}
+                            {% elif task.result.status == task_error %}
+                            <i class="fas fa-times pf-m-danger"></i> {% trans 'Error' %}
+                            {% else %}
+                            <i class="fas fa-question-circle"></i> {% trans 'Unknown' %}
+                            {% endif %}
+                        </span>
+                    </td>
+                    <td>
+                        {% for message in task.result.messages %}
+                        <div>
+                            {{ message }}
+                        </div>
+                        {% endfor %}
+                    </td>
+                    <td>
+                        <ak-action-button url="{% url 'authentik_api:admin_system_tasks-retry' pk=task.task_name %}">
+                            {% trans 'Retry Task' %}
+                        </ak-action-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/token/list.html

@@ -0,0 +1,102 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-security"></i>
+            {% trans 'Tokens' %}
+        </h1>
+        <p>{% trans "Tokens are used throughout authentik for Email validation stages, Recovery keys and API access." %}</p>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Identifier' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'User' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expires?' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Expiry Date' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for token in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>{{ token.identifier }}</div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ token.user }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ token.expiring|yesno:"Yes,No" }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {% if not token.expiring %}
+                            -
+                            {% else %}
+                            {{ token.expires }}
+                            {% endif %}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:token-delete' pk=token.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-danger">
+                                {% trans 'Delete' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        <ak-token-copy-button identifier="{{ token.identifier }}">
+                            {% trans 'Copy token' %}
+                        </ak-token-copy-button>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-key pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Tokens.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any token." %}
+                {% else %}
+                    {% trans 'Currently no tokens exist.' %}
+                {% endif %}
+                </div>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/administration/user/list.html

@@ -0,0 +1,125 @@
+{% extends "administration/base.html" %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block content %}
+<section class="pf-c-page__main-section pf-m-light">
+    <div class="pf-c-content">
+        <h1>
+            <i class="pf-icon pf-icon-user"></i>
+            {% trans 'Users' %}
+        </h1>
+    </div>
+</section>
+<section class="pf-c-page__main-section pf-m-no-padding-mobile">
+    <div class="pf-c-card">
+        {% if object_list %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+                <div class="pf-c-toolbar__bulk-select">
+                    <ak-modal-button href="{% url 'authentik_admin:user-create' %}">
+                        <ak-spinner-button slot="trigger" class="pf-m-primary">
+                            {% trans 'Create' %}
+                        </ak-spinner-button>
+                        <div slot="modal"></div>
+                    </ak-modal-button>
+                    <button role="ak-refresh" class="pf-c-button pf-m-primary">
+                        {% trans 'Refresh' %}
+                    </button>
+                </div>
+                {% include 'partials/pagination.html' %}
+            </div>
+        </div>
+        <table class="pf-c-table pf-m-compact pf-m-grid-xl" role="grid">
+            <thead>
+                <tr role="row">
+                    <th role="columnheader" scope="col">{% trans 'Name' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Active' %}</th>
+                    <th role="columnheader" scope="col">{% trans 'Last Login' %}</th>
+                    <th role="cell"></th>
+                </tr>
+            </thead>
+            <tbody role="rowgroup">
+                {% for user in object_list %}
+                <tr role="row">
+                    <th role="columnheader">
+                        <div>
+                            <div>{{ user.username }}</div>
+                            <small>{{ user.name }}</small>
+                        </div>
+                    </th>
+                    <td role="cell">
+                        <span>
+                            {{ user.is_active }}
+                        </span>
+                    </td>
+                    <td role="cell">
+                        <span>
+                            {{ user.last_login }}
+                        </span>
+                    </td>
+                    <td>
+                        <ak-modal-button href="{% url 'authentik_admin:user-update' pk=user.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-secondary">
+                                {% trans 'Edit' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% if user.is_active %}
+                        <ak-modal-button href="{% url 'authentik_admin:user-disable' pk=user.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-warning">
+                                {% trans 'Disable' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% else %}
+                        <ak-modal-button href="{% url 'authentik_admin:user-delete' pk=user.pk %}">
+                            <ak-spinner-button slot="trigger" class="pf-m-primary">
+                                {% trans 'Enable' %}
+                            </ak-spinner-button>
+                            <div slot="modal"></div>
+                        </ak-modal-button>
+                        {% endif %}
+                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{% url 'authentik_admin:user-password-reset' pk=user.pk %}?back={{ request.get_full_path }}">{% trans 'Reset Password' %}</a>
+                        <a class="pf-c-button pf-m-tertiary ak-root-link" href="{% url 'authentik_core:impersonate-init' user_id=user.pk %}">{% trans 'Impersonate' %}</a>
+                    </td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        <div class="pf-c-pagination pf-m-bottom">
+            {% include 'partials/pagination.html' %}
+        </div>
+        {% else %}
+        <div class="pf-c-toolbar">
+            <div class="pf-c-toolbar__content">
+                {% include 'partials/toolbar_search.html' %}
+            </div>
+        </div>
+        <div class="pf-c-empty-state">
+            <div class="pf-c-empty-state__content">
+                <i class="pf-icon pf-icon-user pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">
+                    {% trans 'No Users.' %}
+                </h1>
+                <div class="pf-c-empty-state__body">
+                {% if request.GET.search != "" %}
+                    {% trans "Your search query doesn't match any users." %}
+                {% else %}
+                    {% trans 'Currently no users exist. How did you even get here.' %}
+                {% endif %}
+                </div>
+                <ak-modal-button href="{% url 'authentik_admin:user-create' %}">
+                    <ak-spinner-button slot="trigger" class="pf-m-primary">
+                        {% trans 'Create' %}
+                    </ak-spinner-button>
+                    <div slot="modal"></div>
+                </ak-modal-button>
+            </div>
+        </div>
+        {% endif %}
+    </div>
+</section>
+{% endblock %}

authentik/admin/templates/generic/form.html

@@ -27,9 +27,7 @@
     </div>
 </section>
 <footer class="pf-c-modal-box__footer">
-    <ak-spinner-button form="main-form">
-        {% block action %}{% endblock %}
-    </ak-spinner-button>&nbsp;
+    <input class="pf-c-button pf-m-primary" type="submit" form="main-form" value="{% block action %}{% endblock %}" />
     <a class="pf-c-button pf-m-secondary" href="{% back %}">{% trans "Cancel" %}</a>
 </footer>
 {% endblock %}

authentik/admin/templatetags/admin_reflection.py

@@ -0,0 +1,62 @@
+"""authentik admin templatetags"""
+from django import template
+from django.db.models import Model
+from django.utils.html import mark_safe
+from structlog import get_logger
+
+register = template.Library()
+LOGGER = get_logger()
+
+
+@register.simple_tag()
+def get_links(model_instance):
+    """Find all link_ methods on an object instance, run them and return as dict"""
+    prefix = "link_"
+    links = {}
+
+    if not isinstance(model_instance, Model):
+        LOGGER.warning("Model is not instance of Model", model_instance=model_instance)
+        return links
+
+    try:
+        for name in dir(model_instance):
+            if not name.startswith(prefix):
+                continue
+            value = getattr(model_instance, name)
+            if not callable(value):
+                continue
+            human_name = name.replace(prefix, "").replace("_", " ").capitalize()
+            link = value()
+            if link:
+                links[human_name] = link
+    except NotImplementedError:
+        pass
+
+    return links
+
+
+@register.simple_tag(takes_context=True)
+def get_htmls(context, model_instance):
+    """Find all html_ methods on an object instance, run them and return as dict"""
+    prefix = "html_"
+    htmls = []
+
+    if not isinstance(model_instance, Model):
+        LOGGER.warning("Model is not instance of Model", model_instance=model_instance)
+        return htmls
+
+    try:
+        for name in dir(model_instance):
+            if not name.startswith(prefix):
+                continue
+            value = getattr(model_instance, name)
+            if not callable(value):
+                continue
+            if name.startswith(prefix):
+                html = value(context.get("request"))
+                if html:
+                    htmls.append(mark_safe(html))
+    except NotImplementedError:
+        pass
+
+    return htmls

authentik/admin/tests/test_api.py

@@ -1,8 +1,8 @@
 """test admin api"""
 from json import loads
 
+from django.shortcuts import reverse
 from django.test import TestCase
-from django.urls import reverse
 
 from authentik import __version__
 from authentik.core.models import Group, User

authentik/admin/tests/test_generated.py

@@ -3,8 +3,8 @@ from importlib import import_module
 from typing import Callable
 
 from django.forms import ModelForm
+from django.shortcuts import reverse
 from django.test import Client, TestCase
-from django.urls import reverse
 from django.urls.exceptions import NoReverseMatch
 
 from authentik.admin.urls import urlpatterns

authentik/admin/tests/test_tasks.py

@@ -32,8 +32,7 @@ REQUEST_MOCK_VALID = Mock(
     return_value=MockResponse(
         200,
         """{
-            "tag_name": "version/99999999.9999999",
-            "body": "https://goauthentik.io/test"
+            "tag_name": "version/1.2.3"
         }""",
     )
 )
@@ -48,12 +47,10 @@ class TestAdminTasks(TestCase):
     def test_version_valid_response(self):
         """Test Update checker with valid response"""
         update_latest_version.delay().get()
-        self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "1.2.3")
         self.assertTrue(
             Event.objects.filter(
-                action=EventAction.UPDATE_AVAILABLE,
-                context__new_version="99999999.9999999",
-                context__message="Changelog: https://goauthentik.io/test",
+                action=EventAction.UPDATE_AVAILABLE, context__new_version="1.2.3"
             ).exists()
         )
         # test that a consecutive check doesn't create a duplicate event
@@ -61,9 +58,7 @@ class TestAdminTasks(TestCase):
         self.assertEqual(
             len(
                 Event.objects.filter(
-                    action=EventAction.UPDATE_AVAILABLE,
-                    context__new_version="99999999.9999999",
-                    context__message="Changelog: https://goauthentik.io/test",
+                    action=EventAction.UPDATE_AVAILABLE, context__new_version="1.2.3"
                 )
             ),
             1,

authentik/admin/urls.py

@@ -4,8 +4,6 @@ from django.urls import path
 from authentik.admin.views import (
     applications,
     certificate_key_pair,
-    events_notifications_rules,
-    events_notifications_transports,
     flows,
     groups,
     outposts,
@@ -20,10 +18,11 @@ from authentik.admin.views import (
     stages_bindings,
     stages_invitations,
     stages_prompts,
+    tasks,
     tokens,
     users,
 )
-from authentik.providers.saml.views.metadata import MetadataImportView
+from authentik.providers.saml.views import MetadataImportView
 
