core: fix token expiration not being updated upon key rotation

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
core: fix expired tokens not being returned by API
2021-08-12 17:24:19 +02:00 · 2021-08-12 17:24:19 +02:00
697 changed files with 15444 additions and 24193 deletions
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2021.8.1
+current_version = 2021.7.3
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@ -1,60 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master, '*', next, version* ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ master ]
-  schedule:
-    - cron: '30 6 * * 5'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'go', 'javascript', 'python' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -33,14 +33,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik:2021.8.1,
+            beryju/authentik:2021.7.3,
            beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2021.8.1,
+            ghcr.io/goauthentik/server:2021.7.3,
            ghcr.io/goauthentik/server:latest
          platforms: linux/amd64,linux/arm64
          context: .
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.8.1', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
        run: |
          docker pull beryju/authentik:latest
          docker tag beryju/authentik:latest beryju/authentik:stable
@ -75,14 +75,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-proxy:2021.8.1,
+            beryju/authentik-proxy:2021.7.3,
            beryju/authentik-proxy:latest,
-            ghcr.io/goauthentik/proxy:2021.8.1,
+            ghcr.io/goauthentik/proxy:2021.7.3,
            ghcr.io/goauthentik/proxy:latest
          file: proxy.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.8.1', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
        run: |
          docker pull beryju/authentik-proxy:latest
          docker tag beryju/authentik-proxy:latest beryju/authentik-proxy:stable
@ -117,14 +117,14 @@ jobs:
        with:
          push: ${{ github.event_name == 'release' }}
          tags: |
-            beryju/authentik-ldap:2021.8.1,
+            beryju/authentik-ldap:2021.7.3,
            beryju/authentik-ldap:latest,
-            ghcr.io/goauthentik/ldap:2021.8.1,
+            ghcr.io/goauthentik/ldap:2021.7.3,
            ghcr.io/goauthentik/ldap:latest
          file: ldap.Dockerfile
          platforms: linux/amd64,linux/arm64
      - name: Building Docker Image (stable)
-        if: ${{ github.event_name == 'release' && !contains('2021.8.1', 'rc') }}
+        if: ${{ github.event_name == 'release' && !contains('2021.7.3', 'rc') }}
        run: |
          docker pull beryju/authentik-ldap:latest
          docker tag beryju/authentik-ldap:latest beryju/authentik-ldap:stable
@ -157,12 +157,13 @@ jobs:
    steps:
      - uses: actions/checkout@v2
      - name: Setup Node.js environment
-        uses: actions/setup-node@v2.4.0
+        uses: actions/setup-node@v2.3.0
        with:
          node-version: 12.x
      - name: Build web api client and web ui
        run: |
          export NODE_ENV=production
+          make gen-web
          cd web
          npm i
          npm run build
@ -175,7 +176,7 @@ jobs:
          SENTRY_PROJECT: authentik
          SENTRY_URL: https://sentry.beryju.org
        with:
-          version: authentik@2021.8.1
+          version: authentik@2021.7.3
          environment: beryjuorg-prod
          sourcemaps: './web/dist'
          url_prefix: '~/static/dist'
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@ -27,7 +27,7 @@ jobs:
          docker-compose run -u root server test
      - name: Extract version number
        id: get_version
-        uses: actions/github-script@v4.1
+        uses: actions/github-script@v4.0.2
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
--- a/.github/workflows/web-api-publish.yml
+++ b/.github/workflows/web-api-publish.yml
@ -1,39 +0,0 @@
-name: authentik-web-api-publish
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'schema.yml'
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v2
-        with:
-          node-version: '16.x'
-          registry-url: 'https://registry.npmjs.org'
-      - name: Generate API Client
-        run: make gen-web
-      - name: Publish package
-        run: |
-          cd web-api/
-          npm i
-          npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-      - name: Upgrade /web
-        run: |
-          cd web/
-          export VERSION=`node -e 'console.log(require("../web-api/package.json").version)'`
-          npm i @goauthentik/api@$VERSION
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v3
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: update-web-api-client
-          commit-message: "web: Update Web API Client version"
-          title: "web: Update Web API Client version"
-          delete-branch: true
-          signoff: true
--- a/.gitignore
+++ b/.gitignore
@ -201,4 +201,3 @@ media/

 .idea/
 /api/
-/web-api/
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -1,22 +0,0 @@
-{
-    "cSpell.words": [
-        "asgi",
-        "authentik",
-        "authn",
-        "goauthentik",
-        "jwks",
-        "oidc",
-        "openid",
-        "plex",
-        "saml",
-        "totp",
-        "webauthn"
-    ],
-    "python.linting.pylintEnabled": true,
-    "todo-tree.tree.showCountsInTree": true,
-    "todo-tree.tree.showBadges": true,
-    "python.formatting.provider": "black",
-    "files.associations": {
-        "*.akflow": "json"
-    }
-}
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -11,8 +11,8 @@ The following is a set of guidelines for contributing to authentik and its compo
 [I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)

 [What should I know before I get started?](#what-should-i-know-before-i-get-started)
-  * [The components](#the-components)
-  * [authentik's structure](#authentiks-structure)
+  * [Atom and Packages](#atom-and-packages)
+  * [Atom Design Decisions](#design-decisions)

 [How Can I Contribute?](#how-can-i-contribute)
  * [Reporting Bugs](#reporting-bugs)
@ -22,9 +22,14 @@ The following is a set of guidelines for contributing to authentik and its compo

 [Styleguides](#styleguides)
  * [Git Commit Messages](#git-commit-messages)
-  * [Python Styleguide](#python-styleguide)
+  * [JavaScript Styleguide](#javascript-styleguide)
+  * [CoffeeScript Styleguide](#coffeescript-styleguide)
+  * [Specs Styleguide](#specs-styleguide)
  * [Documentation Styleguide](#documentation-styleguide)

+[Additional Notes](#additional-notes)
+  * [Issue and Pull Request Labels](#issue-and-pull-request-labels)
+
 ## Code of Conduct

 Basically, don't be a dickhead. This is an open-source non-profit project, that is made in the free time of Volunteers. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.
--- a/17
+++ b/17
@ -18,6 +18,17 @@ COPY ./website /static/
 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build-docs-only

+# Stage 3: Build web API
+FROM openapitools/openapi-generator-cli as web-api-builder
+
+COPY ./schema.yml /local/schema.yml
+
+RUN	docker-entrypoint.sh generate \
+    -i /local/schema.yml \
+    -g typescript-fetch \
+    -o /local/web/api \
+    --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+
 # Stage 3: Generate API Client
 FROM openapitools/openapi-generator-cli as go-api-builder

@ -37,12 +48,13 @@ RUN	docker-entrypoint.sh generate \
 FROM node as web-builder

 COPY ./web /static/
+COPY --from=web-api-builder /local/web/api /static/api

 ENV NODE_ENV=production
 RUN cd /static && npm i && npm run build

 # Stage 5: Build go proxy
-FROM golang:1.17.0 AS builder
+FROM golang:1.16.6 AS builder

 WORKDIR /work

@ -98,5 +110,4 @@ COPY --from=builder /work/authentik /authentik-proxy
 USER authentik
 ENV TMPDIR /dev/shm/
 ENV PYTHONUBUFFERED 1
-ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
-ENTRYPOINT [ "/lifecycle/ak" ]
+ENTRYPOINT [ "/lifecycle/bootstrap.sh" ]
--- a/11
+++ b/11
@ -2,7 +2,6 @@
 PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
-NPM_VERSION = $(shell python -m scripts.npm_version)

 all: lint-fix lint test gen

@ -42,13 +41,9 @@ gen-web:
 		openapitools/openapi-generator-cli generate \
 		-i /local/schema.yml \
 		-g typescript-fetch \
-		-o /local/web-api \
-		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=@goauthentik/api,npmVersion=${NPM_VERSION}
-	mkdir -p web/node_modules/@goauthentik/api
-	python -m scripts.web_api_esm
-	\cp -fv scripts/web_api_readme.md web-api/README.md
-	cd web-api && npm i
-	\cp -rfv web-api/* web/node_modules/@goauthentik/api
+		-o /local/web/api \
+		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+	cd web/api && npx tsc

