core: fix token expiration not being updated upon key rotation

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.4.1-rc1
+current_version = 2021.7.3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
@@ -19,26 +19,18 @@ values =
 
 [bumpversion:file:website/docs/installation/docker-compose.md]
 
-[bumpversion:file:website/docs/installation/kubernetes.md]
-
 [bumpversion:file:docker-compose.yml]
 
-[bumpversion:file:helm/values.yaml]
-
-[bumpversion:file:helm/README.md]
-
-[bumpversion:file:helm/Chart.yaml]
+[bumpversion:file:schema.yml]
 
 [bumpversion:file:.github/workflows/release.yml]
 
 [bumpversion:file:authentik/__init__.py]
 
-[bumpversion:file:outpost/pkg/version.go]
+[bumpversion:file:internal/constants/constants.go]
 
 [bumpversion:file:web/src/constants.ts]
 
-[bumpversion:file:web/nginx.conf]
-
 [bumpversion:file:website/docs/outposts/manual-deploy-docker-compose.md]
 
 [bumpversion:file:website/docs/outposts/manual-deploy-kubernetes.md]

.dockerignore

@@ -1,6 +1,8 @@
 env
-helm
 static
 htmlcov
 *.env.yml
 **/node_modules
+dist/**
+build/**
+build_docs/**

.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,27 @@
+---
+name: Question
+about: Ask a question about a feature or specific configuration
+title: ''
+labels: question
+assignees: ''
+
+---
+
+**Describe your question/**
+A clear and concise description of what you're trying to do.
+
+**Relevant infos**
+i.e. Version of other software you're using, specifics of your setup
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Logs**
+Output of docker-compose logs or kubectl logs respectively
+
+**Version and Deployment (please complete the following information):**
+ - authentik version: [e.g. 0.10.0-stable]
+ - Deployment: [e.g. docker-compose, helm]
+
+**Additional context**
+Add any other context about the problem here.

.github/dependabot.yml

@@ -1,7 +1,15 @@
 version: 2
 updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "04:00"
+  open-pull-requests-limit: 10
+  assignees:
+  - BeryJu
 - package-ecosystem: gomod
-  directory: "/outpost"
+  directory: "/"
   schedule:
     interval: daily
     time: "04:00"
@@ -40,11 +48,3 @@ updates:
   open-pull-requests-limit: 10
   assignees:
   - BeryJu
-- package-ecosystem: docker
-  directory: "/outpost"
-  schedule:
-    interval: daily
-    time: "04:00"
-  open-pull-requests-limit: 10
-  assignees:
-  - BeryJu

.github/pull_request_template.md

@@ -0,0 +1,19 @@
+<!--
+👋 Hello there! Welcome.
+
+Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/master/CONTRIBUTING.md#how-can-i-contribute).
+-->
+
+# Details
+* **Does this resolve an issue?**
+Resolves #
+
+## Changes
+### New Features
+* Adds feature which does x, y, and z.
+
+### Breaking Changes
+* Adds breaking change which causes \<issue\>.
+
+## Additional
+Any further notes or comments you want to make.

.github/stale.yml

@@ -0,0 +1,14 @@
+# Number of days of inactivity before an issue becomes stale
+daysUntilStale: 60
+# Number of days of inactivity before a stale issue is closed
+daysUntilClose: 7
+# Issues with these labels will never be considered stale
+exemptLabels:
+  - pinned
+  - security
+  - pr_wanted
+# Comment to post when marking an issue as stale. Set to `false` to disable
+markComment: >
+  This issue has been automatically marked as stale because it has not had
+  recent activity. It will be closed if no further activity occurs. Thank you
+  for your contributions.

.github/workflows/release.yml

@@ -3,90 +3,143 @@ name: authentik-on-release
 on:
   release:
     types: [published, created]
+  push:
+    branches:
+      - version-*
 
 jobs:
   # Build
   build-server:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1.2.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
       - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Building Docker Image
-        run: docker build
-          --no-cache
-          -t beryju/authentik:2021.4.1-rc1
-          -t beryju/authentik:latest
-          -f Dockerfile .
-      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik:2021.4.1-rc1
-      - name: Push Docker Container to Registry (latest)
-        run: docker push beryju/authentik:latest
+        uses: docker/build-push-action@v2
+        with:
+          push: ${{ github.event_name == 'release' }}
+          tags: |
+            beryju/authentik:2021.7.3,
+            beryju/authentik:latest,
+            ghcr.io/goauthentik/server:2021.7.3,
+            ghcr.io/goauthentik/server:latest
+          platforms: linux/amd64,linux/arm64
+          context: .
+      - name: Building Docker Image (stable)
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
+        run: |
+          docker pull beryju/authentik:latest
+          docker tag beryju/authentik:latest beryju/authentik:stable
+          docker push beryju/authentik:stable
+          docker pull ghcr.io/goauthentik/server:latest
+          docker tag ghcr.io/goauthentik/server:latest ghcr.io/goauthentik/server:stable
+          docker push ghcr.io/goauthentik/server:stable
   build-proxy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
           go-version: "^1.15"
-      - name: prepare go api client
-        run: |
-          cd outpost
-          go get -u github.com/go-swagger/go-swagger/cmd/swagger
-          swagger generate client -f ../swagger.yaml -A authentik -t pkg/
-          go build -v .
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1.2.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
       - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Building Docker Image
+        uses: docker/build-push-action@v2
+        with:
+          push: ${{ github.event_name == 'release' }}
+          tags: |
+            beryju/authentik-proxy:2021.7.3,
+            beryju/authentik-proxy:latest,
+            ghcr.io/goauthentik/proxy:2021.7.3,
+            ghcr.io/goauthentik/proxy:latest
+          file: proxy.Dockerfile
+          platforms: linux/amd64,linux/arm64
+      - name: Building Docker Image (stable)
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
         run: |
-          cd outpost/
-          docker build \
-          --no-cache \
-          -t beryju/authentik-proxy:2021.4.1-rc1 \
-          -t beryju/authentik-proxy:latest \
-          -f proxy.Dockerfile .
-      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-proxy:2021.4.1-rc1
-      - name: Push Docker Container to Registry (latest)
-        run: docker push beryju/authentik-proxy:latest
-  build-static:
+          docker pull beryju/authentik-proxy:latest
+          docker tag beryju/authentik-proxy:latest beryju/authentik-proxy:stable
+          docker push beryju/authentik-proxy:stable
+          docker pull ghcr.io/goauthentik/proxy:latest
+          docker tag ghcr.io/goauthentik/proxy:latest ghcr.io/goauthentik/proxy:stable
+          docker push ghcr.io/goauthentik/proxy:stable
+  build-ldap:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
-      - name: prepare ts api client
-        run: |
-          docker run --rm -v $(pwd):/local openapitools/openapi-generator-cli generate -i /local/swagger.yaml -g typescript-fetch -o /local/web/api --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v2
+        with:
+          go-version: "^1.15"
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1.2.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
       - name: Docker Login Registry
-        env:
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Building Docker Image
+        uses: docker/build-push-action@v2
+        with:
+          push: ${{ github.event_name == 'release' }}
+          tags: |
+            beryju/authentik-ldap:2021.7.3,
+            beryju/authentik-ldap:latest,
+            ghcr.io/goauthentik/ldap:2021.7.3,
+            ghcr.io/goauthentik/ldap:latest
+          file: ldap.Dockerfile
+          platforms: linux/amd64,linux/arm64
+      - name: Building Docker Image (stable)
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
         run: |
-          cd web/
-          docker build \
-          --no-cache \
-          -t beryju/authentik-static:2021.4.1-rc1 \
-          -t beryju/authentik-static:latest \
-          -f Dockerfile .
-      - name: Push Docker Container to Registry (versioned)
-        run: docker push beryju/authentik-static:2021.4.1-rc1
-      - name: Push Docker Container to Registry (latest)
-        run: docker push beryju/authentik-static:latest
+          docker pull beryju/authentik-ldap:latest
+          docker tag beryju/authentik-ldap:latest beryju/authentik-ldap:stable
+          docker push beryju/authentik-ldap:stable
+          docker pull ghcr.io/goauthentik/ldap:latest
+          docker tag ghcr.io/goauthentik/ldap:latest ghcr.io/goauthentik/ldap:stable
+          docker push ghcr.io/goauthentik/ldap:stable
   test-release:
     needs:
       - build-server
-      - build-static
       - build-proxy
+      - build-ldap
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
       - name: Run test suite in final docker images
         run: |
           sudo apt-get install -y pwgen
@@ -95,20 +148,35 @@ jobs:
           docker-compose pull -q
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
+          docker-compose run -u root server test
   sentry-release:
+    if: ${{ github.event_name == 'release' }}
     needs:
       - test-release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v2
+      - name: Setup Node.js environment
+        uses: actions/setup-node@v2.3.0
+        with:
+          node-version: 12.x
+      - name: Build web api client and web ui
+        run: |
+          export NODE_ENV=production
+          make gen-web
+          cd web
+          npm i
+          npm run build
       - name: Create a Sentry.io release
-        uses: tclindner/sentry-releases-action@v1.2.0
+        uses: getsentry/action-release@v1
+        if: ${{ github.event_name == 'release' }}
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: beryjuorg
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          tagName: 2021.4.1-rc1
+          version: authentik@2021.7.3
           environment: beryjuorg-prod
+          sourcemaps: './web/dist'
+          url_prefix: '~/static/dist'

.github/workflows/tag.yml

@@ -10,7 +10,7 @@ jobs:
     name: Create Release from Tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v2
       - name: Pre-release test
         run: |
           sudo apt-get install -y pwgen
@@ -20,30 +20,21 @@ jobs:
           docker-compose pull -q
           docker build \
             --no-cache \
-            -t beryju/authentik:latest \
+            -t ghcr.io/goauthentik/server:latest \
             -f Dockerfile .
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
-      - name: Install Helm
-        run: |
-          apt update && apt install -y curl
-          curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-      - name: Helm package
-        run: |
-          helm dependency update helm/
-          helm package helm/
-          mv authentik-*.tgz authentik-chart.tgz
+          docker-compose run -u root server test
       - name: Extract version number
         id: get_version
-        uses: actions/github-script@0.2.0
+        uses: actions/github-script@v4.0.2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
       - name: Create Release
         id: create_release
-        uses: actions/create-release@v1.0.0
+        uses: actions/create-release@v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -51,13 +42,3 @@ jobs:
           release_name: Release ${{ steps.get_version.outputs.result }}
           draft: true
           prerelease: false
-      - name: Upload packaged Helm Chart
-        id: upload-release-asset
-        uses: actions/upload-release-asset@v1.0.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./authentik-chart.tgz
-          asset_name: authentik-chart.tgz
-          asset_content_type: application/gzip

.gitignore

@@ -193,12 +193,11 @@ pip-selfcheck.json
 local.env.yml
 .vscode/
 
-### Helm ###
-# Chart dependencies
-**/charts/*.tgz
-
 # Selenium Screenshots
 selenium_screenshots/
 backups/
 media/
 *mmdb
+
+.idea/
+/api/

CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+hello@beryju.org.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -0,0 +1,180 @@
+# Contributing to authentik
+
+:+1::tada: Thanks for taking the time to contribute! :tada::+1:
+
+The following is a set of guidelines for contributing to authentik and its components, which are hosted in the [goauthentik Organization](https://github.com/goauthentik) on GitHub. These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
+
+#### Table Of Contents
+
+[Code of Conduct](#code-of-conduct)
+
+[I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)
+
+[What should I know before I get started?](#what-should-i-know-before-i-get-started)
+  * [Atom and Packages](#atom-and-packages)
+  * [Atom Design Decisions](#design-decisions)
+
+[How Can I Contribute?](#how-can-i-contribute)
+  * [Reporting Bugs](#reporting-bugs)
+  * [Suggesting Enhancements](#suggesting-enhancements)
+  * [Your First Code Contribution](#your-first-code-contribution)
+  * [Pull Requests](#pull-requests)
+
+[Styleguides](#styleguides)
+  * [Git Commit Messages](#git-commit-messages)
+  * [JavaScript Styleguide](#javascript-styleguide)
+  * [CoffeeScript Styleguide](#coffeescript-styleguide)
+  * [Specs Styleguide](#specs-styleguide)
+  * [Documentation Styleguide](#documentation-styleguide)
+
+[Additional Notes](#additional-notes)
+  * [Issue and Pull Request Labels](#issue-and-pull-request-labels)
+
+## Code of Conduct
+
+Basically, don't be a dickhead. This is an open-source non-profit project, that is made in the free time of Volunteers. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.
+
+## I don't want to read this whole thing I just have a question!!!
+
+Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://discord.gg/jg33eMhnj6)
+
+## What should I know before I get started?
+
+### The components
+
+authentik consists of a few larger components:
+
+- *authentik* the actual application server, is described below.
+- *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
+- *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
+- *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
+- *website* is the Website/documentation, which uses docusaurus.
+
+### authentik's structure
+
+authentik is at it's very core a Django project. It consists of many individual django applications. These applications are intended to separate concerns, and they may share code between each other.
+
+These are the current packages:
+<a id="authentik-packages"/>
+
+```
+authentik
+├── admin - Administrative tasks and APIs, no models (Version updates, Metrics, system tasks)
+├── api - General API Configuration (Routes, Schema and general API utilities)
+├── core - Core authentik functionality, central routes, core Models
+├── crypto - Cryptography, currently used to generate and hold Certificates and Private Keys
+├── events - Event Log, middleware and signals to generate signals
+├── flows - Flows, the FlowPlanner and the FlowExecutor, used for all flows for authentication, authorization, etc
+├── lib - Generic library of functions, few dependencies on other packages.
+├── managed - Handle managed models and their state.
+├── outposts - Configure and deploy outposts on kubernetes and docker.
+├── policies - General PolicyEngine
+│   ├── dummy - A Dummy policy used for testing
+│   ├── event_matcher - Match events based on different criteria
+│   ├── expiry - Check when a user's password was last set
+│   ├── expression - Execute any arbitrary python code
+│   ├── hibp - Check a password against HaveIBeenPwned
+│   ├── password - Check a password against several rules
+│   └── reputation - Check the user's/client's reputation
+├── providers
+│   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
+│   ├── oauth2 - OIDC-compliant OAuth2 provider
+│   ├── proxy - Provides an identity-aware proxy using an outpost
+│   └── saml - SAML2 Provider
+├── recovery - Generate keys to use in case you lock yourself out
+├── root - Root django application, contains global settings and routes
+├── sources
+│   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
+│   ├── oauth - OAuth1 and OAuth2 Source
+│   ├── plex - Plex source
+│   └── saml - SAML2 Source
+├── stages
+│   ├── authenticator_duo - Configure a DUO authenticator
+│   ├── authenticator_static - Configure TOTP backup keys
+│   ├── authenticator_totp - Configure a TOTP authenticator
+│   ├── authenticator_validate - Validate any authenticator
+│   ├── authenticator_webauthn - Configure a WebAuthn authenticator
+│   ├── captcha - Make the user pass a captcha
+│   ├── consent - Let the user decide if they want to consent to an action
+│   ├── deny - Static deny, can be used with policies
+│   ├── dummy - Dummy stage to test
+│   ├── email - Send the user an email and block execution until they click the link
+│   ├── identification - Identify a user with any combination of fields
+│   ├── invitation - Invitation system to limit flows to certain users
+│   ├── password - Password authentication
+│   ├── prompt - Arbitrary prompts
+│   ├── user_delete - Delete the currently pending user
+│   ├── user_login - Login the currently pending user
+│   ├── user_logout - Logout the currently pending user
+│   └── user_write - Write any currenetly pending data to the user.
+└── tenants - Soft tennancy, configure defaults and branding per domain
+```
+
+This django project is running in gunicorn, which spawns multiple workers and threads. Gunicorn is run from a lightweight Go application which reverse-proxies it, handles static files and will eventually gain more functionality as more code is migrated to go.
+
+There are also several background tasks which run in Celery, the root celery application is defined in `authentik.root.celery`.
+
+## How Can I Contribute?
+
+### Reporting Bugs
+
+This section guides you through submitting a bug report for authentik. Following these guidelines helps maintainers and the community understand your report, reproduce the behavior, and find related reports.
+
+Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.
+
+This form will have the full stack trace of the error that ocurred and shouldn't contain any sensitive data.
+
+### Suggesting Enhancements
+
+This section guides you through submitting an enhancement suggestion for authentik, including completely new features and minor improvements to existing functionality. Following these guidelines helps maintainers and the community understand your suggestion and find related suggestions.
+
+When you are creating an enhancement suggestion, please fill in [the template](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=), including the steps that you imagine you would take if the feature you're requesting existed.
+
+### Your First Code Contribution
+
+#### Local development
+
+authentik can be run locally, all though depending on which part you want to work on, different pre-requisites are required.
+
+This is documented in the [developer docs](https://goauthentik.io/developer-docs/)
+
+### Pull Requests
+
+The process described here has several goals:
+
+- Maintain authentik's quality
+- Fix problems that are important to users
+- Engage the community in working toward the best possible authentik
+- Enable a sustainable system for authentik's maintainers to review contributions
+
+Please follow these steps to have your contribution considered by the maintainers:
+
+1. Follow the [styleguides](#styleguides)
+2. After you submit your pull request, verify that all [status checks](https://help.github.com/articles/about-status-checks/) are passing <details><summary>What if the status checks are failing?</summary>If a status check is failing, and you believe that the failure is unrelated to your change, please leave a comment on the pull request explaining why you believe the failure is unrelated. A maintainer will re-run the status check for you. If we conclude that the failure was a false positive, then we will open an issue to track that problem with our status check suite.</details>
+3. Ensure your Code has tests. While it is not always possible to test every single case, the majority of the code should be tested.
+
+While the prerequisites above must be satisfied prior to having your pull request reviewed, the reviewer(s) may ask you to complete additional design work, tests, or other changes before your pull request can be ultimately accepted.
+
+## Styleguides
+
+### Git Commit Messages
+
+* Use the format of `<package>: <verb> <description>`
+  - See [here](#authentik-packages) for `package`
+  - Example: `providers/saml2: fix parsing of requests`
+* Reference issues and pull requests liberally after the first line
+
+### Python Styleguide
+
+All Python code is linted with [black](https://black.readthedocs.io/en/stable/), [PyLint](https://www.pylint.org/) and [isort](https://pycqa.github.io/isort/).
+
+authentik runs on Python 3.9 at the time of writing this.
+
+* Use native type-annotations wherever possible.
+* Add meaningful docstrings when possible.
+* Ensure any database migrations work properly from the last stable version (this is checked via CI)
+* If your code changes central functions, make sure nothing else is broken.
+
+### Documentation Styleguide
+
+* Use [MDX](https://mdxjs.com/) whenever appropriate.

Dockerfile

@@ -1,3 +1,4 @@
+# Stage 1: Lock python dependencies
 FROM python:3.9-slim-buster as locker
 
 COPY ./Pipfile /app/
@@ -7,8 +8,73 @@ WORKDIR /app/
 
 RUN pip install pipenv && \
     pipenv lock -r > requirements.txt && \
-    pipenv lock -rd > requirements-dev.txt
+    pipenv lock -r --dev-only > requirements-dev.txt
 
+# Stage 2: Build website
+FROM node as website-builder
+
+COPY ./website /static/
+
+ENV NODE_ENV=production
+RUN cd /static && npm i && npm run build-docs-only
+
+# Stage 3: Build web API
+FROM openapitools/openapi-generator-cli as web-api-builder
+
+COPY ./schema.yml /local/schema.yml
+
+RUN	docker-entrypoint.sh generate \
+    -i /local/schema.yml \
+    -g typescript-fetch \
+    -o /local/web/api \
+    --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+
+# Stage 3: Generate API Client
+FROM openapitools/openapi-generator-cli as go-api-builder
+
+COPY ./schema.yml /local/schema.yml
+
+RUN	docker-entrypoint.sh generate \
+    --git-host goauthentik.io \
+    --git-repo-id outpost \
+    --git-user-id api \
+    -i /local/schema.yml \
+    -g go \
+    -o /local/api \
+    --additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true && \
+    rm -f /local/api/go.mod /local/api/go.sum
+
+# Stage 4: Build webui
+FROM node as web-builder
+
+COPY ./web /static/
+COPY --from=web-api-builder /local/web/api /static/api
+
+ENV NODE_ENV=production
+RUN cd /static && npm i && npm run build
+
+# Stage 5: Build go proxy
+FROM golang:1.16.6 AS builder
+
+WORKDIR /work
+
+COPY --from=web-builder /static/robots.txt /work/web/robots.txt
+COPY --from=web-builder /static/security.txt /work/web/security.txt
+COPY --from=web-builder /static/dist/ /work/web/dist/
+COPY --from=web-builder /static/authentik/ /work/web/authentik/
+COPY --from=website-builder /static/help/ /work/website/help/
+
+COPY --from=go-api-builder /local/api api
+COPY ./cmd /work/cmd
+COPY ./web/static.go /work/web/static.go
+COPY ./website/static.go /work/website/static.go
+COPY ./internal /work/internal
+COPY ./go.mod /work/go.mod
+COPY ./go.sum /work/go.sum
+
+RUN go build -o /work/authentik ./cmd/server/main.go
+
+# Stage 6: Run
 FROM python:3.9-slim-buster
 
 WORKDIR /
@@ -19,34 +85,29 @@ ARG GIT_BUILD_HASH
 ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends curl ca-certificates gnupg && \
+    apt-get install -y --no-install-recommends curl ca-certificates gnupg git runit && \
     curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
     echo "deb http://apt.postgresql.org/pub/repos/apt buster-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
     apt-get update && \
-    apt-get install -y --no-install-recommends postgresql-client-12 postgresql-client-11 build-essential libxmlsec1-dev pkg-config libmaxminddb0 && \
-    apt-get clean && \
+    apt-get install -y --no-install-recommends libpq-dev postgresql-client build-essential libxmlsec1-dev pkg-config libmaxminddb0 && \
     pip install -r /requirements.txt --no-cache-dir && \
-    apt-get remove --purge -y build-essential && \
+    apt-get remove --purge -y build-essential git && \
     apt-get autoremove --purge -y && \
-    # This is quite hacky, but docker has no guaranteed Group ID
-    # we could instead check for the GID of the socket and add the user dynamically,
-    # but then we have to drop permmissions later
-    groupadd -g 998 docker_998 && \
-    groupadd -g 999 docker_999 && \
+    apt-get clean && \
+    rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
-    usermod -a -G docker_998 authentik && \
-    usermod -a -G docker_999 authentik && \
     mkdir /backups && \
     chown authentik:authentik /backups
 
 COPY ./authentik/ /authentik
 COPY ./pyproject.toml /
 COPY ./xml /xml
+COPY ./tests /tests
 COPY ./manage.py /
 COPY ./lifecycle/ /lifecycle
+COPY --from=builder /work/authentik /authentik-proxy
 
 USER authentik
-STOPSIGNAL SIGINT
 ENV TMPDIR /dev/shm/
 ENV PYTHONUBUFFERED 1
 ENTRYPOINT [ "/lifecycle/bootstrap.sh" ]

Makefile

@@ -1,4 +1,9 @@
-all: lint-fix lint coverage gen
+.SHELLFLAGS += -x -e
+PWD = $(shell pwd)
+UID = $(shell id -u)
+GID = $(shell id -g)
+
+all: lint-fix lint test gen
 
 test-integration:
 	k3d cluster create || exit 0
@@ -8,7 +13,7 @@ test-integration:
 test-e2e:
 	coverage run manage.py test --failfast -v 3 tests/e2e
 
-coverage:
+test:
 	coverage run manage.py test -v 3 authentik
 	coverage html
 	coverage report
@@ -22,16 +27,42 @@ lint:
 	bandit -r authentik tests lifecycle -x node_modules
 	pylint authentik tests lifecycle
 