 urlpatterns = [
     path(
@@ -53,12 +52,14 @@ urlpatterns = [
         name="application-delete",
     ),
     # Tokens
+    path("tokens/", tokens.TokenListView.as_view(), name="tokens"),
     path(
         "tokens/<uuid:pk>/delete/",
         tokens.TokenDeleteView.as_view(),
         name="token-delete",
     ),
     # Sources
+    path("sources/", sources.SourceListView.as_view(), name="sources"),
     path("sources/create/", sources.SourceCreateView.as_view(), name="source-create"),
     path(
         "sources/<uuid:pk>/update/",
@@ -71,6 +72,7 @@ urlpatterns = [
         name="source-delete",
     ),
     # Policies
+    path("policies/", policies.PolicyListView.as_view(), name="policies"),
     path("policies/create/", policies.PolicyCreateView.as_view(), name="policy-create"),
     path(
         "policies/<uuid:pk>/update/",
@@ -88,6 +90,11 @@ urlpatterns = [
         name="policy-test",
     ),
     # Policy bindings
+    path(
+        "policies/bindings/",
+        policies_bindings.PolicyBindingListView.as_view(),
+        name="policies-bindings",
+    ),
     path(
         "policies/bindings/create/",
         policies_bindings.PolicyBindingCreateView.as_view(),
@@ -104,6 +111,7 @@ urlpatterns = [
         name="policy-binding-delete",
     ),
     # Providers
+    path("providers/", providers.ProviderListView.as_view(), name="providers"),
     path(
         "providers/create/",
         providers.ProviderCreateView.as_view(),
@@ -125,6 +133,7 @@ urlpatterns = [
         name="provider-delete",
     ),
     # Stages
+    path("stages/", stages.StageListView.as_view(), name="stages"),
     path("stages/create/", stages.StageCreateView.as_view(), name="stage-create"),
     path(
         "stages/<uuid:pk>/update/",
@@ -137,6 +146,11 @@ urlpatterns = [
         name="stage-delete",
     ),
     # Stage bindings
+    path(
+        "stages/bindings/",
+        stages_bindings.StageBindingListView.as_view(),
+        name="stage-bindings",
+    ),
     path(
         "stages/bindings/create/",
         stages_bindings.StageBindingCreateView.as_view(),
@@ -154,21 +168,31 @@ urlpatterns = [
     ),
     # Stage Prompts
     path(
-        "stages_prompts/create/",
+        "stages/prompts/",
+        stages_prompts.PromptListView.as_view(),
+        name="stage-prompts",
+    ),
+    path(
+        "stages/prompts/create/",
         stages_prompts.PromptCreateView.as_view(),
         name="stage-prompt-create",
     ),
     path(
-        "stages_prompts/<uuid:pk>/update/",
+        "stages/prompts/<uuid:pk>/update/",
         stages_prompts.PromptUpdateView.as_view(),
         name="stage-prompt-update",
     ),
     path(
-        "stages_prompts/<uuid:pk>/delete/",
+        "stages/prompts/<uuid:pk>/delete/",
         stages_prompts.PromptDeleteView.as_view(),
         name="stage-prompt-delete",
     ),
     # Stage Invitations
+    path(
+        "stages/invitations/",
+        stages_invitations.InvitationListView.as_view(),
+        name="stage-invitations",
+    ),
     path(
         "stages/invitations/create/",
         stages_invitations.InvitationCreateView.as_view(),
@@ -180,6 +204,7 @@ urlpatterns = [
         name="stage-invitation-delete",
     ),
     # Flows
+    path("flows/", flows.FlowListView.as_view(), name="flows"),
     path(
         "flows/create/",
         flows.FlowCreateView.as_view(),
@@ -211,6 +236,11 @@ urlpatterns = [
         name="flow-delete",
     ),
     # Property Mappings
+    path(
+        "property-mappings/",
+        property_mappings.PropertyMappingListView.as_view(),
+        name="property-mappings",
+    ),
     path(
         "property-mappings/create/",
         property_mappings.PropertyMappingCreateView.as_view(),
@@ -226,12 +256,8 @@ urlpatterns = [
         property_mappings.PropertyMappingDeleteView.as_view(),
         name="property-mapping-delete",
     ),
-    path(
-        "property-mappings/<uuid:pk>/test/",
-        property_mappings.PropertyMappingTestView.as_view(),
-        name="property-mapping-test",
-    ),
     # Users
+    path("users/", users.UserListView.as_view(), name="users"),
     path("users/create/", users.UserCreateView.as_view(), name="user-create"),
     path("users/<int:pk>/update/", users.UserUpdateView.as_view(), name="user-update"),
     path("users/<int:pk>/delete/", users.UserDeleteView.as_view(), name="user-delete"),
@@ -245,6 +271,7 @@ urlpatterns = [
         name="user-password-reset",
     ),
     # Groups
+    path("groups/", groups.GroupListView.as_view(), name="groups"),
     path("groups/create/", groups.GroupCreateView.as_view(), name="group-create"),
     path(
         "groups/<uuid:pk>/update/",
@@ -257,16 +284,16 @@ urlpatterns = [
         name="group-delete",
     ),
     # Certificate-Key Pairs
+    path(
+        "crypto/certificates/",
+        certificate_key_pair.CertificateKeyPairListView.as_view(),
+        name="certificate_key_pair",
+    ),
     path(
         "crypto/certificates/create/",
         certificate_key_pair.CertificateKeyPairCreateView.as_view(),
         name="certificatekeypair-create",
     ),
-    path(
-        "crypto/certificates/generate/",
-        certificate_key_pair.CertificateKeyPairGenerateView.as_view(),
-        name="certificatekeypair-generate",
-    ),
     path(
         "crypto/certificates/<uuid:pk>/update/",
         certificate_key_pair.CertificateKeyPairUpdateView.as_view(),
@@ -278,6 +305,11 @@ urlpatterns = [
         name="certificatekeypair-delete",
     ),
     # Outposts
+    path(
+        "outposts/",
+        outposts.OutpostListView.as_view(),
+        name="outposts",
+    ),
     path(
         "outposts/create/",
         outposts.OutpostCreateView.as_view(),
@@ -295,50 +327,29 @@ urlpatterns = [
     ),
     # Outpost Service Connections
     path(
-        "outpost_service_connections/create/",
+        "outposts/service_connections/",
+        outposts_service_connections.OutpostServiceConnectionListView.as_view(),
+        name="outpost-service-connections",
+    ),
+    path(
+        "outposts/service_connections/create/",
         outposts_service_connections.OutpostServiceConnectionCreateView.as_view(),
         name="outpost-service-connection-create",
     ),
     path(
-        "outpost_service_connections/<uuid:pk>/update/",
+        "outposts/service_connections/<uuid:pk>/update/",
         outposts_service_connections.OutpostServiceConnectionUpdateView.as_view(),
         name="outpost-service-connection-update",
     ),
     path(
-        "outpost_service_connections/<uuid:pk>/delete/",
+        "outposts/service_connections/<uuid:pk>/delete/",
         outposts_service_connections.OutpostServiceConnectionDeleteView.as_view(),
         name="outpost-service-connection-delete",
     ),
-    # Event Notification Transpots
+    # Tasks
     path(
-        "events/transports/create/",
-        events_notifications_transports.NotificationTransportCreateView.as_view(),
-        name="notification-transport-create",
-    ),
-    path(
-        "events/transports/<uuid:pk>/update/",
-        events_notifications_transports.NotificationTransportUpdateView.as_view(),
-        name="notification-transport-update",
-    ),
-    path(
-        "events/transports/<uuid:pk>/delete/",
-        events_notifications_transports.NotificationTransportDeleteView.as_view(),
-        name="notification-transport-delete",
-    ),
-    # Event Notification Rules
-    path(
-        "events/rules/create/",
-        events_notifications_rules.NotificationRuleCreateView.as_view(),
-        name="notification-rule-create",
-    ),
-    path(
-        "events/rules/<uuid:pk>/update/",
-        events_notifications_rules.NotificationRuleUpdateView.as_view(),
-        name="notification-rule-update",
-    ),
-    path(
-        "events/rules/<uuid:pk>/delete/",
-        events_notifications_rules.NotificationRuleDeleteView.as_view(),
-        name="notification-rule-delete",
+        "tasks/",
+        tasks.TaskListView.as_view(),
+        name="tasks",
     ),
 ]

authentik/admin/views/applications.py

@@ -1,17 +1,15 @@
 """authentik Application administration"""
-from typing import Any
-
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.generic import UpdateView
 from guardian.mixins import PermissionRequiredMixin
-from guardian.shortcuts import get_objects_for_user
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import BackSuccessUrlMixin, DeleteMessageView
 from authentik.core.forms.applications import ApplicationForm
 from authentik.core.models import Application
 from authentik.lib.views import CreateAssignPermView
@@ -19,6 +17,7 @@ from authentik.lib.views import CreateAssignPermView
 
 class ApplicationCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -29,29 +28,14 @@ class ApplicationCreateView(
     form_class = ApplicationForm
     permission_required = "authentik_core.add_application"
 
-    success_url = "/"
     template_name = "generic/create.html"
+    success_url = reverse_lazy("authentik_admin:applications")
     success_message = _("Successfully created Application")
 
-    def get_initial(self) -> dict[str, Any]:
-        if "provider" in self.request.GET:
-            try:
-                initial_provider_pk = int(self.request.GET["provider"])
-            except ValueError:
-                return super().get_initial()
-            providers = (
-                get_objects_for_user(self.request.user, "authentik_core.view_provider")
-                .filter(pk=initial_provider_pk)
-                .select_subclasses()
-            )
-            if not providers.exists():
-                return {}
-            return {"provider": providers.first()}
-        return super().get_initial()
-
 
 class ApplicationUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -62,8 +46,8 @@ class ApplicationUpdateView(
     form_class = ApplicationForm
     permission_required = "authentik_core.change_application"
 
-    success_url = "/"
     template_name = "generic/update.html"
+    success_url = reverse_lazy("authentik_admin:applications")
     success_message = _("Successfully updated Application")
 
 
@@ -75,6 +59,6 @@ class ApplicationDeleteView(
     model = Application
     permission_required = "authentik_core.delete_application"
 
-    success_url = "/"
     template_name = "generic/delete.html"
+    success_url = reverse_lazy("authentik_admin:applications")
     success_message = _("Successfully deleted Application")

authentik/admin/views/certificate_key_pair.py

@@ -4,25 +4,42 @@ from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http.response import HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from django.views.generic.edit import FormView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
-from authentik.crypto.builder import CertificateBuilder
-from authentik.crypto.forms import (
-    CertificateKeyPairForm,
-    CertificateKeyPairGenerateForm,
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
+from authentik.crypto.forms import CertificateKeyPairForm
 from authentik.crypto.models import CertificateKeyPair
 from authentik.lib.views import CreateAssignPermView
 
 
+class CertificateKeyPairListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all keypairs"""
+
+    model = CertificateKeyPair
+    permission_required = "authentik_crypto.view_certificatekeypair"
+    ordering = "name"
+    template_name = "administration/certificatekeypair/list.html"
+
+    search_fields = ["name"]
+
+
 class CertificateKeyPairCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -34,39 +51,13 @@ class CertificateKeyPairCreateView(
     permission_required = "authentik_crypto.add_certificatekeypair"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
-    success_message = _("Successfully created Certificate-Key Pair")
-
-
-class CertificateKeyPairGenerateView(
-    SuccessMessageMixin,
-    LoginRequiredMixin,
-    DjangoPermissionRequiredMixin,
-    FormView,
-):
-    """Generate new CertificateKeyPair"""
-
-    model = CertificateKeyPair
-    form_class = CertificateKeyPairGenerateForm
-    permission_required = "authentik_crypto.add_certificatekeypair"
-
-    template_name = "administration/certificatekeypair/generate.html"
-    success_url = reverse_lazy("authentik_core:shell")
-    success_message = _("Successfully generated Certificate-Key Pair")
-
-    def form_valid(self, form: CertificateKeyPairGenerateForm) -> HttpResponse:
-        builder = CertificateBuilder()
-        builder.common_name = form.data["common_name"]
-        builder.build(
-            subject_alt_names=form.data.get("subject_alt_name", "").split(","),
-            validity_days=int(form.data["validity_days"]),
-        )
-        builder.save()
-        return super().form_valid(form)
+    success_url = reverse_lazy("authentik_admin:certificate_key_pair")
+    success_message = _("Successfully created CertificateKeyPair")
 
 
 class CertificateKeyPairUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -78,7 +69,7 @@ class CertificateKeyPairUpdateView(
     permission_required = "authentik_crypto.change_certificatekeypair"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:certificate_key_pair")
     success_message = _("Successfully updated Certificate-Key Pair")
 
 
@@ -91,5 +82,5 @@ class CertificateKeyPairDeleteView(
     permission_required = "authentik_crypto.delete_certificatekeypair"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:certificate_key_pair")
     success_message = _("Successfully deleted Certificate-Key Pair")

authentik/admin/views/events_notifications_rules.py

@@ -1,61 +0,0 @@
-"""authentik NotificationRule administration"""
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.contrib.auth.mixins import (
-    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
-)
-from django.contrib.messages.views import SuccessMessageMixin
-from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
-
-from authentik.admin.views.utils import DeleteMessageView
-from authentik.events.forms import NotificationRuleForm
-from authentik.events.models import NotificationRule
-from authentik.lib.views import CreateAssignPermView
-
-
-class NotificationRuleCreateView(
-    SuccessMessageMixin,
-    LoginRequiredMixin,
-    DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
-):
-    """Create new NotificationRule"""
-
-    model = NotificationRule
-    form_class = NotificationRuleForm
-    permission_required = "authentik_events.add_NotificationRule"
-
-    success_url = "/"
-    template_name = "generic/create.html"
-    success_message = _("Successfully created Notification Rule")
-
-
-class NotificationRuleUpdateView(
-    SuccessMessageMixin,
-    LoginRequiredMixin,
-    PermissionRequiredMixin,
-    UpdateView,
-):
-    """Update application"""
-
-    model = NotificationRule
-    form_class = NotificationRuleForm
-    permission_required = "authentik_events.change_NotificationRule"
-
-    success_url = "/"
-    template_name = "generic/update.html"
-    success_message = _("Successfully updated Notification Rule")
-
-
-class NotificationRuleDeleteView(
-    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
-):
-    """Delete application"""
-
-    model = NotificationRule
-    permission_required = "authentik_events.delete_NotificationRule"
-
-    success_url = "/"
-    template_name = "generic/delete.html"
-    success_message = _("Successfully deleted Notification Rule")

authentik/admin/views/events_notifications_transports.py

@@ -1,58 +0,0 @@
-"""authentik NotificationTransport administration"""
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.contrib.auth.mixins import (
-    PermissionRequiredMixin as DjangoPermissionRequiredMixin,
-)
-from django.contrib.messages.views import SuccessMessageMixin
-from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
-
-from authentik.admin.views.utils import DeleteMessageView
-from authentik.events.forms import NotificationTransportForm
-from authentik.events.models import NotificationTransport
-from authentik.lib.views import CreateAssignPermView
-
-
-class NotificationTransportCreateView(
-    SuccessMessageMixin,
-    LoginRequiredMixin,
-    DjangoPermissionRequiredMixin,
-    CreateAssignPermView,
-):
-    """Create new NotificationTransport"""
-
-    model = NotificationTransport
-    form_class = NotificationTransportForm
-    permission_required = "authentik_events.add_notificationtransport"
-    success_url = "/"
-    template_name = "generic/create.html"
-    success_message = _("Successfully created Notification Transport")
-
-
-class NotificationTransportUpdateView(
-    SuccessMessageMixin,
-    LoginRequiredMixin,
-    PermissionRequiredMixin,
-    UpdateView,
-):
-    """Update application"""
-
-    model = NotificationTransport
-    form_class = NotificationTransportForm
-    permission_required = "authentik_events.change_notificationtransport"
-    success_url = "/"
-    template_name = "generic/update.html"
-    success_message = _("Successfully updated Notification Transport")
-
-
-class NotificationTransportDeleteView(
-    LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView
-):
-    """Delete application"""
-
-    model = NotificationTransport
-    permission_required = "authentik_events.delete_notificationtransport"
-    success_url = "/"
-    template_name = "generic/delete.html"
-    success_message = _("Successfully deleted Notification Transport")

authentik/admin/views/flows.py

@@ -8,11 +8,15 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.http import HttpRequest, HttpResponse, JsonResponse
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import DetailView, FormView, UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import DetailView, FormView, ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
-from authentik.flows.exceptions import FlowNonApplicableException
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.flows.forms import FlowForm, FlowImportForm
 from authentik.flows.models import Flow
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
@@ -21,11 +25,28 @@ from authentik.flows.transfer.exporter import FlowExporter
 from authentik.flows.transfer.importer import FlowImporter
 from authentik.flows.views import SESSION_KEY_PLAN, FlowPlanner
 from authentik.lib.utils.urls import redirect_with_qs
-from authentik.lib.views import CreateAssignPermView, bad_request_message
+from authentik.lib.views import CreateAssignPermView
+
+
+class FlowListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all flows"""
+
+    model = Flow
+    permission_required = "authentik_flows.view_flow"
+    ordering = "name"
+    template_name = "administration/flow/list.html"
+    search_fields = ["name", "slug", "designation", "title"]
 
 
 class FlowCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -37,12 +58,13 @@ class FlowCreateView(
     permission_required = "authentik_flows.add_flow"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:flows")
     success_message = _("Successfully created Flow")
 
 
 class FlowUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -54,7 +76,7 @@ class FlowUpdateView(
     permission_required = "authentik_flows.change_flow"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:flows")
     success_message = _("Successfully updated Flow")
 