 gen-outpost:
 	docker run \
--- a/2
+++ b/2
@ -39,7 +39,7 @@ sentry-sdk = "*"
 service_identity = "*"
 structlog = "*"
 swagger-spec-validator = "*"
-twisted = "==21.7.0"
+twisted = "==20.3.0"
 urllib3 = {extras = ["secure"],version = "*"}
 uvicorn = {extras = ["standard"],version = "*"}
 webauthn = "*"
--- a/Pipfile.lock
+++ b/Pipfile.lock
@ -1,7 +1,7 @@
 {
    "_meta": {
        "hash": {
-            "sha256": "f0befa9b3dacc1c3363b9442fa7a43f6be2c46a8fcb80a994230d288a384e54d"
+            "sha256": "e4f2e57bd5c709809515ab2b95eb3f5fa337d4a9334f4110a24bf28c3f9d5f8f"
        },
        "pipfile-spec": 6,
        "requires": {
@ -122,19 +122,19 @@
        },
        "boto3": {
            "hashes": [
-                "sha256:4dc7e346e92c01e8a997daa58a4c990151841d2d2962067325d963f665c7287a",
-                "sha256:79b7e6e0167def749352968ed6eb96954d9e2dd1dca8f297f122414753ce73a3"
+                "sha256:a012570d3535ec6c4db97e60ef51c2f39f38246429e1455cecc26c633ed81c10",
+                "sha256:c7f45b0417395d3020c98cdc10f942939883018210e29dbfe6fbfc0a74e503ec"
            ],
            "index": "pypi",
-            "version": "==1.18.29"
+            "version": "==1.18.7"
        },
        "botocore": {
            "hashes": [
-                "sha256:1f16998b4f5a88e6844196feee7fa5eef6b36034d377f9845c7df12b8803b3be",
-                "sha256:fec924f63b40bd29b522fa109ecbc45f16eedcbeb22b68c6c79773c22a552b16"
+                "sha256:34c8b151a25616ed7791218f6d7780c3a97725fe3ceeaa28085b345a8513af6e",
+                "sha256:dcf399d21170bb899e00d2a693bddcc79e61471fbfead8500a65578700a3190a"
            ],
            "markers": "python_version >= '3.6'",
-            "version": "==1.21.29"
+            "version": "==1.21.7"
        },
        "cachetools": {
            "hashes": [
@ -254,11 +254,11 @@
        },
        "charset-normalizer": {
            "hashes": [
-                "sha256:0c8911edd15d19223366a194a513099a302055a962bca2cec0f54b8b63175d8b",
-                "sha256:f23667ebe1084be45f6ae0538e4a5a865206544097e4e8bbcacf42cd02a348f3"
+                "sha256:88fce3fa5b1a84fdcb3f603d889f723d1dd89b26059d0123ca435570e848d5e1",
+                "sha256:c46c3ace2d744cfbdebceaa3c19ae691f53ae621b39fd7570f59d14fb7f2fd12"
            ],
            "markers": "python_version >= '3'",
-            "version": "==2.0.4"
+            "version": "==2.0.3"
        },
        "click": {
            "hashes": [
@ -305,25 +305,20 @@
        },
        "cryptography": {
            "hashes": [
-                "sha256:0a7dcbcd3f1913f664aca35d47c1331fce738d44ec34b7be8b9d332151b0b01e",
-                "sha256:1eb7bb0df6f6f583dd8e054689def236255161ebbcf62b226454ab9ec663746b",
-                "sha256:21ca464b3a4b8d8e86ba0ee5045e103a1fcfac3b39319727bc0fc58c09c6aff7",
-                "sha256:34dae04a0dce5730d8eb7894eab617d8a70d0c97da76b905de9efb7128ad7085",
-                "sha256:3520667fda779eb788ea00080124875be18f2d8f0848ec00733c0ec3bb8219fc",
-                "sha256:3fa3a7ccf96e826affdf1a0a9432be74dc73423125c8f96a909e3835a5ef194a",
-                "sha256:5b0fbfae7ff7febdb74b574055c7466da334a5371f253732d7e2e7525d570498",
-                "sha256:8695456444f277af73a4877db9fc979849cd3ee74c198d04fc0776ebc3db52b9",
-                "sha256:94cc5ed4ceaefcbe5bf38c8fba6a21fc1d365bb8fb826ea1688e3370b2e24a1c",
-                "sha256:94fff993ee9bc1b2440d3b7243d488c6a3d9724cc2b09cdb297f6a886d040ef7",
-                "sha256:9965c46c674ba8cc572bc09a03f4c649292ee73e1b683adb1ce81e82e9a6a0fb",
-                "sha256:a00cf305f07b26c351d8d4e1af84ad7501eca8a342dedf24a7acb0e7b7406e14",
-                "sha256:a305600e7a6b7b855cd798e00278161b681ad6e9b7eca94c721d5f588ab212af",
-                "sha256:cd65b60cfe004790c795cc35f272e41a3df4631e2fb6b35aa7ac6ef2859d554e",
-                "sha256:d2a6e5ef66503da51d2110edf6c403dc6b494cc0082f85db12f54e9c5d4c3ec5",
-                "sha256:d9ec0e67a14f9d1d48dd87a2531009a9b251c02ea42851c060b25c782516ff06",
-                "sha256:f44d141b8c4ea5eb4dbc9b3ad992d45580c1d22bf5e24363f2fbf50c2d7ae8a7"
+                "sha256:0f1212a66329c80d68aeeb39b8a16d54ef57071bf22ff4e521657b27372e327d",
+                "sha256:1e056c28420c072c5e3cb36e2b23ee55e260cb04eee08f702e0edfec3fb51959",
+                "sha256:240f5c21aef0b73f40bb9f78d2caff73186700bf1bc6b94285699aff98cc16c6",
+                "sha256:26965837447f9c82f1855e0bc8bc4fb910240b6e0d16a664bb722df3b5b06873",
+                "sha256:37340614f8a5d2fb9aeea67fd159bfe4f5f4ed535b1090ce8ec428b2f15a11f2",
+                "sha256:3d10de8116d25649631977cb37da6cbdd2d6fa0e0281d014a5b7d337255ca713",
+                "sha256:3d8427734c781ea5f1b41d6589c293089704d4759e34597dce91014ac125aad1",
+                "sha256:7ec5d3b029f5fa2b179325908b9cd93db28ab7b85bb6c1db56b10e0b54235177",
+                "sha256:8e56e16617872b0957d1c9742a3f94b43533447fd78321514abbe7db216aa250",
+                "sha256:de4e5f7f68220d92b7637fc99847475b59154b7a1b3868fb7385337af54ac9ca",
+                "sha256:eb8cc2afe8b05acbd84a43905832ec78e7b3873fb124ca190f574dca7389a87d",
+                "sha256:ee77aa129f481be46f8d92a1a7db57269a2f23052d5f2433b4621bb457081cc9"
            ],
-            "version": "==3.4.8"
+            "version": "==3.4.7"
        },
        "dacite": {
            "hashes": [
@ -359,11 +354,11 @@
        },
        "django": {
            "hashes": [
-                "sha256:7f92413529aa0e291f3be78ab19be31aefb1e1c9a52cd59e130f505f27a51f13",
-                "sha256:f27f8544c9d4c383bbe007c57e3235918e258364577373d4920e9162837be022"
+                "sha256:3da05fea54fdec2315b54a563d5b59f3b4e2b1e69c3a5841dda35019c01855cd",
+                "sha256:c58b5f19c5ae0afe6d75cbdd7df561e6eb929339985dbbda2565e1cabb19a62e"
            ],
            "index": "pypi",
-            "version": "==3.2.6"
+            "version": "==3.2.5"
        },
        "django-dbbackup": {
            "git": "https://github.com/django-dbbackup/django-dbbackup.git",
@ -451,11 +446,11 @@
        },
        "drf-spectacular": {
            "hashes": [
-                "sha256:5b1c27de127c86564be5a967a6fa195cfe161b552d98364282ae9e6ed3d75a85",
-                "sha256:8588706c27f44adfbb3405bae9ef9cd6506f4b59d4cbd66c59780dce035602d9"
+                "sha256:f080128c42183fcaed6b9e8e5afcd2e5cd68426b1f80bfc85938f25e62db7fe5",
+                "sha256:fb19aa69fcfcd37b0c9dfb9989c0671e1bb47af332ca2171378c7f840263788c"
            ],
            "index": "pypi",
-            "version": "==0.18.0"
+            "version": "==0.17.3"
        },
        "duo-client": {
            "hashes": [
@ -490,11 +485,11 @@
        },
        "google-auth": {
            "hashes": [
-                "sha256:c012c8be7c442c8309ca8fa0876fef33f5fd977c467be1e1c1c2f721e8ebd73c",
-                "sha256:ea1af050b3e06eb73e4470f704d23007307bc0e87c13e015f6b90460f1407bd3"
+                "sha256:036dd68c1e8baa422b6b61619b8e02793da2e20f55e69514612de6c080468755",
+                "sha256:7665c04f2df13cc938dc7d9066cddb1f8af62b038bc8b2306848c1b23121865f"
            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==2.0.1"
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
+            "version": "==1.33.1"
        },
        "gunicorn": {
            "hashes": [
@ -633,11 +628,11 @@
        },
        "kubernetes": {
            "hashes": [
-                "sha256:0c72d00e7883375bd39ae99758425f5e6cb86388417cf7cc84305c211b2192cf",
-                "sha256:ff31ec17437293e7d4e1459f1228c42d27c7724dfb56b4868aba7a901a5b72c9"
+                "sha256:225a95a0aadbd5b645ab389d941a7980db8cdad2a776fde64d1b43fc3299bde9",
+                "sha256:c69b318696ba797dcf63eb928a8d4370c52319f4140023c502d7dfdf2080eb79"
            ],
            "index": "pypi",
-            "version": "==18.20.0"
+            "version": "==17.17.0"
        },
        "ldap3": {
            "hashes": [
@ -671,7 +666,6 @@
                "sha256:542d454665a3e277f76954418124d67516c5f88e51a900365ed54a9806122b83",
                "sha256:5a0a14e264069c03e46f926be0d8919f4105c1623d620e7ec0e612a2e9bf1c04",
                "sha256:5c8c163396cc0df3fd151b927e74f6e4acd67160d6c33304e805b84293351d16",
-                "sha256:64812391546a18896adaa86c77c59a4998f33c24788cadc35789e55b727a37f4",
                "sha256:66e575c62792c3f9ca47cb8b6fab9e35bab91360c783d1606f758761810c9791",
                "sha256:6f12e1427285008fd32a6025e38e977d44d6382cf28e7201ed10d6c1698d2a9a",
                "sha256:74f7d8d439b18fa4c385f3f5dfd11144bb87c1da034a466c5b5577d23a1d9b51",
@ -686,7 +680,6 @@
                "sha256:b007cbb845b28db4fb8b6a5cdcbf65bacb16a8bd328b53cbc0698688a68e1caa",
                "sha256:bc4313cbeb0e7a416a488d72f9680fffffc645f8a838bd2193809881c67dd106",
                "sha256:bccbfc27563652de7dc9bdc595cb25e90b59c5f8e23e806ed0fd623755b6565d",
-                "sha256:c1a40c06fd5ba37ad39caa0b3144eb3772e813b5fb5b084198a985431c2f1e8d",
                "sha256:c47ff7e0a36d4efac9fd692cfa33fbd0636674c102e9e8d9b26e1b93a94e7617",
                "sha256:c4f05c5a7c49d2fb70223d0d5bcfbe474cf928310ac9fa6a7c6dddc831d0b1d4",
                "sha256:cdaf11d2bd275bf391b5308f86731e5194a21af45fbaaaf1d9e8147b9160ea92",
@ -813,11 +806,11 @@
        },
        "prompt-toolkit": {
            "hashes": [
-                "sha256:6076e46efae19b1e0ca1ec003ed37a933dc94b4d20f486235d436e64771dcd5c",
-                "sha256:eb71d5a6b72ce6db177af4a7d4d7085b99756bf656d98ffcc4fecd36850eea6c"
+                "sha256:08360ee3a3148bdb5163621709ee322ec34fc4375099afa4bbf751e9b7b7fa4f",
+                "sha256:7089d8d2938043508aa9420ec18ce0922885304cddae87fb96eebca942299f88"
            ],
-            "markers": "python_full_version >= '3.6.2'",
-            "version": "==3.0.20"
+            "markers": "python_full_version >= '3.6.1'",
+            "version": "==3.0.19"
        },
        "psycopg2-binary": {
            "hashes": [
@ -934,6 +927,14 @@
            "index": "pypi",
            "version": "==3.10.1"
        },
+        "pyhamcrest": {
+            "hashes": [
+                "sha256:412e00137858f04bde0729913874a48485665f2d36fe9ee449f26be864af9316",
+                "sha256:7ead136e03655af85069b6f47b23eb7c3e5c221aa9f022a4fbb499f5b7308f29"
+            ],
+            "markers": "python_version >= '3.5'",
+            "version": "==2.0.2"
+        },
        "pyjwt": {
            "hashes": [
                "sha256:934d73fbba91b0483d3857d1aff50e96b2a892384ee2c17417ed3203f173fca1",
@ -1071,7 +1072,7 @@
                "sha256:78f9a9bf4e7be0c5ded4583326e7461e3a3c5aae24073648b4bdfa797d78c9d2",
                "sha256:9d689e6ca1b3038bc82bf8d23e944b6b6037bc02301a574935b2dd946e0353b9"
            ],
-            "markers": "python_version >= '3.5' and python_version < '4'",
+            "markers": "python_version >= '3.6'",
            "version": "==4.7.2"
        },
        "s3transfer": {
@ -1084,11 +1085,11 @@
        },
        "sentry-sdk": {
            "hashes": [
-                "sha256:ebe99144fa9618d4b0e7617e7929b75acd905d258c3c779edcd34c0adfffe26c",
-                "sha256:f33d34c886d0ba24c75ea8885a8b3a172358853c7cbde05979fc99c29ef7bc52"
+                "sha256:5210a712dd57d88d225c1fc3fe3a3626fee493637bcd54e204826cf04b8d769c",
+                "sha256:6864dcb6f7dec692635e5518c2a5c80010adf673c70340817f1a1b713d65bb41"
            ],
            "index": "pypi",
-            "version": "==1.3.1"
+            "version": "==1.3.0"
        },
        "service-identity": {
            "hashes": [
@ -1135,11 +1136,32 @@
                "tls"
            ],
            "hashes": [
-                "sha256:13c1d1d2421ae556d91e81e66cf0d4f4e4e1e4a36a0486933bee4305c6a4fb9b",
-                "sha256:2cd652542463277378b0d349f47c62f20d9306e57d1247baabd6d1d38a109006"
+                "sha256:040eb6641125d2a9a09cf198ec7b83dd8858c6f51f6770325ed9959c00f5098f",
+                "sha256:147780b8caf21ba2aef3688628eaf13d7e7fe02a86747cd54bfaf2140538f042",
+                "sha256:158ddb80719a4813d292293ac44ba41d8b56555ed009d90994a278237ee63d2c",
+                "sha256:2182000d6ffc05d269e6c03bfcec8b57e20259ca1086180edaedec3f1e689292",
+                "sha256:25ffcf37944bdad4a99981bc74006d735a678d2b5c193781254fbbb6d69e3b22",
+                "sha256:3281d9ce889f7b21bdb73658e887141aa45a102baf3b2320eafcfba954fcefec",
+                "sha256:356e8d8dd3590e790e3dba4db139eb8a17aca64b46629c622e1b1597a4a92478",
+                "sha256:70952c56e4965b9f53b180daecf20a9595cf22b8d0935cd3bd664c90273c3ab2",
+                "sha256:7408c6635ee1b96587289283ebe90ee15dbf9614b05857b446055116bc822d29",
+                "sha256:7c547fd0215db9da8a1bc23182b309e84a232364cc26d829e9ee196ce840b114",
+                "sha256:894f6f3cfa57a15ea0d0714e4283913a5f2511dbd18653dd148eba53b3919797",
+                "sha256:94ac3d55a58c90e2075c5fe1853f2aa3892b73e3bf56395f743aefde8605eeaa",
+                "sha256:a58e61a2a01e5bcbe3b575c0099a2bcb8d70a75b1a087338e0c48dd6e01a5f15",
+                "sha256:c09c47ff9750a8e3aa60ad169c4b95006d455a29b80ad0901f031a103b2991cd",
+                "sha256:ca3a0b8c9110800e576d89b5337373e52018b41069bc879f12fa42b7eb2d0274",
+                "sha256:cd1dc5c85b58494138a3917752b54bb1daa0045d234b7c132c37a61d5483ebad",
+                "sha256:cdbc4c7f0cd7a2218b575844e970f05a1be1861c607b0e048c9bceca0c4d42f7",
+                "sha256:d267125cc0f1e8a0eed6319ba4ac7477da9b78a535601c49ecd20c875576433a",
+                "sha256:d72c55b5d56e176563b91d11952d13b01af8725c623e498db5507b6614fc1e10",
+                "sha256:d95803193561a243cb0401b0567c6b7987d3f2a67046770e1dccd1c9e49a9780",
+                "sha256:e92703bed0cc21d6cb5c61d66922b3b1564015ca8a51325bd164a5e33798d504",
+                "sha256:f058bd0168271de4dcdc39845b52dd0a4a2fecf5f1246335f13f5e96eaebb467",
+                "sha256:f3c19e5bd42bbe4bf345704ad7c326c74d3fd7a1b3844987853bef180be638d4"
            ],
            "index": "pypi",
-            "version": "==21.7.0"
+            "version": "==20.3.0"
        },
        "txaio": {
            "hashes": [
@ -1189,32 +1211,26 @@
                "standard"
            ],
            "hashes": [
-                "sha256:17f898c64c71a2640514d4089da2689e5db1ce5d4086c2d53699bf99513421c1",
-                "sha256:d9a3c0dd1ca86728d3e235182683b4cf94cd53a867c288eaeca80ee781b2caff"
+                "sha256:2a76bb359171a504b3d1c853409af3adbfa5cef374a4a59e5881945a97a93eae",
+                "sha256:45ad7dfaaa7d55cab4cd1e85e03f27e9d60bc067ddc59db52a2b0aeca8870292"
            ],
            "index": "pypi",
-            "version": "==0.15.0"
+            "version": "==0.14.0"
        },
        "uvloop": {
            "hashes": [
