release: 2021.9.1-rc3

web/user: fix edit button for applications
Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
2021-09-19 21:52:49 +02:00 · 2021-09-19 21:10:57 +02:00 · 2021-09-19 21:07:18 +02:00 · 2021-09-19 16:11:20 +02:00 · 2021-09-19 15:57:12 +02:00 · 2021-09-19 15:54:22 +02:00
1035 changed files with 80383 additions and 48666 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.5.4
+current_version = 2021.9.1-rc3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
@ -21,14 +21,14 @@ values =
 [bumpversion:file:docker-compose.yml]
-[bumpversion:file:.github/workflows/release.yml]
+[bumpversion:file:schema.yml]
 [bumpversion:file:.github/workflows/release-publish.yml]
 [bumpversion:file:authentik/__init__.py]
 [bumpversion:file:internal/constants/constants.go]
 [bumpversion:file:outpost/pkg/version.go]
 [bumpversion:file:web/src/constants.ts]
 [bumpversion:file:website/docs/outposts/manual-deploy-docker-compose.md]
--- a/.dockerignore
+++ b/.dockerignore
@ -1,6 +1,8 @@
 env
 helm
 static
 htmlcov
 *.env.yml
 **/node_modules
 dist/**
 build/**
 build_docs/**
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@ -27,7 +27,7 @@ If applicable, add screenshots to help explain your problem.
 Output of docker-compose logs or kubectl logs respectively
 **Version and Deployment (please complete the following information):**
- - authentik version: [e.g. 0.10.0-stable]
+ - authentik version: [e.g. 2021.8.5]
 - Deployment: [e.g. docker-compose, helm]
 **Additional context**
--- a/.github/ISSUE_TEMPLATE/question.md
+++ b/.github/ISSUE_TEMPLATE/question.md
@ -0,0 +1,27 @@
 ---
 name: Question
 about: Ask a question about a feature or specific configuration
 title: ''
 labels: question
 assignees: ''
 ---
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 **Relevant infos**
 i.e. Version of other software you're using, specifics of your setup
 **Screenshots**
 If applicable, add screenshots to help explain your problem.
 **Logs**
 Output of docker-compose logs or kubectl logs respectively
 **Version and Deployment (please complete the following information):**
 - authentik version: [e.g. 2021.8.5]
 - Deployment: [e.g. docker-compose, helm]
 **Additional context**
 Add any other context about the problem here.
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -9,7 +9,7 @@ updates:
  assignees:
  - BeryJu
 - package-ecosystem: gomod
-  directory: "/outpost"
+  directory: "/"
  schedule:
    interval: daily
    time: "04:00"
@ -48,11 +48,3 @@ updates:
  open-pull-requests-limit: 10
  assignees:
  - BeryJu
 - package-ecosystem: docker
  directory: "/outpost"
  schedule:
    interval: daily
    time: "04:00"
  open-pull-requests-limit: 10
  assignees:
  - BeryJu
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@ -0,0 +1,19 @@
 <!--
 👋 Hello there! Welcome.
 Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/master/CONTRIBUTING.md#how-can-i-contribute).
 -->
 # Details
 * **Does this resolve an issue?**
 Resolves #
 ## Changes
 ### New Features
 * Adds feature which does x, y, and z.
 ### Breaking Changes
 * Adds breaking change which causes \<issue\>.
 ## Additional
 Any further notes or comments you want to make.
--- a/.github/stale.yml
+++ b/.github/stale.yml
@ -0,0 +1,14 @@
 # Number of days of inactivity before an issue becomes stale
 daysUntilStale: 60
 # Number of days of inactivity before a stale issue is closed
 daysUntilClose: 7
 # Issues with these labels will never be considered stale
 exemptLabels:
  - pinned
  - security
  - pr_wanted
 # Comment to post when marking an issue as stale. Set to `false` to disable
 markComment: >
  This issue has been automatically marked as stale because it has not had
  recent activity. It will be closed if no further activity occurs. Thank you
  for your contributions.
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@ -0,0 +1,309 @@
 name: authentik-ci-main
 on:
  push:
    branches:
      - master
      - next
      - version-*
    paths-ignore:
      - website
  pull_request:
    branches:
      - master
 env:
  POSTGRES_DB: authentik
  POSTGRES_USER: authentik
  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
 jobs:
  lint-pylint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run pylint
        run: pipenv run pylint authentik tests lifecycle
  lint-black:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run black
        run: pipenv run black --check authentik tests lifecycle
  lint-isort:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run isort
        run: pipenv run isort --check authentik tests lifecycle
  lint-bandit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run bandit
        run: pipenv run bandit -r authentik tests lifecycle
  lint-pyright:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
      - name: prepare
        run: |
          scripts/ci_prepare.sh
          npm install -g pyright@1.1.136
      - name: run bandit
        run: pipenv run pyright e2e lifecycle
  test-migrations:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run migrations
        run: pipenv run python -m lifecycle.migrate
  test-migrations-from-stable:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      - name: checkout stable
        run: |
          # Copy current, latest config to local
          cp authentik/lib/default.yml local.env.yml
          git checkout $(git describe --abbrev=0 --match 'version/*')
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - name: run migrations to stable
        run: pipenv run python -m lifecycle.migrate
      - name: prepare variables
        id: ev
        run: |
          python ./scripts/gh_do_set_branch.py
      - name: checkout current code
        run: |
          set -x
          git fetch
          git checkout ${{ steps.ev.outputs.branchName }}
          pipenv sync --dev
      - name: migrate to latest
        run: pipenv run python -m lifecycle.migrate
  test-unittest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - uses: testspace-com/setup-testspace@v1
        with:
          domain: ${{github.repository_owner}}
      - name: run unittest
        run: |
          pipenv run make test
          pipenv run coverage xml
      - name: run testspace
        if: ${{ always() }}
        run: |
          testspace [unittest]unittest.xml --link=codecov
      - if: ${{ always() }}
        uses: codecov/codecov-action@v2
  test-integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: scripts/ci_prepare.sh
      - uses: testspace-com/setup-testspace@v1
        with:
          domain: ${{github.repository_owner}}
      - name: Create k8s Kind Cluster
        uses: helm/kind-action@v1.2.0
      - name: run integration
        run: |
          pipenv run make test-integration
          pipenv run coverage xml
      - name: run testspace
        if: ${{ always() }}
        run: |
          testspace [integration]unittest.xml --link=codecov
      - if: ${{ always() }}
        uses: codecov/codecov-action@v2
  test-e2e:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-python@v2
        with:
          python-version: '3.9'
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json
      - uses: testspace-com/setup-testspace@v1
        with:
          domain: ${{github.repository_owner}}
      # - id: cache-pipenv
      #   uses: actions/cache@v2.1.6
      #   with:
      #     path: ~/.local/share/virtualenvs
      #     key: ${{ runner.os }}-pipenv-v2-${{ hashFiles('**/Pipfile.lock') }}
      - name: prepare
        # env:
        #   INSTALL: ${{ steps.cache-pipenv.outputs.cache-hit }}
        run: |
          scripts/ci_prepare.sh
          docker-compose -f tests/e2e/ci.docker-compose.yml up -d
      - id: cache-web
        uses: actions/cache@v2.1.6
        with:
          path: web/dist
          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/**') }}
      - name: prepare web ui
        if: steps.cache-web.outputs.cache-hit != 'true'
        run: |
          cd web
          npm i
          npm run build
      - name: run e2e
        run: |
          pipenv run make test-e2e
          pipenv run coverage xml
      - name: run testspace
        if: ${{ always() }}
        run: |
          testspace [e2e]unittest.xml --link=codecov
      - if: ${{ always() }}
        uses: codecov/codecov-action@v2
  build:
    needs:
      - lint-pylint
      - lint-black
      - lint-isort
      - lint-bandit
      - lint-pyright
      - test-migrations
      - test-migrations-from-stable
      - test-unittest
      - test-integration
      - test-e2e
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: prepare variables
        id: ev
        env:
          DOCKER_USERNAME: ${{ secrets.HARBOR_USERNAME }}
        run: |
          python ./scripts/gh_do_set_branch.py
      - name: Login to Container Registry
        uses: docker/login-action@v1
        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
        with:
          registry: beryju.org
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}
      - name: Building Docker Image
        uses: docker/build-push-action@v2
        with:
          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
          tags: |
            beryju.org/authentik/server:gh-${{ steps.ev.outputs.branchName }}
            beryju.org/authentik/server:gh-${{ steps.ev.outputs.branchName }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}
          build-args: |
            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
--- a/.github/workflows/ci-outpost.yml
+++ b/.github/workflows/ci-outpost.yml
@ -0,0 +1,69 @@
 name: authentik-ci-outpost
 on:
  push:
    branches:
      - master
      - next
      - version-*
  pull_request:
    branches:
      - master
 jobs:
  lint-golint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-go@v2
        with:
          go-version: '^1.16.3'
      - name: Run linter
        run: |
          # Create folder structure for go embeds
          mkdir -p web/dist
          mkdir -p website/help
          touch web/dist/test website/help/test
          docker run \
            --rm \
            -v $(pwd):/app \
            -w /app \
            golangci/golangci-lint:v1.39.0 \
            golangci-lint run -v --timeout 200s
  build:
    needs:
      - lint-golint
    strategy:
      matrix:
        type:
          - proxy
          - ldap
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: prepare variables
        id: ev
        env:
          DOCKER_USERNAME: ${{ secrets.HARBOR_USERNAME }}
        run: |
          python ./scripts/gh_do_set_branch.py
      - name: Login to Container Registry
        uses: docker/login-action@v1
        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
        with:
          registry: beryju.org
          username: ${{ secrets.HARBOR_USERNAME }}
          password: ${{ secrets.HARBOR_PASSWORD }}
      - name: Building Docker Image
        uses: docker/build-push-action@v2
        with:
          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
          tags: |
            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchName }}
            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchName }}-${{ steps.ev.outputs.timestamp }}
            beryju.org/authentik/outpost-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
          file: ${{ matrix.type }}.Dockerfile
          build-args: |
            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@ -0,0 +1,89 @@
 name: authentik-ci-web
 on:
  push:
    branches:
      - master
      - next
      - version-*
  pull_request:
    branches:
      - master
 jobs:
  lint-eslint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json
      - run: |
          cd web
          npm install
      - name: Generate API
        run: make gen-web
      - name: Eslint
        run: |
          cd web
          npm run lint
  lint-prettier:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json
      - run: |
          cd web
          npm install
      - name: Generate API
        run: make gen-web
      - name: prettier
        run: |
          cd web
          npm run prettier-check
  lint-lit-analyse:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json
      - run: |
          cd web
          npm install
      - name: Generate API
        run: make gen-web
      - name: prettier
        run: |
          cd web
          npm run lit-analyse
  build:
    needs:
      - lint-eslint
      - lint-prettier
      - lint-lit-analyse
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          cache: 'npm'
          cache-dependency-path: web/package-lock.json
      - run: |
          cd web
          npm install
      - name: Generate API
        run: make gen-web
      - name: build
        run: |
          cd web
          npm run build
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -0,0 +1,60 @@
 name: "CodeQL"
 on:
  push:
    branches: [ master, '*', next, version* ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '30 6 * * 5'
 jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [ 'go', 'javascript', 'python' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
    steps:
    - name: Checkout repository
      uses: actions/checkout@v2
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v1
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
      uses: github/codeql-action/autobuild@v1
    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl
    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language
    #- run: |
    #   make bootstrap
    #   make release
    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v1
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@ -14,7 +14,7 @@ jobs:
    steps:
      - uses: actions/checkout@v2
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.1.0
+        uses: docker/setup-qemu-action@v1.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Docker Login Registry
@ -28,20 +28,26 @@ jobs:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: prepare ts api client
        run: |
          docker run --rm -v $(pwd):/local openapitools/openapi-generator-cli generate -i /local/swagger.yaml -g typescript-fetch -o /local/web/api --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
      - name: Building Docker Image
        uses: docker/build-push-action@v2
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik:2021.5.4,
+            beryju/authentik:2021.9.1-rc3,
            beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2021.5.4,
+            ghcr.io/goauthentik/server:2021.9.1-rc3,
            ghcr.io/goauthentik/server:latest
          platforms: linux/amd64,linux/arm64
          context: .
      - name: Building Docker Image (stable)
        if: ${{ github.event_name == 'release' && !contains('2021.9.1-rc3', 'rc') }}
        run: |
          docker pull beryju/authentik:latest
          docker tag beryju/authentik:latest beryju/authentik:stable
          docker push beryju/authentik:stable
          docker pull ghcr.io/goauthentik/server:latest
          docker tag ghcr.io/goauthentik/server:latest ghcr.io/goauthentik/server:stable
          docker push ghcr.io/goauthentik/server:stable
  build-proxy:
    runs-on: ubuntu-latest
    steps:
@ -49,14 +55,8 @@ jobs:
      - uses: actions/setup-go@v2
        with:
          go-version: "^1.15"
      - name: prepare go api client
        run: |
          cd outpost
          go get -u github.com/go-swagger/go-swagger/cmd/swagger
          swagger generate client -f ../swagger.yaml -A authentik -t pkg/
          go build -v ./cmd/proxy/server.go
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.1.0
+        uses: docker/setup-qemu-action@v1.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Docker Login Registry
@ -75,13 +75,21 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-proxy:2021.5.4,
+            beryju/authentik-proxy:2021.9.1-rc3,
            beryju/authentik-proxy:latest,
-            ghcr.io/goauthentik/proxy:2021.5.4,
+            ghcr.io/goauthentik/proxy:2021.9.1-rc3,
            ghcr.io/goauthentik/proxy:latest
-          context: outpost/
+          file: proxy.Dockerfile
          file: outpost/proxy.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
        if: ${{ github.event_name == 'release' && !contains('2021.9.1-rc3', 'rc') }}
        run: |
          docker pull beryju/authentik-proxy:latest
          docker tag beryju/authentik-proxy:latest beryju/authentik-proxy:stable
          docker push beryju/authentik-proxy:stable
          docker pull ghcr.io/goauthentik/proxy:latest
          docker tag ghcr.io/goauthentik/proxy:latest ghcr.io/goauthentik/proxy:stable
          docker push ghcr.io/goauthentik/proxy:stable
  build-ldap:
    runs-on: ubuntu-latest
    steps:
@ -89,14 +97,8 @@ jobs:
      - uses: actions/setup-go@v2
        with:
          go-version: "^1.15"
      - name: prepare go api client
        run: |
          cd outpost
          go get -u github.com/go-swagger/go-swagger/cmd/swagger
          swagger generate client -f ../swagger.yaml -A authentik -t pkg/
          go build -v ./cmd/ldap/server.go
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.1.0
+        uses: docker/setup-qemu-action@v1.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Docker Login Registry
@ -115,15 +117,22 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-ldap:2021.5.4,
+            beryju/authentik-ldap:2021.9.1-rc3,
            beryju/authentik-ldap:latest,
-            ghcr.io/goauthentik/ldap:2021.5.4,
+            ghcr.io/goauthentik/ldap:2021.9.1-rc3,
            ghcr.io/goauthentik/ldap:latest
-          context: outpost/
+          file: ldap.Dockerfile
          file: outpost/ldap.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
        if: ${{ github.event_name == 'release' && !contains('2021.9.1-rc3', 'rc') }}
        run: |
          docker pull beryju/authentik-ldap:latest
          docker tag beryju/authentik-ldap:latest beryju/authentik-ldap:stable
          docker push beryju/authentik-ldap:stable
          docker pull ghcr.io/goauthentik/ldap:latest
          docker tag ghcr.io/goauthentik/ldap:latest ghcr.io/goauthentik/ldap:stable
          docker push ghcr.io/goauthentik/ldap:stable
  test-release:
    if: ${{ github.event_name == 'release' }}
    needs:
      - build-server
      - build-proxy
@ -139,7 +148,7 @@ jobs:
          docker-compose pull -q
          docker-compose up --no-start
          docker-compose start postgresql redis
-          docker-compose run -u root --entrypoint /bin/bash server -c "apt-get update && apt-get install -y --no-install-recommends git && pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
+          docker-compose run -u root server test
  sentry-release:
    if: ${{ github.event_name == 'release' }}
    needs:
@ -147,13 +156,26 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Setup Node.js environment
        uses: actions/setup-node@v2
        with:
          node-version: '16'
      - name: Build web api client and web ui
        run: |
          export NODE_ENV=production
          cd web
          npm i
          npm run build
      - name: Create a Sentry.io release
        uses: getsentry/action-release@v1
        if: ${{ github.event_name == 'release' }}
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: beryjuorg
          SENTRY_PROJECT: authentik
          SENTRY_URL: https://sentry.beryju.org
        with:
-          version: authentik@2021.5.4
+          version: authentik@2021.9.1-rc3
          environment: beryjuorg-prod
          sourcemaps: './web/dist'
          url_prefix: '~/static/dist'
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@ -11,9 +11,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: prepare ts api client
        run: |
          docker run --rm -v $(pwd):/local openapitools/openapi-generator-cli generate -i /local/swagger.yaml -g typescript-fetch -o /local/web/api --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
      - name: Pre-release test
        run: |
          sudo apt-get install -y pwgen
@ -23,14 +20,14 @@ jobs:
          docker-compose pull -q
          docker build \
            --no-cache \
-            -t beryju/authentik:latest \
+            -t ghcr.io/goauthentik/server:latest \
            -f Dockerfile .
          docker-compose up --no-start
          docker-compose start postgresql redis
-          docker-compose run -u root --entrypoint /bin/bash server -c "apt-get update && apt-get install -y --no-install-recommends git && pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
+          docker-compose run -u root server test
      - name: Extract version number
        id: get_version
-        uses: actions/github-script@v4.0.2
+        uses: actions/github-script@v4.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
--- a/.github/workflows/web-api-publish.yml
+++ b/.github/workflows/web-api-publish.yml
@ -0,0 +1,39 @@
 name: authentik-web-api-publish
 on:
  push:
    branches: [ master ]
    paths:
      - 'schema.yml'
 jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      # Setup .npmrc file to publish to npm
      - uses: actions/setup-node@v2
        with:
          node-version: '16'
          registry-url: 'https://registry.npmjs.org'
      - name: Generate API Client
        run: make gen-web
      - name: Publish package
        run: |
          cd web-api/
          npm i
          npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
      - name: Upgrade /web
        run: |
          cd web/
          export VERSION=`node -e 'console.log(require("../web-api/package.json").version)'`
          npm i @goauthentik/api@$VERSION
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v3
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: update-web-api-client
          commit-message: "web: Update Web API Client version"
          title: "web: Update Web API Client version"
          delete-branch: true
          signoff: true
--- a/.gitignore
+++ b/.gitignore
@ -193,10 +193,6 @@ pip-selfcheck.json
 local.env.yml
 .vscode/
 ### Helm ###
 # Chart dependencies
 **/charts/*.tgz
 # Selenium Screenshots
 selenium_screenshots/
 backups/
@ -204,3 +200,5 @@ media/
 *mmdb
 .idea/
 /api/
 /web-api/
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -0,0 +1,22 @@
 {
    "cSpell.words": [
        "asgi",
        "authentik",
        "authn",
        "goauthentik",
        "jwks",
        "oidc",
        "openid",
        "plex",
        "saml",
        "totp",
        "webauthn"
    ],
    "python.linting.pylintEnabled": true,
    "todo-tree.tree.showCountsInTree": true,
    "todo-tree.tree.showBadges": true,
    "python.formatting.provider": "black",
    "files.associations": {
        "*.akflow": "json"
    }
 }
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@ -0,0 +1,128 @@
 # Contributor Covenant Code of Conduct
 ## Our Pledge
 We as members, contributors, and leaders pledge to make participation in our
 community a harassment-free experience for everyone, regardless of age, body
 size, visible or invisible disability, ethnicity, sex characteristics, gender
 identity and expression, level of experience, education, socio-economic status,
 nationality, personal appearance, race, religion, or sexual identity
 and orientation.
 We pledge to act and interact in ways that contribute to an open, welcoming,
 diverse, inclusive, and healthy community.
 ## Our Standards
 Examples of behavior that contributes to a positive environment for our
 community include:
 * Demonstrating empathy and kindness toward other people
 * Being respectful of differing opinions, viewpoints, and experiences
 * Giving and gracefully accepting constructive feedback
 * Accepting responsibility and apologizing to those affected by our mistakes,
  and learning from the experience
 * Focusing on what is best not just for us as individuals, but for the
  overall community
 Examples of unacceptable behavior include:
 * The use of sexualized language or imagery, and sexual attention or
  advances of any kind
 * Trolling, insulting or derogatory comments, and personal or political attacks
 * Public or private harassment
 * Publishing others' private information, such as a physical or email
  address, without their explicit permission
 * Other conduct which could reasonably be considered inappropriate in a
  professional setting
 ## Enforcement Responsibilities
 Community leaders are responsible for clarifying and enforcing our standards of
 acceptable behavior and will take appropriate and fair corrective action in
 response to any behavior that they deem inappropriate, threatening, offensive,
 or harmful.
 Community leaders have the right and responsibility to remove, edit, or reject
 comments, commits, code, wiki edits, issues, and other contributions that are
 not aligned to this Code of Conduct, and will communicate reasons for moderation
 decisions when appropriate.
 ## Scope
 This Code of Conduct applies within all community spaces, and also applies when
 an individual is officially representing the community in public spaces.
 Examples of representing our community include using an official e-mail address,
 posting via an official social media account, or acting as an appointed
 representative at an online or offline event.
 ## Enforcement
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
 hello@beryju.org.
 All complaints will be reviewed and investigated promptly and fairly.
 All community leaders are obligated to respect the privacy and security of the
 reporter of any incident.
 ## Enforcement Guidelines
 Community leaders will follow these Community Impact Guidelines in determining
 the consequences for any action they deem in violation of this Code of Conduct:
 ### 1. Correction
 **Community Impact**: Use of inappropriate language or other behavior deemed
 unprofessional or unwelcome in the community.
 **Consequence**: A private, written warning from community leaders, providing
 clarity around the nature of the violation and an explanation of why the
 behavior was inappropriate. A public apology may be requested.
 ### 2. Warning
 **Community Impact**: A violation through a single incident or series
 of actions.
 **Consequence**: A warning with consequences for continued behavior. No
 interaction with the people involved, including unsolicited interaction with
 those enforcing the Code of Conduct, for a specified period of time. This
 includes avoiding interactions in community spaces as well as external channels
 like social media. Violating these terms may lead to a temporary or
 permanent ban.
 ### 3. Temporary Ban
 **Community Impact**: A serious violation of community standards, including
 sustained inappropriate behavior.