 
@@ -65,7 +87,7 @@ class FlowDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageV
     permission_required = "authentik_flows.delete_flow"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:flows")
     success_message = _("Successfully deleted Flow")
 
 
@@ -81,17 +103,8 @@ class FlowDebugExecuteView(LoginRequiredMixin, PermissionRequiredMixin, DetailVi
         flow: Flow = self.get_object()
         planner = FlowPlanner(flow)
         planner.use_cache = False
-        try:
-            plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
-            self.request.session[SESSION_KEY_PLAN] = plan
-        except FlowNonApplicableException as exc:
-            return bad_request_message(
-                request,
-                _(
-                    "Flow not applicable to current user/request: %(messages)s"
-                    % {"messages": str(exc)}
-                ),
-            )
+        plan = planner.plan(self.request, {PLAN_CONTEXT_PENDING_USER: request.user})
+        self.request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs(
             "authentik_flows:flow-executor-shell",
             self.request.GET,
@@ -105,7 +118,7 @@ class FlowImportView(LoginRequiredMixin, FormView):
 
     form_class = FlowImportForm
     template_name = "administration/flow/import.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:flows")
 
     def dispatch(self, request, *args, **kwargs):
         if not request.user.is_superuser:

authentik/admin/views/groups.py

@@ -6,17 +6,39 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.core.forms.groups import GroupForm
 from authentik.core.models import Group
 from authentik.lib.views import CreateAssignPermView
 
 
+class GroupListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all groups"""
+
+    model = Group
+    permission_required = "authentik_core.view_group"
+    ordering = "name"
+    template_name = "administration/group/list.html"
+    search_fields = ["name", "attributes"]
+
+
 class GroupCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -28,12 +50,13 @@ class GroupCreateView(
     permission_required = "authentik_core.add_group"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:groups")
     success_message = _("Successfully created Group")
 
 
 class GroupUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -45,7 +68,7 @@ class GroupUpdateView(
     permission_required = "authentik_core.change_group"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:groups")
     success_message = _("Successfully updated Group")
 
 
@@ -56,5 +79,5 @@ class GroupDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessage
     permission_required = "authentik_flows.delete_group"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:groups")
     success_message = _("Successfully deleted Group")

authentik/admin/views/outposts.py

@@ -1,24 +1,47 @@
 """authentik Outpost administration"""
 from dataclasses import asdict
-from typing import Any
+from typing import Any, Dict
 
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.lib.views import CreateAssignPermView
 from authentik.outposts.forms import OutpostForm
 from authentik.outposts.models import Outpost, OutpostConfig
 
 
+class OutpostListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all outposts"""
+
+    model = Outpost
+    permission_required = "authentik_outposts.view_outpost"
+    ordering = "name"
+    template_name = "administration/outpost/list.html"
+    search_fields = ["name", "_config"]
+
+
 class OutpostCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -28,11 +51,12 @@ class OutpostCreateView(
     model = Outpost
     form_class = OutpostForm
     permission_required = "authentik_outposts.add_outpost"
-    success_url = "/"
+
     template_name = "generic/create.html"
+    success_url = reverse_lazy("authentik_admin:outposts")
     success_message = _("Successfully created Outpost")
 
-    def get_initial(self) -> dict[str, Any]:
+    def get_initial(self) -> Dict[str, Any]:
         return {
             "_config": asdict(
                 OutpostConfig(authentik_host=self.request.build_absolute_uri("/"))
@@ -42,6 +66,7 @@ class OutpostCreateView(
 
 class OutpostUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -51,8 +76,9 @@ class OutpostUpdateView(
     model = Outpost
     form_class = OutpostForm
     permission_required = "authentik_outposts.change_outpost"
-    success_url = "/"
+
     template_name = "generic/update.html"
+    success_url = reverse_lazy("authentik_admin:outposts")
     success_message = _("Successfully updated Outpost")
 
 
@@ -61,6 +87,7 @@ class OutpostDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessa
 
     model = Outpost
     permission_required = "authentik_outposts.delete_outpost"
-    success_url = "/"
+
     template_name = "generic/delete.html"
+    success_url = reverse_lazy("authentik_admin:outposts")
     success_message = _("Successfully deleted Outpost")

authentik/admin/views/outposts_service_connections.py

@@ -6,18 +6,39 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.outposts.models import OutpostServiceConnection
 
 
+class OutpostServiceConnectionListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all outpost-service-connections"""
+
+    model = OutpostServiceConnection
+    permission_required = "authentik_outposts.add_outpostserviceconnection"
+    template_name = "administration/outpost_service_connection/list.html"
+    ordering = "pk"
+    search_fields = ["pk", "name"]
+
+
 class OutpostServiceConnectionCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -28,12 +49,13 @@ class OutpostServiceConnectionCreateView(
     permission_required = "authentik_outposts.add_outpostserviceconnection"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
-    success_message = _("Successfully created Outpost Service Connection")
+    success_url = reverse_lazy("authentik_admin:outpost-service-connections")
+    success_message = _("Successfully created OutpostServiceConnection")
 
 
 class OutpostServiceConnectionUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -44,8 +66,8 @@ class OutpostServiceConnectionUpdateView(
     permission_required = "authentik_outposts.change_outpostserviceconnection"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
-    success_message = _("Successfully updated Outpost Service Connection")
+    success_url = reverse_lazy("authentik_admin:outpost-service-connections")
+    success_message = _("Successfully updated OutpostServiceConnection")
 
 
 class OutpostServiceConnectionDeleteView(
@@ -57,5 +79,5 @@ class OutpostServiceConnectionDeleteView(
     permission_required = "authentik_outposts.delete_outpostserviceconnection"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
-    success_message = _("Successfully deleted Outpost Service Connection")
+    success_url = reverse_lazy("authentik_admin:outpost-service-connections")
+    success_message = _("Successfully deleted OutpostServiceConnection")

authentik/admin/views/overview.py

@@ -5,11 +5,10 @@ from django.http.request import HttpRequest
 from django.http.response import HttpResponse
 from django.utils.translation import gettext as _
 from django.views.generic import FormView
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik.admin.forms.overview import FlowCacheClearForm, PolicyCacheClearForm
 from authentik.admin.mixins import AdminRequiredMixin
-from authentik.core.api.applications import user_app_cache_key
 
 LOGGER = get_logger()
 
@@ -18,17 +17,15 @@ class PolicyCacheClearView(AdminRequiredMixin, SuccessMessageMixin, FormView):
     """View to clear Policy cache"""
 
     form_class = PolicyCacheClearForm
-    success_url = "/"
+
     template_name = "generic/form_non_model.html"
+    success_url = "/"
     success_message = _("Successfully cleared Policy cache")
 
     def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         keys = cache.keys("policy_*")
         cache.delete_many(keys)
         LOGGER.debug("Cleared Policy cache", keys=len(keys))
-        # Also delete user application cache
-        keys = cache.keys(user_app_cache_key("*"))
-        cache.delete_many(keys)
         return super().post(request, *args, **kwargs)
 
 
@@ -36,8 +33,9 @@ class FlowCacheClearView(AdminRequiredMixin, SuccessMessageMixin, FormView):
     """View to clear Flow cache"""
 
     form_class = FlowCacheClearForm
-    success_url = "/"
+
     template_name = "generic/form_non_model.html"
+    success_url = "/"
     success_message = _("Successfully cleared Flow cache")
 
     def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:

authentik/admin/views/policies.py

@@ -1,30 +1,53 @@
 """authentik Policy administration"""
-from typing import Any
+from typing import Any, Dict
 
+from django.contrib import messages
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.db.models import QuerySet
 from django.http import HttpResponse
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
 from django.views.generic import FormView
 from django.views.generic.detail import DetailView
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from authentik.admin.forms.policies import PolicyTestForm
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.policies.models import Policy, PolicyBinding
 from authentik.policies.process import PolicyProcess, PolicyRequest
 
 
+class PolicyListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all policies"""
+
+    model = Policy
+    permission_required = "authentik_policies.view_policy"
+    ordering = "name"
+    template_name = "administration/policy/list.html"
+    search_fields = ["name"]
+
+
 class PolicyCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -35,12 +58,13 @@ class PolicyCreateView(
     permission_required = "authentik_policies.add_policy"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies")
     success_message = _("Successfully created Policy")
 
 
 class PolicyUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -51,7 +75,7 @@ class PolicyUpdateView(
     permission_required = "authentik_policies.change_policy"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies")
     success_message = _("Successfully updated Policy")
 
 
@@ -62,7 +86,7 @@ class PolicyDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessag
     permission_required = "authentik_policies.delete_policy"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies")
     success_message = _("Successfully deleted Policy")
 
 
@@ -75,12 +99,12 @@ class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, Fo
     template_name = "administration/policy/test.html"
     object = None
 
-    def get_object(self, queryset=None) -> Policy:
+    def get_object(self, queryset=None) -> QuerySet:
         return (
             Policy.objects.filter(pk=self.kwargs.get("pk")).select_subclasses().first()
         )
 
-    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
         kwargs["policy"] = self.get_object()
         return super().get_context_data(**kwargs)
 
@@ -93,12 +117,13 @@ class PolicyTestView(LoginRequiredMixin, DetailView, PermissionRequiredMixin, Fo
         user = form.cleaned_data.get("user")
 
         p_request = PolicyRequest(user)
-        p_request.debug = True
-        p_request.set_http_request(self.request)
-        p_request.context = form.cleaned_data.get("context", {})
+        p_request.http_request = self.request
+        p_request.context = form.cleaned_data
 
         proc = PolicyProcess(PolicyBinding(policy=policy), p_request, None)
         result = proc.execute()
-        context = self.get_context_data(form=form)
-        context["result"] = result
-        return self.render_to_response(context)
+        if result.passing:
+            messages.success(self.request, _("User successfully passed policy."))
+        else:
+            messages.error(self.request, _("User didn't pass policy."))
+        return self.render_to_response(self.get_context_data(form=form, result=result))

authentik/admin/views/policies_bindings.py

@@ -6,20 +6,55 @@ from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.db.models import Max
+from django.db.models import Max, QuerySet
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
+from guardian.shortcuts import get_objects_for_user
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    UserPaginateListMixin,
+)
 from authentik.lib.views import CreateAssignPermView
 from authentik.policies.forms import PolicyBindingForm
 from authentik.policies.models import PolicyBinding, PolicyBindingModel
 
 
+class PolicyBindingListView(
+    LoginRequiredMixin, PermissionListMixin, UserPaginateListMixin, ListView
+):
+    """Show list of all policies"""
+
+    model = PolicyBinding
+    permission_required = "authentik_policies.view_policybinding"
+    ordering = ["order", "target"]
+    template_name = "administration/policy_binding/list.html"
+
+    def get_queryset(self) -> QuerySet:
+        # Since `select_subclasses` does not work with a foreign key, we have to do two queries here
+        # First, get all pbm objects that have bindings attached
+        objects = (
+            get_objects_for_user(
+                self.request.user, "authentik_policies.view_policybindingmodel"
+            )
+            .filter(policies__isnull=False)
+            .select_subclasses()
+            .select_related()
+            .order_by("pk")
+        )
+        for pbm in objects:
+            pbm.bindings = get_objects_for_user(
+                self.request.user, self.permission_required
+            ).filter(target__pk=pbm.pbm_uuid)
+        return objects
+
+
 class PolicyBindingCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -31,7 +66,7 @@ class PolicyBindingCreateView(
     form_class = PolicyBindingForm
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies-bindings")
     success_message = _("Successfully created PolicyBinding")
 
     def get_initial(self) -> dict[str, Any]:
@@ -53,6 +88,7 @@ class PolicyBindingCreateView(
 
 class PolicyBindingUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -64,7 +100,7 @@ class PolicyBindingUpdateView(
     form_class = PolicyBindingForm
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies-bindings")
     success_message = _("Successfully updated PolicyBinding")
 
 
@@ -77,5 +113,5 @@ class PolicyBindingDeleteView(
     permission_required = "authentik_policies.delete_policybinding"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:policies-bindings")
     success_message = _("Successfully deleted PolicyBinding")

authentik/admin/views/property_mappings.py

@@ -1,29 +1,44 @@
 """authentik PropertyMapping administration"""
-from json import dumps
-from typing import Any
-
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
-from django.http import HttpResponse
+from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import FormView
-from django.views.generic.detail import DetailView
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.forms.policies import PolicyTestForm
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.core.models import PropertyMapping
 
 
+class PropertyMappingListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all property_mappings"""
+
+    model = PropertyMapping
+    permission_required = "authentik_core.view_propertymapping"
+    template_name = "administration/property_mapping/list.html"
+    ordering = "name"
+    search_fields = ["name", "expression"]
+
+
 class PropertyMappingCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -32,13 +47,15 @@ class PropertyMappingCreateView(
 
     model = PropertyMapping
     permission_required = "authentik_core.add_propertymapping"
-    success_url = "/"
+
     template_name = "generic/create.html"
+    success_url = reverse_lazy("authentik_admin:property-mappings")
     success_message = _("Successfully created Property Mapping")
 
 
 class PropertyMappingUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -47,8 +64,9 @@ class PropertyMappingUpdateView(
 
     model = PropertyMapping
     permission_required = "authentik_core.change_propertymapping"
-    success_url = "/"
+
     template_name = "generic/update.html"
+    success_url = reverse_lazy("authentik_admin:property-mappings")
     success_message = _("Successfully updated Property Mapping")
 