-                "sha256:04ff57aa137230d8cc968f03481176041ae789308b4d5079118331ab01112450",
-                "sha256:089b4834fd299d82d83a25e3335372f12117a7d38525217c2258e9b9f4578897",
-                "sha256:1e5f2e2ff51aefe6c19ee98af12b4ae61f5be456cd24396953244a30880ad861",
-                "sha256:30ba9dcbd0965f5c812b7c2112a1ddf60cf904c1c160f398e7eed3a6b82dcd9c",
-                "sha256:3a19828c4f15687675ea912cc28bbcb48e9bb907c801873bd1519b96b04fb805",
-                "sha256:6224f1401025b748ffecb7a6e2652b17768f30b1a6a3f7b44660e5b5b690b12d",
-                "sha256:647e481940379eebd314c00440314c81ea547aa636056f554d491e40503c8464",
-                "sha256:6ccd57ae8db17d677e9e06192e9c9ec4bd2066b77790f9aa7dede2cc4008ee8f",
-                "sha256:772206116b9b57cd625c8a88f2413df2fcfd0b496eb188b82a43bed7af2c2ec9",
-                "sha256:8e0d26fa5875d43ddbb0d9d79a447d2ace4180d9e3239788208527c4784f7cab",
-                "sha256:98d117332cc9e5ea8dfdc2b28b0a23f60370d02e1395f88f40d1effd2cb86c4f",
-                "sha256:b572256409f194521a9895aef274cea88731d14732343da3ecdb175228881638",
-                "sha256:bd53f7f5db562f37cd64a3af5012df8cac2c464c97e732ed556800129505bd64",
-                "sha256:bd8f42ea1ea8f4e84d265769089964ddda95eb2bb38b5cbe26712b0616c3edee",
-                "sha256:e814ac2c6f9daf4c36eb8e85266859f42174a4ff0d71b99405ed559257750382",
-                "sha256:f74bc20c7b67d1c27c72601c78cf95be99d5c2cdd4514502b4f3eb0933ff1228"
+                "sha256:0de811931e90ae2da9e19ce70ffad73047ab0c1dba7c6e74f9ae1a3aabeb89bd",
+                "sha256:1ff05116ede1ebdd81802df339e5b1d4cab1dfbd99295bf27e90b4cec64d70e9",
+                "sha256:2d8ffe44ae709f839c54bacf14ed283f41bee90430c3b398e521e10f8d117b3a",
+                "sha256:5cda65fc60a645470b8525ce014516b120b7057b576fa876cdfdd5e60ab1efbb",
+                "sha256:63a3288abbc9c8ee979d7e34c34e780b2fbab3e7e53d00b6c80271119f277399",
+                "sha256:7522df4e45e4f25b50adbbbeb5bb9847495c438a628177099d2721f2751ff825",
+                "sha256:7f4b8a905df909a407c5791fb582f6c03b0d3b491ecdc1cdceaefbc9bf9e08f6",
+                "sha256:905f0adb0c09c9f44222ee02f6b96fd88b493478fffb7a345287f9444e926030",
+                "sha256:ae2b325c0f6d748027f7463077e457006b4fdb35a8788f01754aadba825285ee",
+                "sha256:e71fb9038bfcd7646ca126c5ef19b17e48d4af9e838b2bcfda7a9f55a6552a32"
            ],
-            "version": "==0.16.0"
+            "version": "==0.15.3"
        },
        "vine": {
            "hashes": [
@ -1248,11 +1264,11 @@
        },
        "websocket-client": {
            "hashes": [
-                "sha256:0133d2f784858e59959ce82ddac316634229da55b498aac311f1620567a710ec",
-                "sha256:8dfb715d8a992f5712fff8c843adae94e22b22a99b2c5e6b0ec4a1a981cc4e0d"
+                "sha256:b68e4959d704768fa20e35c9d508c8dc2bbc041fd8d267c0d7345cffe2824568",
+                "sha256:e5c333bfa9fa739538b652b6f8c8fc2559f1d364243c8a689d7c0e1d41c2e611"
            ],
            "markers": "python_version >= '3.6'",
-            "version": "==1.2.1"
+            "version": "==1.1.0"
        },
        "websockets": {
            "hashes": [
@ -1420,11 +1436,11 @@
        },
        "astroid": {
            "hashes": [
-                "sha256:b6c2d75cd7c2982d09e7d41d70213e863b3ba34d3bd4014e08f167cee966e99e",
-                "sha256:ecc50f9b3803ebf8ea19aa2c6df5622d8a5c31456a53c741d3be044d96ff0948"
+                "sha256:7b963d1c590d490f60d2973e57437115978d3a2529843f160b5003b721e1e925",
+                "sha256:83e494b02d75d07d4e347b27c066fd791c0c74fc96c613d1ea3de0c82c48168f"
            ],
            "markers": "python_version ~= '3.6'",
-            "version": "==2.7.2"
+            "version": "==2.6.5"
        },
        "attrs": {
            "hashes": [
@ -1467,11 +1483,11 @@
        },
        "charset-normalizer": {
            "hashes": [
-                "sha256:0c8911edd15d19223366a194a513099a302055a962bca2cec0f54b8b63175d8b",
-                "sha256:f23667ebe1084be45f6ae0538e4a5a865206544097e4e8bbcacf42cd02a348f3"
+                "sha256:88fce3fa5b1a84fdcb3f603d889f723d1dd89b26059d0123ca435570e848d5e1",
+                "sha256:c46c3ace2d744cfbdebceaa3c19ae691f53ae621b39fd7570f59d14fb7f2fd12"
            ],
            "markers": "python_version >= '3'",
-            "version": "==2.0.4"
+            "version": "==2.0.3"
        },
        "click": {
            "hashes": [
@ -1579,11 +1595,11 @@
        },
        "isort": {
            "hashes": [
-                "sha256:9c2ea1e62d871267b78307fe511c0838ba0da28698c5732d54e2790bf3ba9899",
-                "sha256:e17d6e2b81095c9db0a03a8025a957f334d6ea30b26f9ec70805411e5c7c81f2"
+                "sha256:eed17b53c3e7912425579853d078a0832820f023191561fcee9d7cae424e0813",
+                "sha256:f65ce5bd4cbc6abdfbe29afc2f0245538ab358c14590912df638033f157d555e"
            ],
            "markers": "python_version < '4' and python_full_version >= '3.6.1'",
-            "version": "==5.9.3"
+            "version": "==5.9.2"
        },
        "lazy-object-proxy": {
            "hashes": [
@ -1650,14 +1666,6 @@
            "markers": "python_version >= '2.6'",
            "version": "==5.6.0"
        },
-        "platformdirs": {
-            "hashes": [
-                "sha256:4666d822218db6a262bdfdc9c39d21f23b4cfdb08af331a81e92751daf6c866c",
-                "sha256:632daad3ab546bd8e6af0537d09805cec458dce201bccfe23012df73332e181e"
-            ],
-            "markers": "python_version >= '3.6'",
-            "version": "==2.2.0"
-        },
        "pluggy": {
            "hashes": [
                "sha256:15b2acde666561e1298d71b523007ed7364de07029219b604cf808bfa1c765b0",
@ -1676,11 +1684,11 @@
        },
        "pylint": {
            "hashes": [
-                "sha256:6758cce3ddbab60c52b57dcc07f0c5d779e5daf0cf50f6faacbef1d3ea62d2a1",
-                "sha256:e178e96b6ba171f8ef51fbce9ca30931e6acbea4a155074d80cc081596c9e852"
+                "sha256:1f333dc72ef7f5ea166b3230936ebcfb1f3b722e76c980cb9fe6b9f95e8d3172",
+                "sha256:748f81e5776d6273a6619506e08f1b48ff9bcb8198366a56821cf11aac14fc87"
            ],
            "index": "pypi",
-            "version": "==2.10.2"
+            "version": "==2.9.5"
        },
        "pylint-django": {
            "hashes": [
@ -1758,49 +1766,49 @@
        },
        "regex": {
            "hashes": [
-                "sha256:03840a07a402576b8e3a6261f17eb88abd653ad4e18ec46ef10c9a63f8c99ebd",
-                "sha256:06ba444bbf7ede3890a912bd4904bb65bf0da8f0d8808b90545481362c978642",
-                "sha256:1f9974826aeeda32a76648fc677e3125ade379869a84aa964b683984a2dea9f1",
-                "sha256:330836ad89ff0be756b58758878409f591d4737b6a8cef26a162e2a4961c3321",
-                "sha256:38600fd58c2996829480de7d034fb2d3a0307110e44dae80b6b4f9b3d2eea529",
-                "sha256:3a195e26df1fbb40ebee75865f9b64ba692a5824ecb91c078cc665b01f7a9a36",
-                "sha256:41acdd6d64cd56f857e271009966c2ffcbd07ec9149ca91f71088574eaa4278a",
-                "sha256:45f97ade892ace20252e5ccecdd7515c7df5feeb42c3d2a8b8c55920c3551c30",
-                "sha256:4b0c211c55d4aac4309c3209833c803fada3fc21cdf7b74abedda42a0c9dc3ce",
-                "sha256:5d5209c3ba25864b1a57461526ebde31483db295fc6195fdfc4f8355e10f7376",
-                "sha256:615fb5a524cffc91ab4490b69e10ae76c1ccbfa3383ea2fad72e54a85c7d47dd",
-                "sha256:61e734c2bcb3742c3f454dfa930ea60ea08f56fd1a0eb52d8cb189a2f6be9586",
-                "sha256:640ccca4d0a6fcc6590f005ecd7b16c3d8f5d52174e4854f96b16f34c39d6cb7",
-                "sha256:6dbd51c3db300ce9d3171f4106da18fe49e7045232630fe3d4c6e37cb2b39ab9",
-                "sha256:71a904da8c9c02aee581f4452a5a988c3003207cb8033db426f29e5b2c0b7aea",
-                "sha256:8021dee64899f993f4b5cca323aae65aabc01a546ed44356a0965e29d7893c94",
-                "sha256:8b8d551f1bd60b3e1c59ff55b9e8d74607a5308f66e2916948cafd13480b44a3",
-                "sha256:93f9f720081d97acee38a411e861d4ce84cbc8ea5319bc1f8e38c972c47af49f",
-                "sha256:96f0c79a70642dfdf7e6a018ebcbea7ea5205e27d8e019cad442d2acfc9af267",
-                "sha256:9966337353e436e6ba652814b0a957a517feb492a98b8f9d3b6ba76d22301dcc",
-                "sha256:a34ba9e39f8269fd66ab4f7a802794ffea6d6ac500568ec05b327a862c21ce23",
-                "sha256:a49f85f0a099a5755d0a2cc6fc337e3cb945ad6390ec892332c691ab0a045882",
-                "sha256:a795829dc522227265d72b25d6ee6f6d41eb2105c15912c230097c8f5bfdbcdc",
-                "sha256:a89ca4105f8099de349d139d1090bad387fe2b208b717b288699ca26f179acbe",
-                "sha256:ac95101736239260189f426b1e361dc1b704513963357dc474beb0f39f5b7759",
-                "sha256:ae87ab669431f611c56e581679db33b9a467f87d7bf197ac384e71e4956b4456",
-                "sha256:b091dcfee169ad8de21b61eb2c3a75f9f0f859f851f64fdaf9320759a3244239",
-                "sha256:b511c6009d50d5c0dd0bab85ed25bc8ad6b6f5611de3a63a59786207e82824bb",
-                "sha256:b79dc2b2e313565416c1e62807c7c25c67a6ff0a0f8d83a318df464555b65948",
-                "sha256:bca14dfcfd9aae06d7d8d7e105539bd77d39d06caaae57a1ce945670bae744e0",
-                "sha256:c835c30f3af5c63a80917b72115e1defb83de99c73bc727bddd979a3b449e183",
-                "sha256:ccd721f1d4fc42b541b633d6e339018a08dd0290dc67269df79552843a06ca92",
-                "sha256:d6c2b1d78ceceb6741d703508cd0e9197b34f6bf6864dab30f940f8886e04ade",
-                "sha256:d6ec4ae13760ceda023b2e5ef1f9bc0b21e4b0830458db143794a117fdbdc044",
-                "sha256:d8b623fc429a38a881ab2d9a56ef30e8ea20c72a891c193f5ebbddc016e083ee",
-                "sha256:ea9753d64cba6f226947c318a923dadaf1e21cd8db02f71652405263daa1f033",
-                "sha256:ebbceefbffae118ab954d3cd6bf718f5790db66152f95202ebc231d58ad4e2c2",
-                "sha256:ecb6e7c45f9cd199c10ec35262b53b2247fb9a408803ed00ee5bb2b54aa626f5",
-                "sha256:ef9326c64349e2d718373415814e754183057ebc092261387a2c2f732d9172b2",
-                "sha256:f93a9d8804f4cec9da6c26c8cfae2c777028b4fdd9f49de0302e26e00bb86504",
-                "sha256:faf08b0341828f6a29b8f7dd94d5cf8cc7c39bfc3e67b78514c54b494b66915a"
+                "sha256:0eb2c6e0fcec5e0f1d3bcc1133556563222a2ffd2211945d7b1480c1b1a42a6f",
+                "sha256:15dddb19823f5147e7517bb12635b3c82e6f2a3a6b696cc3e321522e8b9308ad",
+                "sha256:173bc44ff95bc1e96398c38f3629d86fa72e539c79900283afa895694229fe6a",
+                "sha256:1c78780bf46d620ff4fff40728f98b8afd8b8e35c3efd638c7df67be2d5cddbf",
+                "sha256:2366fe0479ca0e9afa534174faa2beae87847d208d457d200183f28c74eaea59",
+                "sha256:2bceeb491b38225b1fee4517107b8491ba54fba77cf22a12e996d96a3c55613d",
+                "sha256:2ddeabc7652024803666ea09f32dd1ed40a0579b6fbb2a213eba590683025895",
+                "sha256:2fe5e71e11a54e3355fa272137d521a40aace5d937d08b494bed4529964c19c4",
+                "sha256:319eb2a8d0888fa6f1d9177705f341bc9455a2c8aca130016e52c7fe8d6c37a3",
+                "sha256:3f5716923d3d0bfb27048242a6e0f14eecdb2e2a7fac47eda1d055288595f222",
+                "sha256:422dec1e7cbb2efbbe50e3f1de36b82906def93ed48da12d1714cabcd993d7f0",
+                "sha256:4c9c3155fe74269f61e27617529b7f09552fbb12e44b1189cebbdb24294e6e1c",
+                "sha256:4f64fc59fd5b10557f6cd0937e1597af022ad9b27d454e182485f1db3008f417",
+                "sha256:564a4c8a29435d1f2256ba247a0315325ea63335508ad8ed938a4f14c4116a5d",
+                "sha256:59506c6e8bd9306cd8a41511e32d16d5d1194110b8cfe5a11d102d8b63cf945d",
+                "sha256:598c0a79b4b851b922f504f9f39a863d83ebdfff787261a5ed061c21e67dd761",
+                "sha256:59c00bb8dd8775473cbfb967925ad2c3ecc8886b3b2d0c90a8e2707e06c743f0",
+                "sha256:6110bab7eab6566492618540c70edd4d2a18f40ca1d51d704f1d81c52d245026",
+                "sha256:6afe6a627888c9a6cfbb603d1d017ce204cebd589d66e0703309b8048c3b0854",
+                "sha256:791aa1b300e5b6e5d597c37c346fb4d66422178566bbb426dd87eaae475053fb",
+                "sha256:8394e266005f2d8c6f0bc6780001f7afa3ef81a7a2111fa35058ded6fce79e4d",
+                "sha256:875c355360d0f8d3d827e462b29ea7682bf52327d500a4f837e934e9e4656068",
+                "sha256:89e5528803566af4df368df2d6f503c84fbfb8249e6631c7b025fe23e6bd0cde",
+                "sha256:99d8ab206a5270c1002bfcf25c51bf329ca951e5a169f3b43214fdda1f0b5f0d",
+                "sha256:9a854b916806c7e3b40e6616ac9e85d3cdb7649d9e6590653deb5b341a736cec",
+                "sha256:b85ac458354165405c8a84725de7bbd07b00d9f72c31a60ffbf96bb38d3e25fa",
+                "sha256:bc84fb254a875a9f66616ed4538542fb7965db6356f3df571d783f7c8d256edd",
+                "sha256:c92831dac113a6e0ab28bc98f33781383fe294df1a2c3dfd1e850114da35fd5b",
+                "sha256:cbe23b323988a04c3e5b0c387fe3f8f363bf06c0680daf775875d979e376bd26",
+                "sha256:ccb3d2190476d00414aab36cca453e4596e8f70a206e2aa8db3d495a109153d2",
+                "sha256:d8bbce0c96462dbceaa7ac4a7dfbbee92745b801b24bce10a98d2f2b1ea9432f",
+                "sha256:db2b7df831c3187a37f3bb80ec095f249fa276dbe09abd3d35297fc250385694",
+                "sha256:e586f448df2bbc37dfadccdb7ccd125c62b4348cb90c10840d695592aa1b29e0",
+                "sha256:e5983c19d0beb6af88cb4d47afb92d96751fb3fa1784d8785b1cdf14c6519407",
+                "sha256:e6a1e5ca97d411a461041d057348e578dc344ecd2add3555aedba3b408c9f874",
+                "sha256:eaf58b9e30e0e546cdc3ac06cf9165a1ca5b3de8221e9df679416ca667972035",
+                "sha256:ed693137a9187052fc46eedfafdcb74e09917166362af4cc4fddc3b31560e93d",
+                "sha256:edd1a68f79b89b0c57339bce297ad5d5ffcc6ae7e1afdb10f1947706ed066c9c",
+                "sha256:f080248b3e029d052bf74a897b9d74cfb7643537fbde97fe8225a6467fb559b5",
+                "sha256:f9392a4555f3e4cb45310a65b403d86b589adc773898c25a39184b1ba4db8985",
+                "sha256:f98dc35ab9a749276f1a4a38ab3e0e2ba1662ce710f6530f5b0a6656f1c32b58"
            ],
-            "version": "==2021.8.21"
+            "version": "==2021.7.6"
        },
        "requests": {
            "hashes": [
@ -1844,11 +1852,11 @@
        },
        "stevedore": {
            "hashes": [
-                "sha256:59b58edb7f57b11897f150475e7bc0c39c5381f0b8e3fa9f5c20ce6c89ec4aa1",
-                "sha256:920ce6259f0b2498aaa4545989536a27e4e4607b8318802d7ddc3a533d3d069e"
+                "sha256:3a5bbd0652bf552748871eaa73a4a8dc2899786bc497a2aa1fcb4dcdb0debeee",
+                "sha256:50d7b78fbaf0d04cd62411188fa7eedcb03eb7f4c4b37005615ceebe582aa82a"
            ],
            "markers": "python_version >= '3.6'",
-            "version": "==3.4.0"
+            "version": "==3.3.0"
        },
        "toml": {
            "hashes": [
--- a/README.md
+++ b/README.md
@ -4,13 +4,13 @@