 **Consequence**: A temporary ban from any sort of interaction or public
 communication with the community for a specified period of time. No public or
 private interaction with the people involved, including unsolicited interaction
 with those enforcing the Code of Conduct, is allowed during this period.
 Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban
 **Community Impact**: Demonstrating a pattern of violation of community
 standards, including sustained inappropriate behavior,  harassment of an
 individual, or aggression toward or disparagement of classes of individuals.
 **Consequence**: A permanent ban from any sort of public interaction within
 the community.
 ## Attribution
 This Code of Conduct is adapted from the [Contributor Covenant][homepage],
 version 2.0, available at
 https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
 Community Impact Guidelines were inspired by [Mozilla's code of conduct
 enforcement ladder](https://github.com/mozilla/diversity).
 [homepage]: https://www.contributor-covenant.org
 For answers to common questions about this code of conduct, see the FAQ at
 https://www.contributor-covenant.org/faq. Translations are available at
 https://www.contributor-covenant.org/translations.
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -0,0 +1,175 @@
 # Contributing to authentik
 :+1::tada: Thanks for taking the time to contribute! :tada::+1:
 The following is a set of guidelines for contributing to authentik and its components, which are hosted in the [goauthentik Organization](https://github.com/goauthentik) on GitHub. These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
 #### Table Of Contents
 [Code of Conduct](#code-of-conduct)
 [I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)
 [What should I know before I get started?](#what-should-i-know-before-i-get-started)
  * [The components](#the-components)
  * [authentik's structure](#authentiks-structure)
 [How Can I Contribute?](#how-can-i-contribute)
  * [Reporting Bugs](#reporting-bugs)
  * [Suggesting Enhancements](#suggesting-enhancements)
  * [Your First Code Contribution](#your-first-code-contribution)
  * [Pull Requests](#pull-requests)
 [Styleguides](#styleguides)
  * [Git Commit Messages](#git-commit-messages)
  * [Python Styleguide](#python-styleguide)
  * [Documentation Styleguide](#documentation-styleguide)
 ## Code of Conduct
 Basically, don't be a dickhead. This is an open-source non-profit project, that is made in the free time of Volunteers. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.
 ## I don't want to read this whole thing I just have a question!!!
 Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://discord.gg/jg33eMhnj6)
 ## What should I know before I get started?
 ### The components
 authentik consists of a few larger components:
 - *authentik* the actual application server, is described below.
 - *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
 - *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
 - *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
 - *website* is the Website/documentation, which uses docusaurus.
 ### authentik's structure
 authentik is at it's very core a Django project. It consists of many individual django applications. These applications are intended to separate concerns, and they may share code between each other.
 These are the current packages:
 <a id="authentik-packages"/>
 ```
 authentik
 ├── admin - Administrative tasks and APIs, no models (Version updates, Metrics, system tasks)
 ├── api - General API Configuration (Routes, Schema and general API utilities)
 ├── core - Core authentik functionality, central routes, core Models
 ├── crypto - Cryptography, currently used to generate and hold Certificates and Private Keys
 ├── events - Event Log, middleware and signals to generate signals
 ├── flows - Flows, the FlowPlanner and the FlowExecutor, used for all flows for authentication, authorization, etc
 ├── lib - Generic library of functions, few dependencies on other packages.
 ├── managed - Handle managed models and their state.
 ├── outposts - Configure and deploy outposts on kubernetes and docker.
 ├── policies - General PolicyEngine
 │   ├── dummy - A Dummy policy used for testing
 │   ├── event_matcher - Match events based on different criteria
 │   ├── expiry - Check when a user's password was last set
 │   ├── expression - Execute any arbitrary python code
 │   ├── hibp - Check a password against HaveIBeenPwned
 │   ├── password - Check a password against several rules
 │   └── reputation - Check the user's/client's reputation
 ├── providers
 │   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
 │   ├── oauth2 - OIDC-compliant OAuth2 provider
 │   ├── proxy - Provides an identity-aware proxy using an outpost
 │   └── saml - SAML2 Provider
 ├── recovery - Generate keys to use in case you lock yourself out
 ├── root - Root django application, contains global settings and routes
 ├── sources
 │   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
 │   ├── oauth - OAuth1 and OAuth2 Source
 │   ├── plex - Plex source
 │   └── saml - SAML2 Source
 ├── stages
 │   ├── authenticator_duo - Configure a DUO authenticator
 │   ├── authenticator_static - Configure TOTP backup keys
 │   ├── authenticator_totp - Configure a TOTP authenticator
 │   ├── authenticator_validate - Validate any authenticator
 │   ├── authenticator_webauthn - Configure a WebAuthn authenticator
 │   ├── captcha - Make the user pass a captcha
 │   ├── consent - Let the user decide if they want to consent to an action
 │   ├── deny - Static deny, can be used with policies
 │   ├── dummy - Dummy stage to test
 │   ├── email - Send the user an email and block execution until they click the link
 │   ├── identification - Identify a user with any combination of fields
 │   ├── invitation - Invitation system to limit flows to certain users
 │   ├── password - Password authentication
 │   ├── prompt - Arbitrary prompts
 │   ├── user_delete - Delete the currently pending user
 │   ├── user_login - Login the currently pending user
 │   ├── user_logout - Logout the currently pending user
 │   └── user_write - Write any currenetly pending data to the user.
 └── tenants - Soft tennancy, configure defaults and branding per domain
 ```
 This django project is running in gunicorn, which spawns multiple workers and threads. Gunicorn is run from a lightweight Go application which reverse-proxies it, handles static files and will eventually gain more functionality as more code is migrated to go.
 There are also several background tasks which run in Celery, the root celery application is defined in `authentik.root.celery`.
 ## How Can I Contribute?
 ### Reporting Bugs
 This section guides you through submitting a bug report for authentik. Following these guidelines helps maintainers and the community understand your report, reproduce the behavior, and find related reports.
 Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.
 This form will have the full stack trace of the error that ocurred and shouldn't contain any sensitive data.
 ### Suggesting Enhancements
 This section guides you through submitting an enhancement suggestion for authentik, including completely new features and minor improvements to existing functionality. Following these guidelines helps maintainers and the community understand your suggestion and find related suggestions.
 When you are creating an enhancement suggestion, please fill in [the template](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=), including the steps that you imagine you would take if the feature you're requesting existed.
 ### Your First Code Contribution
 #### Local development
 authentik can be run locally, all though depending on which part you want to work on, different pre-requisites are required.
 This is documented in the [developer docs](https://goauthentik.io/developer-docs/)
 ### Pull Requests
 The process described here has several goals:
 - Maintain authentik's quality
 - Fix problems that are important to users
 - Engage the community in working toward the best possible authentik
 - Enable a sustainable system for authentik's maintainers to review contributions
 Please follow these steps to have your contribution considered by the maintainers:
 1. Follow the [styleguides](#styleguides)
 2. After you submit your pull request, verify that all [status checks](https://help.github.com/articles/about-status-checks/) are passing <details><summary>What if the status checks are failing?</summary>If a status check is failing, and you believe that the failure is unrelated to your change, please leave a comment on the pull request explaining why you believe the failure is unrelated. A maintainer will re-run the status check for you. If we conclude that the failure was a false positive, then we will open an issue to track that problem with our status check suite.</details>
 3. Ensure your Code has tests. While it is not always possible to test every single case, the majority of the code should be tested.
 While the prerequisites above must be satisfied prior to having your pull request reviewed, the reviewer(s) may ask you to complete additional design work, tests, or other changes before your pull request can be ultimately accepted.
 ## Styleguides
 ### Git Commit Messages
 * Use the format of `<package>: <verb> <description>`
  - See [here](#authentik-packages) for `package`
  - Example: `providers/saml2: fix parsing of requests`
 * Reference issues and pull requests liberally after the first line
 ### Python Styleguide
 All Python code is linted with [black](https://black.readthedocs.io/en/stable/), [PyLint](https://www.pylint.org/) and [isort](https://pycqa.github.io/isort/).
 authentik runs on Python 3.9 at the time of writing this.
 * Use native type-annotations wherever possible.
 * Add meaningful docstrings when possible.
 * Ensure any database migrations work properly from the last stable version (this is checked via CI)
 * If your code changes central functions, make sure nothing else is broken.
 ### Documentation Styleguide
 * Use [MDX](https://mdxjs.com/) whenever appropriate.
--- a/40
+++ b/40
@ -8,36 +8,45 @@ WORKDIR /app/
 RUN pip install pipenv && \
    pipenv lock -r > requirements.txt && \
-    pipenv lock -rd > requirements-dev.txt
+    pipenv lock -r --dev-only > requirements-dev.txt
-# Stage 2: Build webui
+# Stage 2: Build website
-FROM node as npm-builder
+FROM node as website-builder
 COPY ./website /static/
 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build-docs-only
 # Stage 3: Build webui
 FROM node as web-builder
 COPY ./web /static/
 ENV NODE_ENV=production
-RUN cd /static && npm i --production=false && npm run build
+RUN cd /static && npm i && npm run build
-# Stage 3: Build go proxy
+# Stage 4: Build go proxy
-FROM golang:1.16.4 AS builder
+FROM golang:1.17.1 AS builder
 WORKDIR /work
-COPY --from=npm-builder /static/robots.txt /work/web/robots.txt
+COPY --from=web-builder /static/robots.txt /work/web/robots.txt
-COPY --from=npm-builder /static/security.txt /work/web/security.txt
+COPY --from=web-builder /static/security.txt /work/web/security.txt
-COPY --from=npm-builder /static/dist/ /work/web/dist/
+COPY --from=web-builder /static/dist/ /work/web/dist/
-COPY --from=npm-builder /static/authentik/ /work/web/authentik/
+COPY --from=web-builder /static/authentik/ /work/web/authentik/
 COPY --from=website-builder /static/help/ /work/website/help/
 # RUN ls /work/web/static/authentik/ && exit 1
 COPY ./cmd /work/cmd
 COPY ./web/static.go /work/web/static.go
 COPY ./website/static.go /work/website/static.go
 COPY ./internal /work/internal
 COPY ./go.mod /work/go.mod
 COPY ./go.sum /work/go.sum
 RUN go build -o /work/authentik ./cmd/server/main.go
-# Stage 4: Run
+# Stage 5: Run
 FROM python:3.9-slim-buster
 WORKDIR /
@ -65,11 +74,14 @@ RUN apt-get update && \
 COPY ./authentik/ /authentik
 COPY ./pyproject.toml /
 COPY ./xml /xml
 COPY ./tests /tests
 COPY ./manage.py /
 COPY ./lifecycle/ /lifecycle
 COPY --from=builder /work/authentik /authentik-proxy
 USER authentik
 ENV TMPDIR /dev/shm/
-ENV PYTHONUBUFFERED 1
+ENV PYTHONUNBUFFERED 1
-ENTRYPOINT [ "/lifecycle/bootstrap.sh" ]
+ENV prometheus_multiproc_dir /dev/shm/
 ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
 ENTRYPOINT [ "/lifecycle/ak" ]
--- a/49
+++ b/49
@ -1,11 +1,12 @@
 .SHELLFLAGS += -x -e
 PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
 all: lint-fix lint test gen
 test-integration:
 	k3d cluster create || exit 0
 	k3d kubeconfig write -o ~/.kube/config --overwrite
 	coverage run manage.py test -v 3 tests/integration
 test-e2e:
@ -25,16 +26,46 @@ lint:
 	bandit -r authentik tests lifecycle -x node_modules
 	pylint authentik tests lifecycle
-gen:
+gen-build:
-	./manage.py generate_swagger -o swagger.yaml -f yaml
+	./manage.py spectacular --file schema.yml
 gen-clean:
 	rm -rf web/api/src/
 	rm -rf api/
 gen-web:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
 		openapitools/openapi-generator-cli generate \
-		-i /local/swagger.yaml \
+		-i /local/schema.yml \
 		-g typescript-fetch \
-		-o /local/web/api \
+		-o /local/web-api \
-		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=@goauthentik/api,npmVersion=${NPM_VERSION}
-	cd web/api && npx tsc
+	mkdir -p web/node_modules/@goauthentik/api
 	python -m scripts.web_api_esm
 	\cp -fv scripts/web_api_readme.md web-api/README.md
 	cd web-api && npm i
 	\cp -rfv web-api/* web/node_modules/@goauthentik/api
 gen-outpost:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
 		openapitools/openapi-generator-cli generate \
 		--git-host goauthentik.io \
 		--git-repo-id outpost \
 		--git-user-id api \
 		-i /local/schema.yml \
 		-g go \
 		-o /local/api \
 		--additional-properties=packageName=api,enumClassPrefix=true,useOneOfDiscriminatorLookup=true,disallowAdditionalPropertiesIfNotPresent=false
 	rm -f api/go.mod api/go.sum
 gen: gen-build gen-clean gen-web
 migrate:
 	python -m lifecycle.migrate
 run:
-	go run -v cmd/server/main.go
+	WORKERS=1 go run -v cmd/server/main.go
--- a/11
+++ b/11
@ -22,7 +22,7 @@ django-storages = "*"
 djangorestframework = "*"
 djangorestframework-guardian = "*"
 docker = "*"
-drf_yasg = "*"
+drf-spectacular = "*"
 facebook-sdk = "*"
 geoip2 = "*"
 gunicorn = "*"
@ -39,14 +39,15 @@ sentry-sdk = "*"
 service_identity = "*"
 structlog = "*"
 swagger-spec-validator = "*"
-twisted = "==20.3.0"
+twisted = "==21.7.0"
 urllib3 = {extras = ["secure"],version = "*"}
 uvicorn = {extras = ["standard"],version = "*"}
 webauthn = "*"
 xmlsec = "*"
-
+duo-client = "*"
-[requires]
+ua-parser = "*"
-python_version = "3.9"
+deepmerge = "*"
 colorama = "*"
 [dev-packages]
 bandit = "*"
--- a/Pipfile.lock
+++ b/Pipfile.lock
--- a/README.md
+++ b/README.md
@ -4,14 +4,15 @@
 ---
-[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/jg33eMhnj6)
+[![Join Discord](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://discord.gg/jg33eMhnj6)
-[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/6?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-main?label=core%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-main.yml)
-[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/6?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-outpost?label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
-[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=flat-square)](https://codecov.io/gh/goauthentik/authentik)
+[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-web?label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
-![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=flat-square)
+[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=for-the-badge)](https://codecov.io/gh/goauthentik/authentik)
-![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=flat-square)
+[![Testspace tests](https://img.shields.io/testspace/total/goauthentik/goauthentik:authentik/master?style=for-the-badge)](https://goauthentik.testspace.com/)
-![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/goauthentik/authentik?style=flat-square)
+![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=for-the-badge)
-[Transifex](https://www.transifex.com/beryjuorg/authentik/)
+![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=for-the-badge)
 [![](https://img.shields.io/badge/Help%20translate-transifex-blue?style=for-the-badge)](https://www.transifex.com/beryjuorg/authentik/)
 ## What is authentik?
@ -21,7 +22,7 @@ authentik is an open-source Identity Provider focused on flexibility and versati
 For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/)
-For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
+For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
 ## Screenshots
--- a/SECURITY.md
+++ b/SECURITY.md
@ -2,10 +2,12 @@
 ## Supported Versions
 (.x being the latest patch release for each version)
 | Version    | Supported          |
 | ---------- | ------------------ |
-| 2021.4.x   | :white_check_mark: |
+| 2021.7.x   | :white_check_mark: |
-| 2021.5.x   | :white_check_mark: |
+| 2021.8.x   | :white_check_mark: |
 ## Reporting a Vulnerability
--- a/authentik/init.py
+++ b/authentik/init.py
@ -1,3 +1,3 @@
 """authentik"""
-__version__ = "2021.5.4"
+__version__ = "2021.9.1-rc3"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
--- a/authentik/admin/api/meta.py
+++ b/authentik/admin/api/meta.py
@ -1,5 +1,5 @@
 """Meta API"""
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework.fields import CharField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
@ -22,7 +22,7 @@ class AppsViewSet(ViewSet):
    permission_classes = [IsAdminUser]
-    @swagger_auto_schema(responses={200: AppSerializer(many=True)})
+    @extend_schema(responses={200: AppSerializer(many=True)})
    def list(self, request: Request) -> Response:
        """List current messages and pass into Serializer"""
        data = []
--- a/authentik/admin/api/metrics.py
+++ b/authentik/admin/api/metrics.py
@ -7,12 +7,12 @@ from django.db.models import Count, ExpressionWrapper, F
 from django.db.models.fields import DurationField
 from django.db.models.functions import ExtractHour
 from django.utils.timezone import now
-from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
+from drf_spectacular.utils import extend_schema, extend_schema_field
 from rest_framework.fields import IntegerField, SerializerMethodField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.viewsets import ViewSet
+from rest_framework.views import APIView
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.models import Event, EventAction
@ -23,9 +23,7 @@ def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
    date_from = now() - timedelta(days=1)
    result = (
        Event.objects.filter(created__gte=date_from, **filter_kwargs)
-        .annotate(
+        .annotate(age=ExpressionWrapper(now() - F("created"), output_field=DurationField()))
            age=ExpressionWrapper(now() - F("created"), output_field=DurationField())
        )
        .annotate(age_hours=ExtractHour("age"))
        .values("age_hours")
        .annotate(count=Count("pk"))
@ -37,8 +35,7 @@ def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
    for hour in range(0, -24, -1):
        results.append(
            {
-                "x_cord": time.mktime((_now + timedelta(hours=hour)).timetuple())
+                "x_cord": time.mktime((_now + timedelta(hours=hour)).timetuple()) * 1000,
                * 1000,
                "y_cord": data[hour * -1],
            }
        )
@ -58,24 +55,24 @@ class LoginMetricsSerializer(PassiveSerializer):
    logins_per_1h = SerializerMethodField()
    logins_failed_per_1h = SerializerMethodField()
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
    def get_logins_per_1h(self, _):
        """Get successful logins per hour for the last 24 hours"""
        return get_events_per_1h(action=EventAction.LOGIN)
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
    def get_logins_failed_per_1h(self, _):
        """Get failed logins per hour for the last 24 hours"""
        return get_events_per_1h(action=EventAction.LOGIN_FAILED)
-class AdministrationMetricsViewSet(ViewSet):
+class AdministrationMetricsViewSet(APIView):
    """Login Metrics per 1h"""
    permission_classes = [IsAdminUser]
-    @swagger_auto_schema(responses={200: LoginMetricsSerializer(many=False)})
+    @extend_schema(responses={200: LoginMetricsSerializer(many=False)})
-    def list(self, request: Request) -> Response:
+    def get(self, request: Request) -> Response:
        """Login Metrics per 1h"""
        serializer = LoginMetricsSerializer(True)
        return Response(serializer.data)
--- a/authentik/admin/api/system.py
+++ b/authentik/admin/api/system.py
@ -0,0 +1,104 @@
 """authentik administration overview"""
 import os
 import platform
 from datetime import datetime
 from sys import version as python_version
 from typing import TypedDict
 from django.utils.timezone import now
 from drf_spectacular.utils import extend_schema
 from gunicorn import version_info as gunicorn_version
 from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from rest_framework.fields import SerializerMethodField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
 from authentik.core.api.utils import PassiveSerializer
 from authentik.outposts.managed import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost
 class RuntimeDict(TypedDict):
    """Runtime information"""
    python_version: str
    gunicorn_version: str
    environment: str
    architecture: str
    platform: str
    uname: str
 class SystemSerializer(PassiveSerializer):
    """Get system information."""
    env = SerializerMethodField()
    http_headers = SerializerMethodField()
    http_host = SerializerMethodField()
    http_is_secure = SerializerMethodField()
    runtime = SerializerMethodField()
    tenant = SerializerMethodField()
    server_time = SerializerMethodField()
    embedded_outpost_host = SerializerMethodField()
    def get_env(self, request: Request) -> dict[str, str]:
        """Get Environment"""
        return os.environ.copy()
    def get_http_headers(self, request: Request) -> dict[str, str]:
        """Get HTTP Request headers"""
        headers = {}
        for key, value in request.META.items():
            if not isinstance(value, str):
                continue
            headers[key] = value
        return headers
    def get_http_host(self, request: Request) -> str:
        """Get HTTP host"""
        return request._request.get_host()
    def get_http_is_secure(self, request: Request) -> bool:
        """Get HTTP Secure flag"""
        return request._request.is_secure()
    def get_runtime(self, request: Request) -> RuntimeDict:
        """Get versions"""
        return {
            "python_version": python_version,
            "gunicorn_version": ".".join(str(x) for x in gunicorn_version),
            "environment": "kubernetes" if SERVICE_HOST_ENV_NAME in os.environ else "compose",
            "architecture": platform.machine(),
            "platform": platform.platform(),
            "uname": " ".join(platform.uname()),
        }
    def get_tenant(self, request: Request) -> str:
        """Currently active tenant"""
        return str(request._request.tenant)
    def get_server_time(self, request: Request) -> datetime:
        """Current server time"""
        return now()
    def get_embedded_outpost_host(self, request: Request) -> str:
        """Get the FQDN configured on the embeddded outpost"""
        outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
        if not outposts.exists():
            return ""
        return outposts.first().config.authentik_host
 class SystemView(APIView):
    """Get system information."""
    permission_classes = [IsAdminUser]
    pagination_class = None
    filter_backends = []
    @extend_schema(responses={200: SystemSerializer(many=False)})
    def get(self, request: Request) -> Response:
        """Get system information."""
        return Response(SystemSerializer(request).data)
--- a/authentik/admin/api/tasks.py
+++ b/authentik/admin/api/tasks.py
@ -4,7 +4,8 @@ from importlib import import_module
 from django.contrib import messages
 from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
 from rest_framework.permissions import IsAdminUser
@ -21,7 +22,7 @@ class TaskSerializer(PassiveSerializer):
    task_name = CharField()
    task_description = CharField()
-    task_finish_timestamp = DateTimeField(source="finish_timestamp")
+    task_finish_timestamp = DateTimeField(source="finish_time")
    status = ChoiceField(
        source="result.status.name",
@ -29,14 +30,32 @@ class TaskSerializer(PassiveSerializer):
    )
    messages = ListField(source="result.messages")
    def to_representation(self, instance):
        """When a new version of authentik adds fields to TaskInfo,
        the API will fail with an AttributeError, as the classes
        are pickled in cache. In that case, just delete the info"""
        try:
            return super().to_representation(instance)
        except AttributeError:
            if isinstance(self.instance, list):
                for inst in self.instance:
                    inst.delete()
            else:
                self.instance.delete()
            return {}
 class TaskViewSet(ViewSet):
    """Read-only view set that returns all background tasks"""
    permission_classes = [IsAdminUser]
    serializer_class = TaskSerializer
-    @swagger_auto_schema(
+    @extend_schema(
-        responses={200: TaskSerializer(many=False), 404: "Task not found"}
+        responses={
            200: TaskSerializer(many=False),
            404: OpenApiResponse(description="Task not found"),
        }
    )
    # pylint: disable=invalid-name
    def retrieve(self, request: Request, pk=None) -> Response:
@ -46,18 +65,19 @@ class TaskViewSet(ViewSet):
            raise Http404
        return Response(TaskSerializer(task, many=False).data)
-    @swagger_auto_schema(responses={200: TaskSerializer(many=True)})
+    @extend_schema(responses={200: TaskSerializer(many=True)})
    def list(self, request: Request) -> Response:
        """List system tasks"""
        tasks = sorted(TaskInfo.all().values(), key=lambda task: task.task_name)
        return Response(TaskSerializer(tasks, many=True).data)
-    @swagger_auto_schema(
+    @extend_schema(
        request=OpenApiTypes.NONE,
        responses={
-            204: "Task retried successfully",
+            204: OpenApiResponse(description="Task retried successfully"),
-            404: "Task not found",
+            404: OpenApiResponse(description="Task not found"),
-            500: "Failed to retry task",
+            500: OpenApiResponse(description="Failed to retry task"),
-        }
+        },
    )
    @action(detail=True, methods=["post"])
    # pylint: disable=invalid-name
@ -72,10 +92,7 @@ class TaskViewSet(ViewSet):
            task_func.delay(*task.task_call_args, **task.task_call_kwargs)
            messages.success(
                self.request,
-                _(
+                _("Successfully re-scheduled Task %(name)s!" % {"name": task.task_name}),
                    "Successfully re-scheduled Task %(name)s!"