 
@@ -59,47 +77,7 @@ class PropertyMappingDeleteView(
 
     model = PropertyMapping
     permission_required = "authentik_core.delete_propertymapping"
-    success_url = "/"
+
     template_name = "generic/delete.html"
+    success_url = reverse_lazy("authentik_admin:property-mappings")
     success_message = _("Successfully deleted Property Mapping")
-
-
-class PropertyMappingTestView(
-    LoginRequiredMixin, DetailView, PermissionRequiredMixin, FormView
-):
-    """View to test property mappings"""
-
-    model = PropertyMapping
-    form_class = PolicyTestForm
-    permission_required = "authentik_core.view_propertymapping"
-    template_name = "administration/property_mapping/test.html"
-    object = None
-
-    def get_object(self, queryset=None) -> PropertyMapping:
-        return (
-            PropertyMapping.objects.filter(pk=self.kwargs.get("pk"))
-            .select_subclasses()
-            .first()
-        )
-
-    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
-        kwargs["property_mapping"] = self.get_object()
-        return super().get_context_data(**kwargs)
-
-    def post(self, *args, **kwargs) -> HttpResponse:
-        self.object = self.get_object()
-        return super().post(*args, **kwargs)
-
-    def form_valid(self, form: PolicyTestForm) -> HttpResponse:
-        mapping = self.get_object()
-        user = form.cleaned_data.get("user")
-
-        context = self.get_context_data(form=form)
-        try:
-            result = mapping.evaluate(
-                user, self.request, **form.cleaned_data.get("context", {})
-            )
-            context["result"] = dumps(result, indent=4)
-        except Exception as exc:  # pylint: disable=broad-except
-            context["result"] = str(exc)
-        return self.render_to_response(context)

authentik/admin/views/providers.py

@@ -4,19 +4,41 @@ from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.core.models import Provider
 
 
+class ProviderListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all providers"""
+
+    model = Provider
+    permission_required = "authentik_core.add_provider"
+    template_name = "administration/provider/list.html"
+    ordering = "pk"
+    search_fields = ["pk", "name"]
+
+
 class ProviderCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -25,13 +47,15 @@ class ProviderCreateView(
 
     model = Provider
     permission_required = "authentik_core.add_provider"
-    success_url = "/"
+
     template_name = "generic/create.html"
+    success_url = reverse_lazy("authentik_admin:providers")
     success_message = _("Successfully created Provider")
 
 
 class ProviderUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -40,8 +64,9 @@ class ProviderUpdateView(
 
     model = Provider
     permission_required = "authentik_core.change_provider"
-    success_url = "/"
+
     template_name = "generic/update.html"
+    success_url = reverse_lazy("authentik_admin:providers")
     success_message = _("Successfully updated Provider")
 
 
@@ -52,6 +77,7 @@ class ProviderDeleteView(
 
     model = Provider
     permission_required = "authentik_core.delete_provider"
-    success_url = "/"
+
     template_name = "generic/delete.html"
+    success_url = reverse_lazy("authentik_admin:providers")
     success_message = _("Successfully deleted Provider")

authentik/admin/views/sources.py

@@ -4,19 +4,41 @@ from django.contrib.auth.mixins import (
     PermissionRequiredMixin as DjangoPermissionRequiredMixin,
 )
 from django.contrib.messages.views import SuccessMessageMixin
+from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.core.models import Source
 
 
+class SourceListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all sources"""
+
+    model = Source
+    permission_required = "authentik_core.view_source"
+    ordering = "name"
+    template_name = "administration/source/list.html"
+    search_fields = ["name", "slug"]
+
+
 class SourceCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -26,13 +48,14 @@ class SourceCreateView(
     model = Source
     permission_required = "authentik_core.add_source"
 
-    success_url = "/"
     template_name = "generic/create.html"
+    success_url = reverse_lazy("authentik_admin:sources")
     success_message = _("Successfully created Source")
 
 
 class SourceUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -42,8 +65,8 @@ class SourceUpdateView(
     model = Source
     permission_required = "authentik_core.change_source"
 
-    success_url = "/"
     template_name = "generic/update.html"
+    success_url = reverse_lazy("authentik_admin:sources")
     success_message = _("Successfully updated Source")
 
 
@@ -53,6 +76,6 @@ class SourceDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessag
     model = Source
     permission_required = "authentik_core.delete_source"
 
-    success_url = "/"
     template_name = "generic/delete.html"
+    success_url = reverse_lazy("authentik_admin:sources")
     success_message = _("Successfully deleted Source")

authentik/admin/views/stages.py

@@ -6,18 +6,39 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
 from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
     DeleteMessageView,
     InheritanceCreateView,
+    InheritanceListView,
     InheritanceUpdateView,
+    SearchListMixin,
+    UserPaginateListMixin,
 )
 from authentik.flows.models import Stage
 
 
+class StageListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    InheritanceListView,
+):
+    """Show list of all stages"""
+
+    model = Stage
+    template_name = "administration/stage/list.html"
+    permission_required = "authentik_flows.view_stage"
+    ordering = "name"
+    search_fields = ["name"]
+
+
 class StageCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     InheritanceCreateView,
@@ -28,12 +49,13 @@ class StageCreateView(
     template_name = "generic/create.html"
     permission_required = "authentik_flows.add_stage"
 
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stages")
     success_message = _("Successfully created Stage")
 
 
 class StageUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     InheritanceUpdateView,
@@ -43,7 +65,7 @@ class StageUpdateView(
     model = Stage
     permission_required = "authentik_flows.update_application"
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stages")
     success_message = _("Successfully updated Stage")
 
 
@@ -53,5 +75,5 @@ class StageDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessage
     model = Stage
     template_name = "generic/delete.html"
     permission_required = "authentik_flows.delete_stage"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stages")
     success_message = _("Successfully deleted Stage")

authentik/admin/views/stages_bindings.py

@@ -9,17 +9,33 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.db.models import Max
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    UserPaginateListMixin,
+)
 from authentik.flows.forms import FlowStageBindingForm
 from authentik.flows.models import Flow, FlowStageBinding
 from authentik.lib.views import CreateAssignPermView
 
 
+class StageBindingListView(
+    LoginRequiredMixin, PermissionListMixin, UserPaginateListMixin, ListView
+):
+    """Show list of all flows"""
+
+    model = FlowStageBinding
+    permission_required = "authentik_flows.view_flowstagebinding"
+    ordering = ["target", "order"]
+    template_name = "administration/stage_binding/list.html"
+
+
 class StageBindingCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -31,7 +47,7 @@ class StageBindingCreateView(
     form_class = FlowStageBindingForm
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-bindings")
     success_message = _("Successfully created StageBinding")
 
     def get_initial(self) -> dict[str, Any]:
@@ -51,6 +67,7 @@ class StageBindingCreateView(
 
 class StageBindingUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -62,7 +79,7 @@ class StageBindingUpdateView(
     form_class = FlowStageBindingForm
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-bindings")
     success_message = _("Successfully updated StageBinding")
 
 
@@ -75,5 +92,5 @@ class StageBindingDeleteView(
     permission_required = "authentik_flows.delete_flowstagebinding"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-bindings")
     success_message = _("Successfully deleted FlowStageBinding")

authentik/admin/views/stages_invitations.py

@@ -7,16 +7,39 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.http import HttpResponseRedirect
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.lib.views import CreateAssignPermView
 from authentik.stages.invitation.forms import InvitationForm
 from authentik.stages.invitation.models import Invitation
 
 
+class InvitationListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all invitations"""
+
+    model = Invitation
+    permission_required = "authentik_stages_invitation.view_invitation"
+    template_name = "administration/stage_invitation/list.html"
+    ordering = "-expires"
+    search_fields = ["created_by__username", "expires", "fixed_data"]
+
+
 class InvitationCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -28,7 +51,7 @@ class InvitationCreateView(
     permission_required = "authentik_stages_invitation.add_invitation"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-invitations")
     success_message = _("Successfully created Invitation")
 
     def form_valid(self, form):
@@ -47,5 +70,5 @@ class InvitationDeleteView(
     permission_required = "authentik_stages_invitation.delete_invitation"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-invitations")
     success_message = _("Successfully deleted Invitation")

authentik/admin/views/stages_prompts.py

@@ -6,17 +6,44 @@ from django.contrib.auth.mixins import (
 from django.contrib.messages.views import SuccessMessageMixin
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from django.views.generic import UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView, UpdateView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.lib.views import CreateAssignPermView
 from authentik.stages.prompt.forms import PromptAdminForm
 from authentik.stages.prompt.models import Prompt
 
 
+class PromptListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all prompts"""
+
+    model = Prompt
+    permission_required = "authentik_stages_prompt.view_prompt"
+    ordering = "order"
+    template_name = "administration/stage_prompt/list.html"
+    search_fields = [
+        "field_key",
+        "label",
+        "type",
+        "placeholder",
+    ]
+
+
 class PromptCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -28,12 +55,13 @@ class PromptCreateView(
     permission_required = "authentik_stages_prompt.add_prompt"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-prompts")
     success_message = _("Successfully created Prompt")
 
 
 class PromptUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -45,7 +73,7 @@ class PromptUpdateView(
     permission_required = "authentik_stages_prompt.change_prompt"
 
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-prompts")
     success_message = _("Successfully updated Prompt")
 
 
@@ -56,5 +84,5 @@ class PromptDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessag
     permission_required = "authentik_stages_prompt.delete_prompt"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:stage-prompts")
     success_message = _("Successfully deleted Prompt")

authentik/admin/views/tasks.py

@@ -0,0 +1,23 @@
+"""authentik Tasks List"""
+from typing import Any, Dict
+
+from django.views.generic.base import TemplateView
+
+from authentik.admin.mixins import AdminRequiredMixin
+from authentik.lib.tasks import TaskInfo, TaskResultStatus
+
+
+class TaskListView(AdminRequiredMixin, TemplateView):
+    """Show list of all background tasks"""
+
+    template_name = "administration/task/list.html"
+
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
+        kwargs = super().get_context_data(**kwargs)
+        kwargs["object_list"] = sorted(
+            TaskInfo.all().values(), key=lambda x: x.task_name
+        )
+        kwargs["task_successful"] = TaskResultStatus.SUCCESSFUL
+        kwargs["task_warning"] = TaskResultStatus.WARNING
+        kwargs["task_error"] = TaskResultStatus.ERROR
+        return kwargs

authentik/admin/views/tokens.py

@@ -2,12 +2,38 @@
 from django.contrib.auth.mixins import LoginRequiredMixin
 from django.urls import reverse_lazy
 from django.utils.translation import gettext as _
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import ListView
+from guardian.mixins import PermissionListMixin, PermissionRequiredMixin
 
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.core.models import Token
 
 
+class TokenListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all tokens"""
+
+    model = Token
+    permission_required = "authentik_core.view_token"
+    ordering = "expires"
+    template_name = "administration/token/list.html"
+    search_fields = [
+        "identifier",
+        "intent",
+        "user__username",
+        "description",
+    ]
+
+
 class TokenDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
     """Delete token"""
 
@@ -15,5 +41,5 @@ class TokenDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessage
     permission_required = "authentik_core.delete_token"
 
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:tokens")
     success_message = _("Successfully deleted Token")

authentik/admin/views/users.py

@@ -8,20 +8,49 @@ from django.contrib.messages.views import SuccessMessageMixin
 from django.http import HttpRequest, HttpResponse
 from django.http.response import HttpResponseRedirect
 from django.shortcuts import redirect
-from django.urls import reverse_lazy
+from django.urls import reverse, reverse_lazy
 from django.utils.http import urlencode
 from django.utils.translation import gettext as _
-from django.views.generic import DetailView, UpdateView
-from guardian.mixins import PermissionRequiredMixin
+from django.views.generic import DetailView, ListView, UpdateView
+from guardian.mixins import (
+    PermissionListMixin,
+    PermissionRequiredMixin,
+    get_anonymous_user,
+)
 
 from authentik.admin.forms.users import UserForm
-from authentik.admin.views.utils import DeleteMessageView
+from authentik.admin.views.utils import (
+    BackSuccessUrlMixin,
+    DeleteMessageView,
+    SearchListMixin,
+    UserPaginateListMixin,
+)
 from authentik.core.models import Token, User
 from authentik.lib.views import CreateAssignPermView
 
 
+class UserListView(
+    LoginRequiredMixin,
+    PermissionListMixin,
+    UserPaginateListMixin,
+    SearchListMixin,
+    ListView,
+):
+    """Show list of all users"""
+
+    model = User
+    permission_required = "authentik_core.view_user"
+    ordering = "username"
+    template_name = "administration/user/list.html"
+    search_fields = ["username", "name", "attributes"]
+
+    def get_queryset(self):
+        return super().get_queryset().exclude(pk=get_anonymous_user().pk)
+
+
 class UserCreateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     DjangoPermissionRequiredMixin,
     CreateAssignPermView,
@@ -33,12 +62,13 @@ class UserCreateView(
     permission_required = "authentik_core.add_user"
 
     template_name = "generic/create.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:users")
     success_message = _("Successfully created User")
 
 
 class UserUpdateView(
     SuccessMessageMixin,
+    BackSuccessUrlMixin,
     LoginRequiredMixin,
     PermissionRequiredMixin,
     UpdateView,
@@ -52,7 +82,7 @@ class UserUpdateView(
     # By default the object's name is user which is used by other checks
     context_object_name = "object"
     template_name = "generic/update.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:users")
     success_message = _("Successfully updated User")
 