-gen: coverage
-	./manage.py generate_swagger -o swagger.yaml -f yaml
+gen-build:
+	./manage.py spectacular --file schema.yml
 
-local-stack:
-	export AUTHENTIK_TAG=testing
-	docker build -t beryju/authentik:testng .
-	docker-compose up -d
-	docker-compose run --rm server migrate
+gen-clean:
+	rm -rf web/api/src/
+	rm -rf api/
 
-build-static:
-	docker-compose -f scripts/ci.docker-compose.yml up -d
-	docker build -t beryju/authentik-static -f static.Dockerfile --network=scripts_default .
-	docker-compose -f scripts/ci.docker-compose.yml down -v
+gen-web:
+	docker run \
+		--rm -v ${PWD}:/local \
+		--user ${UID}:${GID} \
+		openapitools/openapi-generator-cli generate \
+		-i /local/schema.yml \
+		-g typescript-fetch \
+		-o /local/web/api \
+		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+	cd web/api && npx tsc
+
+gen-outpost:
+	docker run \
+		--rm -v ${PWD}:/local \
+		--user ${UID}:${GID} \
+		openapitools/openapi-generator-cli generate \
+		--git-host goauthentik.io \
+		--git-repo-id outpost \
+		--git-user-id api \
+		-i /local/schema.yml \
+		-g go \
+		-o /local/api \
+		--additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true
+	rm -f api/go.mod api/go.sum
+
+gen: gen-build gen-clean gen-web gen-outpost
+
+migrate:
+	python -m lifecycle.migrate
+
+run:
+	go run -v cmd/server/main.go

Pipfile

@@ -11,7 +11,7 @@ channels-redis = "*"
 dacite = "*"
 defusedxml = "*"
 django = "*"
-django-dbbackup = "*"
+django-dbbackup = { git = 'https://github.com/django-dbbackup/django-dbbackup.git', ref = '9d1909c30a3271c8c9c8450add30d6e0b996e145' }
 django-filter = "*"
 django-guardian = "*"
 django-model-utils = "*"
@@ -22,7 +22,7 @@ django-storages = "*"
 djangorestframework = "*"
 djangorestframework-guardian = "*"
 docker = "*"
-drf_yasg = "*"
+drf-spectacular = "*"
 facebook-sdk = "*"
 geoip2 = "*"
 gunicorn = "*"
@@ -32,7 +32,7 @@ lxml = ">=4.6.3"
 packaging = "*"
 psycopg2-binary = "*"
 pycryptodome = "*"
-pyjwkest = "*"
+pyjwt = "*"
 pyyaml = "*"
 requests-oauthlib = "*"
 sentry-sdk = "*"
@@ -44,13 +44,17 @@ urllib3 = {extras = ["secure"],version = "*"}
 uvicorn = {extras = ["standard"],version = "*"}
 webauthn = "*"
 xmlsec = "*"
+duo-client = "*"
+ua-parser = "*"
+deepmerge = "*"
+colorama = "*"
 
 [requires]
 python_version = "3.9"
 
 [dev-packages]
 bandit = "*"
-black = "==20.8b1"
+black = "==21.5b1"
 bump2version = "*"
 colorama = "*"
 coverage = "*"
@@ -59,3 +63,4 @@ pylint-django = "*"
 pytest = "*"
 pytest-django = "*"
 selenium = "*"
+requests-mock = "*"

README.md

@@ -4,13 +4,14 @@
 
 ---
 
-[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/KPnmtNWy)
-[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/1?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=1)
-[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/1?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=1)
-[![Code Coverage](https://img.shields.io/codecov/c/gh/beryju/authentik?style=flat-square)](https://codecov.io/gh/BeryJu/authentik)
+[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/jg33eMhnj6)
+[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/6?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/6?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=flat-square)](https://codecov.io/gh/goauthentik/authentik)
 ![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=flat-square)
 ![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=flat-square)
-![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/BeryJu/authentik?style=flat-square)
+![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/goauthentik/authentik?style=flat-square)
+[Transifex](https://www.transifex.com/beryjuorg/authentik/)
 
 ## What is authentik?
 
@@ -20,7 +21,7 @@ authentik is an open-source Identity Provider focused on flexibility and versati
 
 For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/)
 
-For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
+For bigger setups, there is a Helm Chart [here])(https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
 
 ## Screenshots
 
@@ -31,7 +32,7 @@ Light | Dark
 
 ## Development
 
-See [Development Documentation](https://goauthentik.io/docs/development/local-dev-environment)
+See [Development Documentation](https://goauthentik.io/developer-docs/)
 
 ## Security
 

SECURITY.md

@@ -2,10 +2,13 @@
 
 ## Supported Versions
 
+(.x being the latest patch release for each version)
+
 | Version    | Supported          |
 | ---------- | ------------------ |
-| 2021.3.x   | :white_check_mark: |
-| 2021.4.x   | :white_check_mark: |
+| 2021.5.x   | :white_check_mark: |
+| 2021.6.x   | :white_check_mark: |
+| 2021.7.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

authentik/__init__.py

@@ -1,3 +1,3 @@
 """authentik"""
-__version__ = "2021.4.1-rc1"
+__version__ = "2021.7.3"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"

authentik/admin/api/meta.py

@@ -1,5 +1,5 @@
 """Meta API"""
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework.fields import CharField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
@@ -22,7 +22,7 @@ class AppsViewSet(ViewSet):
 
     permission_classes = [IsAdminUser]
 
-    @swagger_auto_schema(responses={200: AppSerializer(many=True)})
+    @extend_schema(responses={200: AppSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """List current messages and pass into Serializer"""
         data = []

authentik/admin/api/metrics.py

@@ -7,12 +7,12 @@ from django.db.models import Count, ExpressionWrapper, F
 from django.db.models.fields import DurationField
 from django.db.models.functions import ExtractHour
 from django.utils.timezone import now
-from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
+from drf_spectacular.utils import extend_schema, extend_schema_field
 from rest_framework.fields import IntegerField, SerializerMethodField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.viewsets import ViewSet
+from rest_framework.views import APIView
 
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.models import Event, EventAction
@@ -58,24 +58,24 @@ class LoginMetricsSerializer(PassiveSerializer):
     logins_per_1h = SerializerMethodField()
     logins_failed_per_1h = SerializerMethodField()
 
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
         """Get successful logins per hour for the last 24 hours"""
         return get_events_per_1h(action=EventAction.LOGIN)
 
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_failed_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
         return get_events_per_1h(action=EventAction.LOGIN_FAILED)
 
 
-class AdministrationMetricsViewSet(ViewSet):
+class AdministrationMetricsViewSet(APIView):
     """Login Metrics per 1h"""
 
     permission_classes = [IsAdminUser]
 
-    @swagger_auto_schema(responses={200: LoginMetricsSerializer(many=False)})
-    def list(self, request: Request) -> Response:
+    @extend_schema(responses={200: LoginMetricsSerializer(many=False)})
+    def get(self, request: Request) -> Response:
         """Login Metrics per 1h"""
         serializer = LoginMetricsSerializer(True)
         return Response(serializer.data)

authentik/admin/api/system.py

@@ -0,0 +1,91 @@
+"""authentik administration overview"""
+import os
+import platform
+from datetime import datetime
+from sys import version as python_version
+from typing import TypedDict
+
+from django.utils.timezone import now
+from drf_spectacular.utils import extend_schema
+from gunicorn import version_info as gunicorn_version
+from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
+from rest_framework.fields import SerializerMethodField
+from rest_framework.permissions import IsAdminUser
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from authentik.core.api.utils import PassiveSerializer
+
+
+class RuntimeDict(TypedDict):
+    """Runtime information"""
+
+    python_version: str
+    gunicorn_version: str
+    environment: str
+    architecture: str
+    platform: str
+    uname: str
+
+
+class SystemSerializer(PassiveSerializer):
+    """Get system information."""
+
+    http_headers = SerializerMethodField()
+    http_host = SerializerMethodField()
+    http_is_secure = SerializerMethodField()
+    runtime = SerializerMethodField()
+    tenant = SerializerMethodField()
+    server_time = SerializerMethodField()
+
+    def get_http_headers(self, request: Request) -> dict[str, str]:
+        """Get HTTP Request headers"""
+        headers = {}
+        for key, value in request.META.items():
+            if not isinstance(value, str):
+                continue
+            headers[key] = value
+        return headers
+
+    def get_http_host(self, request: Request) -> str:
+        """Get HTTP host"""
+        return request._request.get_host()
+
+    def get_http_is_secure(self, request: Request) -> bool:
+        """Get HTTP Secure flag"""
+        return request._request.is_secure()
+
+    def get_runtime(self, request: Request) -> RuntimeDict:
+        """Get versions"""
+        return {
+            "python_version": python_version,
+            "gunicorn_version": ".".join(str(x) for x in gunicorn_version),
+            "environment": "kubernetes"
+            if SERVICE_HOST_ENV_NAME in os.environ
+            else "compose",
+            "architecture": platform.machine(),
+            "platform": platform.platform(),
+            "uname": " ".join(platform.uname()),
+        }
+
+    def get_tenant(self, request: Request) -> str:
+        """Currently active tenant"""
+        return str(request._request.tenant)
+
+    def get_server_time(self, request: Request) -> datetime:
+        """Current server time"""
+        return now()
+
+
+class SystemView(APIView):
+    """Get system information."""
+
+    permission_classes = [IsAdminUser]
+    pagination_class = None
+    filter_backends = []
+
+    @extend_schema(responses={200: SystemSerializer(many=False)})
+    def get(self, request: Request) -> Response:
+        """Get system information."""
+        return Response(SystemSerializer(request).data)

authentik/admin/api/tasks.py

@@ -4,7 +4,8 @@ from importlib import import_module
 from django.contrib import messages
 from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
 from rest_framework.permissions import IsAdminUser
@@ -21,7 +22,7 @@ class TaskSerializer(PassiveSerializer):
 
     task_name = CharField()
     task_description = CharField()
-    task_finish_timestamp = DateTimeField(source="finish_timestamp")
+    task_finish_timestamp = DateTimeField(source="finish_time")
 
     status = ChoiceField(
         source="result.status.name",
@@ -29,14 +30,32 @@ class TaskSerializer(PassiveSerializer):
     )
     messages = ListField(source="result.messages")
 
+    def to_representation(self, instance):
+        """When a new version of authentik adds fields to TaskInfo,
+        the API will fail with an AttributeError, as the classes
+        are pickled in cache. In that case, just delete the info"""
+        try:
+            return super().to_representation(instance)
+        except AttributeError:
+            if isinstance(self.instance, list):
+                for inst in self.instance:
+                    inst.delete()
+            else:
+                self.instance.delete()
+            return {}
+
 
 class TaskViewSet(ViewSet):
     """Read-only view set that returns all background tasks"""
 
     permission_classes = [IsAdminUser]
+    serializer_class = TaskSerializer
 
-    @swagger_auto_schema(
-        responses={200: TaskSerializer(many=False), 404: "Task not found"}
+    @extend_schema(
+        responses={
+            200: TaskSerializer(many=False),
+            404: OpenApiResponse(description="Task not found"),
+        }
     )
     # pylint: disable=invalid-name
     def retrieve(self, request: Request, pk=None) -> Response:
@@ -46,18 +65,19 @@ class TaskViewSet(ViewSet):
             raise Http404
         return Response(TaskSerializer(task, many=False).data)
 
-    @swagger_auto_schema(responses={200: TaskSerializer(many=True)})
+    @extend_schema(responses={200: TaskSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """List system tasks"""
         tasks = sorted(TaskInfo.all().values(), key=lambda task: task.task_name)
         return Response(TaskSerializer(tasks, many=True).data)
 
-    @swagger_auto_schema(
+    @extend_schema(
+        request=OpenApiTypes.NONE,
         responses={
-            204: "Task retried successfully",
-            404: "Task not found",
-            500: "Failed to retry task",
-        }
+            204: OpenApiResponse(description="Task retried successfully"),
+            404: OpenApiResponse(description="Task not found"),
+            500: OpenApiResponse(description="Failed to retry task"),
+        },
     )
     @action(detail=True, methods=["post"])
     # pylint: disable=invalid-name

authentik/admin/api/version.py

@@ -2,14 +2,13 @@
 from os import environ
 
 from django.core.cache import cache
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from packaging.version import parse
 from rest_framework.fields import SerializerMethodField
-from rest_framework.mixins import ListModelMixin
-from rest_framework.permissions import IsAdminUser
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.viewsets import GenericViewSet
+from rest_framework.views import APIView
 
 from authentik import ENV_GIT_HASH_KEY, __version__
 from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
@@ -47,15 +46,14 @@ class VersionSerializer(PassiveSerializer):
         )
 
 
-class VersionViewSet(ListModelMixin, GenericViewSet):
+class VersionView(APIView):
     """Get running and latest version."""
 
-    permission_classes = [IsAdminUser]
+    permission_classes = [IsAuthenticated]
+    pagination_class = None
+    filter_backends = []
 
-    def get_queryset(self):  # pragma: no cover
-        return None
-
-    @swagger_auto_schema(responses={200: VersionSerializer(many=False)})
-    def list(self, request: Request) -> Response:
+    @extend_schema(responses={200: VersionSerializer(many=False)})
+    def get(self, request: Request) -> Response:
         """Get running and latest version."""
         return Response(VersionSerializer(True).data)

authentik/admin/api/workers.py

@@ -1,25 +1,26 @@
 """authentik administration overview"""
-from rest_framework.mixins import ListModelMixin
+from drf_spectacular.utils import extend_schema, inline_serializer
+from prometheus_client import Gauge
+from rest_framework.fields import IntegerField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import Serializer
-from rest_framework.viewsets import GenericViewSet
+from rest_framework.views import APIView
 
 from authentik.root.celery import CELERY_APP
 
+GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")
 
-class WorkerViewSet(ListModelMixin, GenericViewSet):
+
+class WorkerView(APIView):
     """Get currently connected worker count."""
 
-    serializer_class = Serializer
     permission_classes = [IsAdminUser]
 
-    def get_queryset(self):  # pragma: no cover
-        return None
-
-    def list(self, request: Request) -> Response:
+    @extend_schema(
+        responses=inline_serializer("Workers", fields={"count": IntegerField()})
+    )
+    def get(self, request: Request) -> Response:
         """Get currently connected worker count."""
-        return Response(
-            {"pagination": {"count": len(CELERY_APP.control.ping(timeout=0.5))}}
-        )
+        count = len(CELERY_APP.control.ping(timeout=0.5))
+        return Response({"count": count})

authentik/admin/settings.py

@@ -4,7 +4,7 @@ from celery.schedules import crontab
 CELERY_BEAT_SCHEDULE = {
     "admin_latest_version": {
         "task": "authentik.admin.tasks.update_latest_version",
-        "schedule": crontab(minute=0),  # Run every hour
+        "schedule": crontab(minute="*/60"),  # Run every hour
         "options": {"queue": "authentik_scheduled"},
     }
 }

authentik/admin/tasks.py

@@ -1,13 +1,15 @@
 """authentik admin tasks"""
 import re
+from os import environ
 
 from django.core.cache import cache
 from django.core.validators import URLValidator
 from packaging.version import parse
+from prometheus_client import Info
 from requests import RequestException, get
 from structlog.stdlib import get_logger
 
-from authentik import __version__
+from authentik import ENV_GIT_HASH_KEY, __version__
 from authentik.events.models import Event, EventAction
 from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
@@ -17,13 +19,27 @@ VERSION_CACHE_KEY = "authentik_latest_version"
 VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
 # Chop of the first ^ because we want to search the entire string
 URL_FINDER = URLValidator.regex.pattern[1:]
+PROM_INFO = Info("authentik_version", "Currently running authentik version")
+
+
+def _set_prom_info():
+    """Set prometheus info for version"""
+    PROM_INFO.info(
+        {
+            "version": __version__,
+            "latest": cache.get(VERSION_CACHE_KEY, ""),
+            "build_hash": environ.get(ENV_GIT_HASH_KEY, ""),
+        }
+    )
 
 
 @CELERY_APP.task(bind=True, base=MonitoredTask)
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
     try:
-        response = get("https://api.github.com/repos/beryju/authentik/releases/latest")
+        response = get(
+            "https://api.github.com/repos/goauthentik/authentik/releases/latest"
+        )
         response.raise_for_status()
         data = response.json()
         tag_name = data.get("tag_name")
@@ -34,6 +50,7 @@ def update_latest_version(self: MonitoredTask):
                 TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"]
             )
         )
+        _set_prom_info()
         # Check if upstream version is newer than what we're running,
         # and if no event exists yet, create one.
         local_version = parse(__version__)
@@ -51,3 +68,6 @@ def update_latest_version(self: MonitoredTask):
     except (RequestException, IndexError) as exc:
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
+
+
+_set_prom_info()

authentik/admin/tests/test_api.py

@@ -7,6 +7,7 @@ from django.urls import reverse
 from authentik import __version__
 from authentik.core.models import Group, User
 from authentik.core.tasks import clean_expired_models
+from authentik.events.monitored_tasks import TaskResultStatus
 
 
 class TestAdminAPI(TestCase):
@@ -30,6 +31,26 @@ class TestAdminAPI(TestCase):
             any(task["task_name"] == "clean_expired_models" for task in body)
         )
 
+    def test_tasks_single(self):
+        """Test Task API (read single)"""
+        clean_expired_models.delay()
+        response = self.client.get(
+            reverse(
+                "authentik_api:admin_system_tasks-detail",
+                kwargs={"pk": "clean_expired_models"},
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content)
+        self.assertEqual(body["status"], TaskResultStatus.SUCCESSFUL.name)
+        self.assertEqual(body["task_name"], "clean_expired_models")
+        response = self.client.get(
+            reverse(
+                "authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"}
+            )
+        )
+        self.assertEqual(response.status_code, 404)
+
     def test_tasks_retry(self):
         """Test Task API (retry)"""
         clean_expired_models.delay()
@@ -53,24 +74,29 @@ class TestAdminAPI(TestCase):
 
     def test_version(self):
         """Test Version API"""
-        response = self.client.get(reverse("authentik_api:admin_version-list"))
+        response = self.client.get(reverse("authentik_api:admin_version"))
         self.assertEqual(response.status_code, 200)
         body = loads(response.content)
         self.assertEqual(body["version_current"], __version__)
 
     def test_workers(self):
         """Test Workers API"""
-        response = self.client.get(reverse("authentik_api:admin_workers-list"))
+        response = self.client.get(reverse("authentik_api:admin_workers"))
         self.assertEqual(response.status_code, 200)
         body = loads(response.content)
-        self.assertEqual(body["pagination"]["count"], 0)
+        self.assertEqual(body["count"], 0)
 
     def test_metrics(self):
         """Test metrics API"""
-        response = self.client.get(reverse("authentik_api:admin_metrics-list"))
+        response = self.client.get(reverse("authentik_api:admin_metrics"))
         self.assertEqual(response.status_code, 200)
 
     def test_apps(self):
         """Test apps API"""
         response = self.client.get(reverse("authentik_api:apps-list"))
         self.assertEqual(response.status_code, 200)
+
+    def test_system(self):
+        """Test system API"""
+        response = self.client.get(reverse("authentik_api:admin_system"))
+        self.assertEqual(response.status_code, 200)

authentik/api/apps.py

@@ -10,3 +10,25 @@ class AuthentikAPIConfig(AppConfig):
     label = "authentik_api"
     mountpoint = "api/"
     verbose_name = "authentik API"
+
+    def ready(self) -> None:
+        from drf_spectacular.extensions import OpenApiAuthenticationExtension
+
+        from authentik.api.authentication import TokenAuthentication
+
+        # Class is defined here as it needs to be created early enough that drf-spectacular will
+        # find it, but also won't cause any import issues
+        # pylint: disable=unused-variable
+        class TokenSchema(OpenApiAuthenticationExtension):
+            """Auth schema"""
+
+            target_class = TokenAuthentication
+            name = "authentik"
+
+            def get_security_definition(self, auto_schema):
+                """Auth schema"""
+                return {
+                    "type": "apiKey",
+                    "in": "header",
+                    "name": "Authorization",
+                }

authentik/api/auth.py

@@ -1,61 +0,0 @@
-"""API Authentication"""
-from base64 import b64decode
-from binascii import Error
-from typing import Any, Optional, Union
-
-from rest_framework.authentication import BaseAuthentication, get_authorization_header
-from rest_framework.request import Request
-from structlog.stdlib import get_logger
-
-from authentik.core.models import Token, TokenIntents, User
-
-LOGGER = get_logger()
-X_AUTHENTIK_PREVENT_BASIC_HEADER = "HTTP_X_AUTHENTIK_PREVENT_BASIC"
-
-
-def token_from_header(raw_header: bytes) -> Optional[Token]:
-    """raw_header in the Format of `Basic dGVzdDp0ZXN0`"""
-    auth_credentials = raw_header.decode()
-    # Accept headers with Type format and without
-    if " " in auth_credentials:
-        auth_type, auth_credentials = auth_credentials.split()
-        if auth_type.lower() != "basic":
-            LOGGER.debug(
-                "Unsupported authentication type, denying", type=auth_type.lower()
-            )
-            return None
-    try:
-        auth_credentials = b64decode(auth_credentials.encode()).decode()
-    except (UnicodeDecodeError, Error):
-        return None
-    # Accept credentials with username and without
-    if ":" in auth_credentials:
-        _, password = auth_credentials.split(":")
-    else:
-        password = auth_credentials
-    if password == "":  # nosec
-        return None
-    tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
-    if not tokens.exists():
-        LOGGER.debug("Token not found")
-        return None
-    return tokens.first()
-
-
-class AuthentikTokenAuthentication(BaseAuthentication):
-    """Token-based authentication using HTTP Basic authentication"""
-
-    def authenticate(self, request: Request) -> Union[tuple[User, Any], None]:
-        """Token-based authentication using HTTP Basic authentication"""
-        auth = get_authorization_header(request)
-
-        token = token_from_header(auth)
-        if not token:
-            return None
-
-        return (token.user, None)
-
-    def authenticate_header(self, request: Request) -> str:
-        if X_AUTHENTIK_PREVENT_BASIC_HEADER in request._request.META:
-            return ""
-        return 'Basic realm="authentik"'

authentik/api/authentication.py

@@ -0,0 +1,57 @@
+"""API Authentication"""
+from base64 import b64decode
+from binascii import Error
+from typing import Any, Optional, Union
+
+from rest_framework.authentication import BaseAuthentication, get_authorization_header
+from rest_framework.exceptions import AuthenticationFailed
+from rest_framework.request import Request
+from structlog.stdlib import get_logger
+
+from authentik.core.models import Token, TokenIntents, User
+
+LOGGER = get_logger()
+
+
+# pylint: disable=too-many-return-statements
+def token_from_header(raw_header: bytes) -> Optional[Token]:
+    """raw_header in the Format of `Bearer dGVzdDp0ZXN0`"""
+    auth_credentials = raw_header.decode()
+    if auth_credentials == "" or " " not in auth_credentials:
+        return None
+    auth_type, _, auth_credentials = auth_credentials.partition(" ")
+    if auth_type.lower() not in ["basic", "bearer"]:
+        LOGGER.debug("Unsupported authentication type, denying", type=auth_type.lower())
+        raise AuthenticationFailed("Unsupported authentication type")
+    password = auth_credentials
+    if auth_type.lower() == "basic":
+        try:
+            auth_credentials = b64decode(auth_credentials.encode()).decode()
+        except (UnicodeDecodeError, Error):
+            raise AuthenticationFailed("Malformed header")
+        # Accept credentials with username and without
+        if ":" in auth_credentials:
+            _, password = auth_credentials.split(":")
+        else:
+            password = auth_credentials
+    if password == "":  # nosec
+        raise AuthenticationFailed("Malformed header")
+    tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
+    if not tokens.exists():
+        raise AuthenticationFailed("Token invalid/expired")
+    return tokens.first()
+
+
+class TokenAuthentication(BaseAuthentication):
+    """Token-based authentication using HTTP Bearer authentication"""
+
+    def authenticate(self, request: Request) -> Union[tuple[User, Any], None]:
+        """Token-based authentication using HTTP Bearer authentication"""
+        auth = get_authorization_header(request)
+
+        token = token_from_header(auth)
+        # None is only returned when the header isn't set.
+        if not token:
+            return None
+
+        return (token.user, None)  # pragma: no cover