 ---

-[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://discord.gg/jg33eMhnj6)
-[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/6?style=for-the-badge)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
-[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/6?compact_message&style=for-the-badge)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
-[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=for-the-badge)](https://codecov.io/gh/goauthentik/authentik)
-![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=for-the-badge)
-![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=for-the-badge)
-![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/goauthentik/authentik?style=for-the-badge)
+[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/jg33eMhnj6)
+[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/6?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/6?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=flat-square)](https://codecov.io/gh/goauthentik/authentik)
+![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=flat-square)
+![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=flat-square)
+![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/goauthentik/authentik?style=flat-square)
 [Transifex](https://www.transifex.com/beryjuorg/authentik/)

 ## What is authentik?
@ -21,7 +21,7 @@ authentik is an open-source Identity Provider focused on flexibility and versati

 For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/)

-For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
+For bigger setups, there is a Helm Chart [here])(https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)

 ## Screenshots

--- a/authentik/init.py
+++ b/authentik/init.py
@ -1,3 +1,3 @@
 """authentik"""
-__version__ = "2021.8.1"
+__version__ = "2021.7.3"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
--- a/authentik/admin/api/metrics.py
+++ b/authentik/admin/api/metrics.py
@ -23,7 +23,9 @@ def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
    date_from = now() - timedelta(days=1)
    result = (
        Event.objects.filter(created__gte=date_from, **filter_kwargs)
-        .annotate(age=ExpressionWrapper(now() - F("created"), output_field=DurationField()))
+        .annotate(
+            age=ExpressionWrapper(now() - F("created"), output_field=DurationField())
+        )
        .annotate(age_hours=ExtractHour("age"))
        .values("age_hours")
        .annotate(count=Count("pk"))
@ -35,7 +37,8 @@ def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
    for hour in range(0, -24, -1):
        results.append(
            {
-                "x_cord": time.mktime((_now + timedelta(hours=hour)).timetuple()) * 1000,
+                "x_cord": time.mktime((_now + timedelta(hours=hour)).timetuple())
+                * 1000,
                "y_cord": data[hour * -1],
            }
        )
--- a/authentik/admin/api/system.py
+++ b/authentik/admin/api/system.py
@ -16,8 +16,6 @@ from rest_framework.response import Response
 from rest_framework.views import APIView

 from authentik.core.api.utils import PassiveSerializer
-from authentik.outposts.managed import MANAGED_OUTPOST
-from authentik.outposts.models import Outpost


 class RuntimeDict(TypedDict):
@ -34,18 +32,12 @@ class RuntimeDict(TypedDict):
 class SystemSerializer(PassiveSerializer):
    """Get system information."""

-    env = SerializerMethodField()
    http_headers = SerializerMethodField()
    http_host = SerializerMethodField()
    http_is_secure = SerializerMethodField()
    runtime = SerializerMethodField()
    tenant = SerializerMethodField()
    server_time = SerializerMethodField()
-    embedded_outpost_host = SerializerMethodField()
-
-    def get_env(self, request: Request) -> dict[str, str]:
-        """Get Environment"""
-        return os.environ.copy()

    def get_http_headers(self, request: Request) -> dict[str, str]:
        """Get HTTP Request headers"""
@ -69,7 +61,9 @@ class SystemSerializer(PassiveSerializer):
        return {
            "python_version": python_version,
            "gunicorn_version": ".".join(str(x) for x in gunicorn_version),
-            "environment": "kubernetes" if SERVICE_HOST_ENV_NAME in os.environ else "compose",
+            "environment": "kubernetes"
+            if SERVICE_HOST_ENV_NAME in os.environ
+            else "compose",
            "architecture": platform.machine(),
            "platform": platform.platform(),
            "uname": " ".join(platform.uname()),
@ -83,13 +77,6 @@ class SystemSerializer(PassiveSerializer):
        """Current server time"""
        return now()

-    def get_embedded_outpost_host(self, request: Request) -> str:
-        """Get the FQDN configured on the embeddded outpost"""
-        outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
-        if not outposts.exists():
-            return ""
-        return outposts.first().config.authentik_host
-

 class SystemView(APIView):
    """Get system information."""
--- a/authentik/admin/api/tasks.py
+++ b/authentik/admin/api/tasks.py
@ -92,7 +92,10 @@ class TaskViewSet(ViewSet):
            task_func.delay(*task.task_call_args, **task.task_call_kwargs)
            messages.success(
                self.request,
-                _("Successfully re-scheduled Task %(name)s!" % {"name": task.task_name}),
+                _(
+                    "Successfully re-scheduled Task %(name)s!"
+                    % {"name": task.task_name}
+                ),
            )
            return Response(status=204)
        except ImportError:  # pragma: no cover
--- a/authentik/admin/api/version.py
+++ b/authentik/admin/api/version.py
@ -41,7 +41,9 @@ class VersionSerializer(PassiveSerializer):

    def get_outdated(self, instance) -> bool:
        """Check if we're running the latest version"""
-        return parse(self.get_version_current(instance)) < parse(self.get_version_latest(instance))
+        return parse(self.get_version_current(instance)) < parse(
+            self.get_version_latest(instance)
+        )


 class VersionView(APIView):
--- a/authentik/admin/api/workers.py
+++ b/authentik/admin/api/workers.py
@ -17,7 +17,9 @@ class WorkerView(APIView):

    permission_classes = [IsAdminUser]

-    @extend_schema(responses=inline_serializer("Workers", fields={"count": IntegerField()}))
+    @extend_schema(
+        responses=inline_serializer("Workers", fields={"count": IntegerField()})
+    )
    def get(self, request: Request) -> Response:
        """Get currently connected worker count."""
        count = len(CELERY_APP.control.ping(timeout=0.5))
--- a/authentik/admin/tasks.py
+++ b/authentik/admin/tasks.py
@ -37,14 +37,18 @@ def _set_prom_info():
 def update_latest_version(self: MonitoredTask):
    """Update latest version info"""
    try:
-        response = get("https://api.github.com/repos/goauthentik/authentik/releases/latest")
+        response = get(
+            "https://api.github.com/repos/goauthentik/authentik/releases/latest"
+        )
        response.raise_for_status()
        data = response.json()
        tag_name = data.get("tag_name")
        upstream_version = tag_name.split("/")[1]
        cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
        self.set_status(
-            TaskResult(TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"])
+            TaskResult(
+                TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"]
+            )
        )
        _set_prom_info()
        # Check if upstream version is newer than what we're running,
--- a/authentik/admin/tests/test_api.py
+++ b/authentik/admin/tests/test_api.py
@ -27,7 +27,9 @@ class TestAdminAPI(TestCase):
        response = self.client.get(reverse("authentik_api:admin_system_tasks-list"))
        self.assertEqual(response.status_code, 200)
        body = loads(response.content)
-        self.assertTrue(any(task["task_name"] == "clean_expired_models" for task in body))
+        self.assertTrue(
+            any(task["task_name"] == "clean_expired_models" for task in body)
+        )

    def test_tasks_single(self):
        """Test Task API (read single)"""
@ -43,7 +45,9 @@ class TestAdminAPI(TestCase):
        self.assertEqual(body["status"], TaskResultStatus.SUCCESSFUL.name)
        self.assertEqual(body["task_name"], "clean_expired_models")
        response = self.client.get(
-            reverse("authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"})
+            reverse(
+                "authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"}
+            )
        )
        self.assertEqual(response.status_code, 404)

--- a/authentik/api/authentication.py
+++ b/authentik/api/authentication.py
@ -3,20 +3,18 @@ from base64 import b64decode
 from binascii import Error
 from typing import Any, Optional, Union

-from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
 from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from structlog.stdlib import get_logger

 from authentik.core.models import Token, TokenIntents, User
-from authentik.outposts.models import Outpost

 LOGGER = get_logger()


 # pylint: disable=too-many-return-statements
-def bearer_auth(raw_header: bytes) -> Optional[User]:
+def token_from_header(raw_header: bytes) -> Optional[Token]:
    """raw_header in the Format of `Bearer dGVzdDp0ZXN0`"""
    auth_credentials = raw_header.decode()
    if auth_credentials == "" or " " not in auth_credentials:
@ -33,33 +31,15 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
            raise AuthenticationFailed("Malformed header")
        # Accept credentials with username and without
        if ":" in auth_credentials:
-            _, _, password = auth_credentials.partition(":")
+            _, password = auth_credentials.split(":")
        else:
            password = auth_credentials
    if password == "":  # nosec
        raise AuthenticationFailed("Malformed header")
    tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
    if not tokens.exists():
-        LOGGER.info("Authenticating via secret_key")
-        user = token_secret_key(password)
-        if not user:
-            raise AuthenticationFailed("Token invalid/expired")
-        return user
-    return tokens.first().user
-
-
-def token_secret_key(value: str) -> Optional[User]:
-    """Check if the token is the secret key
-    and return the service account for the managed outpost"""
-    from authentik.outposts.managed import MANAGED_OUTPOST
-
-    if value != settings.SECRET_KEY:
-        return None
-    outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
-    if not outposts:
-        return None
-    outpost = outposts.first()
-    return outpost.user
+        raise AuthenticationFailed("Token invalid/expired")
+    return tokens.first()


 class TokenAuthentication(BaseAuthentication):
@ -69,9 +49,9 @@ class TokenAuthentication(BaseAuthentication):
        """Token-based authentication using HTTP Bearer authentication"""
        auth = get_authorization_header(request)

-        user = bearer_auth(auth)
+        token = token_from_header(auth)
        # None is only returned when the header isn't set.
-        if not user:
+        if not token:
            return None

-        return (user, None)  # pragma: no cover
+        return (token.user, None)  # pragma: no cover
--- a/authentik/api/decorators.py
+++ b/authentik/api/decorators.py
@ -7,7 +7,9 @@ from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet


-def permission_required(perm: Optional[str] = None, other_perms: Optional[list[str]] = None):
+def permission_required(
+    perm: Optional[str] = None, other_perms: Optional[list[str]] = None
+):
    """Check permissions for a single custom action"""

    def wrapper_outter(func: Callable):
--- a/authentik/api/schema.py
+++ b/authentik/api/schema.py
@ -63,7 +63,9 @@ def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
            method["responses"].setdefault("400", validation_error.ref)
            method["responses"].setdefault("403", generic_error.ref)

-    result["components"] = generator.registry.build(spectacular_settings.APPEND_COMPONENTS)
+    result["components"] = generator.registry.build(
+        spectacular_settings.APPEND_COMPONENTS
+    )

    # This is a workaround for authentik/stages/prompt/stage.py
    # since the serializer PromptChallengeResponse
--- a/authentik/api/tests/test_auth.py
+++ b/authentik/api/tests/test_auth.py
@ -1,14 +1,12 @@
 """Test API Authentication"""
 from base64 import b64encode

-from django.conf import settings
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user
 from rest_framework.exceptions import AuthenticationFailed

-from authentik.api.authentication import bearer_auth
-from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
-from authentik.outposts.managed import OutpostManager
+from authentik.api.authentication import token_from_header
+from authentik.core.models import Token, TokenIntents


 class TestAPIAuth(TestCase):
@ -16,41 +14,36 @@ class TestAPIAuth(TestCase):

    def test_valid_basic(self):
        """Test valid token"""
-        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
+        token = Token.objects.create(
+            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        )
        auth = b64encode(f":{token.key}".encode()).decode()
-        self.assertEqual(bearer_auth(f"Basic {auth}".encode()), token.user)
+        self.assertEqual(token_from_header(f"Basic {auth}".encode()), token)

    def test_valid_bearer(self):
        """Test valid token"""
-        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
-        self.assertEqual(bearer_auth(f"Bearer {token.key}".encode()), token.user)
+        token = Token.objects.create(
+            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        )
+        self.assertEqual(token_from_header(f"Bearer {token.key}".encode()), token)

    def test_invalid_type(self):
        """Test invalid type"""
        with self.assertRaises(AuthenticationFailed):
-            bearer_auth("foo bar".encode())
+            token_from_header("foo bar".encode())

    def test_invalid_decode(self):
        """Test invalid bas64"""
        with self.assertRaises(AuthenticationFailed):
-            bearer_auth("Basic bar".encode())
+            token_from_header("Basic bar".encode())

    def test_invalid_empty_password(self):
        """Test invalid with empty password"""
        with self.assertRaises(AuthenticationFailed):
-            bearer_auth("Basic :".encode())
+            token_from_header("Basic :".encode())

    def test_invalid_no_token(self):
        """Test invalid with no token"""
        with self.assertRaises(AuthenticationFailed):
            auth = b64encode(":abc".encode()).decode()
-            self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
-
-    def test_managed_outpost(self):
-        """Test managed outpost"""
-        with self.assertRaises(AuthenticationFailed):
-            user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-
-        OutpostManager().run()
-        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
+            self.assertIsNone(token_from_header(f"Basic :{auth}".encode()))
--- a/authentik/api/v2/config.py
+++ b/authentik/api/v2/config.py
@ -5,7 +5,7 @@ from django.conf import settings
 from django.db import models
 from drf_spectacular.utils import extend_schema
 from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
-from rest_framework.fields import BooleanField, CharField, ChoiceField, IntegerField, ListField
+from rest_framework.fields import BooleanField, CharField, ChoiceField, ListField
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
@ -33,11 +33,6 @@ class ConfigSerializer(PassiveSerializer):

    capabilities = ListField(child=ChoiceField(choices=Capabilities.choices))

-    cache_timeout = IntegerField(required=True)
-    cache_timeout_flows = IntegerField(required=True)
-    cache_timeout_policies = IntegerField(required=True)
-    cache_timeout_reputation = IntegerField(required=True)
-

 class ConfigView(APIView):
    """Read-only view set that returns the current session's Configs"""
@ -54,7 +49,7 @@ class ConfigView(APIView):
            caps.append(Capabilities.CAN_GEO_IP)
        if SERVICE_HOST_ENV_NAME in environ:
            # Running in k8s, only s3 backup is supported
-            if CONFIG.y("postgresql.s3_backup"):
+            if CONFIG.y_bool("postgresql.s3_backup"):
                caps.append(Capabilities.CAN_BACKUP)
        else:
            # Running in compose, backup is always supported
@ -70,10 +65,6 @@ class ConfigView(APIView):
                "error_reporting_environment": CONFIG.y("error_reporting.environment"),
                "error_reporting_send_pii": CONFIG.y("error_reporting.send_pii"),
                "capabilities": self.get_capabilities(),
-                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
-                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
-                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
-                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
            }
        )
        return Response(config.data)
--- a/authentik/api/v2/urls.py
+++ b/authentik/api/v2/urls.py
@ -52,14 +52,21 @@ from authentik.policies.reputation.api import (
 from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
 from authentik.providers.oauth2.api.provider import OAuth2ProviderViewSet
 from authentik.providers.oauth2.api.scope import ScopeMappingViewSet
-from authentik.providers.oauth2.api.tokens import AuthorizationCodeViewSet, RefreshTokenViewSet
-from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
+from authentik.providers.oauth2.api.tokens import (
+    AuthorizationCodeViewSet,
+    RefreshTokenViewSet,
+)
+from authentik.providers.proxy.api import (
+    ProxyOutpostConfigViewSet,
+    ProxyProviderViewSet,
+)
 from authentik.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProviderViewSet
 from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from authentik.sources.oauth.api.source import OAuthSourceViewSet
-from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
-from authentik.sources.plex.api.source import PlexSourceViewSet
-from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
+from authentik.sources.oauth.api.source_connection import (
+    UserOAuthSourceConnectionViewSet,
+)
+from authentik.sources.plex.api import PlexSourceViewSet
 from authentik.sources.saml.api import SAMLSourceViewSet
 from authentik.stages.authenticator_duo.api import (
    AuthenticatorDuoStageViewSet,
@ -76,7 +83,9 @@ from authentik.stages.authenticator_totp.api import (
    TOTPAdminDeviceViewSet,
    TOTPDeviceViewSet,
 )
-from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageViewSet
+from authentik.stages.authenticator_validate.api import (
+    AuthenticatorValidateStageViewSet,
+)
 from authentik.stages.authenticator_webauthn.api import (
    AuthenticateWebAuthnStageViewSet,
    WebAuthnAdminDeviceViewSet,
@ -113,7 +122,9 @@ router.register("core/tenants", TenantViewSet)
 router.register("outposts/instances", OutpostViewSet)
 router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
-router.register("outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet)
+router.register(
+    "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
+)
 router.register("outposts/proxy", ProxyOutpostConfigViewSet)
 router.register("outposts/ldap", LDAPOutpostConfigViewSet)