 
@@ -65,11 +95,13 @@ class UserDeleteView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageV
     # By default the object's name is user which is used by other checks
     context_object_name = "object"
     template_name = "generic/delete.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:users")
     success_message = _("Successfully deleted User")
 
 
-class UserDisableView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessageView):
+class UserDisableView(
+    LoginRequiredMixin, PermissionRequiredMixin, BackSuccessUrlMixin, DeleteMessageView
+):
     """Disable user"""
 
     object: User
@@ -80,7 +112,7 @@ class UserDisableView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessage
     # By default the object's name is user which is used by other checks
     context_object_name = "object"
     template_name = "administration/user/disable.html"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:users")
     success_message = _("Successfully disabled User")
 
     def delete(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
@@ -91,7 +123,9 @@ class UserDisableView(LoginRequiredMixin, PermissionRequiredMixin, DeleteMessage
         return HttpResponseRedirect(success_url)
 
 
-class UserEnableView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
+class UserEnableView(
+    LoginRequiredMixin, PermissionRequiredMixin, BackSuccessUrlMixin, DetailView
+):
     """Enable user"""
 
     object: User
@@ -101,14 +135,15 @@ class UserEnableView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
 
     # By default the object's name is user which is used by other checks
     context_object_name = "object"
-    success_url = reverse_lazy("authentik_core:shell")
+    success_url = reverse_lazy("authentik_admin:users")
     success_message = _("Successfully enabled User")
 
     def get(self, request: HttpRequest, *args, **kwargs):
         self.object: User = self.get_object()
+        success_url = self.get_success_url()
         self.object.is_active = True
         self.object.save()
-        return HttpResponseRedirect(self.success_url)
+        return HttpResponseRedirect(success_url)
 
 
 class UserPasswordResetView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
@@ -125,7 +160,9 @@ class UserPasswordResetView(LoginRequiredMixin, PermissionRequiredMixin, DetailV
         )
         querystring = urlencode({"token": token.key})
         link = request.build_absolute_uri(
-            reverse_lazy("authentik_flows:default-recovery") + f"?{querystring}"
+            reverse("authentik_flows:default-recovery") + f"?{querystring}"
         )
-        messages.success(request, _("Password reset link: %(link)s" % {"link": link}))
-        return redirect("/")
+        messages.success(
+            request, _("Password reset link: <pre>%(link)s</pre>" % {"link": link})
+        )
+        return redirect("authentik_admin:users")

authentik/admin/views/utils.py

@@ -1,11 +1,15 @@
 """authentik admin util views"""
-from typing import Any
+from typing import Any, Dict, List, Optional
+from urllib.parse import urlparse
 
 from django.contrib import messages
 from django.contrib.messages.views import SuccessMessageMixin
+from django.contrib.postgres.search import SearchQuery, SearchVector
+from django.db.models import QuerySet
 from django.http import Http404
-from django.urls import reverse_lazy
-from django.views.generic import DeleteView, UpdateView
+from django.http.request import HttpRequest
+from django.views.generic import DeleteView, ListView, UpdateView
+from django.views.generic.list import MultipleObjectMixin
 
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.lib.views import CreateAssignPermView
@@ -14,13 +18,42 @@ from authentik.lib.views import CreateAssignPermView
 class DeleteMessageView(SuccessMessageMixin, DeleteView):
     """DeleteView which shows `self.success_message` on successful deletion"""
 
-    success_url = reverse_lazy("authentik_core:shell")
-
     def delete(self, request, *args, **kwargs):
         messages.success(self.request, self.success_message)
         return super().delete(request, *args, **kwargs)
 
 
+class InheritanceListView(ListView):
+    """ListView for objects using InheritanceManager"""
+
+    def get_context_data(self, **kwargs):
+        kwargs["types"] = {x.__name__: x for x in all_subclasses(self.model)}
+        return super().get_context_data(**kwargs)
+
+    def get_queryset(self):
+        return super().get_queryset().select_subclasses()
+
+
+class SearchListMixin(MultipleObjectMixin):
+    """Accept search query using `search` querystring parameter. Requires self.search_fields,
+    a list of all fields to search. Can contain special lookups like __icontains"""
+
+    search_fields: List[str]
+
+    def get_queryset(self) -> QuerySet:
+        queryset = super().get_queryset()
+        if "search" in self.request.GET:
+            raw_query = self.request.GET["search"]
+            if raw_query == "":
+                # Empty query, don't search at all
+                return queryset
+            search = SearchQuery(raw_query, search_type="websearch")
+            return queryset.annotate(search=SearchVector(*self.search_fields)).filter(
+                search=search
+            )
+        return queryset
+
+
 class InheritanceCreateView(CreateAssignPermView):
     """CreateView for objects using InheritanceManager"""
 
@@ -34,7 +67,7 @@ class InheritanceCreateView(CreateAssignPermView):
             raise Http404 from exc
         return model().form
 
-    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
         kwargs = super().get_context_data(**kwargs)
         form_cls = self.get_form_class()
         if hasattr(form_cls, "template_name"):
@@ -45,7 +78,7 @@ class InheritanceCreateView(CreateAssignPermView):
 class InheritanceUpdateView(UpdateView):
     """UpdateView for objects using InheritanceManager"""
 
-    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+    def get_context_data(self, **kwargs: Any) -> Dict[str, Any]:
         kwargs = super().get_context_data(**kwargs)
         form_cls = self.get_form_class()
         if hasattr(form_cls, "template_name"):
@@ -61,3 +94,31 @@ class InheritanceUpdateView(UpdateView):
             .select_subclasses()
             .first()
         )
+
+
+class BackSuccessUrlMixin:
+    """Checks if a relative URL has been given as ?back param, and redirect to it. Otherwise
+    default to self.success_url."""
+
+    request: HttpRequest
+
+    success_url: Optional[str]
+
+    def get_success_url(self) -> str:
+        """get_success_url from FormMixin"""
+        back_param = self.request.GET.get("back")
+        if back_param:
+            if not bool(urlparse(back_param).netloc):
+                return back_param
+        return str(self.success_url)
+
+
+class UserPaginateListMixin:
+    """Get paginate_by value from user's attributes, defaulting to 15"""
+
+    request: HttpRequest
+
+    # pylint: disable=unused-argument
+    def get_paginate_by(self, queryset: QuerySet) -> int:
+        """get_paginate_by Function of ListView"""
+        return self.request.user.attributes.get("paginate_by", 15)

authentik/api/auth.py

@@ -1,11 +1,11 @@
 """API Authentication"""
 from base64 import b64decode
 from binascii import Error
-from typing import Any, Optional, Union
+from typing import Any, Optional, Tuple, Union
 
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
 from rest_framework.request import Request
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik.core.models import Token, TokenIntents, User
 
@@ -44,7 +44,7 @@ def token_from_header(raw_header: bytes) -> Optional[Token]:
 class AuthentikTokenAuthentication(BaseAuthentication):
     """Token-based authentication using HTTP Basic authentication"""
 
-    def authenticate(self, request: Request) -> Union[tuple[User, Any], None]:
+    def authenticate(self, request: Request) -> Union[Tuple[User, Any], None]:
         """Token-based authentication using HTTP Basic authentication"""
         auth = get_authorization_header(request)
 

authentik/api/pagination.py

@@ -6,7 +6,6 @@ from rest_framework.response import Response
 class Pagination(pagination.PageNumberPagination):
     """Pagination which includes total pages and current page"""
 
-    page_query_param = "page"
     page_size_query_param = "page_size"
 
     def get_paginated_response(self, data):

authentik/api/pagination_schema.py

@@ -1,97 +0,0 @@
-"""Swagger Pagination Schema class"""
-from typing import OrderedDict
-
-from drf_yasg2 import openapi
-from drf_yasg2.inspectors import PaginatorInspector
-
-
-class PaginationInspector(PaginatorInspector):
-    """Swagger Pagination Schema class"""
-
-    def get_paginated_response(self, paginator, response_schema):
-        """
-        :param BasePagination paginator: the paginator
-        :param openapi.Schema response_schema: the response schema that must be paged.
-        :rtype: openapi.Schema
-        """
-
-        return openapi.Schema(
-            type=openapi.TYPE_OBJECT,
-            properties=OrderedDict(
-                (
-                    (
-                        "pagination",
-                        openapi.Schema(
-                            type=openapi.TYPE_OBJECT,
-                            properties=OrderedDict(
-                                (
-                                    ("next", openapi.Schema(type=openapi.TYPE_NUMBER)),
-                                    (
-                                        "previous",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    ("count", openapi.Schema(type=openapi.TYPE_NUMBER)),
-                                    (
-                                        "current",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "total_pages",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "start_index",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "end_index",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                )
-                            ),
-                            required=[
-                                "next",
-                                "previous",
-                                "count",
-                                "current",
-                                "total_pages",
-                                "start_index",
-                                "end_index",
-                            ],
-                        ),
-                    ),
-                    ("results", response_schema),
-                )
-            ),
-            required=["results", "pagination"],
-        )
-
-    def get_paginator_parameters(self, paginator):
-        """
-        Get the pagination parameters for a single paginator **instance**.
-
-        Should return :data:`.NotHandled` if this inspector
-        does not know how to handle the given `paginator`.
-
-        :param BasePagination paginator: the paginator
-        :rtype: list[openapi.Parameter]
-        """
-
-        return [
-            openapi.Parameter(
-                "page",
-                openapi.IN_QUERY,
-                "Page Index",
-                False,
-                None,
-                openapi.TYPE_INTEGER,
-            ),
-            openapi.Parameter(
-                "page_size",
-                openapi.IN_QUERY,
-                "Page Size",
-                False,
-                None,
-                openapi.TYPE_INTEGER,
-            ),
-        ]

authentik/api/templates/rest_framework/api.html

@@ -1,31 +1,7 @@
 {% extends "rest_framework/base.html" %}
 
-{% block title %}{% if name %}{{ name }} – {% endif %}authentik{% endblock %}
-
 {% block branding %}
 <span class='navbar-brand'>
     authentik
 </span>
 {% endblock %}
-
-{% block style %}
-{{ block.super }}
-<style>
-    body {
-        background-color: #18191a;
-        color: #fafafa;
-    }
-    .prettyprint {
-        background-color: #1c1e21;
-        color: #fafafa;
-        border: 1px solid #2b2e33;
-    }
-    .pln {
-        color: #fafafa;
-    }
-    .well {
-        background-color: #1c1e21;
-        border: 1px solid #2b2e33;
-    }
-</style>
-{% endblock %}

authentik/api/v2/config.py

@@ -1,11 +1,10 @@
 """core Configs API"""
 from django.db.models import Model
 from drf_yasg2.utils import swagger_auto_schema
-from rest_framework.fields import BooleanField, CharField
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import Serializer
+from rest_framework.serializers import ReadOnlyField, Serializer
 from rest_framework.viewsets import ViewSet
 
 from authentik.lib.config import CONFIG
@@ -14,12 +13,12 @@ from authentik.lib.config import CONFIG
 class ConfigSerializer(Serializer):
     """Serialize authentik Config into DRF Object"""
 
-    branding_logo = CharField(read_only=True)
-    branding_title = CharField(read_only=True)
+    branding_logo = ReadOnlyField()
+    branding_title = ReadOnlyField()
 
-    error_reporting_enabled = BooleanField(read_only=True)
-    error_reporting_environment = CharField(read_only=True)
-    error_reporting_send_pii = BooleanField(read_only=True)
+    error_reporting_enabled = ReadOnlyField()
+    error_reporting_environment = ReadOnlyField()
+    error_reporting_send_pii = ReadOnlyField()
 
     def create(self, validated_data: dict) -> Model:
         raise NotImplementedError
@@ -33,7 +32,7 @@ class ConfigsViewSet(ViewSet):
 
     permission_classes = [AllowAny]
 
-    @swagger_auto_schema(responses={200: ConfigSerializer(many=False)})
+    @swagger_auto_schema(responses={200: ConfigSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """Retrive public configuration options"""
         config = ConfigSerializer(

authentik/api/v2/messages.py

@@ -0,0 +1,37 @@
+"""core messages API"""
+from django.contrib.messages import get_messages
+from django.db.models import Model
+from drf_yasg2.utils import swagger_auto_schema
+from rest_framework.permissions import AllowAny
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ReadOnlyField, Serializer
+from rest_framework.viewsets import ViewSet
+
+
+class MessageSerializer(Serializer):
+    """Serialize Django Message into DRF Object"""
+
+    message = ReadOnlyField()
+    level = ReadOnlyField()
+    tags = ReadOnlyField()
+    extra_tags = ReadOnlyField()
+    level_tag = ReadOnlyField()
+
+    def create(self, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+    def update(self, instance: Model, validated_data: dict) -> Model:
+        raise NotImplementedError
+
+
+class MessagesViewSet(ViewSet):
+    """Read-only view set that returns the current session's messages"""
+
+    permission_classes = [AllowAny]
+
+    @swagger_auto_schema(responses={200: MessageSerializer(many=True)})
+    def list(self, request: Request) -> Response:
+        """List current messages and pass into Serializer"""
+        all_messages = list(get_messages(request))
+        return Response(MessageSerializer(all_messages, many=True).data)