authentik/api/authorization.py

@@ -0,0 +1,35 @@
+"""API Authorization"""
+from django.db.models import Model
+from django.db.models.query import QuerySet
+from rest_framework.filters import BaseFilterBackend
+from rest_framework.permissions import BasePermission
+from rest_framework.request import Request
+
+
+class OwnerFilter(BaseFilterBackend):
+    """Filter objects by their owner"""
+
+    owner_key = "user"
+
+    def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
+        return queryset.filter(**{self.owner_key: request.user})
+
+
+class OwnerPermissions(BasePermission):
+    """Authorize requests by an object's owner matching the requesting user"""
+
+    owner_key = "user"
+
+    def has_permission(self, request: Request, view) -> bool:
+        """If the user is authenticated, we allow all requests here. For listing, the
+        object-level permissions are done by the filter backend"""
+        return request.user.is_authenticated
+
+    def has_object_permission(self, request: Request, view, obj: Model) -> bool:
+        """Check if the object's owner matches the currently logged in user"""
+        if not hasattr(obj, self.owner_key):
+            return False
+        owner = getattr(obj, self.owner_key)
+        if owner != request.user:
+            return False
+        return True

authentik/api/pagination.py

@@ -30,3 +30,47 @@ class Pagination(pagination.PageNumberPagination):
                 "results": data,
             }
         )
+
+    def get_paginated_response_schema(self, schema):
+        return {
+            "type": "object",
+            "properties": {
+                "pagination": {
+                    "type": "object",
+                    "properties": {
+                        "next": {
+                            "type": "number",
+                        },
+                        "previous": {
+                            "type": "number",
+                        },
+                        "count": {
+                            "type": "number",
+                        },
+                        "current": {
+                            "type": "number",
+                        },
+                        "total_pages": {
+                            "type": "number",
+                        },
+                        "start_index": {
+                            "type": "number",
+                        },
+                        "end_index": {
+                            "type": "number",
+                        },
+                    },
+                    "required": [
+                        "next",
+                        "previous",
+                        "count",
+                        "current",
+                        "total_pages",
+                        "start_index",
+                        "end_index",
+                    ],
+                },
+                "results": schema,
+            },
+            "required": ["pagination", "results"],
+        }

authentik/api/pagination_schema.py

@@ -1,97 +0,0 @@
-"""Swagger Pagination Schema class"""
-from typing import OrderedDict
-
-from drf_yasg import openapi
-from drf_yasg.inspectors import PaginatorInspector
-
-
-class PaginationInspector(PaginatorInspector):
-    """Swagger Pagination Schema class"""
-
-    def get_paginated_response(self, paginator, response_schema):
-        """
-        :param BasePagination paginator: the paginator
-        :param openapi.Schema response_schema: the response schema that must be paged.
-        :rtype: openapi.Schema
-        """
-
-        return openapi.Schema(
-            type=openapi.TYPE_OBJECT,
-            properties=OrderedDict(
-                (
-                    (
-                        "pagination",
-                        openapi.Schema(
-                            type=openapi.TYPE_OBJECT,
-                            properties=OrderedDict(
-                                (
-                                    ("next", openapi.Schema(type=openapi.TYPE_NUMBER)),
-                                    (
-                                        "previous",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    ("count", openapi.Schema(type=openapi.TYPE_NUMBER)),
-                                    (
-                                        "current",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "total_pages",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "start_index",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                    (
-                                        "end_index",
-                                        openapi.Schema(type=openapi.TYPE_NUMBER),
-                                    ),
-                                )
-                            ),
-                            required=[
-                                "next",
-                                "previous",
-                                "count",
-                                "current",
-                                "total_pages",
-                                "start_index",
-                                "end_index",
-                            ],
-                        ),
-                    ),
-                    ("results", response_schema),
-                )
-            ),
-            required=["results", "pagination"],
-        )
-
-    def get_paginator_parameters(self, paginator):
-        """
-        Get the pagination parameters for a single paginator **instance**.
-
-        Should return :data:`.NotHandled` if this inspector
-        does not know how to handle the given `paginator`.
-
-        :param BasePagination paginator: the paginator
-        :rtype: list[openapi.Parameter]
-        """
-
-        return [
-            openapi.Parameter(
-                "page",
-                openapi.IN_QUERY,
-                "Page Index",
-                False,
-                None,
-                openapi.TYPE_INTEGER,
-            ),
-            openapi.Parameter(
-                "page_size",
-                openapi.IN_QUERY,
-                "Page Size",
-                False,
-                None,
-                openapi.TYPE_INTEGER,
-            ),
-        ]

authentik/api/schema.py

@@ -1,102 +1,77 @@
 """Error Response schema, from https://github.com/axnsan12/drf-yasg/issues/224"""
-from drf_yasg import openapi
-from drf_yasg.inspectors.view import SwaggerAutoSchema
-from drf_yasg.utils import force_real_str, is_list_view
-from rest_framework import exceptions, status
-from rest_framework.settings import api_settings
+from django.utils.translation import gettext_lazy as _
+from drf_spectacular.plumbing import (
+    ResolvedComponent,
+    build_array_type,
+    build_basic_type,
+    build_object_type,
+)
+from drf_spectacular.settings import spectacular_settings
+from drf_spectacular.types import OpenApiTypes
 
 
-class ErrorResponseAutoSchema(SwaggerAutoSchema):
-    """Inspector which includes an error schema"""
+def build_standard_type(obj, **kwargs):
+    """Build a basic type with optional add ons."""
+    schema = build_basic_type(obj)
+    schema.update(kwargs)
+    return schema
 
-    def get_generic_error_schema(self):
-        """Get a generic error schema"""
-        return openapi.Schema(
-            "Generic API Error",
-            type=openapi.TYPE_OBJECT,
-            properties={
-                "detail": openapi.Schema(
-                    type=openapi.TYPE_STRING, description="Error details"
-                ),
-                "code": openapi.Schema(
-                    type=openapi.TYPE_STRING, description="Error code"
-                ),
-            },
-            required=["detail"],
+
+GENERIC_ERROR = build_object_type(
+    description=_("Generic API Error"),
+    properties={
+        "detail": build_standard_type(OpenApiTypes.STR),
+        "code": build_standard_type(OpenApiTypes.STR),
+    },
+    required=["detail"],
+)
+VALIDATION_ERROR = build_object_type(
+    description=_("Validation Error"),
+    properties={
+        "non_field_errors": build_array_type(build_standard_type(OpenApiTypes.STR)),
+        "code": build_standard_type(OpenApiTypes.STR),
+    },
+    required=["detail"],
+    additionalProperties={},
+)
+
+
+def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
+    """Workaround to set a default response for endpoints.
+    Workaround suggested at
+    <https://github.com/tfranzel/drf-spectacular/issues/119#issuecomment-656970357>
+    for the missing drf-spectacular feature discussed in
+    <https://github.com/tfranzel/drf-spectacular/issues/101>.
+    """
+
+    def create_component(name, schema, type_=ResolvedComponent.SCHEMA):
+        """Register a component and return a reference to it."""
+        component = ResolvedComponent(
+            name=name,
+            type=type_,
+            schema=schema,
+            object=name,
         )
+        generator.registry.register_on_missing(component)
+        return component
 
-    def get_validation_error_schema(self):
-        """Get a generic validation error schema"""
-        return openapi.Schema(
-            "Validation Error",
-            type=openapi.TYPE_OBJECT,
-            properties={
-                api_settings.NON_FIELD_ERRORS_KEY: openapi.Schema(
-                    description="List of validation errors not related to any field",
-                    type=openapi.TYPE_ARRAY,
-                    items=openapi.Schema(type=openapi.TYPE_STRING),
-                ),
-            },
-            additional_properties=openapi.Schema(
-                description=(
-                    "A list of error messages for each "
-                    "field that triggered a validation error"
-                ),
-                type=openapi.TYPE_ARRAY,
-                items=openapi.Schema(type=openapi.TYPE_STRING),
-            ),
-        )
+    generic_error = create_component("GenericError", GENERIC_ERROR)
+    validation_error = create_component("ValidationError", VALIDATION_ERROR)
 
-    def get_response_serializers(self):
-        responses = super().get_response_serializers()
-        definitions = self.components.with_scope(
-            openapi.SCHEMA_DEFINITIONS
-        )  # type: openapi.ReferenceResolver
+    for path in result["paths"].values():
+        for method in path.values():
+            method["responses"].setdefault("400", validation_error.ref)
+            method["responses"].setdefault("403", generic_error.ref)
 
-        definitions.setdefault("GenericError", self.get_generic_error_schema)
-        definitions.setdefault("ValidationError", self.get_validation_error_schema)
-        definitions.setdefault("APIException", self.get_generic_error_schema)
+    result["components"] = generator.registry.build(
+        spectacular_settings.APPEND_COMPONENTS
+    )
 
-        if self.get_request_serializer() or self.get_query_serializer():
-            responses.setdefault(
-                exceptions.ValidationError.status_code,
-                openapi.Response(
-                    description=force_real_str(
-                        exceptions.ValidationError.default_detail
-                    ),
-                    schema=openapi.SchemaRef(definitions, "ValidationError"),
-                ),
-            )
-
-        security = self.get_security()
-        if security is None or len(security) > 0:
-            # Note: 401 error codes are coerced  into 403 see
-            # rest_framework/views.py:433:handle_exception
-            # This is b/c the API uses token auth which doesn't have WWW-Authenticate header
-            responses.setdefault(
-                status.HTTP_403_FORBIDDEN,
-                openapi.Response(
-                    description="Authentication credentials were invalid, absent or insufficient.",
-                    schema=openapi.SchemaRef(definitions, "GenericError"),
-                ),
-            )
-        if not is_list_view(self.path, self.method, self.view):
-            responses.setdefault(
-                exceptions.PermissionDenied.status_code,
-                openapi.Response(
-                    description="Permission denied.",
-                    schema=openapi.SchemaRef(definitions, "APIException"),
-                ),
-            )
-            responses.setdefault(
-                exceptions.NotFound.status_code,
-                openapi.Response(
-                    description=(
-                        "Object does not exist or caller "
-                        "has insufficient permissions to access it."
-                    ),
-                    schema=openapi.SchemaRef(definitions, "APIException"),
-                ),
-            )
-
-        return responses
+    # This is a workaround for authentik/stages/prompt/stage.py
+    # since the serializer PromptChallengeResponse
+    # accepts dynamic keys
+    for component in result["components"]["schemas"]:
+        if component == "PromptChallengeResponseRequest":
+            comp = result["components"]["schemas"][component]
+            comp["additionalProperties"] = {}
+    return result

authentik/api/templates/api/browser.html

@@ -0,0 +1,49 @@
+{% extends "base/skeleton.html" %}
+
+{% load static %}
+
+{% block title %}
+API Browser - {{ tenant.branding_title }}
+{% endblock %}
+
+{% block head %}
+<script type="module" src="{% static 'dist/rapidoc-min.js' %}"></script>
+{% endblock %}
+
+{% block body %}
+<script>
+function getCookie(name) {
+    let cookieValue = "";
+    if (document.cookie && document.cookie !== "") {
+        const cookies = document.cookie.split(";");
+        for (let i = 0; i < cookies.length; i++) {
+            const cookie = cookies[i].trim();
+            // Does this cookie string begin with the name we want?
+            if (cookie.substring(0, name.length + 1) === name + "=") {
+                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+                break;
+            }
+        }
+    }
+    return cookieValue;
+}
+window.addEventListener('DOMContentLoaded', (event) => {
+    const rapidocEl = document.querySelector('rapi-doc');
+    rapidocEl.addEventListener('before-try', (e) => {
+        e.detail.request.headers.append('X-CSRFToken', getCookie("authentik_csrf"));
+    });
+});
+</script>
+<rapi-doc
+    spec-url="{{ path }}"
+    heading-text="authentik"
+    theme="dark"
+    render-style="view"
+    primary-color="#fd4b2d"
+    allow-spec-url-load="false"
+    allow-spec-file-load="false">
+    <div slot="logo">
+        <img src="{% static 'dist/assets/icons/icon.png' %}" style="width:50px; height:50px" />
+    </div>
+</rapi-doc>
+{% endblock %}

authentik/api/templates/api/swagger.html

@@ -1,26 +0,0 @@
-{% extends "base/skeleton.html" %}
-
-{% load static %}
-
-{% block title %}
-authentik API Browser
-{% endblock %}
-
-{% block head %}
-<script type="module" src="{% static 'dist/rapidoc-min.js' %}"></script>
-{% endblock %}
-
-{% block body %}
-<rapi-doc
-    spec-url="{{ path }}"
-    heading-text="authentik"
-    theme="dark"
-    render-style="view"
-    primary-color="#fd4b2d"
-    allow-spec-url-load="false"
-    allow-spec-file-load="false">
-    <div slot="logo">
-        <img src="{% static 'dist/assets/icons/icon.png' %}" style="width:50px; height:50px" />
-    </div>
-</rapi-doc>
-{% endblock %}

authentik/api/tests/test_auth.py

@@ -3,15 +3,16 @@ from base64 import b64encode
 
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user
+from rest_framework.exceptions import AuthenticationFailed
 
-from authentik.api.auth import token_from_header
+from authentik.api.authentication import token_from_header
 from authentik.core.models import Token, TokenIntents
 
 
 class TestAPIAuth(TestCase):
     """Test API Authentication"""
 
-    def test_valid(self):
+    def test_valid_basic(self):
         """Test valid token"""
         token = Token.objects.create(
             intent=TokenIntents.INTENT_API, user=get_anonymous_user()
@@ -19,19 +20,30 @@ class TestAPIAuth(TestCase):
         auth = b64encode(f":{token.key}".encode()).decode()
         self.assertEqual(token_from_header(f"Basic {auth}".encode()), token)
 
+    def test_valid_bearer(self):
+        """Test valid token"""
+        token = Token.objects.create(
+            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        )
+        self.assertEqual(token_from_header(f"Bearer {token.key}".encode()), token)
+
     def test_invalid_type(self):
         """Test invalid type"""
-        self.assertIsNone(token_from_header("foo bar".encode()))
+        with self.assertRaises(AuthenticationFailed):
+            token_from_header("foo bar".encode())
 
     def test_invalid_decode(self):
         """Test invalid bas64"""
-        self.assertIsNone(token_from_header("Basic bar".encode()))
+        with self.assertRaises(AuthenticationFailed):
+            token_from_header("Basic bar".encode())
 
     def test_invalid_empty_password(self):
         """Test invalid with empty password"""
-        self.assertIsNone(token_from_header("Basic :".encode()))
+        with self.assertRaises(AuthenticationFailed):
+            token_from_header("Basic :".encode())
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
-        auth = b64encode(":abc".encode()).decode()
-        self.assertIsNone(token_from_header(f"Basic :{auth}".encode()))
+        with self.assertRaises(AuthenticationFailed):
+            auth = b64encode(":abc".encode()).decode()
+            self.assertIsNone(token_from_header(f"Basic :{auth}".encode()))

authentik/api/tests/test_config.py

@@ -0,0 +1,16 @@
+"""Test config API"""
+from json import loads
+
+from django.urls import reverse
+from rest_framework.test import APITestCase
+
+
+class TestConfig(APITestCase):
+    """Test config API"""
+
+    def test_config(self):
+        """Test YAML generation"""
+        response = self.client.get(
+            reverse("authentik_api:config"),
+        )
+        self.assertTrue(loads(response.content.decode()))

authentik/api/tests/test_decorators.py

@@ -0,0 +1,33 @@
+"""test decorators api"""
+from django.urls import reverse
+from guardian.shortcuts import assign_perm
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Application, User
+
+
+class TestAPIDecorators(APITestCase):
+    """test decorators api"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.user = User.objects.create(username="test-user")
+
+    def test_obj_perm_denied(self):
+        """Test object perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name="denied", slug="denied")
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_other_perm_denied(self):
+        """Test other perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name="denied", slug="denied")
+        assign_perm("authentik_core.view_application", self.user, app)
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)

authentik/api/tests/test_schema.py

@@ -0,0 +1,22 @@
+"""Schema generation tests"""
+from django.urls import reverse
+from rest_framework.test import APITestCase
+from yaml import safe_load
+
+
+class TestSchemaGeneration(APITestCase):
+    """Generic admin tests"""
+
+    def test_schema(self):
+        """Test generation"""
+        response = self.client.get(
+            reverse("authentik_api:schema"),
+        )
+        self.assertTrue(safe_load(response.content.decode()))
+
+    def test_browser(self):
+        """Test API Browser"""
+        response = self.client.get(
+            reverse("authentik_api:schema-browser"),
+        )
+        self.assertEqual(response.status_code, 200)

authentik/api/tests/test_swagger.py

@@ -1,24 +0,0 @@
-"""Swagger generation tests"""
-from json import loads
-
-from django.urls import reverse
-from rest_framework.test import APITestCase
-from yaml import safe_load
-
-
-class TestSwaggerGeneration(APITestCase):
-    """Generic admin tests"""
-
-    def test_yaml(self):
-        """Test YAML generation"""
-        response = self.client.get(
-            reverse("authentik_api:schema-json", kwargs={"format": ".yaml"}),
-        )
-        self.assertTrue(safe_load(response.content.decode()))
-
-    def test_json(self):
-        """Test JSON generation"""
-        response = self.client.get(
-            reverse("authentik_api:schema-json", kwargs={"format": ".json"}),
-        )
-        self.assertTrue(loads(response.content.decode()))

authentik/api/v2/config.py

@@ -1,50 +1,70 @@
 """core Configs API"""
-from drf_yasg.utils import swagger_auto_schema
-from rest_framework.fields import BooleanField, CharField, ListField
+from os import environ, path
+
+from django.conf import settings
+from django.db import models
+from drf_spectacular.utils import extend_schema
+from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
+from rest_framework.fields import BooleanField, CharField, ChoiceField, ListField
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.viewsets import ViewSet
+from rest_framework.views import APIView
 
 from authentik.core.api.utils import PassiveSerializer
+from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 
 
-class FooterLinkSerializer(PassiveSerializer):
-    """Links returned in Config API"""
+class Capabilities(models.TextChoices):
+    """Define capabilities which influence which APIs can/should be used"""
 
-    href = CharField(read_only=True)
-    name = CharField(read_only=True)
+    CAN_SAVE_MEDIA = "can_save_media"
+    CAN_GEO_IP = "can_geo_ip"
+    CAN_BACKUP = "can_backup"
 
 
 class ConfigSerializer(PassiveSerializer):
     """Serialize authentik Config into DRF Object"""
 
-    branding_logo = CharField(read_only=True)
-    branding_title = CharField(read_only=True)
-    ui_footer_links = ListField(child=FooterLinkSerializer(), read_only=True)
-
     error_reporting_enabled = BooleanField(read_only=True)
     error_reporting_environment = CharField(read_only=True)
     error_reporting_send_pii = BooleanField(read_only=True)
 
+    capabilities = ListField(child=ChoiceField(choices=Capabilities.choices))
 
-class ConfigsViewSet(ViewSet):
+
+class ConfigView(APIView):
     """Read-only view set that returns the current session's Configs"""
 
     permission_classes = [AllowAny]
 
-    @swagger_auto_schema(responses={200: ConfigSerializer(many=False)})
-    def list(self, request: Request) -> Response:
+    def get_capabilities(self) -> list[Capabilities]:
+        """Get all capabilities this server instance supports"""
+        caps = []
+        deb_test = settings.DEBUG or settings.TEST
+        if path.ismount(settings.MEDIA_ROOT) or deb_test:
+            caps.append(Capabilities.CAN_SAVE_MEDIA)
+        if GEOIP_READER.enabled:
+            caps.append(Capabilities.CAN_GEO_IP)
+        if SERVICE_HOST_ENV_NAME in environ:
+            # Running in k8s, only s3 backup is supported
+            if CONFIG.y_bool("postgresql.s3_backup"):
+                caps.append(Capabilities.CAN_BACKUP)
+        else:
+            # Running in compose, backup is always supported
+            caps.append(Capabilities.CAN_BACKUP)
+        return caps
+
+    @extend_schema(responses={200: ConfigSerializer(many=False)})
+    def get(self, request: Request) -> Response:
         """Retrive public configuration options"""
         config = ConfigSerializer(
             {
-                "branding_logo": CONFIG.y("authentik.branding.logo"),
-                "branding_title": CONFIG.y("authentik.branding.title"),
                 "error_reporting_enabled": CONFIG.y("error_reporting.enabled"),
                 "error_reporting_environment": CONFIG.y("error_reporting.environment"),
                 "error_reporting_send_pii": CONFIG.y("error_reporting.send_pii"),
-                "ui_footer_links": CONFIG.y("authentik.footer_links"),
+                "capabilities": self.get_capabilities(),
             }
         )
         return Response(config.data)

authentik/api/v2/sentry.py

@@ -0,0 +1,38 @@
+"""Sentry tunnel"""
+from json import loads
+
+from django.conf import settings
+from django.http.request import HttpRequest
+from django.http.response import HttpResponse
+from django.views.generic.base import View
+from requests import post
+from requests.exceptions import RequestException
+
+from authentik.lib.config import CONFIG
+
+
+class SentryTunnelView(View):
+    """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+
+    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
+        """Sentry tunnel, to prevent ad blockers from blocking sentry"""
+        # Only allow usage of this endpoint when error reporting is enabled
+        if not CONFIG.y_bool("error_reporting.enabled", False):
+            return HttpResponse(status=400)
+        # Body is 2 json objects separated by \n
+        full_body = request.body
+        header = loads(full_body.splitlines()[0])
+        # Check that the DSN is what we expect
+        dsn = header.get("dsn", "")
+        if dsn != settings.SENTRY_DSN:
+            return HttpResponse(status=400)
+        response = post(
+            "https://sentry.beryju.org/api/8/envelope/",
+            data=full_body,
+            headers={"Content-Type": "application/octet-stream"},
+        )
+        try:
+            response.raise_for_status()
+        except RequestException:
+            return HttpResponse(status=500)
+        return HttpResponse(status=response.status_code)

authentik/api/v2/urls.py

@@ -1,18 +1,20 @@
 """api v2 urls"""
-from django.urls import path, re_path
-from drf_yasg import openapi
-from drf_yasg.views import get_schema_view
+from django.urls import path
+from django.views.decorators.csrf import csrf_exempt
+from drf_spectacular.views import SpectacularAPIView
 from rest_framework import routers
-from rest_framework.permissions import AllowAny
 
 from authentik.admin.api.meta import AppsViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
+from authentik.admin.api.system import SystemView
 from authentik.admin.api.tasks import TaskViewSet
-from authentik.admin.api.version import VersionViewSet
-from authentik.admin.api.workers import WorkerViewSet
-from authentik.api.v2.config import ConfigsViewSet
-from authentik.api.views import SwaggerView
+from authentik.admin.api.version import VersionView
+from authentik.admin.api.workers import WorkerView
+from authentik.api.v2.config import ConfigView
+from authentik.api.v2.sentry import SentryTunnelView
+from authentik.api.views import APIBrowserView
 from authentik.core.api.applications import ApplicationViewSet
+from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
@@ -28,12 +30,12 @@ from authentik.flows.api.bindings import FlowStageBindingViewSet
 from authentik.flows.api.flows import FlowViewSet
 from authentik.flows.api.stages import StageViewSet
 from authentik.flows.views import FlowExecutorView
-from authentik.outposts.api.outpost_service_connections import (
+from authentik.outposts.api.outposts import OutpostViewSet
+from authentik.outposts.api.service_connections import (
     DockerServiceConnectionViewSet,
     KubernetesServiceConnectionViewSet,
     ServiceConnectionViewSet,
 )
-from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.policies.api.bindings import PolicyBindingViewSet
 from authentik.policies.api.policies import PolicyViewSet
 from authentik.policies.dummy.api import DummyPolicyViewSet
@@ -47,6 +49,7 @@ from authentik.policies.reputation.api import (
     ReputationPolicyViewSet,
     UserReputationViewSet,
 )
+from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
 from authentik.providers.oauth2.api.provider import OAuth2ProviderViewSet
 from authentik.providers.oauth2.api.scope import ScopeMappingViewSet
 from authentik.providers.oauth2.api.tokens import (
@@ -63,7 +66,13 @@ from authentik.sources.oauth.api.source import OAuthSourceViewSet
 from authentik.sources.oauth.api.source_connection import (
     UserOAuthSourceConnectionViewSet,
 )
+from authentik.sources.plex.api import PlexSourceViewSet
 from authentik.sources.saml.api import SAMLSourceViewSet
+from authentik.stages.authenticator_duo.api import (
+    AuthenticatorDuoStageViewSet,
+    DuoAdminDeviceViewSet,
+    DuoDeviceViewSet,
+)
 from authentik.stages.authenticator_static.api import (
     AuthenticatorStaticStageViewSet,
     StaticAdminDeviceViewSet,
@@ -95,30 +104,29 @@ from authentik.stages.user_delete.api import UserDeleteStageViewSet
 from authentik.stages.user_login.api import UserLoginStageViewSet
 from authentik.stages.user_logout.api import UserLogoutStageViewSet
 from authentik.stages.user_write.api import UserWriteStageViewSet
+from authentik.tenants.api import TenantViewSet
 
 router = routers.DefaultRouter()
 