@ -128,8 +139,7 @@ router.register("events/transports", NotificationTransportViewSet)
 router.register("events/rules", NotificationRuleViewSet)

 router.register("sources/all", SourceViewSet)
-router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
-router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
+router.register("sources/oauth_user_connections", UserOAuthSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
@ -174,7 +184,9 @@ router.register(
    StaticAdminDeviceViewSet,
    basename="admin-staticdevice",
 )
-router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice")
+router.register(
+    "authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice"
+)
 router.register(
    "authenticators/admin/webauthn",
    WebAuthnAdminDeviceViewSet,
--- a/authentik/core/api/applications.py
+++ b/authentik/core/api/applications.py
@ -4,9 +4,14 @@ from django.db.models import QuerySet
 from django.http.response import HttpResponseBadRequest
 from django.shortcuts import get_object_or_404
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
+from drf_spectacular.utils import (
+    OpenApiParameter,
+    OpenApiResponse,
+    extend_schema,
+    inline_serializer,
+)
 from rest_framework.decorators import action
-from rest_framework.fields import ReadOnlyField
+from rest_framework.fields import BooleanField, CharField, FileField, ReadOnlyField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@ -19,7 +24,6 @@ from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import FilePathSerializer, FileUploadSerializer
 from authentik.core.models import Application, User
 from authentik.events.models import EventAction
 from authentik.policies.api.exec import PolicyTestResultSerializer
@ -118,10 +122,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
        # If the current user is superuser, they can set `for_user`
        for_user = request.user
        if request.user.is_superuser and "for_user" in request.query_params:
-            try:
-                for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
-            except ValueError:
-                return HttpResponseBadRequest("for_user must be numerical")
+            for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
        engine = PolicyEngine(application, for_user, request)
        engine.use_cache = False
        engine.build()
@ -146,7 +147,9 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
        """Custom list method that checks Policy based access instead of guardian"""
        should_cache = request.GET.get("search", "") == ""

-        superuser_full_list = str(request.GET.get("superuser_full_list", "false")).lower() == "true"
+        superuser_full_list = (
+            str(request.GET.get("superuser_full_list", "false")).lower() == "true"
+        )
        if superuser_full_list and request.user.is_superuser:
            return super().list(request)

@ -176,7 +179,13 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
    @permission_required("authentik_core.change_application")
    @extend_schema(
        request={
-            "multipart/form-data": FileUploadSerializer,
+            "multipart/form-data": inline_serializer(
+                "SetIcon",
+                fields={
+                    "file": FileField(required=False),
+                    "clear": BooleanField(default=False),
+                },
+            )
        },
        responses={
            200: OpenApiResponse(description="Success"),
@ -208,7 +217,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):

    @permission_required("authentik_core.change_application")
    @extend_schema(
-        request=FilePathSerializer,
+        request=inline_serializer("SetIconURL", fields={"url": CharField()}),
        responses={
            200: OpenApiResponse(description="Success"),
            400: OpenApiResponse(description="Bad request"),
@ -231,7 +240,9 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
        app.save()
        return Response({})

-    @permission_required("authentik_core.view_application", ["authentik_events.view_event"])
+    @permission_required(
+        "authentik_core.view_application", ["authentik_events.view_event"]
+    )
    @extend_schema(responses={200: CoordinateSerializer(many=True)})
    @action(detail=True, pagination_class=None, filter_backends=[])
    # pylint: disable=unused-argument
--- a/authentik/core/api/authenticated_sessions.py
+++ b/authentik/core/api/authenticated_sessions.py
@ -68,7 +68,9 @@ class AuthenticatedSessionSerializer(ModelSerializer):
        """Get parsed user agent"""
        return user_agent_parser.Parse(instance.last_user_agent)

-    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
+    def get_geo_ip(
+        self, instance: AuthenticatedSession
+    ) -> Optional[GeoIPDict]:  # pragma: no cover
        """Get parsed user agent"""
        return GEOIP_READER.city_dict(instance.last_ip)

--- a/authentik/core/api/propertymappings.py
+++ b/authentik/core/api/propertymappings.py
@ -15,7 +15,11 @@ from rest_framework.viewsets import GenericViewSet

 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
+from authentik.core.api.utils import (
+    MetaNameSerializer,
+    PassiveSerializer,
+    TypeCreateSerializer,
+)
 from authentik.core.expression import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
 from authentik.lib.utils.reflection import all_subclasses
@ -137,7 +141,9 @@ class PropertyMappingViewSet(
                self.request,
                **test_params.validated_data.get("context", {}),
            )
-            response_data["result"] = dumps(result, indent=(4 if format_result else None))
+            response_data["result"] = dumps(
+                result, indent=(4 if format_result else None)
+            )
        except Exception as exc:  # pylint: disable=broad-except
            response_data["result"] = str(exc)
            response_data["successful"] = False
--- a/authentik/core/api/sources.py
+++ b/authentik/core/api/sources.py
@ -74,8 +74,6 @@ class SourceViewSet(
        for subclass in all_subclasses(self.queryset.model):
            subclass: Source
            component = ""
-            if len(subclass.__subclasses__()) > 0:
-                continue
            if subclass._meta.abstract:
                component = subclass.__bases__[0]().component
            else:
@ -95,7 +93,9 @@ class SourceViewSet(
    @action(detail=False, pagination_class=None, filter_backends=[])
    def user_settings(self, request: Request) -> Response:
        """Get all sources the user can configure"""
-        _all_sources: Iterable[Source] = Source.objects.filter(enabled=True).select_subclasses()
+        _all_sources: Iterable[Source] = Source.objects.filter(
+            enabled=True
+        ).select_subclasses()
        matching_sources: list[UserSettingSerializer] = []
        for source in _all_sources:
            user_settings = source.ui_user_settings
--- a/authentik/core/api/tokens.py
+++ b/authentik/core/api/tokens.py
@ -1,10 +1,7 @@
 """Tokens API Viewset"""
-from typing import Any
-
 from django.http.response import Http404
 from drf_spectacular.utils import OpenApiResponse, extend_schema
 from rest_framework.decorators import action
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField
 from rest_framework.request import Request
 from rest_framework.response import Response
@ -23,16 +20,7 @@ from authentik.managed.api import ManagedSerializer
 class TokenSerializer(ManagedSerializer, ModelSerializer):
    """Token Serializer"""

-    user_obj = UserSerializer(required=False)
-
-    def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
-        """Ensure only API or App password tokens are created."""
-        request: Request = self.context["request"]
-        attrs.setdefault("user", request.user)
-        attrs.setdefault("intent", TokenIntents.INTENT_API)
-        if attrs.get("intent") not in [TokenIntents.INTENT_API, TokenIntents.INTENT_APP_PASSWORD]:
-            raise ValidationError(f"Invalid intent {attrs.get('intent')}")
-        return attrs
+    user = UserSerializer(required=False)

    class Meta:

@ -43,14 +31,11 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
            "identifier",
            "intent",
            "user",
-            "user_obj",
            "description",
            "expires",
            "expiring",
        ]
-        extra_kwargs = {
-            "user": {"required": False},
-        }
+        depth = 2


 class TokenViewSerializer(PassiveSerializer):
@ -84,7 +69,10 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
    def perform_create(self, serializer: TokenSerializer):
        serializer.save(
            user=self.request.user,
-            expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
+            intent=TokenIntents.INTENT_API,
+            expiring=self.request.user.attributes.get(
+                USER_ATTRIBUTE_TOKEN_EXPIRING, True
+            ),
        )

    @permission_required("authentik_core.view_token_key")
@ -101,5 +89,7 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
        token: Token = self.get_object()
        if token.is_expired:
            raise Http404
-        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(request)  # noqa # nosec
+        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(  # noqa # nosec
+            request
+        )
        return Response(TokenViewSerializer({"key": token.key}).data)
--- a/authentik/core/api/used_by.py
+++ b/authentik/core/api/used_by.py
@ -79,7 +79,9 @@ class UsedByMixin:
            ).all():
                # Only merge shadows on first object
                if first_object:
-                    shadows += getattr(manager.model._meta, "authentik_used_by_shadows", [])
+                    shadows += getattr(
+                        manager.model._meta, "authentik_used_by_shadows", []
+                    )
                first_object = False
                serializer = UsedBySerializer(
                    data={
--- a/authentik/core/api/users.py
+++ b/authentik/core/api/users.py
@ -1,23 +1,13 @@
 """User API Views"""
 from json import loads
-from typing import Optional

 from django.db.models.query import QuerySet
-from django.db.transaction import atomic
-from django.db.utils import IntegrityError
 from django.urls import reverse_lazy
 from django.utils.http import urlencode
-from django.utils.translation import gettext as _
-from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
+from django_filters.filters import BooleanFilter, CharFilter
 from django_filters.filterset import FilterSet
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import (
-    OpenApiParameter,
-    extend_schema,
-    extend_schema_field,
-    inline_serializer,
-)
-from guardian.shortcuts import get_anonymous_user, get_objects_for_user
+from drf_spectacular.utils import extend_schema, extend_schema_field
+from guardian.utils import get_anonymous_user
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, JSONField, SerializerMethodField
 from rest_framework.permissions import IsAuthenticated
@ -27,36 +17,24 @@ from rest_framework.serializers import (
    BooleanField,
    ListSerializer,
    ModelSerializer,
-    PrimaryKeyRelatedField,
-    Serializer,
    ValidationError,
 )
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
-from structlog.stdlib import get_logger

 from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.groups import GroupSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
-from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
-from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
-    USER_ATTRIBUTE_TOKEN_EXPIRING,
-    Group,
-    Token,
-    TokenIntents,
-    User,
+from authentik.core.middleware import (
+    SESSION_IMPERSONATE_ORIGINAL_USER,
+    SESSION_IMPERSONATE_USER,
 )
+from authentik.core.models import Token, TokenIntents, User
 from authentik.events.models import EventAction
-from authentik.stages.email.models import EmailStage
-from authentik.stages.email.tasks import send_mails
-from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant

-LOGGER = get_logger()
-

 class UserSerializer(ModelSerializer):
    """User Serializer"""
@ -64,10 +42,7 @@ class UserSerializer(ModelSerializer):
    is_superuser = BooleanField(read_only=True)
    avatar = CharField(read_only=True)
    attributes = JSONField(validators=[is_dict], required=False)
-    groups = PrimaryKeyRelatedField(
-        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all()
-    )
-    groups_obj = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
+    groups = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
    uid = CharField(read_only=True)

    class Meta:
@ -81,7 +56,6 @@ class UserSerializer(ModelSerializer):
            "last_login",
            "is_superuser",
            "groups",
-            "groups_obj",
            "email",
            "avatar",
            "attributes",
@ -142,13 +116,17 @@ class UserMetricsSerializer(PassiveSerializer):
    def get_logins_failed_per_1h(self, _):
        """Get failed logins per hour for the last 24 hours"""
        user = self.context["user"]
-        return get_events_per_1h(action=EventAction.LOGIN_FAILED, context__username=user.username)
+        return get_events_per_1h(
+            action=EventAction.LOGIN_FAILED, context__username=user.username
+        )

    @extend_schema_field(CoordinateSerializer(many=True))
    def get_authorizations_per_1h(self, _):
        """Get failed logins per hour for the last 24 hours"""
        user = self.context["user"]
-        return get_events_per_1h(action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk)
+        return get_events_per_1h(
+            action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk
+        )


 class UsersFilter(FilterSet):
@ -163,16 +141,6 @@ class UsersFilter(FilterSet):

    is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")

-    groups_by_name = ModelMultipleChoiceFilter(
-        field_name="ak_groups__name",
-        to_field_name="name",
-        queryset=Group.objects.all(),
-    )
-    groups_by_pk = ModelMultipleChoiceFilter(
-        field_name="ak_groups",
-        queryset=Group.objects.all(),
-    )
-
    # pylint: disable=unused-argument
    def filter_attributes(self, queryset, name, value):
        """Filter attributes by query args"""
@ -196,8 +164,6 @@ class UsersFilter(FilterSet):
            "is_active",
            "is_superuser",
            "attributes",
-            "groups_by_name",
-            "groups_by_pk",
        ]


@ -212,79 +178,14 @@ class UserViewSet(UsedByMixin, ModelViewSet):
    def get_queryset(self):  # pragma: no cover
        return User.objects.all().exclude(pk=get_anonymous_user().pk)

-    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
-        """Create a recovery link (when the current tenant has a recovery flow set),
-        that can either be shown to an admin or sent to the user directly"""
-        tenant: Tenant = self.request._request.tenant
-        # Check that there is a recovery flow, if not return an error
-        flow = tenant.flow_recovery
-        if not flow:
-            LOGGER.debug("No recovery flow set")
-            return None, None
-        user: User = self.get_object()
-        token, __ = Token.objects.get_or_create(
-            identifier=f"{user.uid}-password-reset",
-            user=user,
-            intent=TokenIntents.INTENT_RECOVERY,
-        )
-        querystring = urlencode({"token": token.key})
-        link = self.request.build_absolute_uri(
-            reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
-            + f"?{querystring}"
-        )
-        return link, token
-
-    @permission_required(None, ["authentik_core.add_user", "authentik_core.add_token"])
-    @extend_schema(
-        request=inline_serializer(
-            "UserServiceAccountSerializer",
-            {
-                "name": CharField(required=True),
-                "create_group": BooleanField(default=False),
-            },
-        ),
-        responses={
-            200: inline_serializer(
-                "UserServiceAccountResponse",
-                {
-                    "username": CharField(required=True),
-                    "token": CharField(required=True),
-                },
-            )
-        },
-    )
-    @action(detail=False, methods=["POST"], pagination_class=None, filter_backends=[])
-    def service_account(self, request: Request) -> Response:
-        """Create a new user account that is marked as a service account"""
-        username = request.data.get("name")
-        create_group = request.data.get("create_group", False)
-        with atomic():
-            try:
-                user = User.objects.create(
-                    username=username,
-                    name=username,
-                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False},
-                )
-                if create_group:
-                    group = Group.objects.create(
-                        name=username,
-                    )
-                    group.users.add(user)
-                token = Token.objects.create(
-                    identifier=f"service-account-{username}-password",
-                    intent=TokenIntents.INTENT_APP_PASSWORD,
-                    user=user,
-                )
-                return Response({"username": user.username, "token": token.key})
-            except (IntegrityError) as exc:
-                return Response(data={"non_field_errors": [str(exc)]}, status=400)
-
    @extend_schema(responses={200: SessionUserSerializer(many=False)})
    @action(detail=False, pagination_class=None, filter_backends=[])
    # pylint: disable=invalid-name
    def me(self, request: Request) -> Response:
        """Get information about current user"""
-        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
+        serializer = SessionUserSerializer(
+            data={"user": UserSerializer(request.user).data}
+        )
        if SESSION_IMPERSONATE_USER in request._request.session:
            serializer.initial_data["original"] = UserSelfSerializer(
                request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
@ -292,7 +193,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
        serializer.is_valid()
        return Response(serializer.data)