                    % {"name": task.task_name}
                ),
            )
            return Response(status=204)
        except ImportError:  # pragma: no cover
--- a/authentik/admin/api/version.py
+++ b/authentik/admin/api/version.py
@ -2,14 +2,13 @@
 from os import environ
 from django.core.cache import cache
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from packaging.version import parse
 from rest_framework.fields import SerializerMethodField
 from rest_framework.mixins import ListModelMixin
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.viewsets import GenericViewSet
+from rest_framework.views import APIView
 from authentik import ENV_GIT_HASH_KEY, __version__
 from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
@ -42,22 +41,17 @@ class VersionSerializer(PassiveSerializer):
    def get_outdated(self, instance) -> bool:
        """Check if we're running the latest version"""
-        return parse(self.get_version_current(instance)) < parse(
+        return parse(self.get_version_current(instance)) < parse(self.get_version_latest(instance))
            self.get_version_latest(instance)
        )
-class VersionViewSet(ListModelMixin, GenericViewSet):
+class VersionView(APIView):
    """Get running and latest version."""
    permission_classes = [IsAuthenticated]
    pagination_class = None
    filter_backends = []
-    def get_queryset(self):  # pragma: no cover
+    @extend_schema(responses={200: VersionSerializer(many=False)})
-        return None
+    def get(self, request: Request) -> Response:
    @swagger_auto_schema(responses={200: VersionSerializer(many=False)})
    def list(self, request: Request) -> Response:
        """Get running and latest version."""
        return Response(VersionSerializer(True).data)
--- a/authentik/admin/api/workers.py
+++ b/authentik/admin/api/workers.py
@ -1,25 +1,24 @@
 """authentik administration overview"""
-from rest_framework.mixins import ListModelMixin
+from drf_spectacular.utils import extend_schema, inline_serializer
 from prometheus_client import Gauge
 from rest_framework.fields import IntegerField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import Serializer
+from rest_framework.views import APIView
 from rest_framework.viewsets import GenericViewSet
 from authentik.root.celery import CELERY_APP
 GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")
-class WorkerViewSet(ListModelMixin, GenericViewSet):
+
 class WorkerView(APIView):
    """Get currently connected worker count."""
    serializer_class = Serializer
    permission_classes = [IsAdminUser]
-    def get_queryset(self):  # pragma: no cover
+    @extend_schema(responses=inline_serializer("Workers", fields={"count": IntegerField()}))
-        return None
+    def get(self, request: Request) -> Response:
    def list(self, request: Request) -> Response:
        """Get currently connected worker count."""
-        return Response(
+        count = len(CELERY_APP.control.ping(timeout=0.5))
-            {"pagination": {"count": len(CELERY_APP.control.ping(timeout=0.5))}}
+        return Response({"count": count})
        )
--- a/authentik/admin/tasks.py
+++ b/authentik/admin/tasks.py
@ -1,15 +1,19 @@
 """authentik admin tasks"""
 import re
 from os import environ
 from django.core.cache import cache
 from django.core.validators import URLValidator
 from packaging.version import parse
-from requests import RequestException, get
+from prometheus_client import Info
 from requests import RequestException
 from structlog.stdlib import get_logger
-from authentik import __version__
+from authentik import ENV_GIT_HASH_KEY, __version__
 from authentik.events.models import Event, EventAction
 from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.config import CONFIG
 from authentik.lib.utils.http import get_http_session
 from authentik.root.celery import CELERY_APP
 LOGGER = get_logger()
@ -17,25 +21,39 @@ VERSION_CACHE_KEY = "authentik_latest_version"
 VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
 # Chop of the first ^ because we want to search the entire string
 URL_FINDER = URLValidator.regex.pattern[1:]
 PROM_INFO = Info("authentik_version", "Currently running authentik version")
 def _set_prom_info():
    """Set prometheus info for version"""
    PROM_INFO.info(
        {
            "version": __version__,
            "latest": cache.get(VERSION_CACHE_KEY, ""),
            "build_hash": environ.get(ENV_GIT_HASH_KEY, ""),
        }
    )
@CELERY_APP.task(bind=True, base=MonitoredTask)
 def update_latest_version(self: MonitoredTask):
    """Update latest version info"""
    if CONFIG.y_bool("disable_update_check"):
        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
        self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
        return
    try:
-        response = get(
+        response = get_http_session().get(
-            "https://api.github.com/repos/goauthentik/authentik/releases/latest"
+            "https://version.goauthentik.io/version.json",
        )
        response.raise_for_status()
        data = response.json()
-        tag_name = data.get("tag_name")
+        upstream_version = data.get("stable", {}).get("version")
        upstream_version = tag_name.split("/")[1]
        cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
        self.set_status(
-            TaskResult(
+            TaskResult(TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"])
                TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"]
            )
        )
        _set_prom_info()
        # Check if upstream version is newer than what we're running,
        # and if no event exists yet, create one.
        local_version = parse(__version__)
@ -47,9 +65,12 @@ def update_latest_version(self: MonitoredTask):
            ).exists():
                return
            event_dict = {"new_version": upstream_version}
-            if match := re.search(URL_FINDER, data.get("body", "")):
+            if match := re.search(URL_FINDER, data.get("stable", {}).get("changelog", "")):
                event_dict["message"] = f"Changelog: {match.group()}"
            Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
    except (RequestException, IndexError) as exc:
        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
 _set_prom_info()
--- a/authentik/admin/tests/test_api.py
+++ b/authentik/admin/tests/test_api.py
@ -27,9 +27,7 @@ class TestAdminAPI(TestCase):
        response = self.client.get(reverse("authentik_api:admin_system_tasks-list"))
        self.assertEqual(response.status_code, 200)
        body = loads(response.content)
-        self.assertTrue(
+        self.assertTrue(any(task["task_name"] == "clean_expired_models" for task in body))
            any(task["task_name"] == "clean_expired_models" for task in body)
        )
    def test_tasks_single(self):
        """Test Task API (read single)"""
@ -45,9 +43,7 @@ class TestAdminAPI(TestCase):
        self.assertEqual(body["status"], TaskResultStatus.SUCCESSFUL.name)
        self.assertEqual(body["task_name"], "clean_expired_models")
        response = self.client.get(
-            reverse(
+            reverse("authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"})
                "authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"}
            )
        )
        self.assertEqual(response.status_code, 404)
@ -74,24 +70,29 @@ class TestAdminAPI(TestCase):
    def test_version(self):
        """Test Version API"""
-        response = self.client.get(reverse("authentik_api:admin_version-list"))
+        response = self.client.get(reverse("authentik_api:admin_version"))
        self.assertEqual(response.status_code, 200)
        body = loads(response.content)
        self.assertEqual(body["version_current"], __version__)
    def test_workers(self):
        """Test Workers API"""
-        response = self.client.get(reverse("authentik_api:admin_workers-list"))
+        response = self.client.get(reverse("authentik_api:admin_workers"))
        self.assertEqual(response.status_code, 200)
        body = loads(response.content)
-        self.assertEqual(body["pagination"]["count"], 0)
+        self.assertEqual(body["count"], 0)
    def test_metrics(self):
        """Test metrics API"""
-        response = self.client.get(reverse("authentik_api:admin_metrics-list"))
+        response = self.client.get(reverse("authentik_api:admin_metrics"))
        self.assertEqual(response.status_code, 200)
    def test_apps(self):
        """Test apps API"""
        response = self.client.get(reverse("authentik_api:apps-list"))
        self.assertEqual(response.status_code, 200)
    def test_system(self):
        """Test system API"""
        response = self.client.get(reverse("authentik_api:admin_system"))
        self.assertEqual(response.status_code, 200)
--- a/authentik/admin/tests/test_tasks.py
+++ b/authentik/admin/tests/test_tasks.py
@ -1,81 +1,58 @@
 """test admin tasks"""
 import json
 from dataclasses import dataclass
 from unittest.mock import Mock, patch
 from django.core.cache import cache
 from django.test import TestCase
-from requests.exceptions import RequestException
+from requests_mock import Mocker
 from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
 from authentik.events.models import Event, EventAction
-
+RESPONSE_VALID = {
-@dataclass
+    "$schema": "https://version.goauthentik.io/schema.json",
-class MockResponse:
+    "stable": {
-    """Mock class to emulate the methods of requests's Response we need"""
+        "version": "99999999.9999999",
-
+        "changelog": "See https://goauthentik.io/test",
-    status_code: int
+        "reason": "bugfix",
-    response: str
+    },
-
+}
    def json(self) -> dict:
        """Get json parsed response"""
        return json.loads(self.response)
    def raise_for_status(self):
        """raise RequestException if status code is 400 or more"""
        if self.status_code >= 400:
            raise RequestException
 REQUEST_MOCK_VALID = Mock(
    return_value=MockResponse(
        200,
        """{
            "tag_name": "version/99999999.9999999",
            "body": "https://goauthentik.io/test"
        }""",
    )
 )
 REQUEST_MOCK_INVALID = Mock(return_value=MockResponse(400, "{}"))
 class TestAdminTasks(TestCase):
    """test admin tasks"""
    @patch("authentik.admin.tasks.get", REQUEST_MOCK_VALID)
    def test_version_valid_response(self):
        """Test Update checker with valid response"""
-        update_latest_version.delay().get()
+        with Mocker() as mocker:
-        self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
+            mocker.get("https://version.goauthentik.io/version.json", json=RESPONSE_VALID)
-        self.assertTrue(
+            update_latest_version.delay().get()
-            Event.objects.filter(
+            self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
-                action=EventAction.UPDATE_AVAILABLE,
+            self.assertTrue(
                context__new_version="99999999.9999999",
                context__message="Changelog: https://goauthentik.io/test",
            ).exists()
        )
        # test that a consecutive check doesn't create a duplicate event
        update_latest_version.delay().get()
        self.assertEqual(
            len(
                Event.objects.filter(
                    action=EventAction.UPDATE_AVAILABLE,
                    context__new_version="99999999.9999999",
                    context__message="Changelog: https://goauthentik.io/test",
-                )
+                ).exists()
-            ),
+            )
-            1,
+            # test that a consecutive check doesn't create a duplicate event
-        )
+            update_latest_version.delay().get()
            self.assertEqual(
                len(
                    Event.objects.filter(
                        action=EventAction.UPDATE_AVAILABLE,
                        context__new_version="99999999.9999999",
                        context__message="Changelog: https://goauthentik.io/test",
                    )
                ),
                1,
            )
    @patch("authentik.admin.tasks.get", REQUEST_MOCK_INVALID)
    def test_version_error(self):
        """Test Update checker with invalid response"""
-        update_latest_version.delay().get()
+        with Mocker() as mocker:
-        self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
+            mocker.get("https://version.goauthentik.io/version.json", status_code=400)
-        self.assertFalse(
+            update_latest_version.delay().get()
-            Event.objects.filter(
+            self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
-                action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
+            self.assertFalse(
-            ).exists()
+                Event.objects.filter(
-        )
+                    action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
                ).exists()
            )
--- a/authentik/api/apps.py
+++ b/authentik/api/apps.py
@ -10,3 +10,25 @@ class AuthentikAPIConfig(AppConfig):
    label = "authentik_api"
    mountpoint = "api/"
    verbose_name = "authentik API"
    def ready(self) -> None:
        from drf_spectacular.extensions import OpenApiAuthenticationExtension
        from authentik.api.authentication import TokenAuthentication
        # Class is defined here as it needs to be created early enough that drf-spectacular will
        # find it, but also won't cause any import issues
        # pylint: disable=unused-variable
        class TokenSchema(OpenApiAuthenticationExtension):
            """Auth schema"""
            target_class = TokenAuthentication
            name = "authentik"
            def get_security_definition(self, auto_schema):
                """Auth schema"""
                return {
                    "type": "apiKey",
                    "in": "header",
                    "name": "Authorization",
                }
--- a/authentik/api/authentication.py
+++ b/authentik/api/authentication.py
@ -3,23 +3,25 @@ from base64 import b64decode
 from binascii import Error
 from typing import Any, Optional, Union
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
 from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from structlog.stdlib import get_logger
 from authentik.core.models import Token, TokenIntents, User
 from authentik.outposts.models import Outpost
 LOGGER = get_logger()
 # pylint: disable=too-many-return-statements
-def token_from_header(raw_header: bytes) -> Optional[Token]:
+def bearer_auth(raw_header: bytes) -> Optional[User]:
    """raw_header in the Format of `Bearer dGVzdDp0ZXN0`"""
    auth_credentials = raw_header.decode()
-    if auth_credentials == "":
+    if auth_credentials == "" or " " not in auth_credentials:
        return None
-    auth_type, auth_credentials = auth_credentials.split()
+    auth_type, _, auth_credentials = auth_credentials.partition(" ")
    if auth_type.lower() not in ["basic", "bearer"]:
        LOGGER.debug("Unsupported authentication type, denying", type=auth_type.lower())
        raise AuthenticationFailed("Unsupported authentication type")
@ -31,15 +33,33 @@ def token_from_header(raw_header: bytes) -> Optional[Token]:
            raise AuthenticationFailed("Malformed header")
        # Accept credentials with username and without
        if ":" in auth_credentials:
-            _, password = auth_credentials.split(":")
+            _, _, password = auth_credentials.partition(":")
        else:
            password = auth_credentials
    if password == "":  # nosec
        raise AuthenticationFailed("Malformed header")
    tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
    if not tokens.exists():
-        raise AuthenticationFailed("Token invalid/expired")
+        LOGGER.info("Authenticating via secret_key")
-    return tokens.first()
+        user = token_secret_key(password)
        if not user:
            raise AuthenticationFailed("Token invalid/expired")
        return user
    return tokens.first().user
 def token_secret_key(value: str) -> Optional[User]:
    """Check if the token is the secret key
    and return the service account for the managed outpost"""
    from authentik.outposts.managed import MANAGED_OUTPOST
    if value != settings.SECRET_KEY:
        return None
    outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
    if not outposts:
        return None
    outpost = outposts.first()
    return outpost.user
 class TokenAuthentication(BaseAuthentication):
@ -49,9 +69,9 @@ class TokenAuthentication(BaseAuthentication):
        """Token-based authentication using HTTP Bearer authentication"""
        auth = get_authorization_header(request)
-        token = token_from_header(auth)
+        user = bearer_auth(auth)
        # None is only returned when the header isn't set.
-        if not token:
+        if not user:
            return None
-        return (token.user, None)  # pragma: no cover
+        return (user, None)  # pragma: no cover
--- a/authentik/api/authorization.py
+++ b/authentik/api/authorization.py
@ -33,3 +33,12 @@ class OwnerPermissions(BasePermission):
        if owner != request.user:
            return False
        return True
 class OwnerSuperuserPermissions(OwnerPermissions):
    """Similar to OwnerPermissions, except always allow access for superusers"""
    def has_object_permission(self, request: Request, view, obj: Model) -> bool:
        if request.user.is_superuser:
            return True
        return super().has_object_permission(request, view, obj)
--- a/authentik/api/decorators.py
+++ b/authentik/api/decorators.py
@ -5,11 +5,12 @@ from typing import Callable, Optional
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 LOGGER = get_logger()
-def permission_required(
+def permission_required(perm: Optional[str] = None, other_perms: Optional[list[str]] = None):
    perm: Optional[str] = None, other_perms: Optional[list[str]] = None
 ):
    """Check permissions for a single custom action"""
    def wrapper_outter(func: Callable):
@ -20,10 +21,12 @@ def permission_required(
            if perm:
                obj = self.get_object()
                if not request.user.has_perm(perm, obj):
                    LOGGER.debug("denying access for object", user=request.user, perm=perm, obj=obj)
                    return self.permission_denied(request)
            if other_perms:
                for other_perm in other_perms:
                    if not request.user.has_perm(other_perm):
                        LOGGER.debug("denying access for other", user=request.user, perm=perm)
                        return self.permission_denied(request)
            return func(self, request, *args, **kwargs)
--- a/authentik/api/pagination.py
+++ b/authentik/api/pagination.py
@ -30,3 +30,47 @@ class Pagination(pagination.PageNumberPagination):
                "results": data,
            }
        )
    def get_paginated_response_schema(self, schema):
        return {
            "type": "object",
            "properties": {
                "pagination": {
                    "type": "object",
                    "properties": {
                        "next": {
                            "type": "number",
                        },
                        "previous": {
                            "type": "number",
                        },
                        "count": {
                            "type": "number",
                        },
                        "current": {
                            "type": "number",
                        },
                        "total_pages": {
                            "type": "number",
                        },
                        "start_index": {
                            "type": "number",
                        },
                        "end_index": {
                            "type": "number",
                        },
                    },
                    "required": [
                        "next",
                        "previous",
                        "count",
                        "current",
                        "total_pages",
                        "start_index",
                        "end_index",
                    ],
                },
                "results": schema,
            },
            "required": ["pagination", "results"],
        }
--- a/authentik/api/pagination_schema.py
+++ b/authentik/api/pagination_schema.py
@ -1,97 +0,0 @@
 """Swagger Pagination Schema class"""
 from typing import OrderedDict
 from drf_yasg import openapi
 from drf_yasg.inspectors import PaginatorInspector
 class PaginationInspector(PaginatorInspector):
    """Swagger Pagination Schema class"""
    def get_paginated_response(self, paginator, response_schema):
        """
        :param BasePagination paginator: the paginator
        :param openapi.Schema response_schema: the response schema that must be paged.
        :rtype: openapi.Schema
        """
        return openapi.Schema(
            type=openapi.TYPE_OBJECT,
            properties=OrderedDict(
                (
                    (
                        "pagination",
                        openapi.Schema(
                            type=openapi.TYPE_OBJECT,
                            properties=OrderedDict(
                                (
                                    ("next", openapi.Schema(type=openapi.TYPE_NUMBER)),
                                    (
                                        "previous",
                                        openapi.Schema(type=openapi.TYPE_NUMBER),
                                    ),
                                    ("count", openapi.Schema(type=openapi.TYPE_NUMBER)),
                                    (
                                        "current",
                                        openapi.Schema(type=openapi.TYPE_NUMBER),
                                    ),
                                    (
                                        "total_pages",
                                        openapi.Schema(type=openapi.TYPE_NUMBER),
                                    ),
                                    (
                                        "start_index",
                                        openapi.Schema(type=openapi.TYPE_NUMBER),
                                    ),
                                    (
                                        "end_index",
                                        openapi.Schema(type=openapi.TYPE_NUMBER),
                                    ),
                                )
                            ),
                            required=[
                                "next",
                                "previous",
                                "count",
                                "current",
                                "total_pages",
                                "start_index",
                                "end_index",
                            ],
                        ),
                    ),
                    ("results", response_schema),
                )
            ),
            required=["results", "pagination"],
        )
    def get_paginator_parameters(self, paginator):
        """
        Get the pagination parameters for a single paginator **instance**.
        Should return :data:`.NotHandled` if this inspector
        does not know how to handle the given `paginator`.
        :param BasePagination paginator: the paginator
        :rtype: list[openapi.Parameter]
        """
        return [
            openapi.Parameter(
                "page",
                openapi.IN_QUERY,
                "Page Index",
                False,
                None,
                openapi.TYPE_INTEGER,
            ),
            openapi.Parameter(
                "page_size",
                openapi.IN_QUERY,
                "Page Size",
                False,
                None,
                openapi.TYPE_INTEGER,
            ),
        ]
--- a/authentik/api/schema.py
+++ b/authentik/api/schema.py
@ -1,102 +1,75 @@
 """Error Response schema, from https://github.com/axnsan12/drf-yasg/issues/224"""
-from drf_yasg import openapi
+from django.utils.translation import gettext_lazy as _
-from drf_yasg.inspectors.view import SwaggerAutoSchema
+from drf_spectacular.plumbing import (
-from drf_yasg.utils import force_real_str, is_list_view
+    ResolvedComponent,
-from rest_framework import exceptions, status
+    build_array_type,
-from rest_framework.settings import api_settings
+    build_basic_type,
    build_object_type,
 )
 from drf_spectacular.settings import spectacular_settings
 from drf_spectacular.types import OpenApiTypes
-class ErrorResponseAutoSchema(SwaggerAutoSchema):
+def build_standard_type(obj, **kwargs):
-    """Inspector which includes an error schema"""
+    """Build a basic type with optional add ons."""
    schema = build_basic_type(obj)
    schema.update(kwargs)
    return schema
-    def get_generic_error_schema(self):
+
-        """Get a generic error schema"""
+GENERIC_ERROR = build_object_type(
-        return openapi.Schema(
+    description=_("Generic API Error"),
-            "Generic API Error",
+    properties={
-            type=openapi.TYPE_OBJECT,
+        "detail": build_standard_type(OpenApiTypes.STR),
-            properties={
+        "code": build_standard_type(OpenApiTypes.STR),
-                "detail": openapi.Schema(
+    },
-                    type=openapi.TYPE_STRING, description="Error details"
+    required=["detail"],
-                ),
+)
-                "code": openapi.Schema(
+VALIDATION_ERROR = build_object_type(
-                    type=openapi.TYPE_STRING, description="Error code"
+    description=_("Validation Error"),
-                ),
+    properties={
-            },
+        "non_field_errors": build_array_type(build_standard_type(OpenApiTypes.STR)),
-            required=["detail"],
+        "code": build_standard_type(OpenApiTypes.STR),
    },
    required=[],
    additionalProperties={},
 )
 def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
    """Workaround to set a default response for endpoints.