-router.register("root/config", ConfigsViewSet, basename="configs")
-
-router.register("admin/version", VersionViewSet, basename="admin_version")
-router.register("admin/workers", WorkerViewSet, basename="admin_workers")
-router.register("admin/metrics", AdministrationMetricsViewSet, basename="admin_metrics")
 router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
 router.register("admin/apps", AppsViewSet, basename="apps")
 
+router.register("core/authenticated_sessions", AuthenticatedSessionViewSet)
 router.register("core/applications", ApplicationViewSet)
 router.register("core/groups", GroupViewSet)
 router.register("core/users", UserViewSet)
 router.register("core/user_consent", UserConsentViewSet)
 router.register("core/tokens", TokenViewSet)
+router.register("core/tenants", TenantViewSet)
 
-router.register("outposts/outposts", OutpostViewSet)
+router.register("outposts/instances", OutpostViewSet)
 router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
 router.register(
     "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
 )
 router.register("outposts/proxy", ProxyOutpostConfigViewSet)
+router.register("outposts/ldap", LDAPOutpostConfigViewSet)
 
 router.register("flows/instances", FlowViewSet)
 router.register("flows/bindings", FlowStageBindingViewSet)
@@ -135,6 +143,7 @@ router.register("sources/oauth_user_connections", UserOAuthSourceConnectionViewS
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
+router.register("sources/plex", PlexSourceViewSet)
 
 router.register("policies/all", PolicyViewSet)
 router.register("policies/bindings", PolicyBindingViewSet)
@@ -148,6 +157,7 @@ router.register("policies/reputation/ips", IPReputationViewSet)
 router.register("policies/reputation", ReputationPolicyViewSet)
 
 router.register("providers/all", ProviderViewSet)
+router.register("providers/ldap", LDAPProviderViewSet)
 router.register("providers/proxy", ProxyProviderViewSet)
 router.register("providers/oauth2", OAuth2ProviderViewSet)
 router.register("providers/saml", SAMLProviderViewSet)
@@ -160,14 +170,31 @@ router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
 router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 router.register("propertymappings/scope", ScopeMappingViewSet)
 
+router.register("authenticators/duo", DuoDeviceViewSet)
 router.register("authenticators/static", StaticDeviceViewSet)
 router.register("authenticators/totp", TOTPDeviceViewSet)
 router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
-router.register("authenticators/admin/static", StaticAdminDeviceViewSet)
-router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet)
-router.register("authenticators/admin/webauthn", WebAuthnAdminDeviceViewSet)
+router.register(
+    "authenticators/admin/duo",
+    DuoAdminDeviceViewSet,
+    basename="admin-duodevice",
+)
+router.register(
+    "authenticators/admin/static",
+    StaticAdminDeviceViewSet,
+    basename="admin-staticdevice",
+)
+router.register(
+    "authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice"
+)
+router.register(
+    "authenticators/admin/webauthn",
+    WebAuthnAdminDeviceViewSet,
+    basename="admin-webauthndevice",
+)
 
 router.register("stages/all", StageViewSet)
+router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
 router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
 router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
 router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
@@ -190,31 +217,27 @@ router.register("stages/user_write", UserWriteStageViewSet)
 router.register("stages/dummy", DummyStageViewSet)
 router.register("policies/dummy", DummyPolicyViewSet)
 
-info = openapi.Info(
-    title="authentik API",
-    default_version="v2beta",
-    contact=openapi.Contact(email="hello@beryju.org"),
-    license=openapi.License(
-        name="GNU GPLv3", url="https://github.com/BeryJu/authentik/blob/master/LICENSE"
-    ),
-)
-SchemaView = get_schema_view(info, public=True, permission_classes=(AllowAny,))
-
 urlpatterns = (
     [
-        path("", SwaggerView.as_view(), name="swagger"),
+        path("", APIBrowserView.as_view(), name="schema-browser"),
     ]
     + router.urls
     + [
+        path(
+            "admin/metrics/",
+            AdministrationMetricsViewSet.as_view(),
+            name="admin_metrics",
+        ),
+        path("admin/version/", VersionView.as_view(), name="admin_version"),
+        path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
+        path("admin/system/", SystemView.as_view(), name="admin_system"),
+        path("root/config/", ConfigView.as_view(), name="config"),
         path(
             "flows/executor/<slug:flow_slug>/",
             FlowExecutorView.as_view(),
             name="flow-executor",
         ),
-        re_path(
-            r"^swagger(?P<format>\.json|\.yaml)$",
-            SchemaView.without_ui(cache_timeout=0),
-            name="schema-json",
-        ),
+        path("sentry/", csrf_exempt(SentryTunnelView.as_view()), name="sentry"),
+        path("schema/", SpectacularAPIView.as_view(), name="schema"),
     ]
 )

authentik/api/views.py

@@ -5,18 +5,15 @@ from django.urls import reverse
 from django.views.generic import TemplateView
 
 
-class SwaggerView(TemplateView):
-    """Show swagger view based on rapi-doc"""
+class APIBrowserView(TemplateView):
+    """Show browser view based on rapi-doc"""
 
-    template_name = "api/swagger.html"
+    template_name = "api/browser.html"
 
     def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
         path = self.request.build_absolute_uri(
             reverse(
-                "authentik_api:schema-json",
-                kwargs={
-                    "format": ".json",
-                },
+                "authentik_api:schema",
             )
         )
         return super().get_context_data(path=path, **kwargs)

authentik/core/api/applications.py

@@ -1,13 +1,17 @@
 """Application API Views"""
-from typing import Optional
-
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.http.response import HttpResponseBadRequest
-from drf_yasg import openapi
-from drf_yasg.utils import no_body, swagger_auto_schema
+from django.shortcuts import get_object_or_404
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import (
+    OpenApiParameter,
+    OpenApiResponse,
+    extend_schema,
+    inline_serializer,
+)
 from rest_framework.decorators import action
-from rest_framework.fields import SerializerMethodField
+from rest_framework.fields import BooleanField, CharField, FileField, ReadOnlyField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -19,9 +23,13 @@ from structlog.stdlib import get_logger
 from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.providers import ProviderSerializer
-from authentik.core.models import Application
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.models import Application, User
 from authentik.events.models import EventAction
+from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
+from authentik.policies.types import PolicyResult
+from authentik.stages.user_login.stage import USER_LOGIN_AUTHENTICATED
 
 LOGGER = get_logger()
 
@@ -34,12 +42,10 @@ def user_app_cache_key(user_pk: str) -> str:
 class ApplicationSerializer(ModelSerializer):
     """Application Serializer"""
 
-    launch_url = SerializerMethodField()
+    launch_url = ReadOnlyField(source="get_launch_url")
     provider_obj = ProviderSerializer(source="get_provider", required=False)
 
-    def get_launch_url(self, instance: Application) -> Optional[str]:
-        """Get generated launch URL"""
-        return instance.get_launch_url()
+    meta_icon = ReadOnlyField(source="get_meta_icon")
 
     class Meta:
 
@@ -57,9 +63,12 @@ class ApplicationSerializer(ModelSerializer):
             "meta_publisher",
             "policy_engine_mode",
         ]
+        extra_kwargs = {
+            "meta_icon": {"read_only": True},
+        }
 
 
-class ApplicationViewSet(ModelViewSet):
+class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
     queryset = Application.objects.all()
@@ -91,13 +100,66 @@ class ApplicationViewSet(ModelViewSet):
                 applications.append(application)
         return applications
 
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(
+                name="for_user",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.INT,
+            )
+        ],
+        responses={
+            200: PolicyTestResultSerializer(),
+            404: OpenApiResponse(description="for_user user not found"),
+        },
+    )
+    @action(detail=True, methods=["GET"])
+    def check_access(self, request: Request, slug: str) -> Response:
+        """Check access to a single application by slug"""
+        # Don't use self.get_object as that checks for view_application permission
+        # which the user might not have, even if they have access
+        application = get_object_or_404(Application, slug=slug)
+        # If the current user is superuser, they can set `for_user`
+        for_user = request.user
+        if request.user.is_superuser and "for_user" in request.query_params:
+            for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
+        engine = PolicyEngine(application, for_user, request)
+        engine.use_cache = False
+        engine.build()
+        result = engine.result
+        response = PolicyTestResultSerializer(PolicyResult(False))
+        if result.passing:
+            response = PolicyTestResultSerializer(PolicyResult(True))
+        if request.user.is_superuser:
+            response = PolicyTestResultSerializer(result)
+        return Response(response.data)
+
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(
+                name="superuser_full_list",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.BOOL,
+            )
+        ]
+    )
     def list(self, request: Request) -> Response:
         """Custom list method that checks Policy based access instead of guardian"""
+        should_cache = request.GET.get("search", "") == ""
+
+        superuser_full_list = (
+            str(request.GET.get("superuser_full_list", "false")).lower() == "true"
+        )
+        if superuser_full_list and request.user.is_superuser:
+            return super().list(request)
+
+        # To prevent the user from having to double login when prompt is set to login
+        # and the user has just signed it. This session variable is set in the UserLoginStage
+        # and is (quite hackily) removed from the session in applications's API's List method
+        self.request.session.pop(USER_LOGIN_AUTHENTICATED, None)
         queryset = self._filter_queryset_for_list(self.get_queryset())
         self.paginate_queryset(queryset)
 
-        should_cache = request.GET.get("search", "") == ""
-
         allowed_applications = []
         if not should_cache:
             allowed_applications = self._get_allowed_applications(queryset)
@@ -115,17 +177,20 @@ class ApplicationViewSet(ModelViewSet):
         return self.get_paginated_response(serializer.data)
 
     @permission_required("authentik_core.change_application")
-    @swagger_auto_schema(
-        request_body=no_body,
-        manual_parameters=[
-            openapi.Parameter(
-                name="file",
-                in_=openapi.IN_FORM,
-                type=openapi.TYPE_FILE,
-                required=True,
+    @extend_schema(
+        request={
+            "multipart/form-data": inline_serializer(
+                "SetIcon",
+                fields={
+                    "file": FileField(required=False),
+                    "clear": BooleanField(default=False),
+                },
             )
-        ],
-        responses={200: "Success", 400: "Bad request"},
+        },
+        responses={
+            200: OpenApiResponse(description="Success"),
+            400: OpenApiResponse(description="Bad request"),
+        },
     )
     @action(
         detail=True,
@@ -139,16 +204,46 @@ class ApplicationViewSet(ModelViewSet):
         """Set application icon"""
         app: Application = self.get_object()
         icon = request.FILES.get("file", None)
-        if not icon:
+        clear = request.data.get("clear", "false").lower() == "true"
+        if clear:
+            # .delete() saves the model by default
+            app.meta_icon.delete()
+            return Response({})
+        if icon:
+            app.meta_icon = icon
+            app.save()
+            return Response({})
+        return HttpResponseBadRequest()
+
+    @permission_required("authentik_core.change_application")
+    @extend_schema(
+        request=inline_serializer("SetIconURL", fields={"url": CharField()}),
+        responses={
+            200: OpenApiResponse(description="Success"),
+            400: OpenApiResponse(description="Bad request"),
+        },
+    )
+    @action(
+        detail=True,
+        pagination_class=None,
+        filter_backends=[],
+        methods=["POST"],
+    )
+    # pylint: disable=unused-argument
+    def set_icon_url(self, request: Request, slug: str):
+        """Set application icon (as URL)"""
+        app: Application = self.get_object()
+        url = request.data.get("url", None)
+        if url is None:
             return HttpResponseBadRequest()
-        app.meta_icon = icon
+        app.meta_icon.name = url
         app.save()
         return Response({})
 
     @permission_required(
         "authentik_core.view_application", ["authentik_events.view_event"]
     )
-    @swagger_auto_schema(responses={200: CoordinateSerializer(many=True)})
+    @extend_schema(responses={200: CoordinateSerializer(many=True)})
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=unused-argument
     def metrics(self, request: Request, slug: str):

authentik/core/api/authenticated_sessions.py

@@ -0,0 +1,117 @@
+"""AuthenticatedSessions API Viewset"""
+from typing import Optional, TypedDict
+
+from django_filters.rest_framework import DjangoFilterBackend
+from guardian.utils import get_anonymous_user
+from rest_framework import mixins
+from rest_framework.fields import SerializerMethodField
+from rest_framework.filters import OrderingFilter, SearchFilter
+from rest_framework.request import Request
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import GenericViewSet
+from ua_parser import user_agent_parser
+
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.models import AuthenticatedSession
+from authentik.events.geo import GEOIP_READER, GeoIPDict
+
+
+class UserAgentDeviceDict(TypedDict):
+    """User agent device"""
+
+    brand: str
+    family: str
+    model: str
+
+
+class UserAgentOSDict(TypedDict):
+    """User agent os"""
+
+    family: str
+    major: str
+    minor: str
+    patch: str
+    patch_minor: str
+
+
+class UserAgentBrowserDict(TypedDict):
+    """User agent browser"""
+
+    family: str
+    major: str
+    minor: str
+    patch: str
+
+
+class UserAgentDict(TypedDict):
+    """User agent details"""
+
+    device: UserAgentDeviceDict
+    os: UserAgentOSDict
+    user_agent: UserAgentBrowserDict
+    string: str
+
+
+class AuthenticatedSessionSerializer(ModelSerializer):
+    """AuthenticatedSession Serializer"""
+
+    current = SerializerMethodField()
+    user_agent = SerializerMethodField()
+    geo_ip = SerializerMethodField()
+
+    def get_current(self, instance: AuthenticatedSession) -> bool:
+        """Check if session is currently active session"""
+        request: Request = self.context["request"]
+        return request._request.session.session_key == instance.session_key
+
+    def get_user_agent(self, instance: AuthenticatedSession) -> UserAgentDict:
+        """Get parsed user agent"""
+        return user_agent_parser.Parse(instance.last_user_agent)
+
+    def get_geo_ip(
+        self, instance: AuthenticatedSession
+    ) -> Optional[GeoIPDict]:  # pragma: no cover
+        """Get parsed user agent"""
+        return GEOIP_READER.city_dict(instance.last_ip)
+
+    class Meta:
+
+        model = AuthenticatedSession
+        fields = [
+            "uuid",
+            "current",
+            "user_agent",
+            "geo_ip",
+            "user",
+            "last_ip",
+            "last_user_agent",
+            "last_used",
+            "expires",
+        ]
+
+
+class AuthenticatedSessionViewSet(
+    mixins.RetrieveModelMixin,
+    mixins.DestroyModelMixin,
+    UsedByMixin,
+    mixins.ListModelMixin,
+    GenericViewSet,
+):
+    """AuthenticatedSession Viewset"""
+
+    queryset = AuthenticatedSession.objects.all()
+    serializer_class = AuthenticatedSessionSerializer
+    search_fields = ["user__username", "last_ip", "last_user_agent"]
+    filterset_fields = ["user__username", "last_ip", "last_user_agent"]
+    ordering = ["user__username"]
+    filter_backends = [
+        DjangoFilterBackend,
+        OrderingFilter,
+        SearchFilter,
+    ]
+
+    def get_queryset(self):
+        user = self.request.user if self.request else get_anonymous_user()
+        if user.is_superuser:
+            return super().get_queryset()
+        return super().get_queryset().filter(user=user.pk)

authentik/core/api/groups.py

@@ -1,24 +1,101 @@
 """Groups API Viewset"""
-from rest_framework.serializers import ModelSerializer
+from django.db.models.query import QuerySet
+from django_filters.filters import ModelMultipleChoiceFilter
+from django_filters.filterset import FilterSet
+from rest_framework.fields import BooleanField, CharField, JSONField
+from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 
-from authentik.core.models import Group
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.api.utils import is_dict
+from authentik.core.models import Group, User
+
+
+class GroupMemberSerializer(ModelSerializer):
+    """Stripped down user serializer to show relevant users for groups"""
+
+    is_superuser = BooleanField(read_only=True)
+    avatar = CharField(read_only=True)
+    attributes = JSONField(validators=[is_dict], required=False)
+    uid = CharField(read_only=True)
+
+    class Meta:
+
+        model = User
+        fields = [
+            "pk",
+            "username",
+            "name",
+            "is_active",
+            "last_login",
+            "is_superuser",
+            "email",
+            "avatar",
+            "attributes",
+            "uid",
+        ]
 
 
 class GroupSerializer(ModelSerializer):
     """Group Serializer"""
 
+    attributes = JSONField(validators=[is_dict], required=False)
+    users_obj = ListSerializer(
+        child=GroupMemberSerializer(), read_only=True, source="users", required=False
+    )
+
     class Meta:
 
         model = Group
-        fields = ["pk", "name", "is_superuser", "parent", "users", "attributes"]
+        fields = [
+            "pk",
+            "name",
+            "is_superuser",
+            "parent",
+            "users",
+            "attributes",
+            "users_obj",
+        ]
 
 
-class GroupViewSet(ModelViewSet):
+class GroupFilter(FilterSet):
+    """Filter for groups"""
+
+    members_by_username = ModelMultipleChoiceFilter(
+        field_name="users__username",
+        to_field_name="username",
+        queryset=User.objects.all(),
+    )
+    members_by_pk = ModelMultipleChoiceFilter(
+        field_name="users",
+        queryset=User.objects.all(),
+    )
+
+    class Meta:
+
+        model = Group
+        fields = ["name", "is_superuser", "members_by_pk", "members_by_username"]
+
+
+class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
     queryset = Group.objects.all()
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]
-    filterset_fields = ["name", "is_superuser"]
+    filterset_class = GroupFilter
     ordering = ["name"]
+
+    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
+        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
+        for backend in list(self.filter_backends):
+            if backend == ObjectPermissionsFilter:
+                continue
+            queryset = backend().filter_queryset(self.request, queryset, self)
+        return queryset
+
+    def filter_queryset(self, queryset):
+        if self.request.user.has_perm("authentik_core.view_group"):
+            return self._filter_queryset_for_list(queryset)
+        return super().filter_queryset(queryset)

authentik/core/api/propertymappings.py

@@ -1,7 +1,8 @@
 """PropertyMapping API Views"""
 from json import dumps
 
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework import mixins
 from rest_framework.decorators import action
@@ -13,6 +14,7 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
 from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import (
     MetaNameSerializer,
     PassiveSerializer,
@@ -64,6 +66,7 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
 class PropertyMappingViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
+    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -77,10 +80,10 @@ class PropertyMappingViewSet(
     filterset_fields = {"managed": ["isnull"]}
     ordering = ["name"]
 
-    def get_queryset(self):
+    def get_queryset(self):  # pragma: no cover
         return PropertyMapping.objects.select_subclasses()
 
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable property-mapping types"""
@@ -91,15 +94,27 @@ class PropertyMappingViewSet(
                 {
                     "name": subclass._meta.verbose_name,
                     "description": subclass.__doc__,
-                    "component": subclass.component,
+                    # pyright: reportGeneralTypeIssues=false
+                    "component": subclass().component,
+                    "model_name": subclass._meta.model_name,
                 }
             )
         return Response(TypeCreateSerializer(data, many=True).data)
 
     @permission_required("authentik_core.view_propertymapping")
-    @swagger_auto_schema(
-        request_body=PolicyTestSerializer(),
-        responses={200: PropertyMappingTestResultSerializer, 400: "Invalid parameters"},
+    @extend_schema(
+        request=PolicyTestSerializer(),
+        responses={
+            200: PropertyMappingTestResultSerializer,
+            400: OpenApiResponse(description="Invalid parameters"),
+        },
+        parameters=[
+            OpenApiParameter(
+                name="format_result",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.BOOL,
+            )
+        ],
     )
     @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     # pylint: disable=unused-argument, invalid-name
@@ -110,6 +125,8 @@ class PropertyMappingViewSet(
         if not test_params.is_valid():
             return Response(test_params.errors, status=400)
 
+        format_result = str(request.GET.get("format_result", "false")).lower() == "true"
+
         # User permission check, only allow mapping testing for users that are readable
         users = get_objects_for_user(request.user, "authentik_core.view_user").filter(
             pk=test_params.validated_data["user"].pk
@@ -124,7 +141,9 @@ class PropertyMappingViewSet(
                 self.request,
                 **test_params.validated_data.get("context", {}),
             )
-            response_data["result"] = dumps(result)
+            response_data["result"] = dumps(
+                result, indent=(4 if format_result else None)
+            )
         except Exception as exc:  # pylint: disable=broad-except
             response_data["result"] = str(exc)
             response_data["successful"] = False

authentik/core/api/providers.py

@@ -1,6 +1,6 @@
 """Provider API Views"""
 from django.utils.translation import gettext_lazy as _
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
 from rest_framework.fields import ReadOnlyField
@@ -9,6 +9,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
 from authentik.lib.utils.reflection import all_subclasses
@@ -22,7 +23,7 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 
     component = SerializerMethodField()
 
-    def get_component(self, obj: Provider):  # pragma: no cover
+    def get_component(self, obj: Provider) -> str:  # pragma: no cover
         """Get object component so that we know how to edit the object"""
         # pyright: reportGeneralTypeIssues=false
         if obj.__class__ == Provider:
@@ -48,6 +49,7 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 class ProviderViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
+    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -63,10 +65,10 @@ class ProviderViewSet(
         "application__name",
     ]
 
-    def get_queryset(self):
+    def get_queryset(self):  # pragma: no cover
         return Provider.objects.select_subclasses()
 
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable provider types"""
@@ -78,6 +80,7 @@ class ProviderViewSet(
                     "name": subclass._meta.verbose_name,
                     "description": subclass.__doc__,
                     "component": subclass().component,
+                    "model_name": subclass._meta.model_name,
                 }
             )
         data.append(
@@ -85,6 +88,7 @@ class ProviderViewSet(
                 "name": _("SAML Provider from Metadata"),
                 "description": _("Create a SAML Provider by importing its Metadata."),
                 "component": "ak-provider-saml-import-form",
+                "model_name": "",
             }
         )
         return Response(TypeCreateSerializer(data, many=True).data)

authentik/core/api/sources.py

@@ -1,7 +1,7 @@
 """Source API Views"""
 from typing import Iterable
 
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
 from rest_framework.request import Request
@@ -10,6 +10,7 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Source
 from authentik.core.types import UserSettingSerializer
@@ -24,7 +25,7 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
 
     component = SerializerMethodField()
 