authentik/api/v2/urls.py

@@ -10,6 +10,7 @@ from authentik.admin.api.tasks import TaskViewSet
 from authentik.admin.api.version import VersionViewSet
 from authentik.admin.api.workers import WorkerViewSet
 from authentik.api.v2.config import ConfigsViewSet
+from authentik.api.v2.messages import MessagesViewSet
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
@@ -18,33 +19,30 @@ from authentik.core.api.sources import SourceViewSet
 from authentik.core.api.tokens import TokenViewSet
 from authentik.core.api.users import UserViewSet
 from authentik.crypto.api import CertificateKeyPairViewSet
-from authentik.events.api.event import EventViewSet
-from authentik.events.api.notification import NotificationViewSet
-from authentik.events.api.notification_rule import NotificationRuleViewSet
-from authentik.events.api.notification_transport import NotificationTransportViewSet
-from authentik.flows.api.bindings import FlowStageBindingViewSet
-from authentik.flows.api.flows import FlowViewSet
-from authentik.flows.api.stages import StageViewSet
-from authentik.flows.views import FlowExecutorView
-from authentik.outposts.api.outpost_service_connections import (
+from authentik.events.api import EventViewSet
+from authentik.flows.api import (
+    FlowCacheViewSet,
+    FlowStageBindingViewSet,
+    FlowViewSet,
+    StageViewSet,
+)
+from authentik.outposts.api import (
     DockerServiceConnectionViewSet,
     KubernetesServiceConnectionViewSet,
-    ServiceConnectionViewSet,
+    OutpostViewSet,
+)
+from authentik.policies.api import (
+    PolicyBindingViewSet,
+    PolicyCacheViewSet,
+    PolicyViewSet,
 )
-from authentik.outposts.api.outposts import OutpostViewSet
-from authentik.policies.api import PolicyBindingViewSet, PolicyViewSet
 from authentik.policies.dummy.api import DummyPolicyViewSet
-from authentik.policies.event_matcher.api import EventMatcherPolicyViewSet
 from authentik.policies.expiry.api import PasswordExpiryPolicyViewSet
 from authentik.policies.expression.api import ExpressionPolicyViewSet
 from authentik.policies.group_membership.api import GroupMembershipPolicyViewSet
 from authentik.policies.hibp.api import HaveIBeenPwendPolicyViewSet
 from authentik.policies.password.api import PasswordPolicyViewSet
-from authentik.policies.reputation.api import (
-    IPReputationViewSet,
-    ReputationPolicyViewSet,
-    UserReputationViewSet,
-)
+from authentik.policies.reputation.api import ReputationPolicyViewSet
 from authentik.providers.oauth2.api import OAuth2ProviderViewSet, ScopeMappingViewSet
 from authentik.providers.proxy.api import (
     ProxyOutpostConfigViewSet,
@@ -54,19 +52,15 @@ from authentik.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProvide
 from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from authentik.sources.oauth.api import OAuthSourceViewSet
 from authentik.sources.saml.api import SAMLSourceViewSet
-from authentik.stages.authenticator_static.api import AuthenticatorStaticStageViewSet
-from authentik.stages.authenticator_totp.api import AuthenticatorTOTPStageViewSet
-from authentik.stages.authenticator_validate.api import (
-    AuthenticatorValidateStageViewSet,
-)
-from authentik.stages.authenticator_webauthn.api import AuthenticateWebAuthnStageViewSet
 from authentik.stages.captcha.api import CaptchaStageViewSet
 from authentik.stages.consent.api import ConsentStageViewSet
-from authentik.stages.deny.api import DenyStageViewSet
 from authentik.stages.dummy.api import DummyStageViewSet
 from authentik.stages.email.api import EmailStageViewSet
 from authentik.stages.identification.api import IdentificationStageViewSet
 from authentik.stages.invitation.api import InvitationStageViewSet, InvitationViewSet
+from authentik.stages.otp_static.api import OTPStaticStageViewSet
+from authentik.stages.otp_time.api import OTPTimeStageViewSet
+from authentik.stages.otp_validate.api import OTPValidateStageViewSet
 from authentik.stages.password.api import PasswordStageViewSet
 from authentik.stages.prompt.api import PromptStageViewSet, PromptViewSet
 from authentik.stages.user_delete.api import UserDeleteStageViewSet
@@ -76,6 +70,7 @@ from authentik.stages.user_write.api import UserWriteStageViewSet
 
 router = routers.DefaultRouter()
 
+router.register("root/messages", MessagesViewSet, basename="messages")
 router.register("root/config", ConfigsViewSet, basename="configs")
 
 router.register("admin/version", VersionViewSet, basename="admin_version")
@@ -89,7 +84,6 @@ router.register("core/users", UserViewSet)
 router.register("core/tokens", TokenViewSet)
 
 router.register("outposts/outposts", OutpostViewSet)
-router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
 router.register(
     "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
@@ -97,14 +91,12 @@ router.register(
 router.register("outposts/proxy", ProxyOutpostConfigViewSet)
 
 router.register("flows/instances", FlowViewSet)
+router.register("flows/cached", FlowCacheViewSet, basename="flows_cache")
 router.register("flows/bindings", FlowStageBindingViewSet)
 
 router.register("crypto/certificatekeypairs", CertificateKeyPairViewSet)
 
 router.register("events/events", EventViewSet)
-router.register("events/notifications", NotificationViewSet)
-router.register("events/transports", NotificationTransportViewSet)
-router.register("events/rules", NotificationRuleViewSet)
 
 router.register("sources/all", SourceViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
@@ -112,15 +104,13 @@ router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
 
 router.register("policies/all", PolicyViewSet)
+router.register("policies/cached", PolicyCacheViewSet, basename="policies_cache")
 router.register("policies/bindings", PolicyBindingViewSet)
 router.register("policies/expression", ExpressionPolicyViewSet)
-router.register("policies/event_matcher", EventMatcherPolicyViewSet)
 router.register("policies/group_membership", GroupMembershipPolicyViewSet)
 router.register("policies/haveibeenpwned", HaveIBeenPwendPolicyViewSet)
 router.register("policies/password_expiry", PasswordExpiryPolicyViewSet)
 router.register("policies/password", PasswordPolicyViewSet)
-router.register("policies/reputation/users", UserReputationViewSet)
-router.register("policies/reputation/ips", IPReputationViewSet)
 router.register("policies/reputation", ReputationPolicyViewSet)
 
 router.register("providers/all", ProviderViewSet)
@@ -134,17 +124,15 @@ router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 router.register("propertymappings/scope", ScopeMappingViewSet)
 
 router.register("stages/all", StageViewSet)
-router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
-router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
-router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
-router.register("stages/authenticator/webauthn", AuthenticateWebAuthnStageViewSet)
 router.register("stages/captcha", CaptchaStageViewSet)
 router.register("stages/consent", ConsentStageViewSet)
-router.register("stages/deny", DenyStageViewSet)
 router.register("stages/email", EmailStageViewSet)
 router.register("stages/identification", IdentificationStageViewSet)
+router.register("stages/invitation", InvitationStageViewSet)
 router.register("stages/invitation/invitations", InvitationViewSet)
-router.register("stages/invitation/stages", InvitationStageViewSet)
+router.register("stages/otp_static", OTPStaticStageViewSet)
+router.register("stages/otp_time", OTPTimeStageViewSet)
+router.register("stages/otp_validate", OTPValidateStageViewSet)
 router.register("stages/password", PasswordStageViewSet)
 router.register("stages/prompt/prompts", PromptViewSet)
 router.register("stages/prompt/stages", PromptStageViewSet)
@@ -182,9 +170,4 @@ urlpatterns = [
         name="schema-swagger-ui",
     ),
     path("redoc/", SchemaView.with_ui("redoc", cache_timeout=0), name="schema-redoc"),
-    path(
-        "flows/executor/<slug:flow_slug>/",
-        FlowExecutorView.as_view(),
-        name="flow-executor",
-    ),
 ] + router.urls

authentik/core/admin.py

@@ -4,6 +4,9 @@ from django.apps import AppConfig, apps
 from django.contrib import admin
 from django.contrib.admin.sites import AlreadyRegistered
 from guardian.admin import GuardedModelAdmin
+from structlog import get_logger
+
+LOGGER = get_logger()
 
 
 def admin_autoregister(app: AppConfig):
@@ -17,4 +20,5 @@ def admin_autoregister(app: AppConfig):
 
 for _app in apps.get_app_configs():
     if _app.label.startswith("authentik_"):
+        LOGGER.debug("Registering application for dj-admin", application=_app.label)
         admin_autoregister(_app)

authentik/core/api/applications.py

@@ -1,5 +1,4 @@
 """Application API Views"""
-from django.core.cache import cache
 from django.db.models import QuerySet
 from django.http.response import Http404
 from guardian.shortcuts import get_objects_for_user
@@ -11,7 +10,6 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
-from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import get_events_per_1h
 from authentik.core.api.providers import ProviderSerializer
@@ -19,13 +17,6 @@ from authentik.core.models import Application
 from authentik.events.models import EventAction
 from authentik.policies.engine import PolicyEngine
 
-LOGGER = get_logger()
-
-
-def user_app_cache_key(user_pk: str) -> str:
-    """Cache key where application list for user is saved"""
-    return f"user_app_cache_{user_pk}"
-
 
 class ApplicationSerializer(ModelSerializer):
     """Application Serializer"""
@@ -77,35 +68,16 @@ class ApplicationViewSet(ModelViewSet):
             queryset = backend().filter_queryset(self.request, queryset, self)
         return queryset
 
-    def _get_allowed_applications(self, queryset: QuerySet) -> list[Application]:
-        applications = []
-        for application in queryset:
-            engine = PolicyEngine(application, self.request.user, self.request)
-            engine.build()
-            if engine.passing:
-                applications.append(application)
-        return applications
-
     def list(self, request: Request) -> Response:
         """Custom list method that checks Policy based access instead of guardian"""
         queryset = self._filter_queryset_for_list(self.get_queryset())
         self.paginate_queryset(queryset)
-
-        should_cache = request.GET.get("search", "") == ""
-
         allowed_applications = []
-        if not should_cache:
-            allowed_applications = self._get_allowed_applications(queryset)
-        if should_cache:
-            LOGGER.debug("Caching allowed application list")
-            allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
-            if not allowed_applications:
-                allowed_applications = self._get_allowed_applications(queryset)
-                cache.set(
-                    user_app_cache_key(self.request.user.pk),
-                    allowed_applications,
-                    timeout=86400,
-                )
+        for application in queryset:
+            engine = PolicyEngine(application, self.request.user, self.request)
+            engine.build()
+            if engine.passing:
+                allowed_applications.append(application)
         serializer = self.get_serializer(allowed_applications, many=True)
         return self.get_paginated_response(serializer.data)
 

authentik/core/api/groups.py

@@ -19,5 +19,3 @@ class GroupViewSet(ModelViewSet):
 
     queryset = Group.objects.all()
     serializer_class = GroupSerializer
-    search_fields = ["name", "is_superuser"]
-    filterset_fields = ["name", "is_superuser"]

authentik/core/api/propertymappings.py

@@ -1,72 +1,30 @@
 """PropertyMapping API Views"""
-from django.urls import reverse
-from drf_yasg2.utils import swagger_auto_schema
-from rest_framework.decorators import action
-from rest_framework.request import Request
-from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ReadOnlyModelViewSet
 
-from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import PropertyMapping
-from authentik.lib.templatetags.authentik_utils import verbose_name
-from authentik.lib.utils.reflection import all_subclasses
 
 
-class PropertyMappingSerializer(ModelSerializer, MetaNameSerializer):
+class PropertyMappingSerializer(ModelSerializer):
     """PropertyMapping Serializer"""
 
-    object_type = SerializerMethodField(method_name="get_type")
+    __type__ = SerializerMethodField(method_name="get_type")
 
     def get_type(self, obj):
         """Get object type so that we know which API Endpoint to use to get the full object"""
         return obj._meta.object_name.lower().replace("propertymapping", "")
 
-    def to_representation(self, instance: PropertyMapping):
-        # pyright: reportGeneralTypeIssues=false
-        if instance.__class__ == PropertyMapping:
-            return super().to_representation(instance)
-        return instance.serializer(instance=instance).data
-
     class Meta:
 
         model = PropertyMapping
-        fields = [
-            "pk",
-            "name",
-            "expression",
-            "object_type",
-            "verbose_name",
-            "verbose_name_plural",
-        ]
+        fields = ["pk", "name", "expression", "__type__"]
 
 
 class PropertyMappingViewSet(ReadOnlyModelViewSet):
     """PropertyMapping Viewset"""
 
-    queryset = PropertyMapping.objects.none()
+    queryset = PropertyMapping.objects.all()
     serializer_class = PropertyMappingSerializer
-    search_fields = [
-        "name",
-    ]
-    filterset_fields = {"managed": ["isnull"]}
-    ordering = ["name"]
 
     def get_queryset(self):
         return PropertyMapping.objects.select_subclasses()
-
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
-    @action(detail=False)
-    def types(self, request: Request) -> Response:
-        """Get all creatable property-mapping types"""
-        data = []
-        for subclass in all_subclasses(self.queryset.model):
-            data.append(
-                {
-                    "name": verbose_name(subclass),
-                    "description": subclass.__doc__,
-                    "link": reverse("authentik_admin:property-mapping-create")
-                    + f"?type={subclass.__name__}",
-                }
-            )
-        return Response(TypeCreateSerializer(data, many=True).data)

authentik/core/api/providers.py

@@ -1,32 +1,26 @@
 """Provider API Views"""
-from django.urls import reverse
-from django.utils.translation import gettext_lazy as _
-from drf_yasg2.utils import swagger_auto_schema
-from rest_framework.decorators import action
-from rest_framework.fields import ReadOnlyField
-from rest_framework.request import Request
-from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
+from authentik.core.api.utils import MetaNameSerializer
 from authentik.core.models import Provider
-from authentik.lib.templatetags.authentik_utils import verbose_name
-from authentik.lib.utils.reflection import all_subclasses
 
 
 class ProviderSerializer(ModelSerializer, MetaNameSerializer):
     """Provider Serializer"""
 
-    assigned_application_slug = ReadOnlyField(source="application.slug")
-    assigned_application_name = ReadOnlyField(source="application.name")
-
     object_type = SerializerMethodField()
 
     def get_object_type(self, obj):
         """Get object type so that we know which API Endpoint to use to get the full object"""
         return obj._meta.object_name.lower().replace("provider", "")
 