    Workaround suggested at
    <https://github.com/tfranzel/drf-spectacular/issues/119#issuecomment-656970357>
    for the missing drf-spectacular feature discussed in
    <https://github.com/tfranzel/drf-spectacular/issues/101>.
    """
    def create_component(name, schema, type_=ResolvedComponent.SCHEMA):
        """Register a component and return a reference to it."""
        component = ResolvedComponent(
            name=name,
            type=type_,
            schema=schema,
            object=name,
        )
        generator.registry.register_on_missing(component)
        return component
-    def get_validation_error_schema(self):
+    generic_error = create_component("GenericError", GENERIC_ERROR)
-        """Get a generic validation error schema"""
+    validation_error = create_component("ValidationError", VALIDATION_ERROR)
        return openapi.Schema(
            "Validation Error",
            type=openapi.TYPE_OBJECT,
            properties={
                api_settings.NON_FIELD_ERRORS_KEY: openapi.Schema(
                    description="List of validation errors not related to any field",
                    type=openapi.TYPE_ARRAY,
                    items=openapi.Schema(type=openapi.TYPE_STRING),
                ),
            },
            additional_properties=openapi.Schema(
                description=(
                    "A list of error messages for each "
                    "field that triggered a validation error"
                ),
                type=openapi.TYPE_ARRAY,
                items=openapi.Schema(type=openapi.TYPE_STRING),
            ),
        )
-    def get_response_serializers(self):
+    for path in result["paths"].values():
-        responses = super().get_response_serializers()
+        for method in path.values():
-        definitions = self.components.with_scope(
+            method["responses"].setdefault("400", validation_error.ref)
-            openapi.SCHEMA_DEFINITIONS
+            method["responses"].setdefault("403", generic_error.ref)
        )  # type: openapi.ReferenceResolver
-        definitions.setdefault("GenericError", self.get_generic_error_schema)
+    result["components"] = generator.registry.build(spectacular_settings.APPEND_COMPONENTS)
        definitions.setdefault("ValidationError", self.get_validation_error_schema)
        definitions.setdefault("APIException", self.get_generic_error_schema)
-        if self.get_request_serializer() or self.get_query_serializer():
+    # This is a workaround for authentik/stages/prompt/stage.py
-            responses.setdefault(
+    # since the serializer PromptChallengeResponse
-                exceptions.ValidationError.status_code,
+    # accepts dynamic keys
-                openapi.Response(
+    for component in result["components"]["schemas"]:
-                    description=force_real_str(
+        if component == "PromptChallengeResponseRequest":
-                        exceptions.ValidationError.default_detail
+            comp = result["components"]["schemas"][component]
-                    ),
+            comp["additionalProperties"] = {}
-                    schema=openapi.SchemaRef(definitions, "ValidationError"),
+    return result
                ),
            )
        security = self.get_security()
        if security is None or len(security) > 0:
            # Note: 401 error codes are coerced  into 403 see
            # rest_framework/views.py:433:handle_exception
            # This is b/c the API uses token auth which doesn't have WWW-Authenticate header
            responses.setdefault(
                status.HTTP_403_FORBIDDEN,
                openapi.Response(
                    description="Authentication credentials were invalid, absent or insufficient.",
                    schema=openapi.SchemaRef(definitions, "GenericError"),
                ),
            )
        if not is_list_view(self.path, self.method, self.view):
            responses.setdefault(
                exceptions.PermissionDenied.status_code,
                openapi.Response(
                    description="Permission denied.",
                    schema=openapi.SchemaRef(definitions, "APIException"),
                ),
            )
            responses.setdefault(
                exceptions.NotFound.status_code,
                openapi.Response(
                    description=(
                        "Object does not exist or caller "
                        "has insufficient permissions to access it."
                    ),
                    schema=openapi.SchemaRef(definitions, "APIException"),
                ),
            )
        return responses
--- a/authentik/api/tasks.py
+++ b/authentik/api/tasks.py
@ -0,0 +1,19 @@
 """API tasks"""
 from authentik.lib.utils.http import get_http_session
 from authentik.root.celery import CELERY_APP
 SENTRY_SESSION = get_http_session()
@CELERY_APP.task()
 def sentry_proxy(payload: str):
    """Relay data to sentry"""
    SENTRY_SESSION.post(
        "https://sentry.beryju.org/api/8/envelope/",
        data=payload,
        headers={
            "Content-Type": "application/octet-stream",
        },
        timeout=10,
    )
--- a/authentik/api/templates/api/browser.html
+++ b/authentik/api/templates/api/browser.html
@ -3,7 +3,7 @@
 {% load static %}
 {% block title %}
-API Browser - {{ config.authentik.branding.title }}
+API Browser - {{ tenant.branding_title }}
 {% endblock %}
 {% block head %}
--- a/authentik/api/tests/test_auth.py
+++ b/authentik/api/tests/test_auth.py
@ -1,12 +1,14 @@
 """Test API Authentication"""
 from base64 import b64encode
 from django.conf import settings
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user
 from rest_framework.exceptions import AuthenticationFailed
-from authentik.api.authentication import token_from_header
+from authentik.api.authentication import bearer_auth
-from authentik.core.models import Token, TokenIntents
+from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
 from authentik.outposts.managed import OutpostManager
 class TestAPIAuth(TestCase):
@ -14,36 +16,41 @@ class TestAPIAuth(TestCase):
    def test_valid_basic(self):
        """Test valid token"""
-        token = Token.objects.create(
+        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
        )
        auth = b64encode(f":{token.key}".encode()).decode()
-        self.assertEqual(token_from_header(f"Basic {auth}".encode()), token)
+        self.assertEqual(bearer_auth(f"Basic {auth}".encode()), token.user)
    def test_valid_bearer(self):
        """Test valid token"""
-        token = Token.objects.create(
+        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
-            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        self.assertEqual(bearer_auth(f"Bearer {token.key}".encode()), token.user)
        )
        self.assertEqual(token_from_header(f"Bearer {token.key}".encode()), token)
    def test_invalid_type(self):
        """Test invalid type"""
        with self.assertRaises(AuthenticationFailed):
-            token_from_header("foo bar".encode())
+            bearer_auth("foo bar".encode())
    def test_invalid_decode(self):
        """Test invalid bas64"""
        with self.assertRaises(AuthenticationFailed):
-            token_from_header("Basic bar".encode())
+            bearer_auth("Basic bar".encode())
    def test_invalid_empty_password(self):
        """Test invalid with empty password"""
        with self.assertRaises(AuthenticationFailed):
-            token_from_header("Basic :".encode())
+            bearer_auth("Basic :".encode())
    def test_invalid_no_token(self):
        """Test invalid with no token"""
        with self.assertRaises(AuthenticationFailed):
            auth = b64encode(":abc".encode()).decode()
-            self.assertIsNone(token_from_header(f"Basic :{auth}".encode()))
+            self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
    def test_managed_outpost(self):
        """Test managed outpost"""
        with self.assertRaises(AuthenticationFailed):
            user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
        OutpostManager().run()
        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
--- a/authentik/api/tests/test_config.py
+++ b/authentik/api/tests/test_config.py
@ -11,6 +11,6 @@ class TestConfig(APITestCase):
    def test_config(self):
        """Test YAML generation"""
        response = self.client.get(
-            reverse("authentik_api:configs-list"),
+            reverse("authentik_api:config"),
        )
        self.assertTrue(loads(response.content.decode()))
--- a/authentik/api/tests/test_schema.py
+++ b/authentik/api/tests/test_schema.py
@ -0,0 +1,22 @@
 """Schema generation tests"""
 from django.urls import reverse
 from rest_framework.test import APITestCase
 from yaml import safe_load
 class TestSchemaGeneration(APITestCase):
    """Generic admin tests"""
    def test_schema(self):
        """Test generation"""
        response = self.client.get(
            reverse("authentik_api:schema"),
        )
        self.assertTrue(safe_load(response.content.decode()))
    def test_browser(self):
        """Test API Browser"""
        response = self.client.get(
            reverse("authentik_api:schema-browser"),
        )
        self.assertEqual(response.status_code, 200)
--- a/authentik/api/tests/test_swagger.py
+++ b/authentik/api/tests/test_swagger.py
@ -1,31 +0,0 @@
 """Swagger generation tests"""
 from json import loads
 from django.urls import reverse
 from rest_framework.test import APITestCase
 from yaml import safe_load
 class TestSwaggerGeneration(APITestCase):
    """Generic admin tests"""
    def test_yaml(self):
        """Test YAML generation"""
        response = self.client.get(
            reverse("authentik_api:schema-json", kwargs={"format": ".yaml"}),
        )
        self.assertTrue(safe_load(response.content.decode()))
    def test_json(self):
        """Test JSON generation"""
        response = self.client.get(
            reverse("authentik_api:schema-json", kwargs={"format": ".json"}),
        )
        self.assertTrue(loads(response.content.decode()))
    def test_browser(self):
        """Test API Browser"""
        response = self.client.get(
            reverse("authentik_api:swagger"),
        )
        self.assertEqual(response.status_code, 200)
--- a/authentik/api/urls.py
+++ b/authentik/api/urls.py
@ -1,8 +1,10 @@
 """authentik api urls"""
 from django.urls import include, path
-from authentik.api.v2.urls import urlpatterns as v2_urls
+from authentik.api.v3.urls import urlpatterns as v3_urls
 urlpatterns = [
-    path("v2beta/", include(v2_urls)),
+    # Remove in 2022.1
    path("v2beta/", include(v3_urls)),
    path("v3/", include(v3_urls)),
 ]
--- a/authentik/api/v2/config.py
+++ b/authentik/api/v2/config.py
@ -1,50 +0,0 @@
 """core Configs API"""
 from drf_yasg.utils import swagger_auto_schema
 from rest_framework.fields import BooleanField, CharField, ListField
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
 from authentik.core.api.utils import PassiveSerializer
 from authentik.lib.config import CONFIG
 class FooterLinkSerializer(PassiveSerializer):
    """Links returned in Config API"""
    href = CharField(read_only=True)
    name = CharField(read_only=True)
 class ConfigSerializer(PassiveSerializer):
    """Serialize authentik Config into DRF Object"""
    branding_logo = CharField(read_only=True)
    branding_title = CharField(read_only=True)
    ui_footer_links = ListField(child=FooterLinkSerializer(), read_only=True)
    error_reporting_enabled = BooleanField(read_only=True)
    error_reporting_environment = CharField(read_only=True)
    error_reporting_send_pii = BooleanField(read_only=True)
 class ConfigsViewSet(ViewSet):
    """Read-only view set that returns the current session's Configs"""
    permission_classes = [AllowAny]
    @swagger_auto_schema(responses={200: ConfigSerializer(many=False)})
    def list(self, request: Request) -> Response:
        """Retrive public configuration options"""
        config = ConfigSerializer(
            {
                "branding_logo": CONFIG.y("authentik.branding.logo"),
                "branding_title": CONFIG.y("authentik.branding.title"),
                "error_reporting_enabled": CONFIG.y("error_reporting.enabled"),
                "error_reporting_environment": CONFIG.y("error_reporting.environment"),
                "error_reporting_send_pii": CONFIG.y("error_reporting.send_pii"),
                "ui_footer_links": CONFIG.y("authentik.footer_links"),
            }
        )
        return Response(config.data)
--- a/authentik/api/v3/init.py
+++ b/authentik/api/v3/init.py
--- a/authentik/api/v3/config.py
+++ b/authentik/api/v3/config.py
@ -0,0 +1,79 @@
 """core Configs API"""
 from os import environ, path
 from django.conf import settings
 from django.db import models
 from drf_spectacular.utils import extend_schema
 from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from rest_framework.fields import BooleanField, CharField, ChoiceField, IntegerField, ListField
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.geo import GEOIP_READER
 from authentik.lib.config import CONFIG
 class Capabilities(models.TextChoices):
    """Define capabilities which influence which APIs can/should be used"""
    CAN_SAVE_MEDIA = "can_save_media"
    CAN_GEO_IP = "can_geo_ip"
    CAN_BACKUP = "can_backup"
 class ConfigSerializer(PassiveSerializer):
    """Serialize authentik Config into DRF Object"""
    error_reporting_enabled = BooleanField(read_only=True)
    error_reporting_environment = CharField(read_only=True)
    error_reporting_send_pii = BooleanField(read_only=True)
    capabilities = ListField(child=ChoiceField(choices=Capabilities.choices))
    cache_timeout = IntegerField(required=True)
    cache_timeout_flows = IntegerField(required=True)
    cache_timeout_policies = IntegerField(required=True)
    cache_timeout_reputation = IntegerField(required=True)
 class ConfigView(APIView):
    """Read-only view set that returns the current session's Configs"""
    permission_classes = [AllowAny]
    def get_capabilities(self) -> list[Capabilities]:
        """Get all capabilities this server instance supports"""
        caps = []
        deb_test = settings.DEBUG or settings.TEST
        if path.ismount(settings.MEDIA_ROOT) or deb_test:
            caps.append(Capabilities.CAN_SAVE_MEDIA)
        if GEOIP_READER.enabled:
            caps.append(Capabilities.CAN_GEO_IP)
        if SERVICE_HOST_ENV_NAME in environ:
            # Running in k8s, only s3 backup is supported
            if CONFIG.y("postgresql.s3_backup"):
                caps.append(Capabilities.CAN_BACKUP)
        else:
            # Running in compose, backup is always supported
            caps.append(Capabilities.CAN_BACKUP)
        return caps
    @extend_schema(responses={200: ConfigSerializer(many=False)})
    def get(self, request: Request) -> Response:
        """Retrive public configuration options"""
        config = ConfigSerializer(
            {
                "error_reporting_enabled": CONFIG.y("error_reporting.enabled"),
                "error_reporting_environment": CONFIG.y("error_reporting.environment"),
                "error_reporting_send_pii": CONFIG.y("error_reporting.send_pii"),
                "capabilities": self.get_capabilities(),
                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
            }
        )
        return Response(config.data)
--- a/authentik/api/v3/sentry.py
+++ b/authentik/api/v3/sentry.py
@ -0,0 +1,60 @@
 """Sentry tunnel"""
 from json import loads
 from django.conf import settings
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
 from rest_framework.authentication import SessionAuthentication
 from rest_framework.parsers import BaseParser
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.throttling import AnonRateThrottle
 from rest_framework.views import APIView
 from authentik.api.tasks import sentry_proxy
 from authentik.lib.config import CONFIG
 class PlainTextParser(BaseParser):
    """Plain text parser."""
    media_type = "text/plain"
    def parse(self, stream, media_type=None, parser_context=None) -> str:
        """Simply return a string representing the body of the request."""
        return stream.read()
 class CsrfExemptSessionAuthentication(SessionAuthentication):
    """CSRF-exempt Session authentication"""
    def enforce_csrf(self, request: Request):
        return  # To not perform the csrf check previously happening
 class SentryTunnelView(APIView):
    """Sentry tunnel, to prevent ad blockers from blocking sentry"""
    serializer_class = None
    parser_classes = [PlainTextParser]
    throttle_classes = [AnonRateThrottle]
    permission_classes = [AllowAny]
    authentication_classes = [CsrfExemptSessionAuthentication]
    def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
        """Sentry tunnel, to prevent ad blockers from blocking sentry"""
        # Only allow usage of this endpoint when error reporting is enabled
        if not CONFIG.y_bool("error_reporting.enabled", False):
            return HttpResponse(status=400)
        # Body is 2 json objects separated by \n
        full_body = request.body
        lines = full_body.splitlines()
        if len(lines) < 1:
            return HttpResponse(status=400)
        header = loads(lines[0])
        # Check that the DSN is what we expect
        dsn = header.get("dsn", "")
        if dsn != settings.SENTRY_DSN:
            return HttpResponse(status=400)
        sentry_proxy.delay(full_body.decode())
        return HttpResponse(status=204)
--- a/authentik/api/v3/urls.py
+++ b/authentik/api/v3/urls.py
@ -1,18 +1,20 @@
-"""api v2 urls"""
+"""api v3 urls"""
-from django.urls import path, re_path
+from django.urls import path
-from drf_yasg import openapi
+from django.views.decorators.cache import cache_page
-from drf_yasg.views import get_schema_view
+from drf_spectacular.views import SpectacularAPIView
 from rest_framework import routers
 from rest_framework.permissions import AllowAny
 from authentik.admin.api.meta import AppsViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
 from authentik.admin.api.system import SystemView
 from authentik.admin.api.tasks import TaskViewSet
-from authentik.admin.api.version import VersionViewSet
+from authentik.admin.api.version import VersionView
-from authentik.admin.api.workers import WorkerViewSet
+from authentik.admin.api.workers import WorkerView
-from authentik.api.v2.config import ConfigsViewSet
+from authentik.api.v3.config import ConfigView
-from authentik.api.views import SwaggerView
+from authentik.api.v3.sentry import SentryTunnelView
 from authentik.api.views import APIBrowserView
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
@ -22,18 +24,19 @@ from authentik.core.api.users import UserViewSet
 from authentik.crypto.api import CertificateKeyPairViewSet
 from authentik.events.api.event import EventViewSet
 from authentik.events.api.notification import NotificationViewSet
 from authentik.events.api.notification_mapping import NotificationWebhookMappingViewSet
 from authentik.events.api.notification_rule import NotificationRuleViewSet
 from authentik.events.api.notification_transport import NotificationTransportViewSet
 from authentik.flows.api.bindings import FlowStageBindingViewSet
 from authentik.flows.api.flows import FlowViewSet
 from authentik.flows.api.stages import StageViewSet
 from authentik.flows.views import FlowExecutorView
-from authentik.outposts.api.outpost_service_connections import (
+from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.outposts.api.service_connections import (
    DockerServiceConnectionViewSet,
    KubernetesServiceConnectionViewSet,
    ServiceConnectionViewSet,
 )
 from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.policies.api.bindings import PolicyBindingViewSet
 from authentik.policies.api.policies import PolicyViewSet
 from authentik.policies.dummy.api import DummyPolicyViewSet
@ -50,22 +53,20 @@ from authentik.policies.reputation.api import (
 from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
 from authentik.providers.oauth2.api.provider import OAuth2ProviderViewSet
 from authentik.providers.oauth2.api.scope import ScopeMappingViewSet
-from authentik.providers.oauth2.api.tokens import (
+from authentik.providers.oauth2.api.tokens import AuthorizationCodeViewSet, RefreshTokenViewSet
-    AuthorizationCodeViewSet,
+from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
    RefreshTokenViewSet,
 )
 from authentik.providers.proxy.api import (
    ProxyOutpostConfigViewSet,
    ProxyProviderViewSet,
 )
 from authentik.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProviderViewSet
 from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from authentik.sources.oauth.api.source import OAuthSourceViewSet
-from authentik.sources.oauth.api.source_connection import (
+from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
-    UserOAuthSourceConnectionViewSet,
+from authentik.sources.plex.api.source import PlexSourceViewSet
-)
+from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
 from authentik.sources.plex.api import PlexSourceViewSet
 from authentik.sources.saml.api import SAMLSourceViewSet
 from authentik.stages.authenticator_duo.api import (
    AuthenticatorDuoStageViewSet,
    DuoAdminDeviceViewSet,
    DuoDeviceViewSet,
 )
 from authentik.stages.authenticator_static.api import (
    AuthenticatorStaticStageViewSet,
    StaticAdminDeviceViewSet,
@ -76,9 +77,7 @@ from authentik.stages.authenticator_totp.api import (
    TOTPAdminDeviceViewSet,
    TOTPDeviceViewSet,
 )
-from authentik.stages.authenticator_validate.api import (
+from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageViewSet
    AuthenticatorValidateStageViewSet,
 )
 from authentik.stages.authenticator_webauthn.api import (
    AuthenticateWebAuthnStageViewSet,
    WebAuthnAdminDeviceViewSet,
@ -97,30 +96,25 @@ from authentik.stages.user_delete.api import UserDeleteStageViewSet
 from authentik.stages.user_login.api import UserLoginStageViewSet
 from authentik.stages.user_logout.api import UserLogoutStageViewSet
 from authentik.stages.user_write.api import UserWriteStageViewSet
 from authentik.tenants.api import TenantViewSet
 router = routers.DefaultRouter()
 router.register("root/config", ConfigsViewSet, basename="configs")
 router.register("admin/version", VersionViewSet, basename="admin_version")
 router.register("admin/workers", WorkerViewSet, basename="admin_workers")
 router.register("admin/metrics", AdministrationMetricsViewSet, basename="admin_metrics")
 router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
 router.register("admin/apps", AppsViewSet, basename="apps")
 router.register("core/authenticated_sessions", AuthenticatedSessionViewSet)
 router.register("core/applications", ApplicationViewSet)
 router.register("core/groups", GroupViewSet)
 router.register("core/users", UserViewSet)
 router.register("core/user_consent", UserConsentViewSet)
 router.register("core/tokens", TokenViewSet)
 router.register("core/tenants", TenantViewSet)
 router.register("outposts/outposts", OutpostViewSet)
 router.register("outposts/instances", OutpostViewSet)
 router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
-router.register(
+router.register("outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet)
    "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
 )
 router.register("outposts/proxy", ProxyOutpostConfigViewSet)
 router.register("outposts/ldap", LDAPOutpostConfigViewSet)
@ -135,7 +129,8 @@ router.register("events/transports", NotificationTransportViewSet)
 router.register("events/rules", NotificationRuleViewSet)
 router.register("sources/all", SourceViewSet)
-router.register("sources/oauth_user_connections", UserOAuthSourceConnectionViewSet)
+router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
 router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
@ -165,18 +160,23 @@ router.register("propertymappings/all", PropertyMappingViewSet)
 router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
 router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 router.register("propertymappings/scope", ScopeMappingViewSet)
 router.register("propertymappings/notification", NotificationWebhookMappingViewSet)
 router.register("authenticators/duo", DuoDeviceViewSet)
 router.register("authenticators/static", StaticDeviceViewSet)
 router.register("authenticators/totp", TOTPDeviceViewSet)
 router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
 router.register(
    "authenticators/admin/duo",
    DuoAdminDeviceViewSet,
    basename="admin-duodevice",
 )
 router.register(
    "authenticators/admin/static",
    StaticAdminDeviceViewSet,
    basename="admin-staticdevice",
 )
-router.register(
+router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice")
    "authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice"
 )
 router.register(
    "authenticators/admin/webauthn",