-    def get_component(self, obj: Source):
+    def get_component(self, obj: Source) -> str:
         """Get object component so that we know how to edit the object"""
         # pyright: reportGeneralTypeIssues=false
         if obj.__class__ == Source:
@@ -45,12 +46,14 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
             "verbose_name",
             "verbose_name_plural",
             "policy_engine_mode",
+            "user_matching_mode",
         ]
 
 
 class SourceViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
+    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -60,10 +63,10 @@ class SourceViewSet(
     serializer_class = SourceSerializer
     lookup_field = "slug"
 
-    def get_queryset(self):
+    def get_queryset(self):  # pragma: no cover
         return Source.objects.select_subclasses()
 
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable source types"""
@@ -81,11 +84,12 @@ class SourceViewSet(
                     "name": subclass._meta.verbose_name,
                     "description": subclass.__doc__,
                     "component": component,
+                    "model_name": subclass._meta.model_name,
                 }
             )
         return Response(TypeCreateSerializer(data, many=True).data)
 
-    @swagger_auto_schema(responses={200: UserSettingSerializer(many=True)})
+    @extend_schema(responses={200: UserSettingSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def user_settings(self, request: Request) -> Response:
         """Get all sources the user can configure"""

authentik/core/api/tokens.py

@@ -1,6 +1,6 @@
 """Tokens API Viewset"""
 from django.http.response import Http404
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField
 from rest_framework.request import Request
@@ -9,9 +9,10 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import Token
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.managed.api import ManagedSerializer
 
@@ -43,11 +44,11 @@ class TokenViewSerializer(PassiveSerializer):
     key = CharField(read_only=True)
 
 
-class TokenViewSet(ModelViewSet):
+class TokenViewSet(UsedByMixin, ModelViewSet):
     """Token Viewset"""
 
     lookup_field = "identifier"
-    queryset = Token.filter_not_expired()
+    queryset = Token.objects.all()
     serializer_class = TokenSerializer
     search_fields = [
         "identifier",
@@ -60,17 +61,25 @@ class TokenViewSet(ModelViewSet):
         "intent",
         "user__username",
         "description",
+        "expires",
+        "expiring",
     ]
     ordering = ["expires"]
 
     def perform_create(self, serializer: TokenSerializer):
-        serializer.save(user=self.request.user)
+        serializer.save(
+            user=self.request.user,
+            intent=TokenIntents.INTENT_API,
+            expiring=self.request.user.attributes.get(
+                USER_ATTRIBUTE_TOKEN_EXPIRING, True
+            ),
+        )
 
     @permission_required("authentik_core.view_token_key")
-    @swagger_auto_schema(
+    @extend_schema(
         responses={
             200: TokenViewSerializer(many=False),
-            404: "Token not found or expired",
+            404: OpenApiResponse(description="Token not found or expired"),
         }
     )
     @action(detail=True, pagination_class=None, filter_backends=[])

authentik/core/api/used_by.py

@@ -0,0 +1,102 @@
+"""used_by mixin"""
+from enum import Enum
+from inspect import getmembers
+
+from django.db.models.base import Model
+from django.db.models.deletion import SET_DEFAULT, SET_NULL
+from django.db.models.manager import Manager
+from drf_spectacular.utils import extend_schema
+from guardian.shortcuts import get_objects_for_user
+from rest_framework.decorators import action
+from rest_framework.fields import CharField, ChoiceField
+from rest_framework.request import Request
+from rest_framework.response import Response
+
+from authentik.core.api.utils import PassiveSerializer
+
+
+class DeleteAction(Enum):
+    """Which action a delete will have on a used object"""
+
+    CASCADE = "cascade"
+    CASCADE_MANY = "cascade_many"
+    SET_NULL = "set_null"
+    SET_DEFAULT = "set_default"
+
+
+class UsedBySerializer(PassiveSerializer):
+    """A list of all objects referencing the queried object"""
+
+    app = CharField()
+    model_name = CharField()
+    pk = CharField()
+    name = CharField()
+    action = ChoiceField(choices=[(x.name, x.name) for x in DeleteAction])
+
+
+def get_delete_action(manager: Manager) -> str:
+    """Get the delete action from the Foreign key, falls back to cascade"""
+    if hasattr(manager, "field"):
+        if manager.field.remote_field.on_delete.__name__ == SET_NULL.__name__:
+            return DeleteAction.SET_NULL.name
+        if manager.field.remote_field.on_delete.__name__ == SET_DEFAULT.__name__:
+            return DeleteAction.SET_DEFAULT.name
+    if hasattr(manager, "source_field"):
+        return DeleteAction.CASCADE_MANY.name
+    return DeleteAction.CASCADE.name
+
+
+class UsedByMixin:
+    """Mixin to add a used_by endpoint to return a list of all objects using this object"""
+
+    @extend_schema(
+        responses={200: UsedBySerializer(many=True)},
+    )
+    @action(detail=True, pagination_class=None, filter_backends=[])
+    # pylint: disable=invalid-name, unused-argument, too-many-locals
+    def used_by(self, request: Request, *args, **kwargs) -> Response:
+        """Get a list of all objects that use this object"""
+        # pyright: reportGeneralTypeIssues=false
+        model: Model = self.get_object()
+        used_by = []
+        shadows = []
+        for attr_name, manager in getmembers(model, lambda x: isinstance(x, Manager)):
+            if attr_name == "objects":  # pragma: no cover
+                continue
+            manager: Manager
+            if manager.model._meta.abstract:
+                continue
+            app = manager.model._meta.app_label
+            model_name = manager.model._meta.model_name
+            delete_action = get_delete_action(manager)
+
+            # To make sure we only apply shadows when there are any objects,
+            # but so we only apply them once, have a simple flag for the first object
+            first_object = True
+
+            for obj in get_objects_for_user(
+                request.user, f"{app}.view_{model_name}", manager
+            ).all():
+                # Only merge shadows on first object
+                if first_object:
+                    shadows += getattr(
+                        manager.model._meta, "authentik_used_by_shadows", []
+                    )
+                first_object = False
+                serializer = UsedBySerializer(
+                    data={
+                        "app": app,
+                        "model_name": model_name,
+                        "pk": str(obj.pk),
+                        "name": str(obj),
+                        "action": delete_action,
+                    }
+                )
+                serializer.is_valid()
+                used_by.append(serializer.data)
+        # Check the shadows map and remove anything that should be shadowed
+        for idx, user in enumerate(used_by):
+            full_model_name = f"{user['app']}.{user['model_name']}"
+            if full_model_name in shadows:
+                del used_by[idx]
+        return Response(used_by)

authentik/core/api/users.py

@@ -1,24 +1,39 @@
 """User API Views"""
+from json import loads
+
+from django.db.models.query import QuerySet
 from django.urls import reverse_lazy
 from django.utils.http import urlencode
-from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
+from django_filters.filters import BooleanFilter, CharFilter
+from django_filters.filterset import FilterSet
+from drf_spectacular.utils import extend_schema, extend_schema_field
 from guardian.utils import get_anonymous_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, SerializerMethodField
+from rest_framework.fields import CharField, JSONField, SerializerMethodField
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import BooleanField, ModelSerializer
+from rest_framework.serializers import (
+    BooleanField,
+    ListSerializer,
+    ModelSerializer,
+    ValidationError,
+)
 from rest_framework.viewsets import ModelViewSet
+from rest_framework_guardian.filters import ObjectPermissionsFilter
 
 from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
-from authentik.core.api.utils import LinkSerializer, PassiveSerializer
+from authentik.core.api.groups import GroupSerializer
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
 from authentik.core.middleware import (
     SESSION_IMPERSONATE_ORIGINAL_USER,
     SESSION_IMPERSONATE_USER,
 )
 from authentik.core.models import Token, TokenIntents, User
 from authentik.events.models import EventAction
+from authentik.tenants.models import Tenant
 
 
 class UserSerializer(ModelSerializer):
@@ -26,6 +41,9 @@ class UserSerializer(ModelSerializer):
 
     is_superuser = BooleanField(read_only=True)
     avatar = CharField(read_only=True)
+    attributes = JSONField(validators=[is_dict], required=False)
+    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
+    uid = CharField(read_only=True)
 
     class Meta:
 
@@ -37,18 +55,48 @@ class UserSerializer(ModelSerializer):
             "is_active",
             "last_login",
             "is_superuser",
+            "groups",
             "email",
             "avatar",
             "attributes",
+            "uid",
         ]
 
 
+class UserSelfSerializer(ModelSerializer):
+    """User Serializer for information a user can retrieve about themselves and
+    update about themselves"""
+
+    is_superuser = BooleanField(read_only=True)
+    avatar = CharField(read_only=True)
+    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
+    uid = CharField(read_only=True)
+
+    class Meta:
+
+        model = User
+        fields = [
+            "pk",
+            "username",
+            "name",
+            "is_active",
+            "is_superuser",
+            "groups",
+            "email",
+            "avatar",
+            "uid",
+        ]
+        extra_kwargs = {
+            "is_active": {"read_only": True},
+        }
+
+
 class SessionUserSerializer(PassiveSerializer):
     """Response for the /user/me endpoint, returns the currently active user (as `user` property)
     and, if this user is being impersonated, the original user in the `original` property."""
 
-    user = UserSerializer()
-    original = UserSerializer(required=False)
+    user = UserSelfSerializer()
+    original = UserSelfSerializer(required=False)
 
 
 class UserMetricsSerializer(PassiveSerializer):
@@ -58,13 +106,13 @@ class UserMetricsSerializer(PassiveSerializer):
     logins_failed_per_1h = SerializerMethodField()
     authorizations_per_1h = SerializerMethodField()
 
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
         """Get successful logins per hour for the last 24 hours"""
         user = self.context["user"]
         return get_events_per_1h(action=EventAction.LOGIN, user__pk=user.pk)
 
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_failed_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
         user = self.context["user"]
@@ -72,7 +120,7 @@ class UserMetricsSerializer(PassiveSerializer):
             action=EventAction.LOGIN_FAILED, context__username=user.username
         )
 
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
     def get_authorizations_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
         user = self.context["user"]
@@ -81,18 +129,56 @@ class UserMetricsSerializer(PassiveSerializer):
         )
 
 
-class UserViewSet(ModelViewSet):
+class UsersFilter(FilterSet):
+    """Filter for users"""
+
+    attributes = CharFilter(
+        field_name="attributes",
+        lookup_expr="",
+        label="Attributes",
+        method="filter_attributes",
+    )
+
+    is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
+
+    # pylint: disable=unused-argument
+    def filter_attributes(self, queryset, name, value):
+        """Filter attributes by query args"""
+        try:
+            value = loads(value)
+        except ValueError:
+            raise ValidationError(detail="filter: failed to parse JSON")
+        if not isinstance(value, dict):
+            raise ValidationError(detail="filter: value must be key:value mapping")
+        qs = {}
+        for key, _value in value.items():
+            qs[f"attributes__{key}"] = _value
+        return queryset.filter(**qs)
+
+    class Meta:
+        model = User
+        fields = [
+            "username",
+            "email",
+            "name",
+            "is_active",
+            "is_superuser",
+            "attributes",
+        ]
+
+
+class UserViewSet(UsedByMixin, ModelViewSet):
     """User Viewset"""
 
     queryset = User.objects.none()
     serializer_class = UserSerializer
-    search_fields = ["username", "name", "is_active"]
-    filterset_fields = ["username", "name", "is_active"]
+    search_fields = ["username", "name", "is_active", "email"]
+    filterset_class = UsersFilter
 
-    def get_queryset(self):
+    def get_queryset(self):  # pragma: no cover
         return User.objects.all().exclude(pk=get_anonymous_user().pk)
 
-    @swagger_auto_schema(responses={200: SessionUserSerializer(many=False)})
+    @extend_schema(responses={200: SessionUserSerializer(many=False)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name
     def me(self, request: Request) -> Response:
@@ -101,14 +187,38 @@ class UserViewSet(ModelViewSet):
             data={"user": UserSerializer(request.user).data}
         )
         if SESSION_IMPERSONATE_USER in request._request.session:
-            serializer.initial_data["original"] = UserSerializer(
+            serializer.initial_data["original"] = UserSelfSerializer(
                 request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
             ).data
         serializer.is_valid()
         return Response(serializer.data)
 
+    @extend_schema(
+        request=UserSelfSerializer, responses={200: SessionUserSerializer(many=False)}
+    )
+    @action(
+        methods=["PUT"],
+        detail=False,
+        pagination_class=None,
+        filter_backends=[],
+        permission_classes=[IsAuthenticated],
+    )
+    def update_self(self, request: Request) -> Response:
+        """Allow users to change information on their own profile"""
+        data = UserSelfSerializer(
+            instance=User.objects.get(pk=request.user.pk), data=request.data
+        )
+        if not data.is_valid():
+            return Response(data.errors)
+        new_user = data.save()
+        # If we're impersonating, we need to update that user object
+        # since it caches the full object
+        if SESSION_IMPERSONATE_USER in request.session:
+            request.session[SESSION_IMPERSONATE_USER] = new_user
+        return self.me(request)
+
     @permission_required("authentik_core.view_user", ["authentik_events.view_event"])
-    @swagger_auto_schema(responses={200: UserMetricsSerializer(many=False)})
+    @extend_schema(responses={200: UserMetricsSerializer(many=False)})
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def metrics(self, request: Request, pk: int) -> Response:
@@ -119,13 +229,21 @@ class UserViewSet(ModelViewSet):
         return Response(serializer.data)
 
     @permission_required("authentik_core.reset_user_password")
-    @swagger_auto_schema(
-        responses={"200": LinkSerializer(many=False)},
+    @extend_schema(
+        responses={
+            "200": LinkSerializer(many=False),
+            "404": LinkSerializer(many=False),
+        },
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
+        tenant: Tenant = request._request.tenant
+        # Check that there is a recovery flow, if not return an error
+        flow = tenant.flow_recovery
+        if not flow:
+            return Response({"link": ""}, status=404)
         user: User = self.get_object()
         token, __ = Token.objects.get_or_create(
             identifier=f"{user.uid}-password-reset",
@@ -134,6 +252,20 @@ class UserViewSet(ModelViewSet):
         )
         querystring = urlencode({"token": token.key})
         link = request.build_absolute_uri(
-            reverse_lazy("authentik_flows:default-recovery") + f"?{querystring}"
+            reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
+            + f"?{querystring}"
         )
         return Response({"link": link})
+
+    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
+        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
+        for backend in list(self.filter_backends):
+            if backend == ObjectPermissionsFilter:
+                continue
+            queryset = backend().filter_queryset(self.request, queryset, self)
+        return queryset
+
+    def filter_queryset(self, queryset):
+        if self.request.user.has_perm("authentik_core.view_user"):
+            return self._filter_queryset_for_list(queryset)
+        return super().filter_queryset(queryset)

authentik/core/api/utils.py

@@ -1,18 +1,38 @@
 """API Utilities"""
+from typing import Any
+
 from django.db.models import Model
 from rest_framework.fields import CharField, IntegerField
-from rest_framework.serializers import Serializer, SerializerMethodField
+from rest_framework.serializers import (
+    Serializer,
+    SerializerMethodField,
+    ValidationError,
+)
+
+
+def is_dict(value: Any):
+    """Ensure a value is a dictionary, useful for JSONFields"""
+    if isinstance(value, dict):
+        return
+    raise ValidationError(
+        "Value must be a dictionary, and not have any duplicate keys."
+    )
 
 
 class PassiveSerializer(Serializer):
     """Base serializer class which doesn't implement create/update methods"""
 
-    def create(self, validated_data: dict) -> Model:
+    def create(self, validated_data: dict) -> Model:  # pragma: no cover
         return Model()
 
-    def update(self, instance: Model, validated_data: dict) -> Model:
+    def update(
+        self, instance: Model, validated_data: dict
+    ) -> Model:  # pragma: no cover
         return Model()
 
+    class Meta:
+        model = Model
+
 
 class MetaNameSerializer(PassiveSerializer):
     """Add verbose names to response"""
@@ -35,6 +55,7 @@ class TypeCreateSerializer(PassiveSerializer):
     name = CharField(required=True)
     description = CharField(required=True)
     component = CharField(required=True)
+    model_name = CharField(required=True)
 
 
 class CacheSerializer(PassiveSerializer):

authentik/core/apps.py

@@ -2,6 +2,10 @@
 from importlib import import_module
 
 from django.apps import AppConfig
+from django.db import ProgrammingError
+
+from authentik.core.signals import GAUGE_MODELS
+from authentik.lib.utils.reflection import get_apps
 
 
 class AuthentikCoreConfig(AppConfig):
@@ -15,3 +19,12 @@ class AuthentikCoreConfig(AppConfig):
     def ready(self):
         import_module("authentik.core.signals")
         import_module("authentik.core.managed")
+        try:
+            for app in get_apps():
+                for model in app.get_models():
+                    GAUGE_MODELS.labels(
+                        model_name=model._meta.model_name,
+                        app=model._meta.app_label,
+                    ).set(model.objects.count())
+        except ProgrammingError:
+            pass

authentik/core/channels.py

@@ -1,9 +1,10 @@
 """Channels base classes"""
 from channels.exceptions import DenyConnection
 from channels.generic.websocket import JsonWebsocketConsumer
+from rest_framework.exceptions import AuthenticationFailed
 from structlog.stdlib import get_logger
 
-from authentik.api.auth import token_from_header
+from authentik.api.authentication import token_from_header
 from authentik.core.models import User
 
 LOGGER = get_logger()
@@ -22,9 +23,13 @@ class AuthJsonConsumer(JsonWebsocketConsumer):
 
         raw_header = headers[b"authorization"]
 
-        token = token_from_header(raw_header)
-        if not token:
-            LOGGER.warning("Failed to authenticate")
+        try:
+            token = token_from_header(raw_header)
+            # token is only None when no header was given, in which case we deny too
+            if not token:
+                raise DenyConnection()
+        except AuthenticationFailed as exc:
+            LOGGER.warning("Failed to authenticate", exc=exc)
             raise DenyConnection()
 
         self.user = token.user

authentik/core/expression.py

@@ -3,23 +3,33 @@ from traceback import format_tb
 from typing import Optional
 
 from django.http import HttpRequest
+from guardian.utils import get_anonymous_user
 
-from authentik.core.models import User
+from authentik.core.models import PropertyMapping, User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
+from authentik.policies.types import PolicyRequest
 
 
 class PropertyMappingEvaluator(BaseEvaluator):
     """Custom Evalautor that adds some different context variables."""
 
     def set_context(
-        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
+        self,
+        user: Optional[User],
+        request: Optional[HttpRequest],
+        mapping: PropertyMapping,
+        **kwargs,
     ):
         """Update context with context from PropertyMapping's evaluate"""
+        req = PolicyRequest(user=get_anonymous_user())
+        req.obj = mapping
         if user:
+            req.user = user
             self._context["user"] = user
         if request:
-            self._context["request"] = request
+            req.http_request = request
+        self._context["request"] = req
         self._context.update(**kwargs)
 
     def handle_error(self, exc: Exception, expression_source: str):
@@ -30,9 +40,8 @@ class PropertyMappingEvaluator(BaseEvaluator):
             expression=expression_source,
             message=error_string,
         )
-        if "user" in self._context:
-            event.set_user(self._context["user"])
         if "request" in self._context:
-            event.from_http(self._context["request"])
+            req: PolicyRequest = self._context["request"]
+            event.from_http(req.http_request, req.user)
             return
         event.save()

authentik/core/middleware.py

@@ -26,6 +26,8 @@ class ImpersonateMiddleware:
 
         if SESSION_IMPERSONATE_USER in request.session:
             request.user = request.session[SESSION_IMPERSONATE_USER]
+            # Ensure that the user is active, otherwise nothing will work
+            request.user.is_active = True
 
         return self.get_response(request)
 
@@ -42,10 +44,14 @@ class RequestIDMiddleware:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
             setattr(request, "request_id", request_id)
-            LOCAL.authentik = {"request_id": request_id}
+            LOCAL.authentik = {
+                "request_id": request_id,
+                "host": request.get_host(),
+            }
         response = self.get_response(request)
         response[RESPONSE_HEADER_ID] = request.request_id
         del LOCAL.authentik["request_id"]
+        del LOCAL.authentik["host"]
         return response
 
 
@@ -54,4 +60,5 @@ def structlog_add_request_id(logger: Logger, method_name: str, event_dict):
     """If threadlocal has authentik defined, add request_id to log"""
     if hasattr(LOCAL, "authentik"):
         event_dict["request_id"] = LOCAL.authentik.get("request_id", "")
+        event_dict["host"] = LOCAL.authentik.get("host", "")
     return event_dict

authentik/core/migrations/0020_source_user_matching_mode.py

@@ -0,0 +1,40 @@
+# Generated by Django 3.2 on 2021-05-03 17:06
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0019_source_managed"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="source",
+            name="user_matching_mode",
+            field=models.TextField(
+                choices=[
+                    ("identifier", "Use the source-specific identifier"),
+                    (
+                        "email_link",
+                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
+                    ),
+                    (
+                        "email_deny",
+                        "Use the user's email address, but deny enrollment when the email address already exists.",
+                    ),
+                    (
+                        "username_link",
+                        "Link to a user with identical username address. Can have security implications when a username is used with another source.",
+                    ),
+                    (
+                        "username_deny",
+                        "Use the user's username, but deny enrollment when the username already exists.",
+                    ),
+                ],
+                default="identifier",
+                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
+            ),
+        ),
+    ]

authentik/core/migrations/0021_alter_application_slug.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.2.3 on 2021-05-14 08:48
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0020_source_user_matching_mode"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="application",
+            name="slug",
+            field=models.SlugField(
+                help_text="Internal application name, used in URLs.", unique=True
+            ),
+        ),
+    ]

authentik/core/migrations/0022_authenticatedsession.py

@@ -0,0 +1,63 @@
+# Generated by Django 3.2.3 on 2021-05-29 22:14
+
+import uuid
+
+import django.db.models.deletion
+from django.apps.registry import Apps
+from django.conf import settings
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+
+import authentik.core.models
+
+
+def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    from django.contrib.sessions.backends.cache import KEY_PREFIX
+    from django.core.cache import cache
+
+    session_keys = cache.keys(KEY_PREFIX + "*")
+    cache.delete_many(session_keys)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0021_alter_application_slug"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="AuthenticatedSession",
+            fields=[
+                (
+                    "expires",
+                    models.DateTimeField(
+                        default=authentik.core.models.default_token_duration
+                    ),
+                ),
+                ("expiring", models.BooleanField(default=True)),
+                (
+                    "uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, primary_key=True, serialize=False
+                    ),
+                ),
+                ("session_key", models.CharField(max_length=40)),
+                ("last_ip", models.TextField()),
+                ("last_user_agent", models.TextField(blank=True)),
+                ("last_used", models.DateTimeField(auto_now=True)),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "abstract": False,
+            },
+        ),
+        migrations.RunPython(migrate_sessions),
+    ]

authentik/core/migrations/0023_alter_application_meta_launch_url.py

@@ -0,0 +1,23 @@
+# Generated by Django 3.2.3 on 2021-06-02 21:51
+
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0022_authenticatedsession"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="application",
+            name="meta_launch_url",
+            field=models.TextField(
+                blank=True,
+                default="",
+                validators=[django.core.validators.URLValidator()],
+            ),
+        ),
+    ]

authentik/core/migrations/0024_alter_token_identifier.py

@@ -0,0 +1,35 @@
+# Generated by Django 3.2.3 on 2021-06-03 09:33
+
+from django.apps.registry import Apps
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+from django.db.models import Count
+
+
+def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    db_alias = schema_editor.connection.alias
+    Token = apps.get_model("authentik_core", "token")
+    identifiers = (
+        Token.objects.using(db_alias)
+        .values("identifier")
+        .annotate(identifier_count=Count("identifier"))
+        .filter(identifier_count__gt=1)
+    )
+    for ident in identifiers:
+        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0023_alter_application_meta_launch_url"),
+    ]
+
+    operations = [
+        migrations.RunPython(fix_duplicates),
+        migrations.AlterField(
+            model_name="token",
+            name="identifier",
+            field=models.SlugField(max_length=255, unique=True),
+        ),
+    ]

authentik/core/migrations/0025_alter_application_meta_icon.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.2.3 on 2021-06-05 19:04
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0024_alter_token_identifier"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="application",
+            name="meta_icon",
+            field=models.FileField(
+                default=None, null=True, upload_to="application-icons/"
+            ),
+        ),
+    ]

authentik/core/migrations/0026_alter_application_meta_icon.py

@@ -0,0 +1,20 @@
+# Generated by Django 3.2.5 on 2021-07-09 17:27
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("authentik_core", "0025_alter_application_meta_icon"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="application",
+            name="meta_icon",
+            field=models.FileField(
+                default=None, max_length=500, null=True, upload_to="application-icons/"
+            ),
+        ),
+    ]

authentik/core/models.py

@@ -5,11 +5,13 @@ from typing import Any, Optional, Type
 from urllib.parse import urlencode
 from uuid import uuid4
 