-    @extend_schema(request=UserSelfSerializer, responses={200: SessionUserSerializer(many=False)})
+    @extend_schema(
+        request=UserSelfSerializer, responses={200: SessionUserSerializer(many=False)}
+    )
    @action(
        methods=["PUT"],
        detail=False,
@ -302,7 +205,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
    )
    def update_self(self, request: Request) -> Response:
        """Allow users to change information on their own profile"""
-        data = UserSelfSerializer(instance=User.objects.get(pk=request.user.pk), data=request.data)
+        data = UserSelfSerializer(
+            instance=User.objects.get(pk=request.user.pk), data=request.data
+        )
        if not data.is_valid():
            return Response(data.errors)
        new_user = data.save()
@ -310,9 +215,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
        # since it caches the full object
        if SESSION_IMPERSONATE_USER in request.session:
            request.session[SESSION_IMPERSONATE_USER] = new_user
-        serializer = SessionUserSerializer(data={"user": UserSelfSerializer(request.user).data})
-        serializer.is_valid()
-        return Response(serializer.data)
+        return self.me(request)

    @permission_required("authentik_core.view_user", ["authentik_events.view_event"])
    @extend_schema(responses={200: UserMetricsSerializer(many=False)})
@ -336,59 +239,23 @@ class UserViewSet(UsedByMixin, ModelViewSet):
    # pylint: disable=invalid-name, unused-argument
    def recovery(self, request: Request, pk: int) -> Response:
        """Create a temporary link that a user can use to recover their accounts"""
-        link, _ = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
+        tenant: Tenant = request._request.tenant
+        # Check that there is a recovery flow, if not return an error
+        flow = tenant.flow_recovery
+        if not flow:
            return Response({"link": ""}, status=404)
-        return Response({"link": link})
-
-    @permission_required("authentik_core.reset_user_password")
-    @extend_schema(
-        parameters=[
-            OpenApiParameter(
-                name="email_stage",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.STR,
-                required=True,
-            )
-        ],
-        responses={
-            "204": Serializer(),
-            "404": Serializer(),
-        },
-    )
-    @action(detail=True, pagination_class=None, filter_backends=[])
-    # pylint: disable=invalid-name, unused-argument
-    def recovery_email(self, request: Request, pk: int) -> Response:
-        """Create a temporary link that a user can use to recover their accounts"""
-        for_user = self.get_object()
-        if for_user.email == "":
-            LOGGER.debug("User doesn't have an email address")
-            return Response(status=404)
-        link, token = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
-            return Response(status=404)
-        # Lookup the email stage to assure the current user can access it
-        stages = get_objects_for_user(
-            request.user, "authentik_stages_email.view_emailstage"
-        ).filter(pk=request.query_params.get("email_stage"))
-        if not stages.exists():
-            LOGGER.debug("Email stage does not exist/user has no permissions")
-            return Response(status=404)
-        email_stage: EmailStage = stages.first()
-        message = TemplateEmailMessage(
-            subject=_(email_stage.subject),
-            template_name=email_stage.template,
-            to=[for_user.email],
-            template_context={
-                "url": link,
-                "user": for_user,
-                "expires": token.expires,
-            },
+        user: User = self.get_object()
+        token, __ = Token.objects.get_or_create(
+            identifier=f"{user.uid}-password-reset",
+            user=user,
+            intent=TokenIntents.INTENT_RECOVERY,
        )
-        send_mails(email_stage, message)
-        return Response(status=204)
+        querystring = urlencode({"token": token.key})
+        link = request.build_absolute_uri(
+            reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
+            + f"?{querystring}"
+        )
+        return Response({"link": link})

    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
--- a/authentik/core/api/utils.py
+++ b/authentik/core/api/utils.py
@ -2,15 +2,21 @@
 from typing import Any

 from django.db.models import Model
-from rest_framework.fields import BooleanField, CharField, FileField, IntegerField
-from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError
+from rest_framework.fields import CharField, IntegerField
+from rest_framework.serializers import (
+    Serializer,
+    SerializerMethodField,
+    ValidationError,
+)


 def is_dict(value: Any):
    """Ensure a value is a dictionary, useful for JSONFields"""
    if isinstance(value, dict):
        return
-    raise ValidationError("Value must be a dictionary, and not have any duplicate keys.")
+    raise ValidationError(
+        "Value must be a dictionary, and not have any duplicate keys."
+    )


 class PassiveSerializer(Serializer):
@ -19,21 +25,13 @@ class PassiveSerializer(Serializer):
    def create(self, validated_data: dict) -> Model:  # pragma: no cover
        return Model()

-    def update(self, instance: Model, validated_data: dict) -> Model:  # pragma: no cover
+    def update(
+        self, instance: Model, validated_data: dict
+    ) -> Model:  # pragma: no cover
        return Model()

-
-class FileUploadSerializer(PassiveSerializer):
-    """Serializer to upload file"""
-
-    file = FileField(required=False)
-    clear = BooleanField(default=False)
-
-
-class FilePathSerializer(PassiveSerializer):
-    """Serializer to upload file"""
-
-    url = CharField()
+    class Meta:
+        model = Model


 class MetaNameSerializer(PassiveSerializer):
--- a/authentik/core/auth.py
+++ b/authentik/core/auth.py
@ -1,59 +0,0 @@
-"""Authenticate with tokens"""
-
-from typing import Any, Optional
-
-from django.contrib.auth.backends import ModelBackend
-from django.http.request import HttpRequest
-
-from authentik.core.models import Token, TokenIntents, User
-from authentik.events.utils import cleanse_dict, sanitize_dict
-from authentik.flows.planner import FlowPlan
-from authentik.flows.views import SESSION_KEY_PLAN
-from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
-
-
-class InbuiltBackend(ModelBackend):
-    """Inbuilt backend"""
-
-    def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> Optional[User]:
-        user = super().authenticate(request, username=username, password=password, **kwargs)
-        if not user:
-            return None
-        self.set_method("password", request)
-        return user
-
-    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
-        """Set method data on current flow, if possbiel"""
-        if not request:
-            return
-        # Since we can't directly pass other variables to signals, and we want to log the method
-        # and the token used, we assume we're running in a flow and set a variable in the context
-        flow_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
-        flow_plan.context[PLAN_CONTEXT_METHOD] = method
-        flow_plan.context[PLAN_CONTEXT_METHOD_ARGS] = cleanse_dict(sanitize_dict(kwargs))
-        request.session[SESSION_KEY_PLAN] = flow_plan
-
-
-class TokenBackend(InbuiltBackend):
-    """Authenticate with token"""
-
-    def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> Optional[User]:
-        try:
-            user = User._default_manager.get_by_natural_key(username)
-        except User.DoesNotExist:
-            # Run the default password hasher once to reduce the timing
-            # difference between an existing and a nonexistent user (#20760).
-            User().set_password(password)
-            return None
-        tokens = Token.filter_not_expired(
-            user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
-        )
-        if not tokens.exists():
-            return None
-        token = tokens.first()
-        self.set_method("password", request, token=token)
-        return token.user
--- a/authentik/core/channels.py
+++ b/authentik/core/channels.py
@ -4,7 +4,7 @@ from channels.generic.websocket import JsonWebsocketConsumer
 from rest_framework.exceptions import AuthenticationFailed
 from structlog.stdlib import get_logger

-from authentik.api.authentication import bearer_auth
+from authentik.api.authentication import token_from_header
 from authentik.core.models import User

 LOGGER = get_logger()
@ -24,12 +24,12 @@ class AuthJsonConsumer(JsonWebsocketConsumer):
        raw_header = headers[b"authorization"]

        try:
-            user = bearer_auth(raw_header)
-            # user is only None when no header was given, in which case we deny too
-            if not user:
+            token = token_from_header(raw_header)
+            # token is only None when no header was given, in which case we deny too
+            if not token:
                raise DenyConnection()
        except AuthenticationFailed as exc:
            LOGGER.warning("Failed to authenticate", exc=exc)
            raise DenyConnection()

-        self.user = user
+        self.user = token.user
--- a/authentik/core/migrations/0001_initial.py
+++ b/authentik/core/migrations/0001_initial.py
@ -38,7 +38,9 @@ class Migration(migrations.Migration):
                ("password", models.CharField(max_length=128, verbose_name="password")),
                (
                    "last_login",
-                    models.DateTimeField(blank=True, null=True, verbose_name="last login"),
+                    models.DateTimeField(
+                        blank=True, null=True, verbose_name="last login"
+                    ),
                ),
                (
                    "is_superuser",
@ -51,25 +53,35 @@ class Migration(migrations.Migration):
                (
                    "username",
                    models.CharField(
-                        error_messages={"unique": "A user with that username already exists."},
+                        error_messages={
+                            "unique": "A user with that username already exists."
+                        },
                        help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
                        max_length=150,
                        unique=True,
-                        validators=[django.contrib.auth.validators.UnicodeUsernameValidator()],
+                        validators=[
+                            django.contrib.auth.validators.UnicodeUsernameValidator()
+                        ],
                        verbose_name="username",
                    ),
                ),
                (
                    "first_name",
-                    models.CharField(blank=True, max_length=30, verbose_name="first name"),
+                    models.CharField(
+                        blank=True, max_length=30, verbose_name="first name"
+                    ),
                ),
                (
                    "last_name",
-                    models.CharField(blank=True, max_length=150, verbose_name="last name"),
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="last name"
+                    ),
                ),
                (
                    "email",
-                    models.EmailField(blank=True, max_length=254, verbose_name="email address"),
+                    models.EmailField(
+                        blank=True, max_length=254, verbose_name="email address"
+                    ),
                ),
                (
                    "is_staff",
@ -205,7 +217,9 @@ class Migration(migrations.Migration):
                ),
                (
                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
+                    models.DateTimeField(
+                        default=authentik.core.models.default_token_duration
+                    ),
                ),
                ("expiring", models.BooleanField(default=True)),
                ("description", models.TextField(blank=True, default="")),
@ -292,7 +306,9 @@ class Migration(migrations.Migration):
                ("name", models.TextField(help_text="Application's display Name.")),
                (
                    "slug",
-                    models.SlugField(help_text="Internal application name, used in URLs."),
+                    models.SlugField(
+                        help_text="Internal application name, used in URLs."
+                    ),
                ),
                ("skip_authorization", models.BooleanField(default=False)),
                ("meta_launch_url", models.URLField(blank=True, default="")),
--- a/authentik/core/migrations/0003_default_user.py
+++ b/authentik/core/migrations/0003_default_user.py
@ -17,7 +17,9 @@ def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
        username="akadmin", email="root@localhost", name="authentik Default Admin"
    )
    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
+        akadmin.set_password(
+            environ.get("AK_ADMIN_PASS", "akadmin"), signal=False
+        )  # noqa # nosec
    else:
        akadmin.set_unusable_password()
    akadmin.save()
--- a/authentik/core/migrations/0006_auto_20200709_1608.py
+++ b/authentik/core/migrations/0006_auto_20200709_1608.py
@ -13,6 +13,8 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="source",
            name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
+            field=models.SlugField(
+                help_text="Internal source name, used in URLs.", unique=True
+            ),
        ),
    ]
--- a/authentik/core/migrations/0007_auto_20200815_1841.py
+++ b/authentik/core/migrations/0007_auto_20200815_1841.py
@ -13,6 +13,8 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="user",
            name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
+            field=models.CharField(
+                blank=True, max_length=150, verbose_name="first name"
+            ),
        ),
    ]
--- a/authentik/core/migrations/0009_group_is_superuser.py
+++ b/authentik/core/migrations/0009_group_is_superuser.py
@ -40,7 +40,9 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="user",
            name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
+            field=models.ManyToManyField(
+                related_name="users", to="authentik_core.Group"
+            ),
        ),
        migrations.AddField(
            model_name="group",
--- a/authentik/core/migrations/0014_auto_20201018_1158.py
+++ b/authentik/core/migrations/0014_auto_20201018_1158.py
@ -42,7 +42,9 @@ class Migration(migrations.Migration):
        ),
        migrations.AddIndex(
            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
+            index=models.Index(
+                fields=["identifier"], name="authentik_co_identif_1a34a8_idx"
+            ),
        ),
        migrations.RunPython(set_default_token_key),
    ]
--- a/authentik/core/migrations/0015_application_icon.py
+++ b/authentik/core/migrations/0015_application_icon.py
@ -17,6 +17,8 @@ class Migration(migrations.Migration):
        migrations.AddField(
            model_name="application",
            name="meta_icon",
-            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
+            field=models.FileField(
+                blank=True, default="", upload_to="application-icons/"
+            ),
        ),
    ]
--- a/authentik/core/migrations/0016_auto_20201202_2234.py
+++ b/authentik/core/migrations/0016_auto_20201202_2234.py
@ -25,7 +25,9 @@ class Migration(migrations.Migration):
        ),
        migrations.AddIndex(
            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
+            index=models.Index(
+                fields=["identifier"], name="authentik_c_identif_d9d032_idx"
+            ),
        ),
        migrations.AddIndex(
            model_name="token",
--- a/authentik/core/migrations/0022_authenticatedsession.py
+++ b/authentik/core/migrations/0022_authenticatedsession.py
@ -32,12 +32,16 @@ class Migration(migrations.Migration):
            fields=[
                (
                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
+                    models.DateTimeField(
+                        default=authentik.core.models.default_token_duration
+                    ),
                ),
                ("expiring", models.BooleanField(default=True)),
                (
                    "uuid",
-                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
+                    models.UUIDField(
+                        default=uuid.uuid4, primary_key=True, serialize=False
+                    ),
                ),
                ("session_key", models.CharField(max_length=40)),
                ("last_ip", models.TextField()),
--- a/authentik/core/migrations/0025_alter_application_meta_icon.py
+++ b/authentik/core/migrations/0025_alter_application_meta_icon.py
@ -13,6 +13,8 @@ class Migration(migrations.Migration):
        migrations.AlterField(
            model_name="application",
            name="meta_icon",
-            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
+            field=models.FileField(
+                default=None, null=True, upload_to="application-icons/"
+            ),
        ),
    ]
--- a/authentik/core/migrations/0026_alter_application_meta_icon.py
+++ b/authentik/core/migrations/0026_alter_application_meta_icon.py
@ -17,11 +17,4 @@ class Migration(migrations.Migration):
                default=None, max_length=500, null=True, upload_to="application-icons/"
            ),
        ),
-        migrations.AlterModelOptions(
-            name="authenticatedsession",
-            options={
-                "verbose_name": "Authenticated Session",
-                "verbose_name_plural": "Authenticated Sessions",
-            },
-        ),
    ]
--- a/authentik/core/migrations/0027_bootstrap_token.py
+++ b/authentik/core/migrations/0027_bootstrap_token.py
@ -1,37 +0,0 @@
-# Generated by Django 3.2.5 on 2021-08-11 19:40
-from os import environ
-
-from django.apps.registry import Apps
-from django.db import migrations
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import Token, TokenIntents, User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    if "AK_ADMIN_TOKEN" not in environ:
-        return
-    Token.objects.using(db_alias).create(
-        identifier="authentik-boostrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=environ["AK_ADMIN_TOKEN"],
-    )
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0026_alter_application_meta_icon"),
-    ]
-
-    operations = [
-        migrations.RunPython(create_default_user_token),
-    ]
--- a/authentik/core/migrations/0028_alter_token_intent.py
+++ b/authentik/core/migrations/0028_alter_token_intent.py
@ -1,26 +0,0 @@
-# Generated by Django 3.2.6 on 2021-08-23 14:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0027_bootstrap_token"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                    ("app_password", "Intent App Password"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]
--- a/authentik/core/models.py
+++ b/authentik/core/models.py
@ -28,7 +28,6 @@ from authentik.core.signals import password_changed
 from authentik.core.types import UILoginButton, UserSettingSerializer
 from authentik.flows.models import Flow
 from authentik.lib.config import CONFIG
-from authentik.lib.generators import generate_id
 from authentik.lib.models import CreatedUpdatedModel, SerializerModel
 from authentik.lib.utils.http import get_client_ip
 from authentik.managed.models import ManagedModel
@ -55,9 +54,7 @@ def default_token_duration():