    WebAuthnAdminDeviceViewSet,
@ -184,6 +184,7 @@ router.register(
 )
 router.register("stages/all", StageViewSet)
 router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
 router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
 router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
 router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
@ -206,32 +207,27 @@ router.register("stages/user_write", UserWriteStageViewSet)
 router.register("stages/dummy", DummyStageViewSet)
 router.register("policies/dummy", DummyPolicyViewSet)
 info = openapi.Info(
    title="authentik API",
    default_version="v2beta",
    contact=openapi.Contact(email="hello@beryju.org"),
    license=openapi.License(
        name="GNU GPLv3",
        url="https://github.com/goauthentik/authentik/blob/master/LICENSE",
    ),
 )
 SchemaView = get_schema_view(info, public=True, permission_classes=(AllowAny,))
 urlpatterns = (
    [
-        path("", SwaggerView.as_view(), name="swagger"),
+        path("", APIBrowserView.as_view(), name="schema-browser"),
    ]
    + router.urls
    + [
        path(
            "admin/metrics/",
            AdministrationMetricsViewSet.as_view(),
            name="admin_metrics",
        ),
        path("admin/version/", VersionView.as_view(), name="admin_version"),
        path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
        path("admin/system/", SystemView.as_view(), name="admin_system"),
        path("root/config/", ConfigView.as_view(), name="config"),
        path(
            "flows/executor/<slug:flow_slug>/",
            FlowExecutorView.as_view(),
            name="flow-executor",
        ),
-        re_path(
+        path("sentry/", SentryTunnelView.as_view(), name="sentry"),
-            r"^swagger(?P<format>\.json|\.yaml)$",
+        path("schema/", cache_page(86400)(SpectacularAPIView.as_view()), name="schema"),
            SchemaView.without_ui(cache_timeout=0),
            name="schema-json",
        ),
    ]
 )
--- a/authentik/api/views.py
+++ b/authentik/api/views.py
@ -5,18 +5,15 @@ from django.urls import reverse
 from django.views.generic import TemplateView
-class SwaggerView(TemplateView):
+class APIBrowserView(TemplateView):
-    """Show swagger view based on rapi-doc"""
+    """Show browser view based on rapi-doc"""
-    template_name = "api/swagger.html"
+    template_name = "api/browser.html"
    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
        path = self.request.build_absolute_uri(
            reverse(
-                "authentik_api:schema-json",
+                "authentik_api:schema",
                kwargs={
                    "format": ".json",
                },
            )
        )
        return super().get_context_data(path=path, **kwargs)
--- a/authentik/core/api/applications.py
+++ b/authentik/core/api/applications.py
@ -1,14 +1,12 @@
 """Application API Views"""
 from typing import Optional
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.http.response import HttpResponseBadRequest
 from django.shortcuts import get_object_or_404
-from drf_yasg import openapi
+from drf_spectacular.types import OpenApiTypes
-from drf_yasg.utils import no_body, swagger_auto_schema
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
-from rest_framework.fields import SerializerMethodField
+from rest_framework.fields import ReadOnlyField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@ -20,9 +18,13 @@ from structlog.stdlib import get_logger
 from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.providers import ProviderSerializer
-from authentik.core.models import Application
+from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import FilePathSerializer, FileUploadSerializer
 from authentik.core.models import Application, User
 from authentik.events.models import EventAction
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
 from authentik.policies.types import PolicyResult
 from authentik.stages.user_login.stage import USER_LOGIN_AUTHENTICATED
 LOGGER = get_logger()
@ -36,12 +38,10 @@ def user_app_cache_key(user_pk: str) -> str:
 class ApplicationSerializer(ModelSerializer):
    """Application Serializer"""
-    launch_url = SerializerMethodField()
+    launch_url = ReadOnlyField(source="get_launch_url")
    provider_obj = ProviderSerializer(source="get_provider", required=False)
-    def get_launch_url(self, instance: Application) -> Optional[str]:
+    meta_icon = ReadOnlyField(source="get_meta_icon")
        """Get generated launch URL"""
        return instance.get_launch_url()
    class Meta:
@ -59,12 +59,15 @@ class ApplicationSerializer(ModelSerializer):
            "meta_publisher",
            "policy_engine_mode",
        ]
        extra_kwargs = {
            "meta_icon": {"read_only": True},
        }
-class ApplicationViewSet(ModelViewSet):
+class ApplicationViewSet(UsedByMixin, ModelViewSet):
    """Application Viewset"""
-    queryset = Application.objects.all()
+    queryset = Application.objects.all().prefetch_related("provider")
    serializer_class = ApplicationSerializer
    search_fields = [
        "name",
@ -93,49 +96,67 @@ class ApplicationViewSet(ModelViewSet):
                applications.append(application)
        return applications
-    @swagger_auto_schema(
+    @extend_schema(
        parameters=[
            OpenApiParameter(
                name="for_user",
                location=OpenApiParameter.QUERY,
                type=OpenApiTypes.INT,
            )
        ],
        responses={
-            204: "Access granted",
+            200: PolicyTestResultSerializer(),
-            403: "Access denied",
+            404: OpenApiResponse(description="for_user user not found"),
-        }
+        },
    )
    @action(detail=True, methods=["GET"])
    # pylint: disable=unused-argument
    def check_access(self, request: Request, slug: str) -> Response:
        """Check access to a single application by slug"""
        # Don't use self.get_object as that checks for view_application permission
        # which the user might not have, even if they have access
        application = get_object_or_404(Application, slug=slug)
-        engine = PolicyEngine(application, self.request.user, self.request)
+        # If the current user is superuser, they can set `for_user`
        for_user = request.user
        if request.user.is_superuser and "for_user" in request.query_params:
            try:
                for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
            except ValueError:
                return HttpResponseBadRequest("for_user must be numerical")
        engine = PolicyEngine(application, for_user, request)
        engine.use_cache = False
        engine.build()
-        if engine.passing:
+        result = engine.result
-            return Response(status=204)
+        response = PolicyTestResultSerializer(PolicyResult(False))
-        return Response(status=403)
+        if result.passing:
            response = PolicyTestResultSerializer(PolicyResult(True))
        if request.user.is_superuser:
            response = PolicyTestResultSerializer(result)
        return Response(response.data)
-    @swagger_auto_schema(
+    @extend_schema(
-        manual_parameters=[
+        parameters=[
-            openapi.Parameter(
+            OpenApiParameter(
                name="superuser_full_list",
-                in_=openapi.IN_QUERY,
+                location=OpenApiParameter.QUERY,
-                type=openapi.TYPE_BOOLEAN,
+                type=OpenApiTypes.BOOL,
            )
        ]
    )
    def list(self, request: Request) -> Response:
        """Custom list method that checks Policy based access instead of guardian"""
        should_cache = request.GET.get("search", "") == ""
        superuser_full_list = str(request.GET.get("superuser_full_list", "false")).lower() == "true"
        if superuser_full_list and request.user.is_superuser:
            return super().list(request)
        # To prevent the user from having to double login when prompt is set to login
        # and the user has just signed it. This session variable is set in the UserLoginStage
        # and is (quite hackily) removed from the session in applications's API's List method
        self.request.session.pop(USER_LOGIN_AUTHENTICATED, None)
        queryset = self._filter_queryset_for_list(self.get_queryset())
        self.paginate_queryset(queryset)
        should_cache = request.GET.get("search", "") == ""
        superuser_full_list = (
            str(request.GET.get("superuser_full_list", "false")).lower() == "true"
        )
        if superuser_full_list and request.user.is_superuser:
            serializer = self.get_serializer(queryset, many=True)
            return self.get_paginated_response(serializer.data)
        allowed_applications = []
        if not should_cache:
            allowed_applications = self._get_allowed_applications(queryset)
@ -153,17 +174,14 @@ class ApplicationViewSet(ModelViewSet):
        return self.get_paginated_response(serializer.data)
    @permission_required("authentik_core.change_application")
-    @swagger_auto_schema(
+    @extend_schema(
-        request_body=no_body,
+        request={
-        manual_parameters=[
+            "multipart/form-data": FileUploadSerializer,
-            openapi.Parameter(
+        },
-                name="file",
+        responses={
-                in_=openapi.IN_FORM,
+            200: OpenApiResponse(description="Success"),
-                type=openapi.TYPE_FILE,
+            400: OpenApiResponse(description="Bad request"),
-                required=True,
+        },
            )
        ],
        responses={200: "Success", 400: "Bad request"},
    )
    @action(
        detail=True,
@ -177,16 +195,44 @@ class ApplicationViewSet(ModelViewSet):
        """Set application icon"""
        app: Application = self.get_object()
        icon = request.FILES.get("file", None)
-        if not icon:
+        clear = request.data.get("clear", "false").lower() == "true"
        if clear:
            # .delete() saves the model by default
            app.meta_icon.delete()
            return Response({})
        if icon:
            app.meta_icon = icon
            app.save()
            return Response({})
        return HttpResponseBadRequest()
    @permission_required("authentik_core.change_application")
    @extend_schema(
        request=FilePathSerializer,
        responses={
            200: OpenApiResponse(description="Success"),
            400: OpenApiResponse(description="Bad request"),
        },
    )
    @action(
        detail=True,
        pagination_class=None,
        filter_backends=[],
        methods=["POST"],
    )
    # pylint: disable=unused-argument
    def set_icon_url(self, request: Request, slug: str):
        """Set application icon (as URL)"""
        app: Application = self.get_object()
        url = request.data.get("url", None)
        if url is None:
            return HttpResponseBadRequest()
-        app.meta_icon = icon
+        app.meta_icon.name = url
        app.save()
        return Response({})
-    @permission_required(
+    @permission_required("authentik_core.view_application", ["authentik_events.view_event"])
-        "authentik_core.view_application", ["authentik_events.view_event"]
+    @extend_schema(responses={200: CoordinateSerializer(many=True)})
    )
    @swagger_auto_schema(responses={200: CoordinateSerializer(many=True)})
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=unused-argument
    def metrics(self, request: Request, slug: str):
--- a/authentik/core/api/authenticated_sessions.py
+++ b/authentik/core/api/authenticated_sessions.py
@ -0,0 +1,113 @@
 """AuthenticatedSessions API Viewset"""
 from typing import Optional, TypedDict
 from django_filters.rest_framework import DjangoFilterBackend
 from guardian.utils import get_anonymous_user
 from rest_framework import mixins
 from rest_framework.fields import SerializerMethodField
 from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import GenericViewSet
 from ua_parser import user_agent_parser
 from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.models import AuthenticatedSession
 from authentik.events.geo import GEOIP_READER, GeoIPDict
 class UserAgentDeviceDict(TypedDict):
    """User agent device"""
    brand: str
    family: str
    model: str
 class UserAgentOSDict(TypedDict):
    """User agent os"""
    family: str
    major: str
    minor: str
    patch: str
    patch_minor: str
 class UserAgentBrowserDict(TypedDict):
    """User agent browser"""
    family: str
    major: str
    minor: str
    patch: str
 class UserAgentDict(TypedDict):
    """User agent details"""
    device: UserAgentDeviceDict
    os: UserAgentOSDict
    user_agent: UserAgentBrowserDict
    string: str
 class AuthenticatedSessionSerializer(ModelSerializer):
    """AuthenticatedSession Serializer"""
    current = SerializerMethodField()
    user_agent = SerializerMethodField()
    geo_ip = SerializerMethodField()
    def get_current(self, instance: AuthenticatedSession) -> bool:
        """Check if session is currently active session"""
        request: Request = self.context["request"]
        return request._request.session.session_key == instance.session_key
    def get_user_agent(self, instance: AuthenticatedSession) -> UserAgentDict:
        """Get parsed user agent"""
        return user_agent_parser.Parse(instance.last_user_agent)
    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
        """Get parsed user agent"""
        return GEOIP_READER.city_dict(instance.last_ip)
    class Meta:
        model = AuthenticatedSession
        fields = [
            "uuid",
            "current",
            "user_agent",
            "geo_ip",
            "user",
            "last_ip",
            "last_user_agent",
            "last_used",
            "expires",
        ]
 class AuthenticatedSessionViewSet(
    mixins.RetrieveModelMixin,
    mixins.DestroyModelMixin,
    UsedByMixin,
    mixins.ListModelMixin,
    GenericViewSet,
 ):
    """AuthenticatedSession Viewset"""
    queryset = AuthenticatedSession.objects.all()
    serializer_class = AuthenticatedSessionSerializer
    search_fields = ["user__username", "last_ip", "last_user_agent"]
    filterset_fields = ["user__username", "last_ip", "last_user_agent"]
    ordering = ["user__username"]
    permission_classes = [OwnerSuperuserPermissions]
    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
    def get_queryset(self):
        user = self.request.user if self.request else get_anonymous_user()
        if user.is_superuser:
            return super().get_queryset()
        return super().get_queryset().filter(user=user.pk)
--- a/authentik/core/api/groups.py
+++ b/authentik/core/api/groups.py
@ -1,32 +1,88 @@
 """Groups API Viewset"""
 from django.db.models.query import QuerySet
-from rest_framework.fields import JSONField
+from django_filters.filters import ModelMultipleChoiceFilter
-from rest_framework.serializers import ModelSerializer
+from django_filters.filterset import FilterSet
 from rest_framework.fields import CharField, JSONField
 from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import is_dict
-from authentik.core.models import Group
+from authentik.core.models import Group, User
 class GroupMemberSerializer(ModelSerializer):
    """Stripped down user serializer to show relevant users for groups"""
    avatar = CharField(read_only=True)
    attributes = JSONField(validators=[is_dict], required=False)
    uid = CharField(read_only=True)
    class Meta:
        model = User
        fields = [
            "pk",
            "username",
            "name",
            "is_active",
            "last_login",
            "email",
            "avatar",
            "attributes",
            "uid",
        ]
 class GroupSerializer(ModelSerializer):
    """Group Serializer"""
    attributes = JSONField(validators=[is_dict], required=False)
    users_obj = ListSerializer(
        child=GroupMemberSerializer(), read_only=True, source="users", required=False
    )
    class Meta:
        model = Group
-        fields = ["pk", "name", "is_superuser", "parent", "users", "attributes"]
+        fields = [
            "pk",
            "name",
            "is_superuser",
            "parent",
            "users",
            "attributes",
            "users_obj",
        ]
-class GroupViewSet(ModelViewSet):
+class GroupFilter(FilterSet):
    """Filter for groups"""
    members_by_username = ModelMultipleChoiceFilter(
        field_name="users__username",
        to_field_name="username",
        queryset=User.objects.all(),
    )
    members_by_pk = ModelMultipleChoiceFilter(
        field_name="users",
        queryset=User.objects.all(),
    )
    class Meta:
        model = Group
        fields = ["name", "is_superuser", "members_by_pk", "members_by_username"]
 class GroupViewSet(UsedByMixin, ModelViewSet):
    """Group Viewset"""
-    queryset = Group.objects.all()
+    queryset = Group.objects.all().select_related("parent").prefetch_related("users")
    serializer_class = GroupSerializer
    search_fields = ["name", "is_superuser"]
-    filterset_fields = ["name", "is_superuser"]
+    filterset_class = GroupFilter
    ordering = ["name"]
    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
--- a/authentik/core/api/propertymappings.py
+++ b/authentik/core/api/propertymappings.py
@ -1,8 +1,8 @@
 """PropertyMapping API Views"""
 from json import dumps
-from drf_yasg import openapi
+from drf_spectacular.types import OpenApiTypes
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework import mixins
 from rest_framework.decorators import action
@ -14,11 +14,8 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from authentik.api.decorators import permission_required
-from authentik.core.api.utils import (
+from authentik.core.api.used_by import UsedByMixin
-    MetaNameSerializer,
+from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
    PassiveSerializer,
    TypeCreateSerializer,
 )
 from authentik.core.expression import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
 from authentik.lib.utils.reflection import all_subclasses
@ -65,6 +62,7 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
 class PropertyMappingViewSet(
    mixins.RetrieveModelMixin,
    mixins.DestroyModelMixin,
    UsedByMixin,
    mixins.ListModelMixin,
    GenericViewSet,
 ):
@ -81,7 +79,7 @@ class PropertyMappingViewSet(
    def get_queryset(self):  # pragma: no cover
        return PropertyMapping.objects.select_subclasses()
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    def types(self, request: Request) -> Response:
        """Get all creatable property-mapping types"""
@ -100,14 +98,17 @@ class PropertyMappingViewSet(
        return Response(TypeCreateSerializer(data, many=True).data)
    @permission_required("authentik_core.view_propertymapping")
-    @swagger_auto_schema(
+    @extend_schema(
-        request_body=PolicyTestSerializer(),
+        request=PolicyTestSerializer(),
-        responses={200: PropertyMappingTestResultSerializer, 400: "Invalid parameters"},
+        responses={
-        manual_parameters=[
+            200: PropertyMappingTestResultSerializer,
-            openapi.Parameter(
+            400: OpenApiResponse(description="Invalid parameters"),
        },
        parameters=[
            OpenApiParameter(
                name="format_result",
-                in_=openapi.IN_QUERY,
+                location=OpenApiParameter.QUERY,
-                type=openapi.TYPE_BOOLEAN,
+                type=OpenApiTypes.BOOL,
            )
        ],
    )
@ -136,9 +137,7 @@ class PropertyMappingViewSet(
                self.request,
                **test_params.validated_data.get("context", {}),
            )
-            response_data["result"] = dumps(
+            response_data["result"] = dumps(result, indent=(4 if format_result else None))
                result, indent=(4 if format_result else None)
            )
        except Exception as exc:  # pylint: disable=broad-except
            response_data["result"] = str(exc)
            response_data["successful"] = False
--- a/authentik/core/api/providers.py
+++ b/authentik/core/api/providers.py
@ -1,6 +1,6 @@
 """Provider API Views"""
 from django.utils.translation import gettext_lazy as _
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
 from rest_framework.fields import ReadOnlyField
@ -9,6 +9,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
 from authentik.lib.utils.reflection import all_subclasses
@ -22,7 +23,7 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
    component = SerializerMethodField()
-    def get_component(self, obj: Provider):  # pragma: no cover
+    def get_component(self, obj: Provider) -> str:  # pragma: no cover
        """Get object component so that we know how to edit the object"""
        # pyright: reportGeneralTypeIssues=false
        if obj.__class__ == Provider:
@ -48,6 +49,7 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 class ProviderViewSet(
    mixins.RetrieveModelMixin,
    mixins.DestroyModelMixin,
    UsedByMixin,
    mixins.ListModelMixin,
    GenericViewSet,
 ):
@ -66,7 +68,7 @@ class ProviderViewSet(
    def get_queryset(self):  # pragma: no cover
        return Provider.objects.select_subclasses()
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    def types(self, request: Request) -> Response:
        """Get all creatable provider types"""
--- a/authentik/core/api/sources.py
+++ b/authentik/core/api/sources.py
@ -1,7 +1,7 @@
 """Source API Views"""
 from typing import Iterable
-from drf_yasg.utils import swagger_auto_schema
+from drf_spectacular.utils import extend_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
 from rest_framework.request import Request
@ -10,6 +10,7 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Source
 from authentik.core.types import UserSettingSerializer
@ -24,7 +25,7 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
    component = SerializerMethodField()
-    def get_component(self, obj: Source):
+    def get_component(self, obj: Source) -> str:
        """Get object component so that we know how to edit the object"""
        # pyright: reportGeneralTypeIssues=false
        if obj.__class__ == Source:
@ -52,6 +53,7 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
 class SourceViewSet(
    mixins.RetrieveModelMixin,
    mixins.DestroyModelMixin,
    UsedByMixin,
    mixins.ListModelMixin,
    GenericViewSet,
 ):
@ -64,7 +66,7 @@ class SourceViewSet(
    def get_queryset(self):  # pragma: no cover
        return Source.objects.select_subclasses()
-    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
+    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    def types(self, request: Request) -> Response:
        """Get all creatable source types"""
@ -72,6 +74,8 @@ class SourceViewSet(
        for subclass in all_subclasses(self.queryset.model):
            subclass: Source
            component = ""
            if len(subclass.__subclasses__()) > 0:
                continue
            if subclass._meta.abstract:
                component = subclass.__bases__[0]().component
            else:
@ -87,13 +91,13 @@ class SourceViewSet(
            )
        return Response(TypeCreateSerializer(data, many=True).data)
-    @swagger_auto_schema(responses={200: UserSettingSerializer(many=True)})
+    @extend_schema(responses={200: UserSettingSerializer(many=True)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    def user_settings(self, request: Request) -> Response:
        """Get all sources the user can configure"""
-        _all_sources: Iterable[Source] = Source.objects.filter(
+        _all_sources: Iterable[Source] = (
-            enabled=True
+            Source.objects.filter(enabled=True).select_subclasses().order_by("name")
-        ).select_subclasses()
+        )
        matching_sources: list[UserSettingSerializer] = []
        for source in _all_sources:
            user_settings = source.ui_user_settings
--- a/authentik/core/api/tokens.py
+++ b/authentik/core/api/tokens.py
@ -1,17 +1,25 @@
 """Tokens API Viewset"""
 from typing import Any
 from django.http.response import Http404
-from drf_yasg.utils import swagger_auto_schema
+from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from guardian.shortcuts import get_anonymous_user
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField
 from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import Token, TokenIntents
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.managed.api import ManagedSerializer
@ -19,7 +27,16 @@ from authentik.managed.api import ManagedSerializer
 class TokenSerializer(ManagedSerializer, ModelSerializer):
    """Token Serializer"""
-    user = UserSerializer(required=False)
+    user_obj = UserSerializer(required=False, source="user")
    def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
        """Ensure only API or App password tokens are created."""