+from deepmerge import always_merger
 from django.conf import settings
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
+from django.core import validators
 from django.db import models
-from django.db.models import Q, QuerySet
+from django.db.models import Q, QuerySet, options
 from django.http import HttpRequest
 from django.templatetags.static import static
 from django.utils.functional import cached_property
@@ -23,22 +25,28 @@ from structlog.stdlib import get_logger
 
 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.signals import password_changed
-from authentik.core.types import UILoginButton
-from authentik.flows.challenge import Challenge
+from authentik.core.types import UILoginButton, UserSettingSerializer
 from authentik.flows.models import Flow
 from authentik.lib.config import CONFIG
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
+from authentik.lib.utils.http import get_client_ip
 from authentik.managed.models import ManagedModel
 from authentik.policies.models import PolicyBindingModel
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
 USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
+USER_ATTRIBUTE_SOURCES = "goauthentik.io/user/sources"
+USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
+USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
 
 GRAVATAR_URL = "https://secure.gravatar.com"
 DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
 
 
+options.DEFAULT_NAMES = options.DEFAULT_NAMES + ("authentik_used_by_shadows",)
+
+
 def default_token_duration():
     """Default duration a Token is valid"""
     return now() + timedelta(minutes=30)
@@ -108,8 +116,8 @@ class User(GuardianUserMixin, AbstractUser):
         including the users attributes"""
         final_attributes = {}
         for group in self.ak_groups.all().order_by("name"):
-            final_attributes.update(group.attributes)
-        final_attributes.update(self.attributes)
+            always_merger.merge(final_attributes, group.attributes)
+        always_merger.merge(final_attributes, self.attributes)
         return final_attributes
 
     @cached_property
@@ -136,21 +144,25 @@ class User(GuardianUserMixin, AbstractUser):
     @property
     def avatar(self) -> str:
         """Get avatar, depending on authentik.avatar setting"""
-        mode = CONFIG.raw.get("authentik").get("avatars")
+        mode: str = CONFIG.y("avatars", "none")
         if mode == "none":
             return DEFAULT_AVATAR
+        # gravatar uses md5 for their URLs, so md5 can't be avoided
+        mail_hash = md5(self.email.encode("utf-8")).hexdigest()  # nosec
         if mode == "gravatar":
             parameters = [
                 ("s", "158"),
                 ("r", "g"),
             ]
-            # gravatar uses md5 for their URLs, so md5 can't be avoided
-            mail_hash = md5(self.email.encode("utf-8")).hexdigest()  # nosec
             gravatar_url = (
                 f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
             )
             return escape(gravatar_url)
-        raise ValueError(f"Invalid avatar mode {mode}")
+        return mode % {
+            "username": self.username,
+            "mail_hash": mail_hash,
+            "upn": self.attributes.get("upn", ""),
+        }
 
     class Meta:
 
@@ -206,17 +218,38 @@ class Application(PolicyBindingModel):
     add custom fields and other properties"""
 
     name = models.TextField(help_text=_("Application's display Name."))
-    slug = models.SlugField(help_text=_("Internal application name, used in URLs."))
+    slug = models.SlugField(
+        help_text=_("Internal application name, used in URLs."), unique=True
+    )
     provider = models.OneToOneField(
         "Provider", null=True, blank=True, default=None, on_delete=models.SET_DEFAULT
     )
 
-    meta_launch_url = models.URLField(default="", blank=True)
+    meta_launch_url = models.TextField(
+        default="", blank=True, validators=[validators.URLValidator()]
+    )
     # For template applications, this can be set to /static/authentik/applications/*
-    meta_icon = models.FileField(upload_to="application-icons/", default="", blank=True)
+    meta_icon = models.FileField(
+        upload_to="application-icons/",
+        default=None,
+        null=True,
+        max_length=500,
+    )
     meta_description = models.TextField(default="", blank=True)
     meta_publisher = models.TextField(default="", blank=True)
 
+    @property
+    def get_meta_icon(self) -> Optional[str]:
+        """Get the URL to the App Icon image. If the name is /static or starts with http
+        it is returned as-is"""
+        if not self.meta_icon:
+            return None
+        if self.meta_icon.name.startswith("http") or self.meta_icon.name.startswith(
+            "/static"
+        ):
+            return self.meta_icon.name
+        return self.meta_icon.url
+
     def get_launch_url(self) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         if self.meta_launch_url:
@@ -240,6 +273,30 @@ class Application(PolicyBindingModel):
         verbose_name_plural = _("Applications")
 
 
+class SourceUserMatchingModes(models.TextChoices):
+    """Different modes a source can handle new/returning users"""
+
+    IDENTIFIER = "identifier", _("Use the source-specific identifier")
+    EMAIL_LINK = "email_link", _(
+        (
+            "Link to a user with identical email address. Can have security implications "
+            "when a source doesn't validate email addresses."
+        )
+    )
+    EMAIL_DENY = "email_deny", _(
+        "Use the user's email address, but deny enrollment when the email address already exists."
+    )
+    USERNAME_LINK = "username_link", _(
+        (
+            "Link to a user with identical username address. Can have security implications "
+            "when a username is used with another source."
+        )
+    )
+    USERNAME_DENY = "username_deny", _(
+        "Use the user's username, but deny enrollment when the username already exists."
+    )
+
+
 class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     """Base Authentication source, i.e. an OAuth Provider, SAML Remote or LDAP Server"""
 
@@ -272,6 +329,17 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         related_name="source_enrollment",
     )
 
+    user_matching_mode = models.TextField(
+        choices=SourceUserMatchingModes.choices,
+        default=SourceUserMatchingModes.IDENTIFIER,
+        help_text=_(
+            (
+                "How the source determines if an existing user should be authenticated or "
+                "a new user enrolled."
+            )
+        ),
+    )
+
     objects = InheritanceManager()
 
     @property
@@ -286,9 +354,9 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         return None
 
     @property
-    def ui_user_settings(self) -> Optional[Challenge]:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         """Entrypoint to integrate with User settings. Can either return None if no
-        user settings are available, or a challenge."""
+        user settings are available, or UserSettingSerializer."""
         return None
 
     def __str__(self):
@@ -301,6 +369,8 @@ class UserSourceConnection(CreatedUpdatedModel):
     user = models.ForeignKey(User, on_delete=models.CASCADE)
     source = models.ForeignKey(Source, on_delete=models.CASCADE)
 
+    objects = InheritanceManager()
+
     class Meta:
 
         unique_together = (("user", "source"),)
@@ -312,6 +382,13 @@ class ExpiringModel(models.Model):
     expires = models.DateTimeField(default=default_token_duration)
     expiring = models.BooleanField(default=True)
 
+    def expire_action(self, *args, **kwargs):
+        """Handler which is called when this object is expired. By
+        default the object is deleted. This is less efficient compared
+        to bulk deleting objects, but classes like Token() need to change
+        values instead of being deleted."""
+        return self.delete(*args, **kwargs)
+
     @classmethod
     def filter_not_expired(cls, **kwargs) -> QuerySet:
         """Filer for tokens which are not expired yet or are not expiring,
@@ -348,7 +425,7 @@ class Token(ManagedModel, ExpiringModel):
     """Token used to authenticate the User for API Access or confirm another Stage like Email."""
 
     token_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
-    identifier = models.SlugField(max_length=255)
+    identifier = models.SlugField(max_length=255, unique=True)
     key = models.TextField(default=default_token_key)
     intent = models.TextField(
         choices=TokenIntents.choices, default=TokenIntents.INTENT_VERIFICATION
@@ -356,6 +433,19 @@ class Token(ManagedModel, ExpiringModel):
     user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
     description = models.TextField(default="", blank=True)
 
+    def expire_action(self, *args, **kwargs):
+        """Handler which is called when this object is expired."""
+        from authentik.events.models import Event, EventAction
+
+        self.key = default_token_key()
+        self.expires = default_token_duration()
+        self.save(*args, **kwargs)
+        Event.new(
+            action=EventAction.SECRET_ROTATE,
+            token=self,
+            message=f"Token {self.identifier}'s secret was rotated.",
+        ).save()
+
     def __str__(self):
         description = f"{self.identifier}"
         if self.expiring:
@@ -399,11 +489,11 @@ class PropertyMapping(SerializerModel, ManagedModel):
         from authentik.core.expression import PropertyMappingEvaluator
 
         evaluator = PropertyMappingEvaluator()
-        evaluator.set_context(user, request, **kwargs)
+        evaluator.set_context(user, request, self, **kwargs)
         try:
             return evaluator.evaluate(self.expression)
-        except (ValueError, SyntaxError) as exc:
-            raise PropertyMappingExpressionException from exc
+        except Exception as exc:
+            raise PropertyMappingExpressionException(str(exc)) from exc
 
     def __str__(self):
         return f"Property Mapping {self.name}"
@@ -412,3 +502,37 @@ class PropertyMapping(SerializerModel, ManagedModel):
 
         verbose_name = _("Property Mapping")
         verbose_name_plural = _("Property Mappings")
+
+
+class AuthenticatedSession(ExpiringModel):
+    """Additional session class for authenticated users. Augments the standard django session
+    to achieve the following:
+        - Make it queryable by user
+        - Have a direct connection to user objects
+        - Allow users to view their own sessions and terminate them
+        - Save structured and well-defined information.
+    """
+
+    uuid = models.UUIDField(default=uuid4, primary_key=True)
+
+    session_key = models.CharField(max_length=40)
+    user = models.ForeignKey(User, on_delete=models.CASCADE)
+
+    last_ip = models.TextField()
+    last_user_agent = models.TextField(blank=True)
+    last_used = models.DateTimeField(auto_now=True)
+
+    @staticmethod
+    def from_request(
+        request: HttpRequest, user: User
+    ) -> Optional["AuthenticatedSession"]:
+        """Create a new session from a http request"""
+        if not hasattr(request, "session") or not request.session.session_key:
+            return None
+        return AuthenticatedSession(
+            session_key=request.session.session_key,
+            user=user,
+            last_ip=get_client_ip(request),
+            last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
+            expires=request.session.get_expiry_date(),
+        )

authentik/core/signals.py

@@ -1,20 +1,39 @@
 """authentik core signals"""
+from typing import TYPE_CHECKING, Type
+
+from django.contrib.auth.signals import user_logged_in, user_logged_out
+from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
 from django.core.signals import Signal
-from django.db.models.signals import post_save
+from django.db.models import Model
+from django.db.models.signals import post_save, pre_delete
 from django.dispatch import receiver
+from django.http.request import HttpRequest
+from prometheus_client import Gauge
 
 # Arguments: user: User, password: str
 password_changed = Signal()
 
+GAUGE_MODELS = Gauge(
+    "authentik_models", "Count of various objects", ["model_name", "app"]
+)
+
+if TYPE_CHECKING:
+    from authentik.core.models import AuthenticatedSession, User
+
 
 @receiver(post_save)
 # pylint: disable=unused-argument
-def post_save_application(sender, instance, created: bool, **_):
+def post_save_application(sender: type[Model], instance, created: bool, **_):
     """Clear user's application cache upon application creation"""
     from authentik.core.api.applications import user_app_cache_key
     from authentik.core.models import Application
 
+    GAUGE_MODELS.labels(
+        model_name=sender._meta.model_name,
+        app=sender._meta.app_label,
+    ).set(sender.objects.count())
+
     if sender != Application:
         return
     if not created:  # pragma: no cover
@@ -22,3 +41,39 @@ def post_save_application(sender, instance, created: bool, **_):
     # Also delete user application cache
     keys = cache.keys(user_app_cache_key("*"))
     cache.delete_many(keys)
+
+
+@receiver(user_logged_in)
+# pylint: disable=unused-argument
+def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
+    """Create an AuthenticatedSession from request"""
+    from authentik.core.models import AuthenticatedSession
+
+    session = AuthenticatedSession.from_request(request, user)
+    if session:
+        session.save()
+
+
+@receiver(user_logged_out)
+# pylint: disable=unused-argument
+def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
+    """Delete AuthenticatedSession if it exists"""
+    from authentik.core.models import AuthenticatedSession
+
+    AuthenticatedSession.objects.filter(
+        session_key=request.session.session_key
+    ).delete()
+
+
+@receiver(pre_delete)
+def authenticated_session_delete(
+    sender: Type[Model], instance: "AuthenticatedSession", **_
+):
+    """Delete session when authenticated session is deleted"""
+    from authentik.core.models import AuthenticatedSession
+
+    if sender != AuthenticatedSession:
+        return
+
+    cache_key = f"{KEY_PREFIX}{instance.session_key}"
+    cache.delete(cache_key)

authentik/core/sources/flow_manager.py

@@ -0,0 +1,289 @@
+"""Source decision helper"""
+from enum import Enum
+from typing import Any, Optional, Type
+
+from django.contrib import messages
+from django.db import IntegrityError
+from django.db.models.query_utils import Q
+from django.http import HttpRequest, HttpResponse, HttpResponseBadRequest
+from django.shortcuts import redirect
+from django.urls import reverse
+from django.utils.translation import gettext as _
+from structlog.stdlib import get_logger
+
+from authentik.core.models import (
+    Source,
+    SourceUserMatchingModes,
+    User,
+    UserSourceConnection,
+)
+from authentik.core.sources.stage import (
+    PLAN_CONTEXT_SOURCES_CONNECTION,
+    PostUserEnrollmentStage,
+)
+from authentik.events.models import Event, EventAction
+from authentik.flows.models import Flow, Stage, in_memory_stage
+from authentik.flows.planner import (
+    PLAN_CONTEXT_PENDING_USER,
+    PLAN_CONTEXT_REDIRECT,
+    PLAN_CONTEXT_SOURCE,
+    PLAN_CONTEXT_SSO,
+    FlowPlanner,
+)
+from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_GET, SESSION_KEY_PLAN
+from authentik.lib.utils.urls import redirect_with_qs
+from authentik.policies.utils import delete_none_keys
+from authentik.stages.password import BACKEND_DJANGO
+from authentik.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
+from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT
+
+
+class Action(Enum):
+    """Actions that can be decided based on the request
+    and source settings"""
+
+    LINK = "link"
+    AUTH = "auth"
+    ENROLL = "enroll"
+    DENY = "deny"
+
+
+class SourceFlowManager:
+    """Help sources decide what they should do after authorization. Based on source settings and
+    previous connections, authenticate the user, enroll a new user, link to an existing user
+    or deny the request."""
+
+    source: Source
+    request: HttpRequest
+
+    identifier: str
+
+    connection_type: Type[UserSourceConnection] = UserSourceConnection
+
+    def __init__(
+        self,
+        source: Source,
+        request: HttpRequest,
+        identifier: str,
+        enroll_info: dict[str, Any],
+    ) -> None:
+        self.source = source
+        self.request = request
+        self.identifier = identifier
+        self.enroll_info = enroll_info
+        self._logger = get_logger().bind(source=source, identifier=identifier)
+
+    # pylint: disable=too-many-return-statements
+    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
+        """decide which action should be taken"""
+        new_connection = self.connection_type(
+            source=self.source, identifier=self.identifier
+        )
+        # When request is authenticated, always link
+        if self.request.user.is_authenticated:
+            new_connection.user = self.request.user
+            new_connection = self.update_connection(new_connection, **kwargs)
+            new_connection.save()
+            return Action.LINK, new_connection
+
+        existing_connections = self.connection_type.objects.filter(
+            source=self.source, identifier=self.identifier
+        )
+        if existing_connections.exists():
+            connection = existing_connections.first()
+            return Action.AUTH, self.update_connection(connection, **kwargs)
+        # No connection exists, but we match on identifier, so enroll
+        if self.source.user_matching_mode == SourceUserMatchingModes.IDENTIFIER:
+            # We don't save the connection here cause it doesn't have a user assigned yet
+            return Action.ENROLL, self.update_connection(new_connection, **kwargs)
+
+        # Check for existing users with matching attributes
+        query = Q()
+        # Either query existing user based on email or username
+        if self.source.user_matching_mode in [
+            SourceUserMatchingModes.EMAIL_LINK,
+            SourceUserMatchingModes.EMAIL_DENY,
+        ]:
+            if not self.enroll_info.get("email", None):
+                self._logger.warning("Refusing to use none email", source=self.source)
+                return Action.DENY, None
+            query = Q(email__exact=self.enroll_info.get("email", None))
+        if self.source.user_matching_mode in [
+            SourceUserMatchingModes.USERNAME_LINK,
+            SourceUserMatchingModes.USERNAME_DENY,
+        ]:
+            if not self.enroll_info.get("username", None):
+                self._logger.warning(
+                    "Refusing to use none username", source=self.source
+                )
+                return Action.DENY, None
+            query = Q(username__exact=self.enroll_info.get("username", None))
+        self._logger.debug("trying to link with existing user", query=query)
+        matching_users = User.objects.filter(query)
+        # No matching users, always enroll
+        if not matching_users.exists():
+            self._logger.debug("no matching users found, enrolling")
+            return Action.ENROLL, self.update_connection(new_connection, **kwargs)
+
+        user = matching_users.first()
+        if self.source.user_matching_mode in [
+            SourceUserMatchingModes.EMAIL_LINK,
+            SourceUserMatchingModes.USERNAME_LINK,
+        ]:
+            new_connection.user = user
+            new_connection = self.update_connection(new_connection, **kwargs)
+            new_connection.save()
+            return Action.LINK, new_connection
+        if self.source.user_matching_mode in [
+            SourceUserMatchingModes.EMAIL_DENY,
+            SourceUserMatchingModes.USERNAME_DENY,
+        ]:
+            self._logger.info("denying source because user exists", user=user)
+            return Action.DENY, None
+        # Should never get here as default enroll case is returned above.
+        return Action.DENY, None  # pragma: no cover
+
+    def update_connection(
+        self, connection: UserSourceConnection, **kwargs
+    ) -> UserSourceConnection:  # pragma: no cover
+        """Optionally make changes to the connection after it is looked up/created."""
+        return connection
+
+    def get_flow(self, **kwargs) -> HttpResponse:
+        """Get the flow response based on user_matching_mode"""
+        try:
+            action, connection = self.get_action(**kwargs)
+        except IntegrityError as exc:
+            self._logger.warning("failed to get action", exc=exc)
+            return redirect("/")
+        self._logger.debug("get_action() says", action=action, connection=connection)
+        if connection:
+            if action == Action.LINK:
+                self._logger.debug("Linking existing user")
+                return self.handle_existing_user_link(connection)
+            if action == Action.AUTH:
+                self._logger.debug("Handling auth user")
+                return self.handle_auth_user(connection)
+            if action == Action.ENROLL:
+                self._logger.debug("Handling enrollment of new user")
+                return self.handle_enroll(connection)
+        # Default case, assume deny
+        messages.error(
+            self.request,
+            _(
+                (
+                    "Request to authenticate with %(source)s has been denied. Please authenticate "
+                    "with the source you've previously signed up with."
+                )
+                % {"source": self.source.name}
+            ),
+        )
+        return redirect(reverse("authentik_core:root-redirect"))
+
+    # pylint: disable=unused-argument
+    def get_stages_to_append(self, flow: Flow) -> list[Stage]:
+        """Hook to override stages which are appended to the flow"""
+        if not self.source.enrollment_flow:
+            return []
+        if flow.slug == self.source.enrollment_flow.slug:
+            return [
+                in_memory_stage(PostUserEnrollmentStage),
+            ]
+        return []
+
+    def _handle_login_flow(self, flow: Flow, **kwargs) -> HttpResponse:
+        """Prepare Authentication Plan, redirect user FlowExecutor"""
+        # Ensure redirect is carried through when user was trying to
+        # authorize application
+        final_redirect = self.request.session.get(SESSION_KEY_GET, {}).get(
+            NEXT_ARG_NAME, "authentik_core:if-admin"
+        )
+        kwargs.update(
+            {
+                # Since we authenticate the user by their token, they have no backend set
+                PLAN_CONTEXT_AUTHENTICATION_BACKEND: BACKEND_DJANGO,
+                PLAN_CONTEXT_SSO: True,
+                PLAN_CONTEXT_SOURCE: self.source,
+                PLAN_CONTEXT_REDIRECT: final_redirect,
+            }
+        )
+        if not flow:
+            return HttpResponseBadRequest()
+        # We run the Flow planner here so we can pass the Pending user in the context
+        planner = FlowPlanner(flow)
+        plan = planner.plan(self.request, kwargs)
+        for stage in self.get_stages_to_append(flow):
+            plan.append_stage(stage=stage)
+        self.request.session[SESSION_KEY_PLAN] = plan
+        return redirect_with_qs(
+            "authentik_core:if-flow",
+            self.request.GET,
+            flow_slug=flow.slug,
+        )
+
+    # pylint: disable=unused-argument
+    def handle_auth_user(
+        self,
+        connection: UserSourceConnection,
+    ) -> HttpResponse:
+        """Login user and redirect."""
+        messages.success(
+            self.request,
+            _(
+                "Successfully authenticated with %(source)s!"
+                % {"source": self.source.name}
+            ),
+        )
+        flow_kwargs = {PLAN_CONTEXT_PENDING_USER: connection.user}
+        return self._handle_login_flow(self.source.authentication_flow, **flow_kwargs)
+
+    def handle_existing_user_link(
+        self,
+        connection: UserSourceConnection,
+    ) -> HttpResponse:
+        """Handler when the user was already authenticated and linked an external source
+        to their account."""
+        # Connection has already been saved
+        Event.new(
+            EventAction.SOURCE_LINKED,
+            message="Linked Source",
+            source=self.source,
+        ).from_http(self.request)
+        messages.success(
+            self.request,
+            _("Successfully linked %(source)s!" % {"source": self.source.name}),
+        )
+        # When request isn't authenticated we jump straight to auth
+        if not self.request.user.is_authenticated:
+            return self.handle_auth_user(connection)
+        return redirect(
+            reverse(
+                "authentik_core:if-admin",
+            )
+            + f"#/user;page-{self.source.slug}"
+        )
+
+    def handle_enroll(
+        self,
+        connection: UserSourceConnection,
+    ) -> HttpResponse:
+        """User was not authenticated and previous request was not authenticated."""
+        messages.success(
+            self.request,
+            _(
+                "Successfully authenticated with %(source)s!"
+                % {"source": self.source.name}
+            ),
+        )
+
+        # We run the Flow planner here so we can pass the Pending user in the context
+        if not self.source.enrollment_flow:
+            self._logger.warning("source has no enrollment flow")
+            return HttpResponseBadRequest()
+        return self._handle_login_flow(
+            self.source.enrollment_flow,
+            **{
+                PLAN_CONTEXT_PROMPT: delete_none_keys(self.enroll_info),
+                PLAN_CONTEXT_SOURCES_CONNECTION: connection,
+            },
+        )

authentik/core/sources/stage.py

@@ -1,32 +1,30 @@
-"""OAuth Stages"""
+"""Source flow manager stages"""
 from django.http import HttpRequest, HttpResponse
 
-from authentik.core.models import User
+from authentik.core.models import User, UserSourceConnection
 from authentik.events.models import Event, EventAction
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
 from authentik.flows.stage import StageView
-from authentik.sources.oauth.models import UserOAuthSourceConnection
 
-PLAN_CONTEXT_SOURCES_OAUTH_ACCESS = "sources_oauth_access"
+PLAN_CONTEXT_SOURCES_CONNECTION = "goauthentik.io/sources/connection"
 
 
 class PostUserEnrollmentStage(StageView):
-    """Dynamically injected stage which saves the OAuth Connection after
+    """Dynamically injected stage which saves the Connection after
     the user has been enrolled."""
 