+    def to_representation(self, instance: Provider):
+        # pyright: reportGeneralTypeIssues=false
+        if instance.__class__ == Provider:
+            return super().to_representation(instance)
+        return instance.serializer(instance=instance).data
+
     class Meta:
 
         model = Provider
@@ -37,8 +31,6 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
             "authorization_flow",
             "property_mappings",
             "object_type",
-            "assigned_application_slug",
-            "assigned_application_name",
             "verbose_name",
             "verbose_name_plural",
         ]
@@ -47,38 +39,11 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 class ProviderViewSet(ModelViewSet):
     """Provider Viewset"""
 
-    queryset = Provider.objects.none()
+    queryset = Provider.objects.all()
     serializer_class = ProviderSerializer
     filterset_fields = {
         "application": ["isnull"],
     }
-    search_fields = [
-        "name",
-        "application__name",
-    ]
 
     def get_queryset(self):
         return Provider.objects.select_subclasses()
-
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
-    @action(detail=False)
-    def types(self, request: Request) -> Response:
-        """Get all creatable provider types"""
-        data = []
-        for subclass in all_subclasses(self.queryset.model):
-            data.append(
-                {
-                    "name": verbose_name(subclass),
-                    "description": subclass.__doc__,
-                    "link": reverse("authentik_admin:provider-create")
-                    + f"?type={subclass.__name__}",
-                }
-            )
-        data.append(
-            {
-                "name": _("SAML Provider from Metadata"),
-                "description": _("Create a SAML Provider by importing its Metadata."),
-                "link": reverse("authentik_admin:provider-saml-from-metadata"),
-            }
-        )
-        return Response(TypeCreateSerializer(data, many=True).data)

authentik/core/api/sources.py

@@ -1,65 +1,39 @@
 """Source API Views"""
-from django.urls import reverse
-from drf_yasg2.utils import swagger_auto_schema
-from rest_framework.decorators import action
-from rest_framework.request import Request
-from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ReadOnlyModelViewSet
 
-from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
+from authentik.admin.forms.source import SOURCE_SERIALIZER_FIELDS
+from authentik.core.api.utils import MetaNameSerializer
 from authentik.core.models import Source
-from authentik.lib.templatetags.authentik_utils import verbose_name
-from authentik.lib.utils.reflection import all_subclasses
 
 
 class SourceSerializer(ModelSerializer, MetaNameSerializer):
     """Source Serializer"""
 
-    object_type = SerializerMethodField()
+    __type__ = SerializerMethodField(method_name="get_type")
 
-    def get_object_type(self, obj):
+    def get_type(self, obj):
         """Get object type so that we know which API Endpoint to use to get the full object"""
         return obj._meta.object_name.lower().replace("source", "")
 
+    def to_representation(self, instance: Source):
+        # pyright: reportGeneralTypeIssues=false
+        if instance.__class__ == Source:
+            return super().to_representation(instance)
+        return instance.serializer(instance=instance).data
+
     class Meta:
 
         model = Source
-        fields = [
-            "pk",
-            "name",
-            "slug",
-            "enabled",
-            "authentication_flow",
-            "enrollment_flow",
-            "object_type",
-            "verbose_name",
-            "verbose_name_plural",
-        ]
+        fields = SOURCE_SERIALIZER_FIELDS + ["__type__"]
 
 
 class SourceViewSet(ReadOnlyModelViewSet):
     """Source Viewset"""
 
-    queryset = Source.objects.none()
+    queryset = Source.objects.all()
     serializer_class = SourceSerializer
     lookup_field = "slug"
 
     def get_queryset(self):
         return Source.objects.select_subclasses()
-
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
-    @action(detail=False)
-    def types(self, request: Request) -> Response:
-        """Get all creatable source types"""
-        data = []
-        for subclass in all_subclasses(self.queryset.model):
-            data.append(
-                {
-                    "name": verbose_name(subclass),
-                    "description": subclass.__doc__,
-                    "link": reverse("authentik_admin:source-create")
-                    + f"?type={subclass.__name__}",
-                }
-            )
-        return Response(TypeCreateSerializer(data, many=True).data)

authentik/core/api/tokens.py

@@ -1,15 +1,11 @@
 """Tokens API Viewset"""
-from django.db.models.base import Model
 from django.http.response import Http404
-from drf_yasg2.utils import swagger_auto_schema
 from rest_framework.decorators import action
-from rest_framework.fields import CharField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer, Serializer
+from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.core.api.users import UserSerializer
 from authentik.core.models import Token
 from authentik.events.models import Event, EventAction
 
@@ -17,33 +13,10 @@ from authentik.events.models import Event, EventAction
 class TokenSerializer(ModelSerializer):
     """Token Serializer"""
 
-    user = UserSerializer()
-
     class Meta:
 
         model = Token
-        fields = [
-            "pk",
-            "identifier",
-            "intent",
-            "user",
-            "description",
-            "expires",
-            "expiring",
-        ]
-        depth = 2
-
-
-class TokenViewSerializer(Serializer):
-    """Show token's current key"""
-
-    key = CharField(read_only=True)
-
-    def create(self, validated_data: dict) -> Model:
-        raise NotImplementedError
-
-    def update(self, instance: Model, validated_data: dict) -> Model:
-        raise NotImplementedError
+        fields = ["pk", "identifier", "intent", "user", "description"]
 
 
 class TokenViewSet(ModelViewSet):
@@ -52,29 +25,13 @@ class TokenViewSet(ModelViewSet):
     lookup_field = "identifier"
     queryset = Token.filter_not_expired()
     serializer_class = TokenSerializer
-    search_fields = [
-        "identifier",
-        "intent",
-        "user__username",
-        "description",
-    ]
-    filterset_fields = [
-        "identifier",
-        "intent",
-        "user__username",
-        "description",
-    ]
-    ordering = ["expires"]
 
-    @swagger_auto_schema(responses={200: TokenViewSerializer(many=False)})
     @action(detail=True)
-    # pylint: disable=unused-argument
     def view_key(self, request: Request, identifier: str) -> Response:
         """Return token key and log access"""
-        token: Token = self.get_object()
-        if token.is_expired:
+        tokens = Token.filter_not_expired(identifier=identifier)
+        if not tokens.exists():
             raise Http404
-        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(  # noqa # nosec
-            request
-        )
-        return Response(TokenViewSerializer({"key": token.key}).data)
+        token = tokens.first()
+        Event.new(EventAction.TOKEN_VIEW, token=token).from_http(request)
+        return Response({"key": token.key})

authentik/core/api/users.py

@@ -2,44 +2,40 @@
 from drf_yasg2.utils import swagger_auto_schema
 from guardian.utils import get_anonymous_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import BooleanField, ModelSerializer
+from rest_framework.serializers import (
+    BooleanField,
+    ModelSerializer,
+    SerializerMethodField,
+)
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.core.models import User
+from authentik.lib.templatetags.authentik_utils import avatar
 
 
 class UserSerializer(ModelSerializer):
     """User Serializer"""
 
     is_superuser = BooleanField(read_only=True)
-    avatar = CharField(read_only=True)
+    avatar = SerializerMethodField()
+
+    def get_avatar(self, user: User) -> str:
+        """Add user's avatar as URL"""
+        return avatar(user)
 
     class Meta:
 
         model = User
-        fields = [
-            "pk",
-            "username",
-            "name",
-            "is_active",
-            "last_login",
-            "is_superuser",
-            "email",
-            "avatar",
-            "attributes",
-        ]
+        fields = ["pk", "username", "name", "is_superuser", "email", "avatar"]
 
 
 class UserViewSet(ModelViewSet):
     """User Viewset"""
 
-    queryset = User.objects.none()
+    queryset = User.objects.all()
     serializer_class = UserSerializer
-    search_fields = ["username", "name", "is_active"]
-    filterset_fields = ["username", "name", "is_active"]
 
     def get_queryset(self):
         return User.objects.all().exclude(pk=get_anonymous_user().pk)

authentik/core/api/utils.py

@@ -1,6 +1,5 @@
 """API Utilities"""
 from django.db.models import Model
-from rest_framework.fields import CharField, IntegerField
 from rest_framework.serializers import Serializer, SerializerMethodField
 
 
@@ -23,29 +22,3 @@ class MetaNameSerializer(Serializer):
     def get_verbose_name_plural(self, obj: Model) -> str:
         """Return object's plural verbose_name"""
         return obj._meta.verbose_name_plural
-
-
-class TypeCreateSerializer(Serializer):
-    """Types of an object that can be created"""
-
-    name = CharField(read_only=True)
-    description = CharField(read_only=True)
-    link = CharField(read_only=True)
-
-    def create(self, validated_data: dict) -> Model:
-        raise NotImplementedError
-
-    def update(self, instance: Model, validated_data: dict) -> Model:
-        raise NotImplementedError
-
-
-class CacheSerializer(Serializer):
-    """Generic cache stats for an object"""
-
-    count = IntegerField(read_only=True)
-
-    def create(self, validated_data: dict) -> Model:
-        raise NotImplementedError
-
-    def update(self, instance: Model, validated_data: dict) -> Model:
-        raise NotImplementedError

authentik/core/apps.py

@@ -1,6 +1,4 @@
 """authentik core app config"""
-from importlib import import_module
-
 from django.apps import AppConfig
 
 
@@ -11,6 +9,3 @@ class AuthentikCoreConfig(AppConfig):
     label = "authentik_core"
     verbose_name = "authentik Core"
     mountpoint = ""
-
-    def ready(self):
-        import_module("authentik.core.signals")

authentik/core/channels.py

@@ -1,7 +1,7 @@
 """Channels base classes"""
 from channels.exceptions import DenyConnection
 from channels.generic.websocket import JsonWebsocketConsumer
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik.api.auth import token_from_header
 from authentik.core.models import User

authentik/core/expression.py

@@ -28,7 +28,7 @@ class PropertyMappingEvaluator(BaseEvaluator):
         event = Event.new(
             EventAction.PROPERTY_MAPPING_EXCEPTION,
             expression=expression_source,
-            message=error_string,
+            error=error_string,
         )
         if "user" in self._context:
             event.set_user(self._context["user"])

authentik/core/forms/applications.py

@@ -9,10 +9,10 @@ from authentik.lib.widgets import GroupedModelChoiceField
 class ApplicationForm(forms.ModelForm):
     """Application Form"""
 
-    def __init__(self, *args, **kwargs):  # pragma: no cover
+    def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.fields["provider"].queryset = (
-            Provider.objects.all().order_by("name").select_subclasses()
+            Provider.objects.all().order_by("pk").select_subclasses()
         )
 
     class Meta:

authentik/core/middleware.py

@@ -9,7 +9,6 @@ from django.http import HttpRequest, HttpResponse
 SESSION_IMPERSONATE_USER = "authentik_impersonate_user"
 SESSION_IMPERSONATE_ORIGINAL_USER = "authentik_impersonate_original_user"
 LOCAL = local()
-RESPONSE_HEADER_ID = "X-authentik-id"
 
 
 class ImpersonateMiddleware:
@@ -44,7 +43,7 @@ class RequestIDMiddleware:
             setattr(request, "request_id", request_id)
             LOCAL.authentik = {"request_id": request_id}
         response = self.get_response(request)
-        response[RESPONSE_HEADER_ID] = request.request_id
+        response["X-authentik-id"] = request.request_id
         del LOCAL.authentik["request_id"]
         return response
 

authentik/core/migrations/0017_managed.py

@@ -1,35 +0,0 @@
-# Generated by Django 3.1.4 on 2021-01-30 18:28
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0016_auto_20201202_2234"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="propertymapping",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                verbose_name="Managed by authentik",
-                unique=True,
-            ),
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                verbose_name="Managed by authentik",
-                unique=True,
-            ),
-        ),
-    ]

authentik/core/models.py

@@ -1,43 +1,33 @@
 """authentik core models"""
 from datetime import timedelta
-from hashlib import md5, sha256
-from typing import Any, Optional, Type
-from urllib.parse import urlencode
+from typing import Any, Dict, Optional, Type
 from uuid import uuid4
 
-from django.conf import settings
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
 from django.db import models
 from django.db.models import Q, QuerySet
 from django.forms import ModelForm
 from django.http import HttpRequest
-from django.templatetags.static import static
 from django.utils.functional import cached_property
-from django.utils.html import escape
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from guardian.mixins import GuardianUserMixin
 from model_utils.managers import InheritanceManager
 from rest_framework.serializers import Serializer
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.signals import password_changed
 from authentik.core.types import UILoginButton
 from authentik.flows.models import Flow
-from authentik.lib.config import CONFIG
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
-from authentik.managed.models import ManagedModel
 from authentik.policies.models import PolicyBindingModel
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
 USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 
-GRAVATAR_URL = "https://secure.gravatar.com"
-DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
-
 
 def default_token_duration():
     """Default duration a Token is valid"""
@@ -90,7 +80,7 @@ class UserManager(DjangoUserManager):
 
 
 class User(GuardianUserMixin, AbstractUser):
-    """Custom User model to allow easier adding of user-based settings"""
+    """Custom User model to allow easier adding o f user-based settings"""
 
     uuid = models.UUIDField(default=uuid4, editable=False)
     name = models.TextField(help_text=_("User's display name."))
@@ -103,7 +93,7 @@ class User(GuardianUserMixin, AbstractUser):
 
     objects = UserManager()
 
-    def group_attributes(self) -> dict[str, Any]:
+    def group_attributes(self) -> Dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
@@ -128,30 +118,6 @@ class User(GuardianUserMixin, AbstractUser):
         self.password_change_date = now()
         return super().set_password(password)
 