        request: Request = self.context["request"]
        attrs.setdefault("user", request.user)
        attrs.setdefault("intent", TokenIntents.INTENT_API)
        if attrs.get("intent") not in [TokenIntents.INTENT_API, TokenIntents.INTENT_APP_PASSWORD]:
            raise ValidationError(f"Invalid intent {attrs.get('intent')}")
        return attrs
    class Meta:
@ -30,11 +47,14 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
            "identifier",
            "intent",
            "user",
            "user_obj",
            "description",
            "expires",
            "expiring",
        ]
-        depth = 2
+        extra_kwargs = {
            "user": {"required": False},
        }
 class TokenViewSerializer(PassiveSerializer):
@ -43,11 +63,11 @@ class TokenViewSerializer(PassiveSerializer):
    key = CharField(read_only=True)
-class TokenViewSet(ModelViewSet):
+class TokenViewSet(UsedByMixin, ModelViewSet):
    """Token Viewset"""
    lookup_field = "identifier"
-    queryset = Token.filter_not_expired()
+    queryset = Token.objects.all()
    serializer_class = TokenSerializer
    search_fields = [
        "identifier",
@ -60,17 +80,32 @@ class TokenViewSet(ModelViewSet):
        "intent",
        "user__username",
        "description",
        "expires",
        "expiring",
    ]
-    ordering = ["expires"]
+    ordering = ["identifier", "expires"]
    permission_classes = [OwnerSuperuserPermissions]
    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
    def get_queryset(self):
        user = self.request.user if self.request else get_anonymous_user()
        if user.is_superuser:
            return super().get_queryset()
        return super().get_queryset().filter(user=user.pk)
    def perform_create(self, serializer: TokenSerializer):
-        serializer.save(user=self.request.user, intent=TokenIntents.INTENT_API)
+        if not self.request.user.is_superuser:
            return serializer.save(
                user=self.request.user,
                expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
            )
        return super().perform_create(serializer)
    @permission_required("authentik_core.view_token_key")
-    @swagger_auto_schema(
+    @extend_schema(
        responses={
            200: TokenViewSerializer(many=False),
-            404: "Token not found or expired",
+            404: OpenApiResponse(description="Token not found or expired"),
        }
    )
    @action(detail=True, pagination_class=None, filter_backends=[])
@ -80,7 +115,5 @@ class TokenViewSet(ModelViewSet):
        token: Token = self.get_object()
        if token.is_expired:
            raise Http404
-        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(  # noqa # nosec
+        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(request)  # noqa # nosec
            request
        )
        return Response(TokenViewSerializer({"key": token.key}).data)
--- a/authentik/core/api/used_by.py
+++ b/authentik/core/api/used_by.py
@ -0,0 +1,100 @@
 """used_by mixin"""
 from enum import Enum
 from inspect import getmembers
 from django.db.models.base import Model
 from django.db.models.deletion import SET_DEFAULT, SET_NULL
 from django.db.models.manager import Manager
 from drf_spectacular.utils import extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField
 from rest_framework.request import Request
 from rest_framework.response import Response
 from authentik.core.api.utils import PassiveSerializer
 class DeleteAction(Enum):
    """Which action a delete will have on a used object"""
    CASCADE = "cascade"
    CASCADE_MANY = "cascade_many"
    SET_NULL = "set_null"
    SET_DEFAULT = "set_default"
 class UsedBySerializer(PassiveSerializer):
    """A list of all objects referencing the queried object"""
    app = CharField()
    model_name = CharField()
    pk = CharField()
    name = CharField()
    action = ChoiceField(choices=[(x.name, x.name) for x in DeleteAction])
 def get_delete_action(manager: Manager) -> str:
    """Get the delete action from the Foreign key, falls back to cascade"""
    if hasattr(manager, "field"):
        if manager.field.remote_field.on_delete.__name__ == SET_NULL.__name__:
            return DeleteAction.SET_NULL.name
        if manager.field.remote_field.on_delete.__name__ == SET_DEFAULT.__name__:
            return DeleteAction.SET_DEFAULT.name
    if hasattr(manager, "source_field"):
        return DeleteAction.CASCADE_MANY.name
    return DeleteAction.CASCADE.name
 class UsedByMixin:
    """Mixin to add a used_by endpoint to return a list of all objects using this object"""
    @extend_schema(
        responses={200: UsedBySerializer(many=True)},
    )
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name, unused-argument, too-many-locals
    def used_by(self, request: Request, *args, **kwargs) -> Response:
        """Get a list of all objects that use this object"""
        # pyright: reportGeneralTypeIssues=false
        model: Model = self.get_object()
        used_by = []
        shadows = []
        for attr_name, manager in getmembers(model, lambda x: isinstance(x, Manager)):
            if attr_name == "objects":  # pragma: no cover
                continue
            manager: Manager
            if manager.model._meta.abstract:
                continue
            app = manager.model._meta.app_label
            model_name = manager.model._meta.model_name
            delete_action = get_delete_action(manager)
            # To make sure we only apply shadows when there are any objects,
            # but so we only apply them once, have a simple flag for the first object
            first_object = True
            for obj in get_objects_for_user(
                request.user, f"{app}.view_{model_name}", manager
            ).all():
                # Only merge shadows on first object
                if first_object:
                    shadows += getattr(manager.model._meta, "authentik_used_by_shadows", [])
                first_object = False
                serializer = UsedBySerializer(
                    data={
                        "app": app,
                        "model_name": model_name,
                        "pk": str(obj.pk),
                        "name": str(obj),
                        "action": delete_action,
                    }
                )
                serializer.is_valid()
                used_by.append(serializer.data)
        # Check the shadows map and remove anything that should be shadowed
        for idx, user in enumerate(used_by):
            full_model_name = f"{user['app']}.{user['model_name']}"
            if full_model_name in shadows:
                del used_by[idx]
        return Response(used_by)
--- a/authentik/core/api/users.py
+++ b/authentik/core/api/users.py
@ -1,38 +1,63 @@
 """User API Views"""
 from datetime import timedelta
 from json import loads
 from typing import Optional
 from django.db.models.query import QuerySet
-from django.http.response import Http404
+from django.db.transaction import atomic
 from django.db.utils import IntegrityError
 from django.urls import reverse_lazy
 from django.utils.http import urlencode
-from django_filters.filters import BooleanFilter, CharFilter
+from django.utils.timezone import now
 from django.utils.translation import gettext as _
 from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
 from django_filters.filterset import FilterSet
-from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
+from drf_spectacular.types import OpenApiTypes
-from guardian.utils import get_anonymous_user
+from drf_spectacular.utils import (
    OpenApiParameter,
    extend_schema,
    extend_schema_field,
    inline_serializer,
 )
 from guardian.shortcuts import get_anonymous_user, get_objects_for_user
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, JSONField, SerializerMethodField
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import (
    BooleanField,
    ListSerializer,
    ModelSerializer,
    PrimaryKeyRelatedField,
    Serializer,
    ValidationError,
 )
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 from structlog.stdlib import get_logger
 from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.groups import GroupSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
-from authentik.core.middleware import (
+from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
-    SESSION_IMPERSONATE_ORIGINAL_USER,
+from authentik.core.models import (
-    SESSION_IMPERSONATE_USER,
+    USER_ATTRIBUTE_SA,
    USER_ATTRIBUTE_TOKEN_EXPIRING,
    Group,
    Token,
    TokenIntents,
    User,
 )
 from authentik.core.models import Token, TokenIntents, User
 from authentik.events.models import EventAction
-from authentik.flows.models import Flow, FlowDesignation
+from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant
 LOGGER = get_logger()
 class UserSerializer(ModelSerializer):
@ -41,7 +66,10 @@ class UserSerializer(ModelSerializer):
    is_superuser = BooleanField(read_only=True)
    avatar = CharField(read_only=True)
    attributes = JSONField(validators=[is_dict], required=False)
-    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
+    groups = PrimaryKeyRelatedField(
        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all()
    )
    groups_obj = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
    uid = CharField(read_only=True)
    class Meta:
@ -55,6 +83,7 @@ class UserSerializer(ModelSerializer):
            "last_login",
            "is_superuser",
            "groups",
            "groups_obj",
            "email",
            "avatar",
            "attributes",
@ -62,12 +91,40 @@ class UserSerializer(ModelSerializer):
        ]
 class UserSelfSerializer(ModelSerializer):
    """User Serializer for information a user can retrieve about themselves and
    update about themselves"""
    is_superuser = BooleanField(read_only=True)
    avatar = CharField(read_only=True)
    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
    uid = CharField(read_only=True)
    class Meta:
        model = User
        fields = [
            "pk",
            "username",
            "name",
            "is_active",
            "is_superuser",
            "groups",
            "email",
            "avatar",
            "uid",
        ]
        extra_kwargs = {
            "is_active": {"read_only": True},
        }
 class SessionUserSerializer(PassiveSerializer):
    """Response for the /user/me endpoint, returns the currently active user (as `user` property)
    and, if this user is being impersonated, the original user in the `original` property."""
-    user = UserSerializer()
+    user = UserSelfSerializer()
-    original = UserSerializer(required=False)
+    original = UserSelfSerializer(required=False)
 class UserMetricsSerializer(PassiveSerializer):
@ -77,27 +134,23 @@ class UserMetricsSerializer(PassiveSerializer):
    logins_failed_per_1h = SerializerMethodField()
    authorizations_per_1h = SerializerMethodField()
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
    def get_logins_per_1h(self, _):
        """Get successful logins per hour for the last 24 hours"""
        user = self.context["user"]
        return get_events_per_1h(action=EventAction.LOGIN, user__pk=user.pk)
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
    def get_logins_failed_per_1h(self, _):
        """Get failed logins per hour for the last 24 hours"""
        user = self.context["user"]
-        return get_events_per_1h(
+        return get_events_per_1h(action=EventAction.LOGIN_FAILED, context__username=user.username)
            action=EventAction.LOGIN_FAILED, context__username=user.username
        )
-    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
+    @extend_schema_field(CoordinateSerializer(many=True))
    def get_authorizations_per_1h(self, _):
        """Get failed logins per hour for the last 24 hours"""
        user = self.context["user"]
-        return get_events_per_1h(
+        return get_events_per_1h(action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk)
            action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk
        )
 class UsersFilter(FilterSet):
@ -112,6 +165,16 @@ class UsersFilter(FilterSet):
    is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
    groups_by_name = ModelMultipleChoiceFilter(
        field_name="ak_groups__name",
        to_field_name="name",
        queryset=Group.objects.all(),
    )
    groups_by_pk = ModelMultipleChoiceFilter(
        field_name="ak_groups",
        queryset=Group.objects.all(),
    )
    # pylint: disable=unused-argument
    def filter_attributes(self, queryset, name, value):
        """Filter attributes by query args"""
@ -128,37 +191,134 @@ class UsersFilter(FilterSet):
    class Meta:
        model = User
-        fields = ["username", "name", "is_active", "is_superuser", "attributes"]
+        fields = [
            "username",
            "email",
            "name",
            "is_active",
            "is_superuser",
            "attributes",
            "groups_by_name",
            "groups_by_pk",
        ]
-class UserViewSet(ModelViewSet):
+class UserViewSet(UsedByMixin, ModelViewSet):
    """User Viewset"""
    queryset = User.objects.none()
    serializer_class = UserSerializer
-    search_fields = ["username", "name", "is_active"]
+    search_fields = ["username", "name", "is_active", "email"]
    filterset_class = UsersFilter
    def get_queryset(self):  # pragma: no cover
        return User.objects.all().exclude(pk=get_anonymous_user().pk)
-    @swagger_auto_schema(responses={200: SessionUserSerializer(many=False)})
+    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
        """Create a recovery link (when the current tenant has a recovery flow set),
        that can either be shown to an admin or sent to the user directly"""
        tenant: Tenant = self.request._request.tenant
        # Check that there is a recovery flow, if not return an error
        flow = tenant.flow_recovery
        if not flow:
            LOGGER.debug("No recovery flow set")
            return None, None
        user: User = self.get_object()
        token, __ = Token.objects.get_or_create(
            identifier=f"{user.uid}-password-reset",
            user=user,
            intent=TokenIntents.INTENT_RECOVERY,
        )
        querystring = urlencode({"token": token.key})
        link = self.request.build_absolute_uri(
            reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
            + f"?{querystring}"
        )
        return link, token
    @permission_required(None, ["authentik_core.add_user", "authentik_core.add_token"])
    @extend_schema(
        request=inline_serializer(
            "UserServiceAccountSerializer",
            {
                "name": CharField(required=True),
                "create_group": BooleanField(default=False),
            },
        ),
        responses={
            200: inline_serializer(
                "UserServiceAccountResponse",
                {
                    "username": CharField(required=True),
                    "token": CharField(required=True),
                },
            )
        },
    )
    @action(detail=False, methods=["POST"], pagination_class=None, filter_backends=[])
    def service_account(self, request: Request) -> Response:
        """Create a new user account that is marked as a service account"""
        username = request.data.get("name")
        create_group = request.data.get("create_group", False)
        with atomic():
            try:
                user = User.objects.create(
                    username=username,
                    name=username,
                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False},
                )
                if create_group:
                    group = Group.objects.create(
                        name=username,
                    )
                    group.users.add(user)
                token = Token.objects.create(
                    identifier=f"service-account-{username}-password",
                    intent=TokenIntents.INTENT_APP_PASSWORD,
                    user=user,
                    expires=now() + timedelta(days=360),
                )
                return Response({"username": user.username, "token": token.key})
            except (IntegrityError) as exc:
                return Response(data={"non_field_errors": [str(exc)]}, status=400)
    @extend_schema(responses={200: SessionUserSerializer(many=False)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name
    def me(self, request: Request) -> Response:
        """Get information about current user"""
-        serializer = SessionUserSerializer(
+        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
            data={"user": UserSerializer(request.user).data}
        )
        if SESSION_IMPERSONATE_USER in request._request.session:
-            serializer.initial_data["original"] = UserSerializer(
+            serializer.initial_data["original"] = UserSelfSerializer(
                request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
            ).data
        serializer.is_valid()
        return Response(serializer.data)
    @extend_schema(request=UserSelfSerializer, responses={200: SessionUserSerializer(many=False)})
    @action(
        methods=["PUT"],
        detail=False,
        pagination_class=None,
        filter_backends=[],
        permission_classes=[IsAuthenticated],
    )
    def update_self(self, request: Request) -> Response:
        """Allow users to change information on their own profile"""
        data = UserSelfSerializer(instance=User.objects.get(pk=request.user.pk), data=request.data)
        if not data.is_valid():
            return Response(data.errors)
        new_user = data.save()
        # If we're impersonating, we need to update that user object
        # since it caches the full object
        if SESSION_IMPERSONATE_USER in request.session:
            request.session[SESSION_IMPERSONATE_USER] = new_user
        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
        serializer.is_valid()
        return Response(serializer.data)
    @permission_required("authentik_core.view_user", ["authentik_events.view_event"])
-    @swagger_auto_schema(responses={200: UserMetricsSerializer(many=False)})
+    @extend_schema(responses={200: UserMetricsSerializer(many=False)})
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name, unused-argument
    def metrics(self, request: Request, pk: int) -> Response:
@ -169,29 +329,70 @@ class UserViewSet(ModelViewSet):
        return Response(serializer.data)
    @permission_required("authentik_core.reset_user_password")
-    @swagger_auto_schema(
+    @extend_schema(
-        responses={"200": LinkSerializer(many=False), "404": "No recovery flow found."},
+        responses={
            "200": LinkSerializer(many=False),
            "404": LinkSerializer(many=False),
        },
    )
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name, unused-argument
    def recovery(self, request: Request, pk: int) -> Response:
        """Create a temporary link that a user can use to recover their accounts"""
-        # Check that there is a recovery flow, if not return an error
+        link, _ = self._create_recovery_link()
-        flow = Flow.with_policy(request, designation=FlowDesignation.RECOVERY)
+        if not link:
-        if not flow:
+            LOGGER.debug("Couldn't create token")
-            raise Http404
+            return Response({"link": ""}, status=404)
        user: User = self.get_object()
        token, __ = Token.objects.get_or_create(
            identifier=f"{user.uid}-password-reset",
            user=user,
            intent=TokenIntents.INTENT_RECOVERY,
        )
        querystring = urlencode({"token": token.key})
        link = request.build_absolute_uri(
            reverse_lazy("authentik_flows:default-recovery") + f"?{querystring}"
        )
        return Response({"link": link})
    @permission_required("authentik_core.reset_user_password")
    @extend_schema(
        parameters=[
            OpenApiParameter(
                name="email_stage",
                location=OpenApiParameter.QUERY,
                type=OpenApiTypes.STR,
                required=True,
            )
        ],
        responses={
            "204": Serializer(),
            "404": Serializer(),
        },
    )
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name, unused-argument
    def recovery_email(self, request: Request, pk: int) -> Response:
        """Create a temporary link that a user can use to recover their accounts"""
        for_user = self.get_object()
        if for_user.email == "":
            LOGGER.debug("User doesn't have an email address")
            return Response(status=404)
        link, token = self._create_recovery_link()
        if not link:
            LOGGER.debug("Couldn't create token")
            return Response(status=404)
        # Lookup the email stage to assure the current user can access it
        stages = get_objects_for_user(
            request.user, "authentik_stages_email.view_emailstage"
        ).filter(pk=request.query_params.get("email_stage"))
        if not stages.exists():
            LOGGER.debug("Email stage does not exist/user has no permissions")
            return Response(status=404)
        email_stage: EmailStage = stages.first()
        message = TemplateEmailMessage(
            subject=_(email_stage.subject),
            template_name=email_stage.template,
            to=[for_user.email],
            template_context={
                "url": link,
                "user": for_user,
                "expires": token.expires,
            },
        )
        send_mails(email_stage, message)
        return Response(status=204)
    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
        for backend in list(self.filter_backends):
@ -201,6 +402,6 @@ class UserViewSet(ModelViewSet):
        return queryset
    def filter_queryset(self, queryset):
-        if self.request.user.has_perm("authentik_core.view_group"):
+        if self.request.user.has_perm("authentik_core.view_user"):
            return self._filter_queryset_for_list(queryset)
        return super().filter_queryset(queryset)
--- a/authentik/core/api/utils.py
+++ b/authentik/core/api/utils.py
@ -2,19 +2,15 @@
 from typing import Any
 from django.db.models import Model
-from rest_framework.fields import CharField, IntegerField
+from rest_framework.fields import BooleanField, CharField, FileField, IntegerField
-from rest_framework.serializers import (
+from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError
    Serializer,
    SerializerMethodField,
    ValidationError,
 )
 def is_dict(value: Any):
    """Ensure a value is a dictionary, useful for JSONFields"""
    if isinstance(value, dict):
        return
-    raise ValidationError("Value must be a dictionary.")
+    raise ValidationError("Value must be a dictionary, and not have any duplicate keys.")
 class PassiveSerializer(Serializer):
@ -23,12 +19,23 @@ class PassiveSerializer(Serializer):
    def create(self, validated_data: dict) -> Model:  # pragma: no cover
        return Model()
-    def update(
+    def update(self, instance: Model, validated_data: dict) -> Model:  # pragma: no cover
        self, instance: Model, validated_data: dict
    ) -> Model:  # pragma: no cover
        return Model()
 class FileUploadSerializer(PassiveSerializer):
    """Serializer to upload file"""
    file = FileField(required=False)
    clear = BooleanField(default=False)
 class FilePathSerializer(PassiveSerializer):
    """Serializer to upload file"""
    url = CharField()
 class MetaNameSerializer(PassiveSerializer):
    """Add verbose names to response"""
--- a/authentik/core/apps.py
+++ b/authentik/core/apps.py
@ -2,6 +2,10 @@
 from importlib import import_module
 from django.apps import AppConfig
 from django.db import ProgrammingError
 from authentik.core.signals import GAUGE_MODELS
 from authentik.lib.utils.reflection import get_apps
 class AuthentikCoreConfig(AppConfig):
@ -15,3 +19,12 @@ class AuthentikCoreConfig(AppConfig):
    def ready(self):
        import_module("authentik.core.signals")
        import_module("authentik.core.managed")
        try:
            for app in get_apps():
                for model in app.get_models():
                    GAUGE_MODELS.labels(
                        model_name=model._meta.model_name,
                        app=model._meta.app_label,
                    ).set(model.objects.count())
        except ProgrammingError:
            pass
--- a/authentik/core/auth.py
+++ b/authentik/core/auth.py
@ -0,0 +1,59 @@
 """Authenticate with tokens"""
 from typing import Any, Optional
 from django.contrib.auth.backends import ModelBackend
 from django.http.request import HttpRequest
 from authentik.core.models import Token, TokenIntents, User
 from authentik.events.utils import cleanse_dict, sanitize_dict
 from authentik.flows.planner import FlowPlan
 from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
 class InbuiltBackend(ModelBackend):
    """Inbuilt backend"""
    def authenticate(
        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
    ) -> Optional[User]:
        user = super().authenticate(request, username=username, password=password, **kwargs)
        if not user:
            return None
        self.set_method("password", request)
        return user
    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
        """Set method data on current flow, if possbiel"""
        if not request:
            return
        # Since we can't directly pass other variables to signals, and we want to log the method
        # and the token used, we assume we're running in a flow and set a variable in the context
        flow_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
        flow_plan.context[PLAN_CONTEXT_METHOD] = method
        flow_plan.context[PLAN_CONTEXT_METHOD_ARGS] = cleanse_dict(sanitize_dict(kwargs))
        request.session[SESSION_KEY_PLAN] = flow_plan
 class TokenBackend(InbuiltBackend):
    """Authenticate with token"""
    def authenticate(
        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
    ) -> Optional[User]:
        try:
            user = User._default_manager.get_by_natural_key(username)
        except User.DoesNotExist:
            # Run the default password hasher once to reduce the timing
            # difference between an existing and a nonexistent user (#20760).
            User().set_password(password)
            return None
        tokens = Token.filter_not_expired(
            user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
        )
        if not tokens.exists():
            return None
        token = tokens.first()
        self.set_method("password", request, token=token)
        return token.user
--- a/authentik/core/channels.py
+++ b/authentik/core/channels.py
@ -4,7 +4,7 @@ from channels.generic.websocket import JsonWebsocketConsumer
 from rest_framework.exceptions import AuthenticationFailed
 from structlog.stdlib import get_logger
-from authentik.api.authentication import token_from_header
+from authentik.api.authentication import bearer_auth
 from authentik.core.models import User
 LOGGER = get_logger()
@ -24,12 +24,12 @@ class AuthJsonConsumer(JsonWebsocketConsumer):
        raw_header = headers[b"authorization"]
        try:
-            token = token_from_header(raw_header)
+            user = bearer_auth(raw_header)
-            # token is only None when no header was given, in which case we deny too
+            # user is only None when no header was given, in which case we deny too
-            if not token:
+            if not user:
                raise DenyConnection()
        except AuthenticationFailed as exc:
            LOGGER.warning("Failed to authenticate", exc=exc)
            raise DenyConnection()
-        self.user = token.user
+        self.user = user
--- a/authentik/core/expression.py
+++ b/authentik/core/expression.py
@ -3,23 +3,33 @@ from traceback import format_tb
 from typing import Optional
 from django.http import HttpRequest
 from guardian.utils import get_anonymous_user
-from authentik.core.models import User
+from authentik.core.models import PropertyMapping, User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
 from authentik.policies.types import PolicyRequest
 class PropertyMappingEvaluator(BaseEvaluator):
    """Custom Evalautor that adds some different context variables."""
    def set_context(
-        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
+        self,
        user: Optional[User],
        request: Optional[HttpRequest],
        mapping: PropertyMapping,
        **kwargs,
    ):
        """Update context with context from PropertyMapping's evaluate"""
        req = PolicyRequest(user=get_anonymous_user())
        req.obj = mapping
        if user:
            req.user = user
            self._context["user"] = user
        if request:
-            self._context["request"] = request
+            req.http_request = request
        self._context["request"] = req
        self._context.update(**kwargs)
    def handle_error(self, exc: Exception, expression_source: str):
@ -30,9 +40,8 @@ class PropertyMappingEvaluator(BaseEvaluator):
            expression=expression_source,
            message=error_string,
        )
        if "user" in self._context:
            event.set_user(self._context["user"])
        if "request" in self._context:
-            event.from_http(self._context["request"])
+            req: PolicyRequest = self._context["request"]
            event.from_http(req.http_request, req.user)
            return
        event.save()
--- a/authentik/core/middleware.py
+++ b/authentik/core/middleware.py
@ -26,6 +26,8 @@ class ImpersonateMiddleware:
        if SESSION_IMPERSONATE_USER in request.session:
            request.user = request.session[SESSION_IMPERSONATE_USER]
            # Ensure that the user is active, otherwise nothing will work
            request.user.is_active = True
        return self.get_response(request)
@ -42,10 +44,14 @@ class RequestIDMiddleware:
        if not hasattr(request, "request_id"):
            request_id = uuid4().hex
            setattr(request, "request_id", request_id)
-            LOCAL.authentik = {"request_id": request_id}
+            LOCAL.authentik = {
                "request_id": request_id,
                "host": request.get_host(),
            }
        response = self.get_response(request)
        response[RESPONSE_HEADER_ID] = request.request_id
        del LOCAL.authentik["request_id"]
        del LOCAL.authentik["host"]
        return response
@ -54,4 +60,5 @@ def structlog_add_request_id(logger: Logger, method_name: str, event_dict):
    """If threadlocal has authentik defined, add request_id to log"""
    if hasattr(LOCAL, "authentik"):
        event_dict["request_id"] = LOCAL.authentik.get("request_id", "")
        event_dict["host"] = LOCAL.authentik.get("host", "")
    return event_dict
--- a/authentik/core/migrations/0001_initial.py
+++ b/authentik/core/migrations/0001_initial.py
@ -38,9 +38,7 @@ class Migration(migrations.Migration):
                ("password", models.CharField(max_length=128, verbose_name="password")),
                (
                    "last_login",
-                    models.DateTimeField(
+                    models.DateTimeField(blank=True, null=True, verbose_name="last login"),
                        blank=True, null=True, verbose_name="last login"
                    ),
                ),
                (
                    "is_superuser",
@ -53,35 +51,25 @@ class Migration(migrations.Migration):
                (
                    "username",
                    models.CharField(
-                        error_messages={
+                        error_messages={"unique": "A user with that username already exists."},
                            "unique": "A user with that username already exists."