     # pylint: disable=unused-argument
     def get(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         """Stage used after the user has been enrolled"""
-        access: UserOAuthSourceConnection = self.executor.plan.context[
-            PLAN_CONTEXT_SOURCES_OAUTH_ACCESS
+        connection: UserSourceConnection = self.executor.plan.context[
+            PLAN_CONTEXT_SOURCES_CONNECTION
         ]
         user: User = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
-        access.user = user
-        access.save()
-        UserOAuthSourceConnection.objects.filter(pk=access.pk).update(user=user)
+        connection.user = user
+        connection.save()
         Event.new(
             EventAction.SOURCE_LINKED,
-            message="Linked OAuth Source",
-            source=access.source,
+            message="Linked Source",
+            source=connection.source,
         ).from_http(self.request)
         return self.executor.stage_ok()

authentik/core/tasks.py

@@ -26,14 +26,16 @@ def clean_expired_models(self: MonitoredTask):
     messages = []
     for cls in ExpiringModel.__subclasses__():
         cls: ExpiringModel
-        amount, _ = (
+        objects = (
             cls.objects.all()
             .exclude(expiring=False)
             .exclude(expiring=True, expires__gt=now())
-            .delete()
         )
-        LOGGER.debug("Deleted expired models", model=cls, amount=amount)
-        messages.append(f"Deleted {amount} expired {cls._meta.verbose_name_plural}")
+        for obj in objects:
+            obj.expire_action()
+        amount = objects.count()
+        LOGGER.debug("Expired models", model=cls, amount=amount)
+        messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
     self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL, messages))
 
 
@@ -75,5 +77,6 @@ def backup_database(self: MonitoredTask):  # pragma: no cover
         Boto3Error,
         PermissionError,
         CommandConnectorError,
+        ValueError,
     ) as exc:
         self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))

authentik/core/templates/base/skeleton.html

@@ -7,12 +7,17 @@
     <head>
         <meta charset="UTF-8">
         <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-        <title>{% block title %}{% trans title|default:config.authentik.branding.title %}{% endblock %}</title>
-        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <title>{% block title %}{% trans title|default:tenant.branding_title %}{% endblock %}</title>
         <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-base.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}?v={{ ak_version }}">
+        {% block head_before %}
+        {% endblock %}
         <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}?v={{ ak_version }}">
         <script src="{% static 'dist/poly.js' %}?v={{ ak_version }}" type="module"></script>
+        <script>window["polymerSkipLoadingFontRoboto"] = true;</script>
         {% block head %}
         {% endblock %}
     </head>

authentik/core/templates/error/generic.html

@@ -12,7 +12,7 @@
 {% endblock %}
 
 {% block body %}
-<section class="pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
+<section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
     <div class="pf-c-empty-state">
         <div class="pf-c-empty-state__content">
             <i class="fas fa-exclamation-circle pf-c-empty-state__icon" aria-hidden="true"></i>

authentik/core/templates/if/admin.html

@@ -10,7 +10,7 @@
 {% block body %}
 <ak-message-container></ak-message-container>
 <ak-interface-admin>
-    <section class="pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
+    <section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
         <div class="pf-c-empty-state" style="height: 100vh;">
             <div class="pf-c-empty-state__content">
                 <span class="pf-c-spinner pf-m-xl pf-c-empty-state__icon" role="progressbar" aria-valuetext="{% trans 'Loading...' %}">

authentik/core/templates/if/end_session.html

@@ -3,18 +3,8 @@
 {% load static %}
 {% load i18n %}
 
-{% block head %}
-{{ block.super }}
-<style>
-.pf-c-background-image::before {
-    background-image: url("{% static 'dist/assets/images/flow_background.jpg' %}");
-    background-position: center;
-}
-</style>
-{% endblock %}
-
 {% block title %}
-{% trans 'End session' %}
+{% trans 'End session' %} - {{ tenant.branding_title }}
 {% endblock %}
 
 {% block card_title %}

authentik/core/templates/if/flow.html

@@ -3,14 +3,25 @@
 {% load static %}
 {% load i18n %}
 
+{% block head_before %}
+{% if flow.compatibility_mode %}
+<script>ShadyDOM = { force: !navigator.webdriver };</script>
+{% endif %}
+{% endblock %}
+
 {% block head %}
 <script src="{% static 'dist/FlowInterface.js' %}?v={{ ak_version }}" type="module"></script>
+<style>
+.pf-c-background-image::before {
+    --ak-flow-background: url("{{ flow.background_url }}");
+}
+</style>
 {% endblock %}
 
 {% block body %}
 <ak-message-container></ak-message-container>
 <ak-flow-executor>
-    <section class="pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
+    <section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
         <div class="pf-c-empty-state" style="height: 100vh;">
             <div class="pf-c-empty-state__content">
                 <span class="pf-c-spinner pf-m-xl pf-c-empty-state__icon" role="progressbar" aria-valuetext="{% trans 'Loading...' %}">

authentik/core/templates/login/base_full.html

@@ -3,6 +3,18 @@
 {% load static %}
 {% load i18n %}
 
+{% block head_before %}
+<link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}?v={{ ak_version }}">
+{% endblock %}
+
+{% block head %}
+<style>
+.pf-c-background-image::before {
+    --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
+}
+</style>
+{% endblock %}
+
 {% block body %}
 <div class="pf-c-background-image">
     <svg xmlns="http://www.w3.org/2000/svg" class="pf-c-background-image__filter" width="0" height="0">
@@ -22,10 +34,7 @@
     <div class="ak-login-container">
         <header class="pf-c-login__header">
             <div class="pf-c-brand ak-brand">
-                <img src="{{ config.authentik.branding.logo }}" alt="authentik icon" />
-                {% if config.authentik.branding.title_show %}
-                <p>{{ config.authentik.branding.title }}</p>
-                {% endif %}
+                <img src="{{ tenant.branding_logo }}" alt="authentik icon" />
             </div>
         </header>
         {% block main_container %}
@@ -45,12 +54,12 @@
         <footer class="pf-c-login__footer">
             <p></p>
             <ul class="pf-c-list pf-m-inline">
-                {% for link in config.authentik.footer_links %}
+                {% for link in footer_links %}
                 <li>
                     <a href="{{ link.href }}">{{ link.name }}</a>
                 </li>
                 {% endfor %}
-                {% if config.authentik.branding.title != "authentik" %}
+                {% if tenant.branding_title != "authentik" %}
                 <li>
                     <a href="https://goauthentik.io">
                         {% trans 'Powered by authentik' %}

authentik/core/tests/test_api_utils.py

@@ -0,0 +1,15 @@
+"""Test API Utils"""
+from rest_framework.exceptions import ValidationError
+from rest_framework.test import APITestCase
+
+from authentik.core.api.utils import is_dict
+
+
+class TestAPIUtils(APITestCase):
+    """Test API Utils"""
+
+    def test_is_dict(self):
+        """Test is_dict"""
+        self.assertIsNone(is_dict({}))
+        with self.assertRaises(ValidationError):
+            is_dict("foo")

authentik/core/tests/test_applications_api.py

@@ -0,0 +1,131 @@
+"""Test Applications API"""
+from django.urls import reverse
+from django.utils.encoding import force_str
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Application, User
+from authentik.policies.dummy.models import DummyPolicy
+from authentik.policies.models import PolicyBinding
+
+
+class TestApplicationsAPI(APITestCase):
+    """Test applications API"""
+
+    def setUp(self) -> None:
+        self.user = User.objects.get(username="akadmin")
+        self.allowed = Application.objects.create(name="allowed", slug="allowed")
+        self.denied = Application.objects.create(name="denied", slug="denied")
+        PolicyBinding.objects.create(
+            target=self.denied,
+            policy=DummyPolicy.objects.create(
+                name="deny", result=False, wait_min=1, wait_max=2
+            ),
+            order=0,
+        )
+
+    def test_check_access(self):
+        """Test check_access operation"""
+        self.client.force_login(self.user)
+        response = self.client.get(
+            reverse(
+                "authentik_api:application-check-access",
+                kwargs={"slug": self.allowed.slug},
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_str(response.content), {"messages": [], "passing": True}
+        )
+        response = self.client.get(
+            reverse(
+                "authentik_api:application-check-access",
+                kwargs={"slug": self.denied.slug},
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertJSONEqual(
+            force_str(response.content), {"messages": ["dummy"], "passing": False}
+        )
+
+    def test_list(self):
+        """Test list operation without superuser_full_list"""
+        self.client.force_login(self.user)
+        response = self.client.get(reverse("authentik_api:application-list"))
+        self.assertJSONEqual(
+            force_str(response.content),
+            {
+                "pagination": {
+                    "next": 0,
+                    "previous": 0,
+                    "count": 2,
+                    "current": 1,
+                    "total_pages": 1,
+                    "start_index": 1,
+                    "end_index": 2,
+                },
+                "results": [
+                    {
+                        "pk": str(self.allowed.pk),
+                        "name": "allowed",
+                        "slug": "allowed",
+                        "provider": None,
+                        "provider_obj": None,
+                        "launch_url": None,
+                        "meta_launch_url": "",
+                        "meta_icon": None,
+                        "meta_description": "",
+                        "meta_publisher": "",
+                        "policy_engine_mode": "any",
+                    },
+                ],
+            },
+        )
+
+    def test_list_superuser_full_list(self):
+        """Test list operation with superuser_full_list"""
+        self.client.force_login(self.user)
+        response = self.client.get(
+            reverse("authentik_api:application-list") + "?superuser_full_list=true"
+        )
+        self.assertJSONEqual(
+            force_str(response.content),
+            {
+                "pagination": {
+                    "next": 0,
+                    "previous": 0,
+                    "count": 2,
+                    "current": 1,
+                    "total_pages": 1,
+                    "start_index": 1,
+                    "end_index": 2,
+                },
+                "results": [
+                    {
+                        "pk": str(self.allowed.pk),
+                        "name": "allowed",
+                        "slug": "allowed",
+                        "provider": None,
+                        "provider_obj": None,
+                        "launch_url": None,
+                        "meta_launch_url": "",
+                        "meta_icon": None,
+                        "meta_description": "",
+                        "meta_publisher": "",
+                        "policy_engine_mode": "any",
+                    },
+                    {
+                        "launch_url": None,
+                        "meta_description": "",
+                        "meta_icon": None,
+                        "meta_launch_url": "",
+                        "meta_publisher": "",
+                        "name": "denied",
+                        "pk": str(self.denied.pk),
+                        "policy_engine_mode": "any",
+                        "provider": None,
+                        "provider_obj": None,
+                        "slug": "denied",
+                    },
+                ],
+            },
+        )

authentik/core/tests/test_authenticated_sessions_api.py

@@ -0,0 +1,31 @@
+"""Test AuthenticatedSessions API"""
+from json import loads
+
+from django.urls.base import reverse
+from django.utils.encoding import force_str
+from rest_framework.test import APITestCase
+
+from authentik.core.models import User
+
+
+class TestAuthenticatedSessionsAPI(APITestCase):
+    """Test AuthenticatedSessions API"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.user = User.objects.get(username="akadmin")
+        self.other_user = User.objects.create(username="normal-user")
+
+    def test_list(self):
+        """Test session list endpoint"""
+        self.client.force_login(self.user)
+        response = self.client.get(reverse("authentik_api:authenticatedsession-list"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_non_admin_list(self):
+        """Test non-admin list"""
+        self.client.force_login(self.other_user)
+        response = self.client.get(reverse("authentik_api:authenticatedsession-list"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(force_str(response.content))
+        self.assertEqual(body["pagination"]["count"], 1)

authentik/core/tests/test_impersonation.py

@@ -17,6 +17,9 @@ class TestImpersonation(TestCase):
 
     def test_impersonate_simple(self):
         """test simple impersonation and un-impersonation"""
+        # test with an inactive user to ensure that still works
+        self.other_user.is_active = False
+        self.other_user.save()
         self.client.force_login(self.akadmin)
 
         self.client.get(

authentik/core/tests/test_models.py

@@ -1,11 +1,14 @@
 """authentik core models tests"""
 from time import sleep
+from typing import Callable, Type
 
 from django.test import TestCase
 from django.utils.timezone import now
 from guardian.shortcuts import get_anonymous_user
 
-from authentik.core.models import Token
+from authentik.core.models import Provider, Source, Token
+from authentik.flows.models import Stage
+from authentik.lib.utils.reflection import all_subclasses
 
 
 class TestModels(TestCase):
@@ -18,9 +21,46 @@ class TestModels(TestCase):
         self.assertTrue(token.is_expired)
 
     def test_token_expire_no_expire(self):
-        """Test token expiring with "expiring" set """
+        """Test token expiring with "expiring" set"""
         token = Token.objects.create(
             expires=now(), user=get_anonymous_user(), expiring=False
         )
         sleep(0.5)
         self.assertFalse(token.is_expired)
+
+
+def source_tester_factory(test_model: Type[Stage]) -> Callable:
+    """Test source"""
+
+    def tester(self: TestModels):
+        model_class = None
+        if test_model._meta.abstract:
+            model_class = test_model.__bases__[0]()
+        else:
+            model_class = test_model()
+        model_class.slug = "test"
+        self.assertIsNotNone(model_class.component)
+        _ = model_class.ui_login_button
+        _ = model_class.ui_user_settings
+
+    return tester
+
+
+def provider_tester_factory(test_model: Type[Stage]) -> Callable:
+    """Test provider"""
+
+    def tester(self: TestModels):
+        model_class = None
+        if test_model._meta.abstract:
+            model_class = test_model.__bases__[0]()
+        else:
+            model_class = test_model()
+        self.assertIsNotNone(model_class.component)
+
+    return tester
+
+
+for model in all_subclasses(Source):
+    setattr(TestModels, f"test_model_{model.__name__}", source_tester_factory(model))
+for model in all_subclasses(Provider):
+    setattr(TestModels, f"test_model_{model.__name__}", provider_tester_factory(model))

authentik/core/tests/test_property_mapping.py

@@ -31,7 +31,7 @@ class TestPropertyMappings(TestCase):
         """Test expression error"""
         expr = "return aaa"
         mapping = PropertyMapping.objects.create(name="test", expression=expr)
-        with self.assertRaises(NameError):
+        with self.assertRaises(PropertyMappingExpressionException):
             mapping.evaluate(None, None)
         events = Event.objects.filter(
             action=EventAction.PROPERTY_MAPPING_EXCEPTION, context__expression=expr
@@ -44,7 +44,7 @@ class TestPropertyMappings(TestCase):
         expr = "return aaa"
         request = self.factory.get("/")
         mapping = PropertyMapping.objects.create(name="test", expression=expr)
-        with self.assertRaises(NameError):
+        with self.assertRaises(PropertyMappingExpressionException):
             mapping.evaluate(get_anonymous_user(), request)
         events = Event.objects.filter(
             action=EventAction.PROPERTY_MAPPING_EXCEPTION, context__expression=expr

authentik/core/tests/test_source_flow_manager.py

@@ -0,0 +1,160 @@
+"""Test Source flow_manager"""
+from django.contrib.auth.models import AnonymousUser
+from django.contrib.messages.middleware import MessageMiddleware
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.http.request import HttpRequest
+from django.test import TestCase
+from django.test.client import RequestFactory
+from guardian.utils import get_anonymous_user
+
+from authentik.core.models import SourceUserMatchingModes, User
+from authentik.core.sources.flow_manager import Action
+from authentik.flows.tests.test_planner import dummy_get_response
+from authentik.providers.oauth2.generators import generate_client_id
+from authentik.sources.oauth.models import OAuthSource, UserOAuthSourceConnection
+from authentik.sources.oauth.views.callback import OAuthSourceFlowManager
+
+
+class TestSourceFlowManager(TestCase):
+    """Test Source flow_manager"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.source = OAuthSource.objects.create(name="test")
+        self.factory = RequestFactory()
+        self.identifier = generate_client_id()
+
+    def get_request(self, user: User) -> HttpRequest:
+        """Helper to create a get request with session and message middleware"""
+        request = self.factory.get("/")
+        request.user = user
+        middleware = SessionMiddleware(dummy_get_response)
+        middleware.process_request(request)
+        request.session.save()
+        middleware = MessageMiddleware(dummy_get_response)
+        middleware.process_request(request)
+        request.session.save()
+        return request
+
+    def test_unauthenticated_enroll(self):
+        """Test un-authenticated user enrolling"""
+        flow_manager = OAuthSourceFlowManager(
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.ENROLL)
+        flow_manager.get_flow()
+
+    def test_unauthenticated_auth(self):
+        """Test un-authenticated user authenticating"""
+        UserOAuthSourceConnection.objects.create(
+            user=get_anonymous_user(), source=self.source, identifier=self.identifier
+        )
+
+        flow_manager = OAuthSourceFlowManager(
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.AUTH)
+        flow_manager.get_flow()
+
+    def test_authenticated_link(self):
+        """Test authenticated user linking"""
+        UserOAuthSourceConnection.objects.create(
+            user=get_anonymous_user(), source=self.source, identifier=self.identifier
+        )
+        user = User.objects.create(username="foo", email="foo@bar.baz")
+        flow_manager = OAuthSourceFlowManager(
+            self.source, self.get_request(user), self.identifier, {}
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.LINK)
+        flow_manager.get_flow()
+
+    def test_unauthenticated_enroll_email(self):
+        """Test un-authenticated user enrolling (link on email)"""
+        User.objects.create(username="foo", email="foo@bar.baz")
+        self.source.user_matching_mode = SourceUserMatchingModes.EMAIL_LINK
+
+        # Without email, deny
+        flow_manager = OAuthSourceFlowManager(
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.DENY)
+        flow_manager.get_flow()
+        # With email
+        flow_manager = OAuthSourceFlowManager(
+            self.source,
+            self.get_request(AnonymousUser()),
+            self.identifier,
+            {"email": "foo@bar.baz"},
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.LINK)
+        flow_manager.get_flow()
+
+    def test_unauthenticated_enroll_username(self):
+        """Test un-authenticated user enrolling (link on username)"""
+        User.objects.create(username="foo", email="foo@bar.baz")
+        self.source.user_matching_mode = SourceUserMatchingModes.USERNAME_LINK
+
+        # Without username, deny
+        flow_manager = OAuthSourceFlowManager(
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.DENY)
+        flow_manager.get_flow()
+        # With username
+        flow_manager = OAuthSourceFlowManager(
+            self.source,
+            self.get_request(AnonymousUser()),
+            self.identifier,
+            {"username": "foo"},
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.LINK)
+        flow_manager.get_flow()
+
+    def test_unauthenticated_enroll_username_deny(self):
+        """Test un-authenticated user enrolling (deny on username)"""
+        User.objects.create(username="foo", email="foo@bar.baz")
+        self.source.user_matching_mode = SourceUserMatchingModes.USERNAME_DENY
+
+        # With non-existent username, enroll
+        flow_manager = OAuthSourceFlowManager(
+            self.source,
+            self.get_request(AnonymousUser()),
+            self.identifier,
+            {
+                "username": "bar",
+            },
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.ENROLL)
+        flow_manager.get_flow()
+        # With username
+        flow_manager = OAuthSourceFlowManager(
+            self.source,
+            self.get_request(AnonymousUser()),
+            self.identifier,
+            {"username": "foo"},
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.DENY)
+        flow_manager.get_flow()
+
+    def test_unauthenticated_enroll_link_non_existent(self):
+        """Test un-authenticated user enrolling (link on username), username doesn't exist"""
+        self.source.user_matching_mode = SourceUserMatchingModes.USERNAME_LINK
+
+        flow_manager = OAuthSourceFlowManager(
+            self.source,
+            self.get_request(AnonymousUser()),
+            self.identifier,
+            {"username": "foo"},
+        )
+        action, _ = flow_manager.get_action()
+        self.assertEqual(action, Action.ENROLL)
+        flow_manager.get_flow()

authentik/core/tests/test_tasks.py

@@ -1,18 +0,0 @@
-"""authentik core task tests"""
-from django.test import TestCase
-from django.utils.timezone import now
-from guardian.shortcuts import get_anonymous_user
-
-from authentik.core.models import Token
-from authentik.core.tasks import clean_expired_models
-
-
-class TestTasks(TestCase):
-    """Test Tasks"""
-
-    def test_token_cleanup(self):
-        """Test Token cleanup task"""
-        Token.objects.create(expires=now(), user=get_anonymous_user())
-        self.assertEqual(Token.objects.all().count(), 1)
-        clean_expired_models.delay().get()
-        self.assertEqual(Token.objects.all().count(), 0)

authentik/core/tests/test_token_api.py

@@ -1,8 +1,16 @@
 """Test token API"""
 from django.urls.base import reverse
+from django.utils.timezone import now
+from guardian.shortcuts import get_anonymous_user
 from rest_framework.test import APITestCase
 
-from authentik.core.models import Token, User
+from authentik.core.models import (
+    USER_ATTRIBUTE_TOKEN_EXPIRING,
+    Token,
+    TokenIntents,
+    User,
+)
+from authentik.core.tasks import clean_expired_models
 
 
 class TestTokenAPI(APITestCase):
@@ -19,4 +27,28 @@ class TestTokenAPI(APITestCase):
             reverse("authentik_api:token-list"), {"identifier": "test-token"}
         )
         self.assertEqual(response.status_code, 201)
-        self.assertEqual(Token.objects.get(identifier="test-token").user, self.user)
+        token = Token.objects.get(identifier="test-token")
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, True)
+
+    def test_token_create_non_expiring(self):
+        """Test token creation endpoint"""
+        self.user.attributes[USER_ATTRIBUTE_TOKEN_EXPIRING] = False
+        self.user.save()
+        response = self.client.post(
+            reverse("authentik_api:token-list"), {"identifier": "test-token"}
+        )
+        self.assertEqual(response.status_code, 201)
+        token = Token.objects.get(identifier="test-token")
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, False)
+
+    def test_token_expire(self):
+        """Test Token expire task"""
+        token: Token = Token.objects.create(expires=now(), user=get_anonymous_user())
+        key = token.key
+        clean_expired_models.delay().get()
+        token.refresh_from_db()
+        self.assertNotEqual(key, token.key)

authentik/core/tests/test_users_api.py

@@ -0,0 +1,29 @@
+"""Test Users API"""
+from django.urls.base import reverse
+from rest_framework.test import APITestCase
+
+from authentik.core.models import User
+
+
+class TestUsersAPI(APITestCase):
+    """Test Users API"""
+
+    def setUp(self) -> None:
+        self.admin = User.objects.get(username="akadmin")
+        self.user = User.objects.create(username="test-user")
+
+    def test_metrics(self):
+        """Test user's metrics"""
+        self.client.force_login(self.admin)
+        response = self.client.get(
+            reverse("authentik_api:user-metrics", kwargs={"pk": self.user.pk})
+        )
+        self.assertEqual(response.status_code, 200)
+
+    def test_metrics_denied(self):
+        """Test user's metrics (non-superuser)"""
+        self.client.force_login(self.user)
+        response = self.client.get(
+            reverse("authentik_api:user-metrics", kwargs={"pk": self.user.pk})
+        )
+        self.assertEqual(response.status_code, 403)

authentik/core/types.py

@@ -5,6 +5,7 @@ from typing import Optional
 from rest_framework.fields import CharField
 
 from authentik.core.api.utils import PassiveSerializer
+from authentik.flows.challenge import Challenge
 