 def default_token_key():
    """Default token key"""
-    # We use generate_id since the chars in the key should be easy
-    # to use in Emails (for verification) and URLs (for recovery)
-    return generate_id(128)
+    return uuid4().hex


 class Group(models.Model):
@ -157,7 +154,9 @@ class User(GuardianUserMixin, AbstractUser):
                ("s", "158"),
                ("r", "g"),
            ]
-            gravatar_url = f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
+            gravatar_url = (
+                f"{GRAVATAR_URL}/avatar/{mail_hash}?{urlencode(parameters, doseq=True)}"
+            )
            return escape(gravatar_url)
        return mode % {
            "username": self.username,
@ -187,7 +186,9 @@ class Provider(SerializerModel):
        related_name="provider_authorization",
    )

-    property_mappings = models.ManyToManyField("PropertyMapping", default=None, blank=True)
+    property_mappings = models.ManyToManyField(
+        "PropertyMapping", default=None, blank=True
+    )

    objects = InheritanceManager()

@ -217,7 +218,9 @@ class Application(PolicyBindingModel):
    add custom fields and other properties"""

    name = models.TextField(help_text=_("Application's display Name."))
-    slug = models.SlugField(help_text=_("Internal application name, used in URLs."), unique=True)
+    slug = models.SlugField(
+        help_text=_("Internal application name, used in URLs."), unique=True
+    )
    provider = models.OneToOneField(
        "Provider", null=True, blank=True, default=None, on_delete=models.SET_DEFAULT
    )
@ -241,7 +244,9 @@ class Application(PolicyBindingModel):
        it is returned as-is"""
        if not self.meta_icon:
            return None
-        if self.meta_icon.name.startswith("http") or self.meta_icon.name.startswith("/static"):
+        if self.meta_icon.name.startswith("http") or self.meta_icon.name.startswith(
+            "/static"
+        ):
            return self.meta_icon.name
        return self.meta_icon.url

@ -296,10 +301,14 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
    """Base Authentication source, i.e. an OAuth Provider, SAML Remote or LDAP Server"""

    name = models.TextField(help_text=_("Source's display Name."))
-    slug = models.SlugField(help_text=_("Internal source name, used in URLs."), unique=True)
+    slug = models.SlugField(
+        help_text=_("Internal source name, used in URLs."), unique=True
+    )

    enabled = models.BooleanField(default=True)
-    property_mappings = models.ManyToManyField("PropertyMapping", default=None, blank=True)
+    property_mappings = models.ManyToManyField(
+        "PropertyMapping", default=None, blank=True
+    )

    authentication_flow = models.ForeignKey(
        Flow,
@ -411,9 +420,6 @@ class TokenIntents(models.TextChoices):
    # Recovery use for the recovery app
    INTENT_RECOVERY = "recovery"

-    # App-specific passwords
-    INTENT_APP_PASSWORD = "app_password"  # nosec
-

 class Token(ManagedModel, ExpiringModel):
    """Token used to authenticate the User for API Access or confirm another Stage like Email."""
@ -476,7 +482,9 @@ class PropertyMapping(SerializerModel, ManagedModel):
        """Get serializer for this model"""
        raise NotImplementedError

-    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
+    def evaluate(
+        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
+    ) -> Any:
        """Evaluate `self.expression` using `**kwargs` as Context."""
        from authentik.core.expression import PropertyMappingEvaluator

@ -515,7 +523,9 @@ class AuthenticatedSession(ExpiringModel):
    last_used = models.DateTimeField(auto_now=True)

    @staticmethod
-    def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
+    def from_request(
+        request: HttpRequest, user: User
+    ) -> Optional["AuthenticatedSession"]:
        """Create a new session from a http request"""
        if not hasattr(request, "session") or not request.session.session_key:
            return None
@ -526,8 +536,3 @@ class AuthenticatedSession(ExpiringModel):
            last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
            expires=request.session.get_expiry_date(),
        )
-
-    class Meta:
-
-        verbose_name = _("Authenticated Session")
-        verbose_name_plural = _("Authenticated Sessions")
--- a/authentik/core/signals.py
+++ b/authentik/core/signals.py
@ -14,7 +14,9 @@ from prometheus_client import Gauge
 # Arguments: user: User, password: str
 password_changed = Signal()

-GAUGE_MODELS = Gauge("authentik_models", "Count of various objects", ["model_name", "app"])
+GAUGE_MODELS = Gauge(
+    "authentik_models", "Count of various objects", ["model_name", "app"]
+)

 if TYPE_CHECKING:
    from authentik.core.models import AuthenticatedSession, User
@ -58,11 +60,15 @@ def user_logged_out_session(sender, request: HttpRequest, user: "User", **_):
    """Delete AuthenticatedSession if it exists"""
    from authentik.core.models import AuthenticatedSession

-    AuthenticatedSession.objects.filter(session_key=request.session.session_key).delete()
+    AuthenticatedSession.objects.filter(
+        session_key=request.session.session_key
+    ).delete()


@receiver(pre_delete)
-def authenticated_session_delete(sender: Type[Model], instance: "AuthenticatedSession", **_):
+def authenticated_session_delete(
+    sender: Type[Model], instance: "AuthenticatedSession", **_
+):
    """Delete session when authenticated session is deleted"""
    from authentik.core.models import AuthenticatedSession

--- a/authentik/core/sources/flow_manager.py
+++ b/authentik/core/sources/flow_manager.py
@ -11,8 +11,16 @@ from django.urls import reverse
 from django.utils.translation import gettext as _
 from structlog.stdlib import get_logger

-from authentik.core.models import Source, SourceUserMatchingModes, User, UserSourceConnection
-from authentik.core.sources.stage import PLAN_CONTEXT_SOURCES_CONNECTION, PostUserEnrollmentStage
+from authentik.core.models import (
+    Source,
+    SourceUserMatchingModes,
+    User,
+    UserSourceConnection,
+)
+from authentik.core.sources.stage import (
+    PLAN_CONTEXT_SOURCES_CONNECTION,
+    PostUserEnrollmentStage,
+)
 from authentik.events.models import Event, EventAction
 from authentik.flows.models import Flow, Stage, in_memory_stage
 from authentik.flows.planner import (
@ -25,7 +33,7 @@ from authentik.flows.planner import (
 from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_GET, SESSION_KEY_PLAN
 from authentik.lib.utils.urls import redirect_with_qs
 from authentik.policies.utils import delete_none_keys
-from authentik.stages.password import BACKEND_INBUILT
+from authentik.stages.password import BACKEND_DJANGO
 from authentik.stages.password.stage import PLAN_CONTEXT_AUTHENTICATION_BACKEND
 from authentik.stages.prompt.stage import PLAN_CONTEXT_PROMPT

@ -68,7 +76,9 @@ class SourceFlowManager:
    # pylint: disable=too-many-return-statements
    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
        """decide which action should be taken"""
-        new_connection = self.connection_type(source=self.source, identifier=self.identifier)
+        new_connection = self.connection_type(
+            source=self.source, identifier=self.identifier
+        )
        # When request is authenticated, always link
        if self.request.user.is_authenticated:
            new_connection.user = self.request.user
@ -103,7 +113,9 @@ class SourceFlowManager:
            SourceUserMatchingModes.USERNAME_DENY,
        ]:
            if not self.enroll_info.get("username", None):
-                self._logger.warning("Refusing to use none username", source=self.source)
+                self._logger.warning(
+                    "Refusing to use none username", source=self.source
+                )
                return Action.DENY, None
            query = Q(username__exact=self.enroll_info.get("username", None))
        self._logger.debug("trying to link with existing user", query=query)
@ -189,7 +201,7 @@ class SourceFlowManager:
        kwargs.update(
            {
                # Since we authenticate the user by their token, they have no backend set
-                PLAN_CONTEXT_AUTHENTICATION_BACKEND: BACKEND_INBUILT,
+                PLAN_CONTEXT_AUTHENTICATION_BACKEND: BACKEND_DJANGO,
                PLAN_CONTEXT_SSO: True,
                PLAN_CONTEXT_SOURCE: self.source,
                PLAN_CONTEXT_REDIRECT: final_redirect,
@ -217,7 +229,10 @@ class SourceFlowManager:
        """Login user and redirect."""
        messages.success(
            self.request,
-            _("Successfully authenticated with %(source)s!" % {"source": self.source.name}),
+            _(
+                "Successfully authenticated with %(source)s!"
+                % {"source": self.source.name}
+            ),
        )
        flow_kwargs = {PLAN_CONTEXT_PENDING_USER: connection.user}
        return self._handle_login_flow(self.source.authentication_flow, **flow_kwargs)
@ -255,7 +270,10 @@ class SourceFlowManager:
        """User was not authenticated and previous request was not authenticated."""
        messages.success(
            self.request,
-            _("Successfully authenticated with %(source)s!" % {"source": self.source.name}),
+            _(
+                "Successfully authenticated with %(source)s!"
+                % {"source": self.source.name}
+            ),
        )

        # We run the Flow planner here so we can pass the Pending user in the context
--- a/authentik/core/tasks.py
+++ b/authentik/core/tasks.py
@ -7,14 +7,12 @@ from boto3.exceptions import Boto3Error
 from botocore.exceptions import BotoCoreError, ClientError
 from dbbackup.db.exceptions import CommandConnectorError
 from django.contrib.humanize.templatetags.humanize import naturaltime
-from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core import management
-from django.core.cache import cache
 from django.utils.timezone import now
 from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
 from structlog.stdlib import get_logger

-from authentik.core.models import AuthenticatedSession, ExpiringModel
+from authentik.core.models import ExpiringModel
 from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.lib.config import CONFIG
 from authentik.root.celery import CELERY_APP
@ -29,23 +27,15 @@ def clean_expired_models(self: MonitoredTask):
    for cls in ExpiringModel.__subclasses__():
        cls: ExpiringModel
        objects = (
-            cls.objects.all().exclude(expiring=False).exclude(expiring=True, expires__gt=now())
+            cls.objects.all()
+            .exclude(expiring=False)
+            .exclude(expiring=True, expires__gt=now())
        )
        for obj in objects:
            obj.expire_action()
        amount = objects.count()
        LOGGER.debug("Expired models", model=cls, amount=amount)
        messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
-    # Special case
-    amount = 0
-    for session in AuthenticatedSession.objects.all():
-        cache_key = f"{KEY_PREFIX}{session.session_key}"
-        value = cache.get(cache_key)
-        if not value:
-            session.delete()
-            amount += 1
-    LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
-    messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
    self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL, messages))


--- a/authentik/core/tests/test_applications_api.py
+++ b/authentik/core/tests/test_applications_api.py
@ -17,7 +17,9 @@ class TestApplicationsAPI(APITestCase):
        self.denied = Application.objects.create(name="denied", slug="denied")
        PolicyBinding.objects.create(
            target=self.denied,
-            policy=DummyPolicy.objects.create(name="deny", result=False, wait_min=1, wait_max=2),
+            policy=DummyPolicy.objects.create(
+                name="deny", result=False, wait_min=1, wait_max=2
+            ),
            order=0,
        )

@ -31,7 +33,9 @@ class TestApplicationsAPI(APITestCase):
            )
        )
        self.assertEqual(response.status_code, 200)
-        self.assertJSONEqual(force_str(response.content), {"messages": [], "passing": True})
+        self.assertJSONEqual(
+            force_str(response.content), {"messages": [], "passing": True}
+        )
        response = self.client.get(
            reverse(
                "authentik_api:application-check-access",
@ -39,7 +43,9 @@ class TestApplicationsAPI(APITestCase):
            )
        )
        self.assertEqual(response.status_code, 200)
-        self.assertJSONEqual(force_str(response.content), {"messages": ["dummy"], "passing": False})
+        self.assertJSONEqual(
+            force_str(response.content), {"messages": ["dummy"], "passing": False}
+        )

    def test_list(self):
        """Test list operation without superuser_full_list"""
--- a/authentik/core/tests/test_impersonation.py
+++ b/authentik/core/tests/test_impersonation.py
@ -46,7 +46,9 @@ class TestImpersonation(TestCase):
        self.client.force_login(self.other_user)

        self.client.get(
-            reverse("authentik_core:impersonate-init", kwargs={"user_id": self.akadmin.pk})
+            reverse(
+                "authentik_core:impersonate-init", kwargs={"user_id": self.akadmin.pk}
+            )
        )

        response = self.client.get(reverse("authentik_api:user-me"))
--- a/authentik/core/tests/test_models.py
+++ b/authentik/core/tests/test_models.py
@ -22,7 +22,9 @@ class TestModels(TestCase):

    def test_token_expire_no_expire(self):
        """Test token expiring with "expiring" set"""
-        token = Token.objects.create(expires=now(), user=get_anonymous_user(), expiring=False)
+        token = Token.objects.create(
+            expires=now(), user=get_anonymous_user(), expiring=False
+        )
        sleep(0.5)
        self.assertFalse(token.is_expired)