                        },
                        help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
                        max_length=150,
                        unique=True,
-                        validators=[
+                        validators=[django.contrib.auth.validators.UnicodeUsernameValidator()],
                            django.contrib.auth.validators.UnicodeUsernameValidator()
                        ],
                        verbose_name="username",
                    ),
                ),
                (
                    "first_name",
-                    models.CharField(
+                    models.CharField(blank=True, max_length=30, verbose_name="first name"),
                        blank=True, max_length=30, verbose_name="first name"
                    ),
                ),
                (
                    "last_name",
-                    models.CharField(
+                    models.CharField(blank=True, max_length=150, verbose_name="last name"),
                        blank=True, max_length=150, verbose_name="last name"
                    ),
                ),
                (
                    "email",
-                    models.EmailField(
+                    models.EmailField(blank=True, max_length=254, verbose_name="email address"),
                        blank=True, max_length=254, verbose_name="email address"
                    ),
                ),
                (
                    "is_staff",
@ -217,9 +205,7 @@ class Migration(migrations.Migration):
                ),
                (
                    "expires",
-                    models.DateTimeField(
+                    models.DateTimeField(default=authentik.core.models.default_token_duration),
                        default=authentik.core.models.default_token_duration
                    ),
                ),
                ("expiring", models.BooleanField(default=True)),
                ("description", models.TextField(blank=True, default="")),
@ -306,9 +292,7 @@ class Migration(migrations.Migration):
                ("name", models.TextField(help_text="Application's display Name.")),
                (
                    "slug",
-                    models.SlugField(
+                    models.SlugField(help_text="Internal application name, used in URLs."),
                        help_text="Internal application name, used in URLs."
                    ),
                ),
                ("skip_authorization", models.BooleanField(default=False)),
                ("meta_launch_url", models.URLField(blank=True, default="")),
--- a/authentik/core/migrations/0003_default_user.py
+++ b/authentik/core/migrations/0003_default_user.py
@ -17,9 +17,7 @@ def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
        username="akadmin", email="root@localhost", name="authentik Default Admin"
    )
    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(
+        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
            environ.get("AK_ADMIN_PASS", "akadmin"), signal=False
        )  # noqa # nosec
    else:
        akadmin.set_unusable_password()
    akadmin.save()
--- a/authentik/core/migrations/0006_auto_20200709_1608.py
+++ b/authentik/core/migrations/0006_auto_20200709_1608.py
@ -13,8 +13,6 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="source",
            name="slug",
-            field=models.SlugField(
+            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
                help_text="Internal source name, used in URLs.", unique=True
            ),
        ),
    ]
--- a/authentik/core/migrations/0007_auto_20200815_1841.py
+++ b/authentik/core/migrations/0007_auto_20200815_1841.py
@ -13,8 +13,6 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="user",
            name="first_name",
-            field=models.CharField(
+            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
                blank=True, max_length=150, verbose_name="first name"
            ),
        ),
    ]
--- a/authentik/core/migrations/0009_group_is_superuser.py
+++ b/authentik/core/migrations/0009_group_is_superuser.py
@ -40,9 +40,7 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="user",
            name="pb_groups",
-            field=models.ManyToManyField(
+            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
                related_name="users", to="authentik_core.Group"
            ),
        ),
        migrations.AddField(
            model_name="group",
--- a/authentik/core/migrations/0014_auto_20201018_1158.py
+++ b/authentik/core/migrations/0014_auto_20201018_1158.py
@ -42,9 +42,7 @@ class Migration(migrations.Migration):
        ),
        migrations.AddIndex(
            model_name="token",
-            index=models.Index(
+            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
                fields=["identifier"], name="authentik_co_identif_1a34a8_idx"
            ),
        ),
        migrations.RunPython(set_default_token_key),
    ]
--- a/authentik/core/migrations/0015_application_icon.py
+++ b/authentik/core/migrations/0015_application_icon.py
@ -17,8 +17,6 @@ class Migration(migrations.Migration):
        migrations.AddField(
            model_name="application",
            name="meta_icon",
-            field=models.FileField(
+            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
                blank=True, default="", upload_to="application-icons/"
            ),
        ),
    ]
--- a/authentik/core/migrations/0016_auto_20201202_2234.py
+++ b/authentik/core/migrations/0016_auto_20201202_2234.py
@ -25,9 +25,7 @@ class Migration(migrations.Migration):
        ),
        migrations.AddIndex(
            model_name="token",
-            index=models.Index(
+            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
                fields=["identifier"], name="authentik_c_identif_d9d032_idx"
            ),
        ),
        migrations.AddIndex(
            model_name="token",
--- a/authentik/core/migrations/0022_authenticatedsession.py
+++ b/authentik/core/migrations/0022_authenticatedsession.py
@ -0,0 +1,59 @@
 # Generated by Django 3.2.3 on 2021-05-29 22:14
 import uuid
 import django.db.models.deletion
 from django.apps.registry import Apps
 from django.conf import settings
 from django.db import migrations, models
 from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 import authentik.core.models
 def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
    db_alias = schema_editor.connection.alias
    from django.contrib.sessions.backends.cache import KEY_PREFIX
    from django.core.cache import cache
    session_keys = cache.keys(KEY_PREFIX + "*")
    cache.delete_many(session_keys)
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0021_alter_application_slug"),
    ]
    operations = [
        migrations.CreateModel(
            name="AuthenticatedSession",
            fields=[
                (
                    "expires",
                    models.DateTimeField(default=authentik.core.models.default_token_duration),
                ),
                ("expiring", models.BooleanField(default=True)),
                (
                    "uuid",
                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
                ),
                ("session_key", models.CharField(max_length=40)),
                ("last_ip", models.TextField()),
                ("last_user_agent", models.TextField(blank=True)),
                ("last_used", models.DateTimeField(auto_now=True)),
                (
                    "user",
                    models.ForeignKey(
                        on_delete=django.db.models.deletion.CASCADE,
                        to=settings.AUTH_USER_MODEL,
                    ),
                ),
            ],
            options={
                "abstract": False,
            },
        ),
        migrations.RunPython(migrate_sessions),
    ]
--- a/authentik/core/migrations/0023_alter_application_meta_launch_url.py
+++ b/authentik/core/migrations/0023_alter_application_meta_launch_url.py
@ -0,0 +1,23 @@
 # Generated by Django 3.2.3 on 2021-06-02 21:51
 import django.core.validators
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0022_authenticatedsession"),
    ]
    operations = [
        migrations.AlterField(
            model_name="application",
            name="meta_launch_url",
            field=models.TextField(
                blank=True,
                default="",
                validators=[django.core.validators.URLValidator()],
            ),
        ),
    ]
--- a/authentik/core/migrations/0024_alter_token_identifier.py
+++ b/authentik/core/migrations/0024_alter_token_identifier.py
@ -0,0 +1,35 @@
 # Generated by Django 3.2.3 on 2021-06-03 09:33
 from django.apps.registry import Apps
 from django.db import migrations, models
 from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 from django.db.models import Count
 def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
    db_alias = schema_editor.connection.alias
    Token = apps.get_model("authentik_core", "token")
    identifiers = (
        Token.objects.using(db_alias)
        .values("identifier")
        .annotate(identifier_count=Count("identifier"))
        .filter(identifier_count__gt=1)
    )
    for ident in identifiers:
        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0023_alter_application_meta_launch_url"),
    ]
    operations = [
        migrations.RunPython(fix_duplicates),
        migrations.AlterField(
            model_name="token",
            name="identifier",
            field=models.SlugField(max_length=255, unique=True),
        ),
    ]
--- a/authentik/core/migrations/0025_alter_application_meta_icon.py
+++ b/authentik/core/migrations/0025_alter_application_meta_icon.py
@ -0,0 +1,18 @@
 # Generated by Django 3.2.3 on 2021-06-05 19:04
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0024_alter_token_identifier"),
    ]
    operations = [
        migrations.AlterField(
            model_name="application",
            name="meta_icon",
            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
        ),
    ]
--- a/authentik/core/migrations/0026_alter_application_meta_icon.py
+++ b/authentik/core/migrations/0026_alter_application_meta_icon.py
@ -0,0 +1,27 @@
 # Generated by Django 3.2.5 on 2021-07-09 17:27
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0025_alter_application_meta_icon"),
    ]
    operations = [
        migrations.AlterField(
            model_name="application",
            name="meta_icon",
            field=models.FileField(
                default=None, max_length=500, null=True, upload_to="application-icons/"
            ),
        ),
        migrations.AlterModelOptions(
            name="authenticatedsession",
            options={
                "verbose_name": "Authenticated Session",
                "verbose_name_plural": "Authenticated Sessions",
            },
        ),
    ]
--- a/authentik/core/migrations/0027_bootstrap_token.py
+++ b/authentik/core/migrations/0027_bootstrap_token.py
@ -0,0 +1,37 @@
 # Generated by Django 3.2.5 on 2021-08-11 19:40
 from os import environ
 from django.apps.registry import Apps
 from django.db import migrations
 from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
    # We have to use a direct import here, otherwise we get an object manager error
    from authentik.core.models import Token, TokenIntents, User
    db_alias = schema_editor.connection.alias
    akadmin = User.objects.using(db_alias).filter(username="akadmin")
    if not akadmin.exists():
        return
    if "AK_ADMIN_TOKEN" not in environ:
        return
    Token.objects.using(db_alias).create(
        identifier="authentik-boostrap-token",
        user=akadmin.first(),
        intent=TokenIntents.INTENT_API,
        expiring=False,
        key=environ["AK_ADMIN_TOKEN"],
    )
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0026_alter_application_meta_icon"),
    ]
    operations = [
        migrations.RunPython(create_default_user_token),
    ]
--- a/authentik/core/migrations/0028_alter_token_intent.py
+++ b/authentik/core/migrations/0028_alter_token_intent.py
@ -0,0 +1,26 @@
 # Generated by Django 3.2.6 on 2021-08-23 14:35
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ("authentik_core", "0027_bootstrap_token"),
    ]
    operations = [
        migrations.AlterField(
            model_name="token",
            name="intent",
            field=models.TextField(
                choices=[
                    ("verification", "Intent Verification"),
                    ("api", "Intent Api"),
                    ("recovery", "Intent Recovery"),
                    ("app_password", "Intent App Password"),
                ],
                default="verification",
            ),
        ),
    ]
--- a/authentik/core/models.py
+++ b/authentik/core/models.py
@ -5,11 +5,13 @@ from typing import Any, Optional, Type
 from urllib.parse import urlencode
 from uuid import uuid4
 from deepmerge import always_merger
 from django.conf import settings
 from django.contrib.auth.models import AbstractUser
 from django.contrib.auth.models import UserManager as DjangoUserManager
 from django.core import validators
 from django.db import models
-from django.db.models import Q, QuerySet
+from django.db.models import Q, QuerySet, options
 from django.http import HttpRequest
 from django.templatetags.static import static
 from django.utils.functional import cached_property
@ -23,11 +25,12 @@ from structlog.stdlib import get_logger
 from authentik.core.exceptions import PropertyMappingExpressionException
 from authentik.core.signals import password_changed
-from authentik.core.types import UILoginButton
+from authentik.core.types import UILoginButton, UserSettingSerializer
 from authentik.flows.challenge import Challenge
 from authentik.flows.models import Flow
 from authentik.lib.config import CONFIG
 from authentik.lib.generators import generate_id
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
 from authentik.lib.utils.http import get_client_ip
 from authentik.managed.models import ManagedModel
 from authentik.policies.models import PolicyBindingModel
@ -35,11 +38,16 @@ LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
 USER_ATTRIBUTE_SA = "goauthentik.io/user/service-account"
 USER_ATTRIBUTE_SOURCES = "goauthentik.io/user/sources"
 USER_ATTRIBUTE_TOKEN_EXPIRING = "goauthentik.io/user/token-expires"  # nosec
 USER_ATTRIBUTE_CAN_OVERRIDE_IP = "goauthentik.io/user/override-ips"
 GRAVATAR_URL = "https://secure.gravatar.com"
 DEFAULT_AVATAR = static("dist/assets/images/user_default.png")
 options.DEFAULT_NAMES = options.DEFAULT_NAMES + ("authentik_used_by_shadows",)
 def default_token_duration():
    """Default duration a Token is valid"""
    return now() + timedelta(minutes=30)
@ -47,7 +55,9 @@ def default_token_duration():
 def default_token_key():
    """Default token key"""
-    return uuid4().hex
+    # We use generate_id since the chars in the key should be easy
    # to use in Emails (for verification) and URLs (for recovery)
    return generate_id(128)
 class Group(models.Model):
@ -109,8 +119,8 @@ class User(GuardianUserMixin, AbstractUser):
        including the users attributes"""
        final_attributes = {}
        for group in self.ak_groups.all().order_by("name"):
-            final_attributes.update(group.attributes)
+            always_merger.merge(final_attributes, group.attributes)
-        final_attributes.update(self.attributes)
+        always_merger.merge(final_attributes, self.attributes)
        return final_attributes
    @cached_property
@ -137,21 +147,23 @@ class User(GuardianUserMixin, AbstractUser):
    @property
    def avatar(self) -> str:
        """Get avatar, depending on authentik.avatar setting"""
-        mode = CONFIG.raw.get("authentik").get("avatars")
+        mode: str = CONFIG.y("avatars", "none")
        if mode == "none":
            return DEFAULT_AVATAR
        # gravatar uses md5 for their URLs, so md5 can't be avoided
        mail_hash = md5(self.email.encode("utf-8")).hexdigest()  # nosec
        if mode == "gravatar":
            parameters = [
                ("s", "158"),
                ("r", "g"),
            ]
-            # gravatar uses md5 for their URLs, so md5 can't be avoided
+            gravatar_url = f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
            mail_hash = md5(self.email.encode("utf-8")).hexdigest()  # nosec
            gravatar_url = (
                f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
            )
            return escape(gravatar_url)
-        raise ValueError(f"Invalid avatar mode {mode}")
+        return mode % {
            "username": self.username,
            "mail_hash": mail_hash,
            "upn": self.attributes.get("upn", ""),
        }
    class Meta:
@ -175,9 +187,7 @@ class Provider(SerializerModel):
        related_name="provider_authorization",
    )
-    property_mappings = models.ManyToManyField(
+    property_mappings = models.ManyToManyField("PropertyMapping", default=None, blank=True)
        "PropertyMapping", default=None, blank=True
    )
    objects = InheritanceManager()
@ -207,19 +217,34 @@ class Application(PolicyBindingModel):
    add custom fields and other properties"""
    name = models.TextField(help_text=_("Application's display Name."))
-    slug = models.SlugField(
+    slug = models.SlugField(help_text=_("Internal application name, used in URLs."), unique=True)
        help_text=_("Internal application name, used in URLs."), unique=True
    )
    provider = models.OneToOneField(
        "Provider", null=True, blank=True, default=None, on_delete=models.SET_DEFAULT
    )
-    meta_launch_url = models.URLField(default="", blank=True)
+    meta_launch_url = models.TextField(
        default="", blank=True, validators=[validators.URLValidator()]
    )
    # For template applications, this can be set to /static/authentik/applications/*
-    meta_icon = models.FileField(upload_to="application-icons/", default="", blank=True)
+    meta_icon = models.FileField(
        upload_to="application-icons/",
        default=None,
        null=True,
        max_length=500,
    )
    meta_description = models.TextField(default="", blank=True)
    meta_publisher = models.TextField(default="", blank=True)
    @property
    def get_meta_icon(self) -> Optional[str]:
        """Get the URL to the App Icon image. If the name is /static or starts with http
        it is returned as-is"""
        if not self.meta_icon:
            return None
        if self.meta_icon.name.startswith("http") or self.meta_icon.name.startswith("/static"):
            return self.meta_icon.name
        return self.meta_icon.url
    def get_launch_url(self) -> Optional[str]:
        """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
        if self.meta_launch_url:
@ -271,14 +296,10 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
    """Base Authentication source, i.e. an OAuth Provider, SAML Remote or LDAP Server"""
    name = models.TextField(help_text=_("Source's display Name."))
-    slug = models.SlugField(
+    slug = models.SlugField(help_text=_("Internal source name, used in URLs."), unique=True)
        help_text=_("Internal source name, used in URLs."), unique=True
    )
    enabled = models.BooleanField(default=True)
-    property_mappings = models.ManyToManyField(
+    property_mappings = models.ManyToManyField("PropertyMapping", default=None, blank=True)
        "PropertyMapping", default=None, blank=True
    )
    authentication_flow = models.ForeignKey(
        Flow,
@ -324,9 +345,9 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
        return None
    @property
-    def ui_user_settings(self) -> Optional[Challenge]:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
        """Entrypoint to integrate with User settings. Can either return None if no
-        user settings are available, or a challenge."""
+        user settings are available, or UserSettingSerializer."""
        return None
    def __str__(self):
@ -352,6 +373,13 @@ class ExpiringModel(models.Model):
    expires = models.DateTimeField(default=default_token_duration)
    expiring = models.BooleanField(default=True)
    def expire_action(self, *args, **kwargs):
        """Handler which is called when this object is expired. By
        default the object is deleted. This is less efficient compared
        to bulk deleting objects, but classes like Token() need to change
        values instead of being deleted."""
        return self.delete(*args, **kwargs)
    @classmethod
    def filter_not_expired(cls, **kwargs) -> QuerySet:
        """Filer for tokens which are not expired yet or are not expiring,
@ -383,12 +411,15 @@ class TokenIntents(models.TextChoices):
    # Recovery use for the recovery app
    INTENT_RECOVERY = "recovery"
    # App-specific passwords
    INTENT_APP_PASSWORD = "app_password"  # nosec
 class Token(ManagedModel, ExpiringModel):
    """Token used to authenticate the User for API Access or confirm another Stage like Email."""
    token_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
-    identifier = models.SlugField(max_length=255)
+    identifier = models.SlugField(max_length=255, unique=True)
    key = models.TextField(default=default_token_key)
    intent = models.TextField(
        choices=TokenIntents.choices, default=TokenIntents.INTENT_VERIFICATION
@ -396,6 +427,19 @@ class Token(ManagedModel, ExpiringModel):
    user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
    description = models.TextField(default="", blank=True)
    def expire_action(self, *args, **kwargs):
        """Handler which is called when this object is expired."""
        from authentik.events.models import Event, EventAction
        self.key = default_token_key()
        self.expires = default_token_duration()
        self.save(*args, **kwargs)
        Event.new(
            action=EventAction.SECRET_ROTATE,
            token=self,
            message=f"Token {self.identifier}'s secret was rotated.",
        ).save()
    def __str__(self):
        description = f"{self.identifier}"
        if self.expiring:
@ -432,18 +476,16 @@ class PropertyMapping(SerializerModel, ManagedModel):
        """Get serializer for this model"""
        raise NotImplementedError
-    def evaluate(
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
    ) -> Any:
        """Evaluate `self.expression` using `**kwargs` as Context."""
        from authentik.core.expression import PropertyMappingEvaluator
        evaluator = PropertyMappingEvaluator()
-        evaluator.set_context(user, request, **kwargs)
+        evaluator.set_context(user, request, self, **kwargs)
        try:
            return evaluator.evaluate(self.expression)
-        except (ValueError, SyntaxError) as exc:
+        except Exception as exc:
-            raise PropertyMappingExpressionException from exc
+            raise PropertyMappingExpressionException(str(exc)) from exc
    def __str__(self):
        return f"Property Mapping {self.name}"
@ -452,3 +494,40 @@ class PropertyMapping(SerializerModel, ManagedModel):
        verbose_name = _("Property Mapping")
        verbose_name_plural = _("Property Mappings")
 class AuthenticatedSession(ExpiringModel):
    """Additional session class for authenticated users. Augments the standard django session
    to achieve the following:
        - Make it queryable by user
        - Have a direct connection to user objects
        - Allow users to view their own sessions and terminate them
        - Save structured and well-defined information.