-    @property
-    def uid(self) -> str:
-        """Generate a globall unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{settings.SECRET_KEY}".encode("ascii")).hexdigest()
-
-    @property
-    def avatar(self) -> str:
-        """Get avatar, depending on authentik.avatar setting"""
-        mode = CONFIG.raw.get("authentik").get("avatars")
-        if mode == "none":
-            return DEFAULT_AVATAR
-        if mode == "gravatar":
-            parameters = [
-                ("s", "158"),
-                ("r", "g"),
-            ]
-            # gravatar uses md5 for their URLs, so md5 can't be avoided
-            mail_hash = md5(self.email.encode("utf-8")).hexdigest()  # nosec
-            gravatar_url = (
-                f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
-            )
-            return escape(gravatar_url)
-        raise ValueError(f"Invalid avatar mode {mode}")
-
     class Meta:
 
         permissions = (
@@ -285,6 +251,11 @@ class Source(SerializerModel, PolicyBindingModel):
         button. If source doesn't use http-based flow, return None."""
         return None
 
+    @property
+    def ui_additional_info(self) -> Optional[str]:
+        """Return additional Info, such as a callback URL. Show in the administration interface."""
+        return None
+
     @property
     def ui_user_settings(self) -> Optional[str]:
         """Entrypoint to integrate with User settings. Can either return None if no
@@ -342,7 +313,7 @@ class TokenIntents(models.TextChoices):
     INTENT_RECOVERY = "recovery"
 
 
-class Token(ManagedModel, ExpiringModel):
+class Token(ExpiringModel):
     """Token used to authenticate the User for API Access or confirm another Stage like Email."""
 
     token_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
@@ -370,7 +341,7 @@ class Token(ManagedModel, ExpiringModel):
         ]
 
 
-class PropertyMapping(SerializerModel, ManagedModel):
+class PropertyMapping(models.Model):
     """User-defined key -> x mapping which can be used by providers to expose extra data."""
 
     pm_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
@@ -384,11 +355,6 @@ class PropertyMapping(SerializerModel, ManagedModel):
         """Return Form class used to edit this object"""
         raise NotImplementedError
 
-    @property
-    def serializer(self) -> Type[Serializer]:
-        """Get serializer for this model"""
-        raise NotImplementedError
-
     def evaluate(
         self, user: Optional[User], request: Optional[HttpRequest], **kwargs
     ) -> Any:

authentik/core/signals.py

@@ -1,24 +1,5 @@
 """authentik core signals"""
-from django.core.cache import cache
 from django.core.signals import Signal
-from django.db.models.signals import post_save
-from django.dispatch import receiver
 
 # Arguments: user: User, password: str
 password_changed = Signal()
-
-
-@receiver(post_save)
-# pylint: disable=unused-argument
-def post_save_application(sender, instance, created: bool, **_):
-    """Clear user's application cache upon application creation"""
-    from authentik.core.models import Application
-    from authentik.core.api.applications import user_app_cache_key
-
-    if sender != Application:
-        return
-    if not created:
-        return
-    # Also delete user application cache
-    keys = cache.keys(user_app_cache_key("*"))
-    cache.delete_many(keys)

authentik/core/tasks.py

@@ -8,10 +8,10 @@ from dbbackup.db.exceptions import CommandConnectorError
 from django.contrib.humanize.templatetags.humanize import naturaltime
 from django.core import management
 from django.utils.timezone import now
-from structlog.stdlib import get_logger
+from structlog import get_logger
 
 from authentik.core.models import ExpiringModel
-from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
+from authentik.lib.tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
@@ -46,7 +46,8 @@ def backup_database(self: MonitoredTask):  # pragma: no cover
             TaskResult(
                 TaskResultStatus.SUCCESSFUL,
                 [
-                    f"Successfully finished database backup {naturaltime(start)} {out.getvalue()}",
+                    f"Successfully finished database backup {naturaltime(start)}",
+                    out.getvalue(),
                 ],
             )
         )

authentik/core/templates/base/page.html

@@ -0,0 +1,12 @@
+{% extends "base/skeleton.html" %}
+
+{% load i18n %}
+
+{% block body %}
+<ak-message-container></ak-message-container>
+<div class="pf-c-page">
+    <a class="pf-c-skip-to-content pf-c-button pf-m-primary" href="#main-content">{% trans 'Skip to content' %}</a>
+    {% block page_content %}
+    {% endblock %}
+</div>
+{% endblock %}

authentik/core/templates/base/skeleton.html

@@ -9,13 +9,14 @@
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
         <title>{% block title %}{% trans title|default:config.authentik.branding.title %}{% endblock %}</title>
-        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
-        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.css' %}?v={{ ak_version }}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-addons.css' %}?v={{ ak_version }}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/fontawesome.min.css' %}?v={{ ak_version }}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}?v={{ ak_version }}">
-        <script src="{% url 'javascript-catalog' %}?v={{ ak_version }}"></script>
+        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
+        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.css' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-addons.css' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/fontawesome.min.css' %}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
+        <script src="{% url 'javascript-catalog' %}"></script>
+        <script src="{% static 'dist/main.js' %}" type="module"></script>
         {% block head %}
         {% endblock %}
     </head>

authentik/core/templates/error/generic.html

@@ -1,4 +1,4 @@
-{% extends 'base/skeleton.html' %}
+{% extends 'base/page.html' %}
 
 {% load i18n %}
 {% load authentik_utils %}

authentik/core/templates/generic/autosubmit_form.html

@@ -0,0 +1,31 @@
+{% extends "login/base.html" %}
+
+{% load authentik_utils %}
+{% load i18n %}
+
+{% block title %}
+{{ title }}
+{% endblock %}
+
+{% block card %}
+<form method="POST" action="{{ url }}" autosubmit>
+    {% csrf_token %}
+    {% for key, value in attrs.items %}
+    <input type="hidden" name="{{ key }}" value="{{ value }}">
+    {% endfor %}
+    <div class="pf-c-form__group pf-u-display-flex pf-u-justify-content-center">
+        <div class="pf-c-form__group-control">
+            <span class="pf-c-spinner" role="progressbar" aria-valuetext="Loading...">
+                <span class="pf-c-spinner__clipper"></span>
+                <span class="pf-c-spinner__lead-ball"></span>
+                <span class="pf-c-spinner__tail-ball"></span>
+            </span>
+        </div>
+    </div>
+    <div class="pf-c-form__group pf-m-action">
+        <div class="pf-c-form__actions">
+            <button class="pf-c-button pf-m-primary pf-m-block" type="submit">{% trans 'Continue' %}</button>
+        </div>
+    </div>
+</form>
+{% endblock %}

authentik/core/templates/library.html

@@ -0,0 +1,53 @@
+{% load i18n %}
+
+<main role="main" class="pf-c-page__main" tabindex="-1" id="main-content">
+    <section class="pf-c-page__main-section pf-m-light">
+        <div class="pf-c-content">
+            <h1>
+                <i class="pf-icon pf-icon-applications"></i>
+                {% trans 'Applications' %}
+            </h1>
+        </div>
+    </section>
+    <section class="pf-c-page__main-section">
+        {% if applications %}
+        <div class="pf-l-gallery pf-m-gutter">
+            {% for app in applications %}
+            <a href="{{ app.get_launch_url }}" class="pf-c-card pf-m-hoverable pf-m-compact ak-root-link">
+                <div class="pf-c-card__header">
+                    {% if app.meta_icon %}
+                    <img class="app-icon pf-c-avatar" src="{{ app.meta_icon.url }}" alt="{% trans 'Application Icon' %}">
+                    {% else %}
+                    <i class="pf-icon pf-icon-arrow"></i>
+                    {% endif %}
+                </div>
+                <div class="pf-c-card__title">
+                    <p id="card-1-check-label">{{ app.name }}</p>
+                    <div class="pf-c-content">
+                        <small>{{ app.meta_publisher }}</small>
+                    </div>
+                </div>
+                <div class="pf-c-card__body">
+                    {% trans app.meta_description|truncatewords:35 %}
+                </div>
+            </a>
+            {% endfor %}
+        </div>
+        {% else %}
+        <div class="pf-c-empty-state pf-m-full-height">
+            <div class="pf-c-empty-state__content">
+                <i class="fas fa-cubes pf-c-empty-state__icon" aria-hidden="true"></i>
+                <h1 class="pf-c-title pf-m-lg">{% trans 'No Applications available.' %}</h1>
+                <div class="pf-c-empty-state__body">
+                    {% trans "Either no applications are defined, or you don't have access to any." %}
+                </div>
+                {% if perms.authentik_core.add_application %}
+                <a href="{% url 'authentik_admin:application-create' %}" class="pf-c-button pf-m-primary" type="button">
+                    {% trans 'Create Application' %}
+                </a>
+                {% endif %}
+            </div>
+        </div>
+        {% endif %}
+    </section>
+</main>

authentik/core/templates/login/base.html

@@ -28,8 +28,10 @@
         {% for source in sources %}
         <li class="pf-c-login__main-footer-links-item">
             <a href="{{ source.url }}" class="pf-c-login__main-footer-links-item-link">
-                {% if source.icon_url %}
-                <img src="{{ source.icon_url }}" alt="{{ source.name }}">
+                {% if source.icon_path %}
+                <img src="{% static source.icon_path %}" alt="{{ source.name }}">
+                {% elif source.icon_url %}
+                <img src="icon_url" alt="{{ source.name }}">
                 {% else %}
                 <i class="pf-icon pf-icon-arrow" title="{{ source.name }}"></i>
                 {% endif %}

authentik/core/templates/login/form.html

@@ -0,0 +1,19 @@
+{% extends 'login/base.html' %}
+
+{% load static %}
+{% load i18n %}
+
+{% block card %}
+<form method="POST" class="pf-c-form">
+    {% block above_form %}
+    {% endblock %}
+
+    {% include 'partials/form.html' %}
+
+    {% block beneath_form %}
+    {% endblock %}
+    <div class="pf-c-form__group pf-m-action">
+        <button class="pf-c-button pf-m-primary pf-m-block" type="submit">{% trans primary_action %}</button>
+    </div>
+</form>
+{% endblock %}

authentik/core/templates/login/form_with_user.html

@@ -0,0 +1,18 @@
+{% extends 'login/form.html' %}
+
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block above_form %}
+<div class="pf-c-form__group">
+    <div class="form-control-static">
+        <div class="left">
+            <img class="pf-c-avatar" src="{% avatar user %}" alt="">
+            {{ user.username }}
+        </div>
+        <div class="right">
+            <a href="{% url 'authentik_flows:cancel' %}">{% trans 'Not you?' %}</a>
+        </div>
+    </div>
+</div>
+{% endblock %}

authentik/core/templates/login/loading.html

@@ -0,0 +1,24 @@
+{% extends 'login/base.html' %}
+
+{% load static %}
+{% load i18n %}
+{% load authentik_utils %}
+
+{% block title %}
+{% trans title %}
+{% endblock %}
+
+{% block head %}
+<meta http-equiv="refresh" content="0; url={{ target_url }}" />
+{% endblock %}
+
+{% block card %}
+<header class="login-pf-header">
+  <h1>{% trans title %}</h1>
+</header>
+<form>
+  <div class="form-group">
+    <div class="spinner spinner-lg"></div>
+  </div>
+</form>
+{% endblock %}

authentik/core/templates/partials/form.html

@@ -3,7 +3,7 @@
 
 {% csrf_token %}
 {% if form.non_field_errors %}
-<div class="pf-c-form__group">
+<div class="pf-c-form__group has-error">
     <p class="pf-c-form__helper-text pf-m-error">
         {{ form.non_field_errors }}
     </p>
@@ -13,7 +13,7 @@
 {% if field.field.widget|fieldtype == 'HiddenInput' %}
     {{ field }}
 {% else %}
-<div class="pf-c-form__group">
+<div class="pf-c-form__group {% if field.errors %} has-error {% endif %}">
     {% if field.field.widget|fieldtype == 'RadioSelect' %}
         <label class="pf-c-form__label" {% if field.field.required %}class="required" {% endif %}
             for="{{ field.name }}-{{ forloop.counter0 }}">

authentik/core/templates/partials/pagination.html

@@ -0,0 +1,42 @@
+{% load i18n %}
+{% load authentik_utils %}
+
+<div class="pf-c-toolbar__item pf-m-pagination ">
+    <div class="pf-c-pagination pf-m-compact pf-m-hidden pf-m-visible-on-md">
+        <div class="pf-c-pagination pf-m-compact pf-m-compact pf-m-hidden pf-m-visible-on-md">
+            <div class="pf-c-options-menu">
+                <div class="pf-c-options-menu__toggle pf-m-text pf-m-plain">
+                    <span class="pf-c-options-menu__toggle-text">
+                        {% blocktrans with start_index=page_obj.start_index end_index=page_obj.end_index total_items=paginator.count %}
+                            {{ start_index }} - {{ end_index }} of {{ total_items }}
+                        {% endblocktrans %}
+                    </span>
+                </div>
+            </div>
+            <nav class="pf-c-pagination__nav" aria-label="Pagination">
+                <div class="pf-c-pagination__nav-control pf-m-prev">
+                    <a class="pf-c-button pf-m-plain"
+                        {% if page_obj.has_previous %}
+                        href="{{ request.path }}?{% query_transform page=page_obj.previous_page_number %}"
+                        {% else %}
+                        disabled
+                        {% endif %}
+                        aria-label="{% trans 'Go to previous page' %}">
+                        <i class="fas fa-angle-left" aria-hidden="true"></i>
+                    </a>
+                </div>
+                <div class="pf-c-pagination__nav-control pf-m-next">
+                    <a class="pf-c-button pf-m-plain"
+                        {% if page_obj.has_next %}
+                        href="{{ request.path }}?{% query_transform page=page_obj.next_page_number %}"
+                        {% else %}
+                        disabled
+                        {% endif %}
+                        aria-label="{% trans 'Go to next page' %}">
+                        <i class="fas fa-angle-right" aria-hidden="true"></i>
+                    </a>
+                </div>
+            </nav>
+        </div>
+    </div>
+</div>