 
 @dataclass
@@ -14,24 +15,17 @@ class UILoginButton:
     # Name, ran through i18n
     name: str
 
-    # URL Which Button points to
-    url: str
+    # Challenge which is presented to the user when they click the button
+    challenge: Challenge
 
     # Icon URL, used as-is
     icon_url: Optional[str] = None
 
 
-class UILoginButtonSerializer(PassiveSerializer):
-    """Serializer for Login buttons of sources"""
-
-    name = CharField()
-    url = CharField()
-    icon_url = CharField(required=False, allow_null=True)
-
-
 class UserSettingSerializer(PassiveSerializer):
     """Serializer for User settings for stages and sources"""
 
     object_uid = CharField()
     component = CharField()
     title = CharField()
+    configure_url = CharField(required=False)

authentik/core/urls.py

@@ -6,6 +6,8 @@ from django.views.generic import RedirectView
 from django.views.generic.base import TemplateView
 
 from authentik.core.views import impersonate
+from authentik.core.views.interface import FlowInterfaceView
+from authentik.core.views.session import EndSessionView
 
 urlpatterns = [
     path(
@@ -32,7 +34,18 @@ urlpatterns = [
     ),
     path(
         "if/flow/<slug:flow_slug>/",
-        ensure_csrf_cookie(TemplateView.as_view(template_name="if/flow.html")),
+        ensure_csrf_cookie(FlowInterfaceView.as_view()),
         name="if-flow",
     ),
+    path(
+        "if/session-end/<slug:application_slug>/",
+        ensure_csrf_cookie(EndSessionView.as_view()),
+        name="if-session-end",
+    ),
+    # Fallback for WS
+    path("ws/outpost/<uuid:pk>/", TemplateView.as_view(template_name="if/admin.html")),
+    path(
+        "ws/client/",
+        TemplateView.as_view(template_name="if/admin.html"),
+    ),
 ]

authentik/core/views/interface.py

@@ -0,0 +1,17 @@
+"""Interface views"""
+from typing import Any
+
+from django.shortcuts import get_object_or_404
+from django.views.generic.base import TemplateView
+
+from authentik.flows.models import Flow
+
+
+class FlowInterfaceView(TemplateView):
+    """Flow interface"""
+
+    template_name = "if/flow.html"
+
+    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+        kwargs["flow"] = get_object_or_404(Flow, slug=self.kwargs.get("flow_slug"))
+        return super().get_context_data(**kwargs)

authentik/core/views/session.py

@@ -1,22 +1,24 @@
-"""authentik OAuth2 Session Views"""
+"""authentik Session Views"""
 from typing import Any
 
 from django.shortcuts import get_object_or_404
 from django.views.generic.base import TemplateView
 
 from authentik.core.models import Application
+from authentik.policies.views import PolicyAccessView
 
 
-class EndSessionView(TemplateView):
+class EndSessionView(TemplateView, PolicyAccessView):
     """Allow the client to end the Session"""
 
-    template_name = "providers/oauth2/end_session.html"
+    template_name = "if/end_session.html"
 
-    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
-        context = super().get_context_data(**kwargs)
-
-        context["application"] = get_object_or_404(
+    def resolve_provider_application(self):
+        self.application = get_object_or_404(
             Application, slug=self.kwargs["application_slug"]
         )
 
+    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
+        context = super().get_context_data(**kwargs)
+        context["application"] = self.application
         return context

authentik/crypto/api.py

@@ -1,10 +1,14 @@
 """Crypto API Views"""
-import django_filters
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
 from cryptography.x509 import load_pem_x509_certificate
+from django.http.response import HttpResponse
+from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
-from drf_yasg.utils import swagger_auto_schema
+from django_filters import FilterSet
+from django_filters.filters import BooleanFilter
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import (
     CharField,
@@ -18,6 +22,7 @@ from rest_framework.serializers import ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.crypto.builder import CertificateBuilder
 from authentik.crypto.models import CertificateKeyPair
@@ -31,6 +36,9 @@ class CertificateKeyPairSerializer(ModelSerializer):
     cert_subject = SerializerMethodField()
     private_key_available = SerializerMethodField()
 
+    certificate_download_url = SerializerMethodField()
+    private_key_download_url = SerializerMethodField()
+
     def get_cert_subject(self, instance: CertificateKeyPair) -> str:
         """Get certificate subject as full rfc4514"""
         return instance.certificate.subject.rfc4514_string()
@@ -39,7 +47,27 @@ class CertificateKeyPairSerializer(ModelSerializer):
         """Show if this keypair has a private key configured or not"""
         return instance.key_data != "" and instance.key_data is not None
 
-    def validate_certificate_data(self, value):
+    def get_certificate_download_url(self, instance: CertificateKeyPair) -> str:
+        """Get URL to download certificate"""
+        return (
+            reverse(
+                "authentik_api:certificatekeypair-view-certificate",
+                kwargs={"pk": instance.pk},
+            )
+            + "?download"
+        )
+
+    def get_private_key_download_url(self, instance: CertificateKeyPair) -> str:
+        """Get URL to download private key"""
+        return (
+            reverse(
+                "authentik_api:certificatekeypair-view-private-key",
+                kwargs={"pk": instance.pk},
+            )
+            + "?download"
+        )
+
+    def validate_certificate_data(self, value: str) -> str:
         """Verify that input is a valid PEM x509 Certificate"""
         try:
             load_pem_x509_certificate(value.encode("utf-8"), default_backend())
@@ -47,7 +75,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             raise ValidationError("Unable to load certificate.")
         return value
 
-    def validate_key_data(self, value):
+    def validate_key_data(self, value: str) -> str:
         """Verify that input is a valid PEM RSA Key"""
         # Since this field is optional, data can be empty.
         if value != "":
@@ -57,8 +85,10 @@ class CertificateKeyPairSerializer(ModelSerializer):
                     password=None,
                     backend=default_backend(),
                 )
-            except ValueError:
-                raise ValidationError("Unable to load private key.")
+            except (ValueError, TypeError):
+                raise ValidationError(
+                    "Unable to load private key (possibly encrypted?)."
+                )
         return value
 
     class Meta:
@@ -67,12 +97,15 @@ class CertificateKeyPairSerializer(ModelSerializer):
         fields = [
             "pk",
             "name",
-            "fingerprint",
+            "fingerprint_sha256",
+            "fingerprint_sha1",
             "certificate_data",
             "key_data",
             "cert_expiry",
             "cert_subject",
             "private_key_available",
+            "certificate_download_url",
+            "private_key_download_url",
         ]
         extra_kwargs = {
             "key_data": {"write_only": True},
@@ -96,10 +129,10 @@ class CertificateGenerationSerializer(PassiveSerializer):
     validity_days = IntegerField(initial=365)
 
 
-class CertificateKeyPairFilter(django_filters.FilterSet):
+class CertificateKeyPairFilter(FilterSet):
     """Filter for certificates"""
 
-    has_key = django_filters.BooleanFilter(
+    has_key = BooleanFilter(
         label="Only return certificate-key pairs with keys", method="filter_has_key"
     )
 
@@ -113,7 +146,7 @@ class CertificateKeyPairFilter(django_filters.FilterSet):
         fields = ["name"]
 
 
-class CertificateKeyPairViewSet(ModelViewSet):
+class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
     """CertificateKeyPair Viewset"""
 
     queryset = CertificateKeyPair.objects.all()
@@ -121,9 +154,12 @@ class CertificateKeyPairViewSet(ModelViewSet):
     filterset_class = CertificateKeyPairFilter
 
     @permission_required(None, ["authentik_crypto.add_certificatekeypair"])
-    @swagger_auto_schema(
-        request_body=CertificateGenerationSerializer(),
-        responses={200: CertificateKeyPairSerializer, 400: "Bad request"},
+    @extend_schema(
+        request=CertificateGenerationSerializer(),
+        responses={
+            200: CertificateKeyPairSerializer,
+            400: OpenApiResponse(description="Bad request"),
+        },
     )
     @action(detail=False, methods=["POST"])
     def generate(self, request: Request) -> Response:
@@ -143,7 +179,16 @@ class CertificateKeyPairViewSet(ModelViewSet):
         serializer = self.get_serializer(instance)
         return Response(serializer.data)
 
-    @swagger_auto_schema(responses={200: CertificateDataSerializer(many=False)})
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(
+                name="download",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.BOOL,
+            )
+        ],
+        responses={200: CertificateDataSerializer(many=False)},
+    )
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def view_certificate(self, request: Request, pk: str) -> Response:
@@ -154,11 +199,29 @@ class CertificateKeyPairViewSet(ModelViewSet):
             secret=certificate,
             type="certificate",
         ).from_http(request)
+        if "download" in request._request.GET:
+            # Mime type from https://pki-tutorial.readthedocs.io/en/latest/mime.html
+            response = HttpResponse(
+                certificate.certificate_data, content_type="application/x-pem-file"
+            )
+            response[
+                "Content-Disposition"
+            ] = f'attachment; filename="{certificate.name}_certificate.pem"'
+            return response
         return Response(
             CertificateDataSerializer({"data": certificate.certificate_data}).data
         )
 
-    @swagger_auto_schema(responses={200: CertificateDataSerializer(many=False)})
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(
+                name="download",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.BOOL,
+            )
+        ],
+        responses={200: CertificateDataSerializer(many=False)},
+    )
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def view_private_key(self, request: Request, pk: str) -> Response:
@@ -169,4 +232,13 @@ class CertificateKeyPairViewSet(ModelViewSet):
             secret=certificate,
             type="private_key",
         ).from_http(request)
+        if "download" in request._request.GET:
+            # Mime type from https://pki-tutorial.readthedocs.io/en/latest/mime.html
+            response = HttpResponse(
+                certificate.key_data, content_type="application/x-pem-file"
+            )
+            response[
+                "Content-Disposition"
+            ] = f'attachment; filename="{certificate.name}_private_key.pem"'
+            return response
         return Response(CertificateDataSerializer({"data": certificate.key_data}).data)

authentik/crypto/builder.py

@@ -16,11 +16,6 @@ from authentik.crypto.models import CertificateKeyPair
 class CertificateBuilder:
     """Build self-signed certificates"""
 
-    __public_key = None
-    __private_key = None
-    __builder = None
-    __certificate = None
-
     common_name: str
 
     def __init__(self):
@@ -33,7 +28,7 @@ class CertificateBuilder:
     def save(self) -> Optional[CertificateKeyPair]:
         """Save generated certificate as model"""
         if not self.__certificate:
-            return None
+            raise ValueError("Certificated hasn't been built yet")
         return CertificateKeyPair.objects.create(
             name=self.common_name,
             certificate_data=self.certificate,

authentik/crypto/models.py

@@ -55,20 +55,32 @@ class CertificateKeyPair(CreatedUpdatedModel):
     def private_key(self) -> Optional[RSAPrivateKey]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self._private_key != "":
-            self._private_key = load_pem_private_key(
-                str.encode("\n".join([x.strip() for x in self.key_data.split("\n")])),
-                password=None,
-                backend=default_backend(),
-            )
+            try:
+                self._private_key = load_pem_private_key(
+                    str.encode(
+                        "\n".join([x.strip() for x in self.key_data.split("\n")])
+                    ),
+                    password=None,
+                    backend=default_backend(),
+                )
+            except ValueError:
+                return None
         return self._private_key
 
     @property
-    def fingerprint(self) -> str:
+    def fingerprint_sha256(self) -> str:
         """Get SHA256 Fingerprint of certificate_data"""
         return hexlify(self.certificate.fingerprint(hashes.SHA256()), ":").decode(
             "utf-8"
         )
 
+    @property
+    def fingerprint_sha1(self) -> str:
+        """Get SHA1 Fingerprint of certificate_data"""
+        return hexlify(
+            self.certificate.fingerprint(hashes.SHA1()), ":"  # nosec
+        ).decode("utf-8")
+
     @property
     def kid(self):
         """Get Key ID used for JWKS"""

authentik/crypto/tests.py

@@ -2,10 +2,16 @@
 import datetime
 
 from django.test import TestCase
+from django.urls import reverse
 
+from authentik.core.api.used_by import DeleteAction
+from authentik.core.models import User
 from authentik.crypto.api import CertificateKeyPairSerializer
 from authentik.crypto.builder import CertificateBuilder
 from authentik.crypto.models import CertificateKeyPair
+from authentik.flows.models import Flow
+from authentik.providers.oauth2.generators import generate_client_secret
+from authentik.providers.oauth2.models import OAuth2Provider
 
 
 class TestCrypto(TestCase):
@@ -37,6 +43,8 @@ class TestCrypto(TestCase):
         """Test Builder"""
         builder = CertificateBuilder()
         builder.common_name = "test-cert"
+        with self.assertRaises(ValueError):
+            builder.save()
         builder.build(
             subject_alt_names=[],
             validity_days=3,
@@ -45,3 +53,77 @@ class TestCrypto(TestCase):
         now = datetime.datetime.today()
         self.assertEqual(instance.name, "test-cert")
         self.assertEqual((instance.certificate.not_valid_after - now).days, 2)
+
+    def test_certificate_download(self):
+        """Test certificate export (download)"""
+        self.client.force_login(User.objects.get(username="akadmin"))
+        keypair = CertificateKeyPair.objects.first()
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-view-certificate",
+                kwargs={"pk": keypair.pk},
+            )
+        )
+        self.assertEqual(200, response.status_code)
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-view-certificate",
+                kwargs={"pk": keypair.pk},
+            )
+            + "?download",
+        )
+        self.assertEqual(200, response.status_code)
+        self.assertIn("Content-Disposition", response)
+
+    def test_private_key_download(self):
+        """Test private_key export (download)"""
+        self.client.force_login(User.objects.get(username="akadmin"))
+        keypair = CertificateKeyPair.objects.first()
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-view-private-key",
+                kwargs={"pk": keypair.pk},
+            )
+        )
+        self.assertEqual(200, response.status_code)
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-view-private-key",
+                kwargs={"pk": keypair.pk},
+            )
+            + "?download",
+        )
+        self.assertEqual(200, response.status_code)
+        self.assertIn("Content-Disposition", response)
+
+    def test_used_by(self):
+        """Test used_by endpoint"""
+        self.client.force_login(User.objects.get(username="akadmin"))
+        keypair = CertificateKeyPair.objects.first()
+        provider = OAuth2Provider.objects.create(
+            name="test",
+            client_id="test",
+            client_secret=generate_client_secret(),
+            authorization_flow=Flow.objects.first(),
+            redirect_uris="http://localhost",
+            rsa_key=CertificateKeyPair.objects.first(),
+        )
+        response = self.client.get(
+            reverse(
+                "authentik_api:certificatekeypair-used-by",
+                kwargs={"pk": keypair.pk},
+            )
+        )
+        self.assertEqual(200, response.status_code)
+        self.assertJSONEqual(
+            response.content.decode(),
+            [
+                {
+                    "app": "authentik_providers_oauth2",
+                    "model_name": "oauth2provider",
+                    "pk": str(provider.pk),
+                    "name": str(provider),
+                    "action": DeleteAction.SET_NULL.name,
+                }
+            ],
+        )

authentik/events/api/event.py

@@ -2,27 +2,23 @@
 import django_filters
 from django.db.models.aggregates import Count
 from django.db.models.fields.json import KeyTextTransform
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiParameter, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, DictField, IntegerField
+from rest_framework.fields import DictField, IntegerField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer, Serializer
-from rest_framework.viewsets import ReadOnlyModelViewSet
+from rest_framework.serializers import ModelSerializer
+from rest_framework.viewsets import ModelViewSet
 
-from authentik.core.api.utils import TypeCreateSerializer
+from authentik.core.api.utils import PassiveSerializer, TypeCreateSerializer
 from authentik.events.models import Event, EventAction
 
 
 class EventSerializer(ModelSerializer):
     """Event Serializer"""
 
-    # Since we only use this serializer for read-only operations,
-    # no checking of the action is done here.
-    # This allows clients to check wildcards, prefixes and custom types
-    action = CharField()
-
     class Meta:
 
         model = Event
@@ -35,34 +31,17 @@ class EventSerializer(ModelSerializer):
             "client_ip",
             "created",
             "expires",
+            "tenant",
         ]
 
 
-class EventTopPerUserParams(Serializer):
-    """Query params for top_per_user"""
-
-    top_n = IntegerField(default=15)
-
-    def create(self, request: Request) -> Response:
-        raise NotImplementedError
-
-    def update(self, request: Request) -> Response:
-        raise NotImplementedError
-
-
-class EventTopPerUserSerializer(Serializer):
+class EventTopPerUserSerializer(PassiveSerializer):
     """Response object of Event's top_per_user"""
 
     application = DictField()
     counted_events = IntegerField()
     unique_users = IntegerField()
 
-    def create(self, request: Request) -> Response:
-        raise NotImplementedError
-
-    def update(self, request: Request) -> Response:
-        raise NotImplementedError
-
 
 class EventsFilter(django_filters.FilterSet):
     """Filter for events"""
@@ -93,6 +72,11 @@ class EventsFilter(django_filters.FilterSet):
         field_name="action",
         lookup_expr="icontains",
     )
+    tenant_name = django_filters.CharFilter(
+        field_name="tenant",
+        lookup_expr="name",
+        label="Tenant name",
+    )
 
     # pylint: disable=unused-argument
     def filter_context_model_pk(self, queryset, name, value):
@@ -107,7 +91,7 @@ class EventsFilter(django_filters.FilterSet):
         fields = ["action", "client_ip", "username"]
 
 
-class EventViewSet(ReadOnlyModelViewSet):
+class EventViewSet(ModelViewSet):
     """Event Read-Only Viewset"""
 
     queryset = Event.objects.all()
@@ -123,16 +107,23 @@ class EventViewSet(ReadOnlyModelViewSet):
     ]
     filterset_class = EventsFilter
 
-    @swagger_auto_schema(
-        method="GET",
+    @extend_schema(
+        methods=["GET"],
         responses={200: EventTopPerUserSerializer(many=True)},
-        query_serializer=EventTopPerUserParams,
+        parameters=[
+            OpenApiParameter(
+                "top_n",
+                type=OpenApiTypes.INT,
+                location=OpenApiParameter.QUERY,
+                required=False,
+            )
+        ],
     )
-    @action(detail=False, methods=["GET"])
+    @action(detail=False, methods=["GET"], pagination_class=None)
     def top_per_user(self, request: Request):
         """Get the top_n events grouped by user count"""
         filtered_action = request.query_params.get("action", EventAction.LOGIN)
-        top_n = request.query_params.get("top_n", 15)
+        top_n = int(request.query_params.get("top_n", "15"))
         return Response(
             get_objects_for_user(request.user, "authentik_events.view_event")
             .filter(action=filtered_action)
@@ -146,17 +137,13 @@ class EventViewSet(ReadOnlyModelViewSet):
             .order_by("-counted_events")[:top_n]
         )
 
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def actions(self, request: Request) -> Response:
         """Get all actions"""
         data = []
         for value, name in EventAction.choices:
             data.append(
-                {
-                    "name": name,
-                    "description": "",
-                    "component": value,
-                }
+                {"name": name, "description": "", "component": value, "model_name": ""}
             )
         return Response(TypeCreateSerializer(data, many=True).data)

authentik/events/api/notification.py

@@ -1,9 +1,13 @@
 """Notification API Views"""
+from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework import mixins
 from rest_framework.fields import ReadOnlyField
+from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import GenericViewSet
 
+from authentik.api.authorization import OwnerFilter, OwnerPermissions
+from authentik.core.api.used_by import UsedByMixin
 from authentik.events.api.event import EventSerializer
 from authentik.events.models import Notification
 
@@ -32,6 +36,7 @@ class NotificationViewSet(
     mixins.RetrieveModelMixin,
     mixins.UpdateModelMixin,
     mixins.DestroyModelMixin,
+    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -46,8 +51,5 @@ class NotificationViewSet(
         "event",
         "seen",
     ]
-
-    def get_queryset(self):
-        if not self.request:
-            return super().get_queryset()
-        return Notification.objects.filter(user=self.request.user)
+    permission_classes = [OwnerPermissions]
+    filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]

authentik/events/api/notification_rule.py

@@ -2,26 +2,30 @@
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.core.api.groups import GroupSerializer
+from authentik.core.api.used_by import UsedByMixin
 from authentik.events.models import NotificationRule
 
 
 class NotificationRuleSerializer(ModelSerializer):
     """NotificationRule Serializer"""
 
+    group_obj = GroupSerializer(read_only=True, source="group")
+
     class Meta:
 
         model = NotificationRule
-        depth = 2
         fields = [
             "pk",
             "name",
             "transports",
             "severity",
             "group",
+            "group_obj",
         ]
 
 
-class NotificationRuleViewSet(ModelViewSet):
+class NotificationRuleViewSet(UsedByMixin, ModelViewSet):
     """NotificationRule Viewset"""
 
     queryset = NotificationRule.objects.all()

authentik/events/api/notification_transport.py

@@ -1,5 +1,6 @@
 """NotificationTransport API Views"""
-from drf_yasg.utils import no_body, swagger_auto_schema
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ListField, SerializerMethodField
 from rest_framework.request import Request
@@ -8,6 +9,7 @@ from rest_framework.serializers import ModelSerializer, Serializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.decorators import permission_required
+from authentik.core.api.used_by import UsedByMixin
 from authentik.events.models import (
     Notification,
     NotificationSeverity,
@@ -22,7 +24,7 @@ class NotificationTransportSerializer(ModelSerializer):
 
     mode_verbose = SerializerMethodField()
 
-    def get_mode_verbose(self, instance: NotificationTransport):
+    def get_mode_verbose(self, instance: NotificationTransport) -> str:
         """Return selected mode with a UI Label"""
         return TransportMode(instance.mode).label
 
@@ -44,26 +46,26 @@ class NotificationTransportTestSerializer(Serializer):
 
     messages = ListField(child=CharField())
 
-    def create(self, request: Request) -> Response:
+    def create(self, validated_data: Request) -> Response:
         raise NotImplementedError
 
     def update(self, request: Request) -> Response:
         raise NotImplementedError
 
 
-class NotificationTransportViewSet(ModelViewSet):
+class NotificationTransportViewSet(UsedByMixin, ModelViewSet):
     """NotificationTransport Viewset"""
 
     queryset = NotificationTransport.objects.all()
     serializer_class = NotificationTransportSerializer
 
     @permission_required("authentik_events.change_notificationtransport")
-    @swagger_auto_schema(
+    @extend_schema(
         responses={
             200: NotificationTransportTestSerializer(many=False),
-            503: "Failed to test transport",
+            500: OpenApiResponse(description="Failed to test transport"),
         },
-        request_body=no_body,
+        request=OpenApiTypes.NONE,
     )
     @action(detail=True, pagination_class=None, filter_backends=[], methods=["post"])
     # pylint: disable=invalid-name, unused-argument
@@ -83,4 +85,4 @@ class NotificationTransportViewSet(ModelViewSet):
             response.is_valid()
             return Response(response.data)
         except NotificationTransportError as exc:
-            return Response(str(exc.__cause__ or None), status=503)
+            return Response(str(exc.__cause__ or None), status=500)