    """
    uuid = models.UUIDField(default=uuid4, primary_key=True)
    session_key = models.CharField(max_length=40)
    user = models.ForeignKey(User, on_delete=models.CASCADE)
    last_ip = models.TextField()
    last_user_agent = models.TextField(blank=True)
    last_used = models.DateTimeField(auto_now=True)
    @staticmethod
    def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
        """Create a new session from a http request"""
        if not hasattr(request, "session") or not request.session.session_key:
            return None
        return AuthenticatedSession(
            session_key=request.session.session_key,
            user=user,
            last_ip=get_client_ip(request),
            last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
            expires=request.session.get_expiry_date(),
        )
    class Meta:
        verbose_name = _("Authenticated Session")
        verbose_name_plural = _("Authenticated Sessions")
--- a/authentik/core/signals.py
+++ b/authentik/core/signals.py
@ -1,20 +1,37 @@
 """authentik core signals"""
 from typing import TYPE_CHECKING, Type
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
 from django.core.signals import Signal
-from django.db.models.signals import post_save
+from django.db.models import Model
 from django.db.models.signals import post_save, pre_delete
 from django.dispatch import receiver
 from django.http.request import HttpRequest
 from prometheus_client import Gauge
 # Arguments: user: User, password: str
 password_changed = Signal()
 GAUGE_MODELS = Gauge("authentik_models", "Count of various objects", ["model_name", "app"])
 if TYPE_CHECKING:
    from authentik.core.models import AuthenticatedSession, User
@receiver(post_save)
 # pylint: disable=unused-argument
-def post_save_application(sender, instance, created: bool, **_):
+def post_save_application(sender: type[Model], instance, created: bool, **_):
    """Clear user's application cache upon application creation"""
    from authentik.core.api.applications import user_app_cache_key
    from authentik.core.models import Application
    GAUGE_MODELS.labels(
        model_name=sender._meta.model_name,
        app=sender._meta.app_label,
    ).set(sender.objects.count())
    if sender != Application:
        return
    if not created:  # pragma: no cover
@ -22,3 +39,35 @@ def post_save_application(sender, instance, created: bool, **_):
    # Also delete user application cache
    keys = cache.keys(user_app_cache_key("*"))
    cache.delete_many(keys)
@receiver(user_logged_in)
 # pylint: disable=unused-argument
 def user_logged_in_session(sender, request: HttpRequest, user: "User", **_):
    """Create an AuthenticatedSession from request"""
    from authentik.core.models import AuthenticatedSession
    session = AuthenticatedSession.from_request(request, user)
    if session:
        session.save()
@receiver(user_logged_out)
 # pylint: disable=unused-argument
 def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
    """Delete AuthenticatedSession if it exists"""
    from authentik.core.models import AuthenticatedSession
    AuthenticatedSession.objects.filter(session_key=request.session.session_key).delete()
@receiver(pre_delete)
 def authenticated_session_delete(sender: Type[Model], instance: "AuthenticatedSession", **_):
    """Delete session when authenticated session is deleted"""
    from authentik.core.models import AuthenticatedSession
    if sender != AuthenticatedSession:
        return
    cache_key = f"{KEY_PREFIX}{instance.session_key}"
    cache.delete(cache_key)
--- a/authentik/core/sources/flow_manager.py
+++ b/authentik/core/sources/flow_manager.py
@ -11,16 +11,8 @@ from django.urls import reverse
 from django.utils.translation import gettext as _
 from structlog.stdlib import get_logger
-from authentik.core.models import (
+from authentik.core.models import Source, SourceUserMatchingModes, User, UserSourceConnection
-    Source,
+from authentik.core.sources.stage import PLAN_CONTEXT_SOURCES_CONNECTION, PostUserEnrollmentStage
    SourceUserMatchingModes,
    User,
    UserSourceConnection,
 )
 from authentik.core.sources.stage import (
    PLAN_CONTEXT_SOURCES_CONNECTION,
    PostUserEnrollmentStage,
 )
 from authentik.events.models import Event, EventAction
 from authentik.flows.models import Flow, Stage, in_memory_stage
 from authentik.flows.planner import (
@ -33,6 +25,7 @@ from authentik.flows.planner import (
 from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_GET, SESSION_KEY_PLAN
 from authentik.lib.utils.urls import redirect_with_qs
 from authentik.policies.utils import delete_none_keys
 from authentik.stages.password import BACKEND_INBUILT
 from authentik.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
 from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT
@ -75,9 +68,7 @@ class SourceFlowManager:
    # pylint: disable=too-many-return-statements
    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
        """decide which action should be taken"""
-        new_connection = self.connection_type(
+        new_connection = self.connection_type(source=self.source, identifier=self.identifier)
            source=self.source, identifier=self.identifier
        )
        # When request is authenticated, always link
        if self.request.user.is_authenticated:
            new_connection.user = self.request.user
@ -112,9 +103,7 @@ class SourceFlowManager:
            SourceUserMatchingModes.USERNAME_DENY,
        ]:
            if not self.enroll_info.get("username", None):
-                self._logger.warning(
+                self._logger.warning("Refusing to use none username", source=self.source)
                    "Refusing to use none username", source=self.source
                )
                return Action.DENY, None
            query = Q(username__exact=self.enroll_info.get("username", None))
        self._logger.debug("trying to link with existing user", query=query)
@ -140,11 +129,11 @@ class SourceFlowManager:
            self._logger.info("denying source because user exists", user=user)
            return Action.DENY, None
        # Should never get here as default enroll case is returned above.
-        return Action.DENY, None
+        return Action.DENY, None  # pragma: no cover
    def update_connection(
        self, connection: UserSourceConnection, **kwargs
-    ) -> UserSourceConnection:
+    ) -> UserSourceConnection:  # pragma: no cover
        """Optionally make changes to the connection after it is looked up/created."""
        return connection
@ -177,11 +166,13 @@ class SourceFlowManager:
                % {"source": self.source.name}
            ),
        )
-        return redirect("/")
+        return redirect(reverse("authentik_core:root-redirect"))
    # pylint: disable=unused-argument
    def get_stages_to_append(self, flow: Flow) -> list[Stage]:
        """Hook to override stages which are appended to the flow"""
        if not self.source.enrollment_flow:
            return []
        if flow.slug == self.source.enrollment_flow.slug:
            return [
                in_memory_stage(PostUserEnrollmentStage),
@ -193,12 +184,12 @@ class SourceFlowManager:
        # Ensure redirect is carried through when user was trying to
        # authorize application
        final_redirect = self.request.session.get(SESSION_KEY_GET, {}).get(
-            NEXT_ARG_NAME, "authentik_core:if-admin"
+            NEXT_ARG_NAME, "authentik_core:if-user"
        )
        kwargs.update(
            {
                # Since we authenticate the user by their token, they have no backend set
-                PLAN_CONTEXT_AUTHENTICATION_BACKEND: "django.contrib.auth.backends.ModelBackend",
+                PLAN_CONTEXT_AUTHENTICATION_BACKEND: BACKEND_INBUILT,
                PLAN_CONTEXT_SSO: True,
                PLAN_CONTEXT_SOURCE: self.source,
                PLAN_CONTEXT_REDIRECT: final_redirect,
@ -210,7 +201,7 @@ class SourceFlowManager:
        planner = FlowPlanner(flow)
        plan = planner.plan(self.request, kwargs)
        for stage in self.get_stages_to_append(flow):
-            plan.append(stage)
+            plan.append_stage(stage=stage)
        self.request.session[SESSION_KEY_PLAN] = plan
        return redirect_with_qs(
            "authentik_core:if-flow",
@ -226,10 +217,7 @@ class SourceFlowManager:
        """Login user and redirect."""
        messages.success(
            self.request,
-            _(
+            _("Successfully authenticated with %(source)s!" % {"source": self.source.name}),
                "Successfully authenticated with %(source)s!"
                % {"source": self.source.name}
            ),
        )
        flow_kwargs = {PLAN_CONTEXT_PENDING_USER: connection.user}
        return self._handle_login_flow(self.source.authentication_flow, **flow_kwargs)
@ -255,9 +243,9 @@ class SourceFlowManager:
            return self.handle_auth_user(connection)
        return redirect(
            reverse(
-                "authentik_core:if-admin",
+                "authentik_core:if-user",
            )
-            + f"#/user;page-{self.source.slug}"
+            + f"#/settings;page-{self.source.slug}"
        )
    def handle_enroll(
@ -267,10 +255,7 @@ class SourceFlowManager:
        """User was not authenticated and previous request was not authenticated."""
        messages.success(
            self.request,
-            _(
+            _("Successfully authenticated with %(source)s!" % {"source": self.source.name}),
                "Successfully authenticated with %(source)s!"
                % {"source": self.source.name}
            ),
        )
        # We run the Flow planner here so we can pass the Pending user in the context
--- a/authentik/core/sources/stage.py
+++ b/authentik/core/sources/stage.py
@ -28,3 +28,7 @@ class PostUserEnrollmentStage(StageView):
            source=connection.source,
        ).from_http(self.request)
        return self.executor.stage_ok()
    def post(self, request: HttpRequest) -> HttpResponse:
        """Wrapper for post requests"""
        return self.get(request)
--- a/authentik/core/tasks.py
+++ b/authentik/core/tasks.py
@ -7,12 +7,14 @@ from boto3.exceptions import Boto3Error
 from botocore.exceptions import BotoCoreError, ClientError
 from dbbackup.db.exceptions import CommandConnectorError
 from django.contrib.humanize.templatetags.humanize import naturaltime
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core import management
 from django.core.cache import cache
 from django.utils.timezone import now
 from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from structlog.stdlib import get_logger
-from authentik.core.models import ExpiringModel
+from authentik.core.models import AuthenticatedSession, ExpiringModel
 from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.config import CONFIG
 from authentik.root.celery import CELERY_APP
@ -26,14 +28,24 @@ def clean_expired_models(self: MonitoredTask):
    messages = []
    for cls in ExpiringModel.__subclasses__():
        cls: ExpiringModel
-        amount, _ = (
+        objects = (
-            cls.objects.all()
+            cls.objects.all().exclude(expiring=False).exclude(expiring=True, expires__gt=now())
            .exclude(expiring=False)
            .exclude(expiring=True, expires__gt=now())
            .delete()
        )
-        LOGGER.debug("Deleted expired models", model=cls, amount=amount)
+        for obj in objects:
-        messages.append(f"Deleted {amount} expired {cls._meta.verbose_name_plural}")
+            obj.expire_action()
        amount = objects.count()
        LOGGER.debug("Expired models", model=cls, amount=amount)
        messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
    # Special case
    amount = 0
    for session in AuthenticatedSession.objects.all():
        cache_key = f"{KEY_PREFIX}{session.session_key}"
        value = cache.get(cache_key)
        if not value:
            session.delete()
            amount += 1
    LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
    messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
    self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL, messages))
--- a/authentik/core/templates/base/skeleton.html
+++ b/authentik/core/templates/base/skeleton.html
@ -7,18 +7,16 @@
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
-        <title>{% block title %}{% trans title|default:config.authentik.branding.title %}{% endblock %}</title>
+        <title>{% block title %}{% trans title|default:tenant.branding_title %}{% endblock %}</title>
-        <link rel="icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}">
-        <link rel="shortcut icon" type="image/png" href="{% static 'dist/assets/icons/icon.png' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-base.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly-base.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/page.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}">
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/empty-state.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}">
        <link rel="stylesheet" type="text/css" href="{% static 'dist/spinner.css' %}?v={{ ak_version }}">
        {% block head_before %}
        {% endblock %}
-        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}?v={{ ak_version }}">
+        <link rel="stylesheet" type="text/css" href="{% static 'dist/authentik.css' %}">
-        <script src="{% static 'dist/poly.js' %}?v={{ ak_version }}" type="module"></script>
+        <script src="{% static 'dist/poly.js' %}" type="module"></script>
        <script>window["polymerSkipLoadingFontRoboto"] = true;</script>
        {% block head %}
        {% endblock %}
    </head>
--- a/authentik/core/templates/if/admin.html
+++ b/authentik/core/templates/if/admin.html
@ -4,7 +4,7 @@
 {% load i18n %}
 {% block head %}
-<script src="{% static 'dist/AdminInterface.js' %}?v={{ ak_version }}" type="module"></script>
+<script src="{% static 'dist/AdminInterface.js' %}" type="module"></script>
 {% endblock %}
 {% block body %}
--- a/authentik/providers/oauth2/templates/providers/oauth2/end_session.html
+++ b/authentik/providers/oauth2/templates/providers/oauth2/end_session.html
@ -3,18 +3,8 @@
 {% load static %}
 {% load i18n %}
 {% block head %}
 {{ block.super }}
 <style>
 .pf-c-background-image::before {
    background-image: url("{% static 'dist/assets/images/flow_background.jpg' %}");
    background-position: center;
 }
 </style>
 {% endblock %}
 {% block title %}
-{% trans 'End session' %} - {{ config.authentik.branding.title }}
+{% trans 'End session' %} - {{ tenant.branding_title }}
 {% endblock %}
 {% block card_title %}
@ -31,7 +21,7 @@ You've logged out of {{ application }}.
        {% endblocktrans %}
    </p>
-    <a id="ak-back-home" href="{% url 'authentik_core:if-admin' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
+    <a id="ak-back-home" href="{% url 'authentik_core:root-redirect' %}" class="pf-c-button pf-m-primary">{% trans 'Go back to overview' %}</a>
    <a id="logout" href="{% url 'authentik_flows:default-invalidation' %}" class="pf-c-button pf-m-secondary">{% trans 'Log out of authentik' %}</a>
--- a/authentik/core/templates/if/flow.html
+++ b/authentik/core/templates/if/flow.html
@ -4,11 +4,19 @@
 {% load i18n %}
 {% block head_before %}
 {{ block.super }}
 {% if flow.compatibility_mode %}
 <script>ShadyDOM = { force: !navigator.webdriver };</script>
 {% endif %}
 {% endblock %}
 {% block head %}
-<script src="{% static 'dist/FlowInterface.js' %}?v={{ ak_version }}" type="module"></script>
+<script src="{% static 'dist/FlowInterface.js' %}" type="module"></script>
 <style>
 .pf-c-background-image::before {
    --ak-flow-background: url("{{ flow.background_url }}");
 }
 </style>
 {% endblock %}
 {% block body %}
--- a/authentik/core/templates/if/user.html
+++ b/authentik/core/templates/if/user.html
@ -0,0 +1,28 @@
 {% extends "base/skeleton.html" %}
 {% load static %}
 {% load i18n %}
 {% block head %}
 <script src="{% static 'dist/UserInterface.js' %}" type="module"></script>
 {% endblock %}
 {% block body %}
 <ak-message-container></ak-message-container>
 <ak-interface-user>
    <section class="ak-static-page pf-c-page__main-section pf-m-no-padding-mobile pf-m-xl">
        <div class="pf-c-empty-state" style="height: 100vh;">
            <div class="pf-c-empty-state__content">
                <span class="pf-c-spinner pf-m-xl pf-c-empty-state__icon" role="progressbar" aria-valuetext="{% trans 'Loading...' %}">
                    <span class="pf-c-spinner__clipper"></span>
                    <span class="pf-c-spinner__lead-ball"></span>
                    <span class="pf-c-spinner__tail-ball"></span>
                </span>
                <h1 class="pf-c-title pf-m-lg">
                    {% trans "Loading..." %}
                </h1>
            </div>
        </div>
    </section>
 </ak-interface-user>
 {% endblock %}
--- a/authentik/core/templates/login/base_full.html
+++ b/authentik/core/templates/login/base_full.html
@ -4,7 +4,15 @@
 {% load i18n %}
 {% block head_before %}
-<link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}?v={{ ak_version }}">
+<link rel="stylesheet" type="text/css" href="{% static 'dist/patternfly.min.css' %}">
 {% endblock %}
 {% block head %}
 <style>
 .pf-c-background-image::before {
    --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
 }
 </style>
 {% endblock %}
 {% block body %}
@ -26,10 +34,7 @@
    <div class="ak-login-container">
        <header class="pf-c-login__header">
            <div class="pf-c-brand ak-brand">
-                <img src="{{ config.authentik.branding.logo }}" alt="authentik icon" />
+                <img src="{{ tenant.branding_logo }}" alt="authentik icon" />
                {% if config.authentik.branding.title_show %}
                <p>{{ config.authentik.branding.title }}</p>
                {% endif %}
            </div>
        </header>
        {% block main_container %}
@ -49,12 +54,12 @@
        <footer class="pf-c-login__footer">
            <p></p>
            <ul class="pf-c-list pf-m-inline">
-                {% for link in config.authentik.footer_links %}
+                {% for link in footer_links %}
                <li>
                    <a href="{{ link.href }}">{{ link.name }}</a>
                </li>
                {% endfor %}
-                {% if config.authentik.branding.title != "authentik" %}
+                {% if tenant.branding_title != "authentik" %}
                <li>
                    <a href="https://goauthentik.io">
                        {% trans 'Powered by authentik' %}
--- a/authentik/core/tests/test_applications_api.py
+++ b/authentik/core/tests/test_applications_api.py
@ -17,9 +17,7 @@ class TestApplicationsAPI(APITestCase):
        self.denied = Application.objects.create(name="denied", slug="denied")
        PolicyBinding.objects.create(
            target=self.denied,
-            policy=DummyPolicy.objects.create(
+            policy=DummyPolicy.objects.create(name="deny", result=False, wait_min=1, wait_max=2),
                name="deny", result=False, wait_min=1, wait_max=2
            ),
            order=0,
        )
@ -32,14 +30,16 @@ class TestApplicationsAPI(APITestCase):
                kwargs={"slug": self.allowed.slug},
            )
        )
-        self.assertEqual(response.status_code, 204)
+        self.assertEqual(response.status_code, 200)
        self.assertJSONEqual(force_str(response.content), {"messages": [], "passing": True})
        response = self.client.get(
            reverse(
                "authentik_api:application-check-access",
                kwargs={"slug": self.denied.slug},
            )
        )
-        self.assertEqual(response.status_code, 403)
+        self.assertEqual(response.status_code, 200)
        self.assertJSONEqual(force_str(response.content), {"messages": ["dummy"], "passing": False})
    def test_list(self):
        """Test list operation without superuser_full_list"""
--- a/authentik/core/tests/test_authenticated_sessions_api.py
+++ b/authentik/core/tests/test_authenticated_sessions_api.py
@ -0,0 +1,31 @@
 """Test AuthenticatedSessions API"""
 from json import loads
 from django.urls.base import reverse
 from django.utils.encoding import force_str
 from rest_framework.test import APITestCase
 from authentik.core.models import User
 class TestAuthenticatedSessionsAPI(APITestCase):
    """Test AuthenticatedSessions API"""
    def setUp(self) -> None:
        super().setUp()
        self.user = User.objects.get(username="akadmin")
        self.other_user = User.objects.create(username="normal-user")
    def test_list(self):
        """Test session list endpoint"""
        self.client.force_login(self.user)
        response = self.client.get(reverse("authentik_api:authenticatedsession-list"))
        self.assertEqual(response.status_code, 200)
    def test_non_admin_list(self):
        """Test non-admin list"""
        self.client.force_login(self.other_user)
        response = self.client.get(reverse("authentik_api:authenticatedsession-list"))
        self.assertEqual(response.status_code, 200)
        body = loads(force_str(response.content))
        self.assertEqual(body["pagination"]["count"], 1)
--- a/authentik/core/tests/test_impersonation.py
+++ b/authentik/core/tests/test_impersonation.py
@ -17,6 +17,9 @@ class TestImpersonation(TestCase):
    def test_impersonate_simple(self):
        """test simple impersonation and un-impersonation"""
        # test with an inactive user to ensure that still works
        self.other_user.is_active = False
        self.other_user.save()
        self.client.force_login(self.akadmin)
        self.client.get(
@ -43,9 +46,7 @@ class TestImpersonation(TestCase):
        self.client.force_login(self.other_user)
        self.client.get(
-            reverse(
+            reverse("authentik_core:impersonate-init", kwargs={"user_id": self.akadmin.pk})
                "authentik_core:impersonate-init", kwargs={"user_id": self.akadmin.pk}
            )
        )
        response = self.client.get(reverse("authentik_api:user-me"))
@ -57,4 +58,4 @@ class TestImpersonation(TestCase):
        self.client.force_login(self.other_user)
        response = self.client.get(reverse("authentik_core:impersonate-end"))
-        self.assertRedirects(response, reverse("authentik_core:if-admin"))
+        self.assertRedirects(response, reverse("authentik_core:if-user"))
--- a/authentik/core/tests/test_models.py
+++ b/authentik/core/tests/test_models.py
@ -22,9 +22,7 @@ class TestModels(TestCase):
    def test_token_expire_no_expire(self):
        """Test token expiring with "expiring" set"""
-        token = Token.objects.create(
+        token = Token.objects.create(expires=now(), user=get_anonymous_user(), expiring=False)
            expires=now(), user=get_anonymous_user(), expiring=False
        )
        sleep(0.5)
        self.assertFalse(token.is_expired)
--- a/authentik/core/tests/test_property_mapping.py
+++ b/authentik/core/tests/test_property_mapping.py
@ -16,9 +16,7 @@ class TestPropertyMappings(TestCase):
    def test_expression(self):
        """Test expression"""
-        mapping = PropertyMapping.objects.create(
+        mapping = PropertyMapping.objects.create(name="test", expression="return 'test'")
            name="test", expression="return 'test'"
        )
        self.assertEqual(mapping.evaluate(None, None), "test")
    def test_expression_syntax(self):
@ -31,7 +29,7 @@ class TestPropertyMappings(TestCase):
        """Test expression error"""
        expr = "return aaa"
        mapping = PropertyMapping.objects.create(name="test", expression=expr)
-        with self.assertRaises(NameError):
+        with self.assertRaises(PropertyMappingExpressionException):
            mapping.evaluate(None, None)
        events = Event.objects.filter(
            action=EventAction.PROPERTY_MAPPING_EXCEPTION, context__expression=expr
@ -44,7 +42,7 @@ class TestPropertyMappings(TestCase):
        expr = "return aaa"
        request = self.factory.get("/")
        mapping = PropertyMapping.objects.create(name="test", expression=expr)
-        with self.assertRaises(NameError):
+        with self.assertRaises(PropertyMappingExpressionException):
            mapping.evaluate(get_anonymous_user(), request)
        events = Event.objects.filter(
            action=EventAction.PROPERTY_MAPPING_EXCEPTION, context__expression=expr
--- a/Show More
+++ b/Show More