--- a/authentik/core/tests/test_property_mapping.py
+++ b/authentik/core/tests/test_property_mapping.py
@ -16,7 +16,9 @@ class TestPropertyMappings(TestCase):

    def test_expression(self):
        """Test expression"""
-        mapping = PropertyMapping.objects.create(name="test", expression="return 'test'")
+        mapping = PropertyMapping.objects.create(
+            name="test", expression="return 'test'"
+        )
        self.assertEqual(mapping.evaluate(None, None), "test")

    def test_expression_syntax(self):
--- a/authentik/core/tests/test_property_mapping_api.py
+++ b/authentik/core/tests/test_property_mapping_api.py
@ -23,7 +23,9 @@ class TestPropertyMappingAPI(APITestCase):
    def test_test_call(self):
        """Test PropertMappings's test endpoint"""
        response = self.client.post(
-            reverse("authentik_api:propertymapping-test", kwargs={"pk": self.mapping.pk}),
+            reverse(
+                "authentik_api:propertymapping-test", kwargs={"pk": self.mapping.pk}
+            ),
            data={
                "user": self.user.pk,
            },
--- a/authentik/core/tests/test_source_flow_manager.py
+++ b/authentik/core/tests/test_source_flow_manager.py
@ -1,13 +1,16 @@
 """Test Source flow_manager"""
 from django.contrib.auth.models import AnonymousUser
+from django.contrib.messages.middleware import MessageMiddleware
+from django.contrib.sessions.middleware import SessionMiddleware
+from django.http.request import HttpRequest
 from django.test import TestCase
 from django.test.client import RequestFactory
 from guardian.utils import get_anonymous_user

 from authentik.core.models import SourceUserMatchingModes, User
 from authentik.core.sources.flow_manager import Action
-from authentik.lib.generators import generate_id
-from authentik.lib.tests.utils import get_request
+from authentik.flows.tests.test_planner import dummy_get_response
+from authentik.providers.oauth2.generators import generate_client_id
 from authentik.sources.oauth.models import OAuthSource, UserOAuthSourceConnection
 from authentik.sources.oauth.views.callback import OAuthSourceFlowManager

@ -19,12 +22,24 @@ class TestSourceFlowManager(TestCase):
        super().setUp()
        self.source = OAuthSource.objects.create(name="test")
        self.factory = RequestFactory()
-        self.identifier = generate_id()
+        self.identifier = generate_client_id()
+
+    def get_request(self, user: User) -> HttpRequest:
+        """Helper to create a get request with session and message middleware"""
+        request = self.factory.get("/")
+        request.user = user
+        middleware = SessionMiddleware(dummy_get_response)
+        middleware.process_request(request)
+        request.session.save()
+        middleware = MessageMiddleware(dummy_get_response)
+        middleware.process_request(request)
+        request.session.save()
+        return request

    def test_unauthenticated_enroll(self):
        """Test un-authenticated user enrolling"""
        flow_manager = OAuthSourceFlowManager(
-            self.source, get_request("/", user=AnonymousUser()), self.identifier, {}
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
        )
        action, _ = flow_manager.get_action()
        self.assertEqual(action, Action.ENROLL)
@ -37,7 +52,7 @@ class TestSourceFlowManager(TestCase):
        )

        flow_manager = OAuthSourceFlowManager(
-            self.source, get_request("/", user=AnonymousUser()), self.identifier, {}
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
        )
        action, _ = flow_manager.get_action()
        self.assertEqual(action, Action.AUTH)
@ -50,7 +65,7 @@ class TestSourceFlowManager(TestCase):
        )
        user = User.objects.create(username="foo", email="foo@bar.baz")
        flow_manager = OAuthSourceFlowManager(
-            self.source, get_request("/", user=user), self.identifier, {}
+            self.source, self.get_request(user), self.identifier, {}
        )
        action, _ = flow_manager.get_action()
        self.assertEqual(action, Action.LINK)
@ -63,7 +78,7 @@ class TestSourceFlowManager(TestCase):

        # Without email, deny
        flow_manager = OAuthSourceFlowManager(
-            self.source, get_request("/", user=AnonymousUser()), self.identifier, {}
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
        )
        action, _ = flow_manager.get_action()
        self.assertEqual(action, Action.DENY)
@ -71,7 +86,7 @@ class TestSourceFlowManager(TestCase):
        # With email
        flow_manager = OAuthSourceFlowManager(
            self.source,
-            get_request("/", user=AnonymousUser()),
+            self.get_request(AnonymousUser()),
            self.identifier,
            {"email": "foo@bar.baz"},
        )
@ -86,7 +101,7 @@ class TestSourceFlowManager(TestCase):

        # Without username, deny
        flow_manager = OAuthSourceFlowManager(
-            self.source, get_request("/", user=AnonymousUser()), self.identifier, {}
+            self.source, self.get_request(AnonymousUser()), self.identifier, {}
        )
        action, _ = flow_manager.get_action()
        self.assertEqual(action, Action.DENY)
@ -94,7 +109,7 @@ class TestSourceFlowManager(TestCase):
        # With username
        flow_manager = OAuthSourceFlowManager(
            self.source,
-            get_request("/", user=AnonymousUser()),
+            self.get_request(AnonymousUser()),
            self.identifier,
            {"username": "foo"},
        )
@ -110,7 +125,7 @@ class TestSourceFlowManager(TestCase):
        # With non-existent username, enroll
        flow_manager = OAuthSourceFlowManager(
            self.source,
-            get_request("/", user=AnonymousUser()),
+            self.get_request(AnonymousUser()),
            self.identifier,
            {
                "username": "bar",
@ -122,7 +137,7 @@ class TestSourceFlowManager(TestCase):
        # With username
        flow_manager = OAuthSourceFlowManager(
            self.source,
-            get_request("/", user=AnonymousUser()),
+            self.get_request(AnonymousUser()),
            self.identifier,
            {"username": "foo"},
        )
@ -136,7 +151,7 @@ class TestSourceFlowManager(TestCase):

        flow_manager = OAuthSourceFlowManager(
            self.source,
-            get_request("/", user=AnonymousUser()),
+            self.get_request(AnonymousUser()),
            self.identifier,
            {"username": "foo"},
        )
--- a/authentik/core/tests/test_token_api.py
+++ b/authentik/core/tests/test_token_api.py
@ -4,7 +4,12 @@ from django.utils.timezone import now
 from guardian.shortcuts import get_anonymous_user
 from rest_framework.test import APITestCase

-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
+from authentik.core.models import (
+    USER_ATTRIBUTE_TOKEN_EXPIRING,
+    Token,
+    TokenIntents,
+    User,
+)
 from authentik.core.tasks import clean_expired_models


@ -27,14 +32,6 @@ class TestTokenAPI(APITestCase):
        self.assertEqual(token.intent, TokenIntents.INTENT_API)
        self.assertEqual(token.expiring, True)

-    def test_token_create_invalid(self):
-        """Test token creation endpoint (invalid data)"""
-        response = self.client.post(
-            reverse("authentik_api:token-list"),
-            {"identifier": "test-token", "intent": TokenIntents.INTENT_RECOVERY},
-        )
-        self.assertEqual(response.status_code, 400)
-
    def test_token_create_non_expiring(self):
        """Test token creation endpoint"""
        self.user.attributes[USER_ATTRIBUTE_TOKEN_EXPIRING] = False
--- a/authentik/core/tests/test_token_auth.py
+++ b/authentik/core/tests/test_token_auth.py
@ -1,40 +0,0 @@
-"""Test token auth"""
-from django.test import TestCase
-
-from authentik.core.auth import TokenBackend
-from authentik.core.models import Token, TokenIntents, User
-from authentik.flows.planner import FlowPlan
-from authentik.flows.views import SESSION_KEY_PLAN
-from authentik.lib.tests.utils import get_request
-
-
-class TestTokenAuth(TestCase):
-    """Test token auth"""
-
-    def setUp(self) -> None:
-        self.user = User.objects.create(username="test-user")
-        self.token = Token.objects.create(
-            expiring=False, user=self.user, intent=TokenIntents.INTENT_APP_PASSWORD
-        )
-        # To test with session we need to create a request and pass it through all middlewares
-        self.request = get_request("/")
-        self.request.session[SESSION_KEY_PLAN] = FlowPlan("test")
-
-    def test_token_auth(self):
-        """Test auth with token"""
-        self.assertEqual(
-            TokenBackend().authenticate(self.request, "test-user", self.token.key), self.user
-        )
-
-    def test_token_auth_none(self):
-        """Test auth with token (non-existent user)"""
-        self.assertIsNone(
-            TokenBackend().authenticate(self.request, "test-user-foo", self.token.key), self.user
-        )
-
-    def test_token_auth_invalid(self):
-        """Test auth with token (invalid token)"""
-        self.assertIsNone(
-            TokenBackend().authenticate(self.request, "test-user", self.token.key + "foo"),
-            self.user,
-        )
--- a/authentik/core/tests/test_users_api.py
+++ b/authentik/core/tests/test_users_api.py
@ -3,9 +3,6 @@ from django.urls.base import reverse
 from rest_framework.test import APITestCase

 from authentik.core.models import User
-from authentik.flows.models import Flow, FlowDesignation
-from authentik.stages.email.models import EmailStage
-from authentik.tenants.models import Tenant


 class TestUsersAPI(APITestCase):
@ -30,114 +27,3 @@ class TestUsersAPI(APITestCase):
            reverse("authentik_api:user-metrics", kwargs={"pk": self.user.pk})
        )
        self.assertEqual(response.status_code, 403)
-
-    def test_recovery_no_flow(self):
-        """Test user recovery link (no recovery flow set)"""
-        self.client.force_login(self.admin)
-        response = self.client.get(
-            reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 404)
-
-    def test_recovery(self):
-        """Test user recovery link (no recovery flow set)"""
-        flow = Flow.objects.create(
-            name="test", title="test", slug="test", designation=FlowDesignation.RECOVERY
-        )
-        tenant: Tenant = Tenant.objects.first()
-        tenant.flow_recovery = flow
-        tenant.save()
-        self.client.force_login(self.admin)
-        response = self.client.get(
-            reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 200)
-
-    def test_recovery_email_no_flow(self):
-        """Test user recovery link (no recovery flow set)"""
-        self.client.force_login(self.admin)
-        response = self.client.get(
-            reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 404)
-        self.user.email = "foo@bar.baz"
-        self.user.save()
-        response = self.client.get(
-            reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 404)
-
-    def test_recovery_email_no_stage(self):
-        """Test user recovery link (no email stage)"""
-        self.user.email = "foo@bar.baz"
-        self.user.save()
-        flow = Flow.objects.create(
-            name="test", title="test", slug="test", designation=FlowDesignation.RECOVERY
-        )
-        tenant: Tenant = Tenant.objects.first()
-        tenant.flow_recovery = flow
-        tenant.save()
-        self.client.force_login(self.admin)
-        response = self.client.get(
-            reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
-        )
-        self.assertEqual(response.status_code, 404)
-
-    def test_recovery_email(self):
-        """Test user recovery link"""
-        self.user.email = "foo@bar.baz"
-        self.user.save()
-        flow = Flow.objects.create(
-            name="test", title="test", slug="test", designation=FlowDesignation.RECOVERY
-        )
-        tenant: Tenant = Tenant.objects.first()
-        tenant.flow_recovery = flow
-        tenant.save()
-
-        stage = EmailStage.objects.create(name="email")
-
-        self.client.force_login(self.admin)
-        response = self.client.get(
-            reverse(
-                "authentik_api:user-recovery-email",
-                kwargs={"pk": self.user.pk},
-            )
-            + f"?email_stage={stage.pk}"
-        )
-        self.assertEqual(response.status_code, 204)
-
-    def test_service_account(self):
-        """Service account creation"""
-        self.client.force_login(self.admin)
-        response = self.client.post(reverse("authentik_api:user-service-account"))
-        self.assertEqual(response.status_code, 400)
-        response = self.client.post(
-            reverse("authentik_api:user-service-account"),
-            data={
-                "name": "test-sa",
-                "create_group": True,
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertTrue(User.objects.filter(username="test-sa").exists())
-
-    def test_service_account_invalid(self):
-        """Service account creation (twice with same name, expect error)"""
-        self.client.force_login(self.admin)
-        response = self.client.post(
-            reverse("authentik_api:user-service-account"),
-            data={
-                "name": "test-sa",
-                "create_group": True,
-            },
-        )
-        self.assertEqual(response.status_code, 200)
-        self.assertTrue(User.objects.filter(username="test-sa").exists())
-        response = self.client.post(
-            reverse("authentik_api:user-service-account"),
-            data={
-                "name": "test-sa",
-                "create_group": True,
-            },
-        )
-        self.assertEqual(response.status_code, 400)
--- a/authentik/core/views/impersonate.py
+++ b/authentik/core/views/impersonate.py
@ -5,7 +5,10 @@ from django.shortcuts import get_object_or_404, redirect
 from django.views import View
 from structlog.stdlib import get_logger

-from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
+from authentik.core.middleware import (
+    SESSION_IMPERSONATE_ORIGINAL_USER,
+    SESSION_IMPERSONATE_USER,
+)
 from authentik.core.models import User
 from authentik.events.models import Event, EventAction

@ -18,7 +21,9 @@ class ImpersonateInitView(View):
    def get(self, request: HttpRequest, user_id: int) -> HttpResponse:
        """Impersonation handler, checks permissions"""
        if not request.user.has_perm("impersonate"):
-            LOGGER.debug("User attempted to impersonate without permissions", user=request.user)
+            LOGGER.debug(
+                "User attempted to impersonate without permissions", user=request.user
+            )
            return HttpResponse("Unauthorized", status=401)

        user_to_be = get_object_or_404(User, pk=user_id)
--- a/authentik/core/views/session.py
+++ b/authentik/core/views/session.py
@ -14,7 +14,9 @@ class EndSessionView(TemplateView, PolicyAccessView):
    template_name = "if/end_session.html"

    def resolve_provider_application(self):
-        self.application = get_object_or_404(Application, slug=self.kwargs["application_slug"])
+        self.application = get_object_or_404(
+            Application, slug=self.kwargs["application_slug"]
+        )

    def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
        context = super().get_context_data(**kwargs)
--- a/authentik/crypto/api.py
+++ b/authentik/crypto/api.py
@ -10,7 +10,12 @@ from django_filters.filters import BooleanFilter
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, DateTimeField, IntegerField, SerializerMethodField
+from rest_framework.fields import (
+    CharField,
+    DateTimeField,
+    IntegerField,
+    SerializerMethodField,
+)
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, ValidationError
@ -81,7 +86,9 @@ class CertificateKeyPairSerializer(ModelSerializer):
                    backend=default_backend(),
                )
            except (ValueError, TypeError):
-                raise ValidationError("Unable to load private key (possibly encrypted?).")
+                raise ValidationError(
+                    "Unable to load private key (possibly encrypted?)."
+                )
        return value

    class Meta:
@ -116,7 +123,9 @@ class CertificateGenerationSerializer(PassiveSerializer):
    """Certificate generation parameters"""

    common_name = CharField()
-    subject_alt_name = CharField(required=False, allow_blank=True, label=_("Subject-alt name"))
+    subject_alt_name = CharField(
+        required=False, allow_blank=True, label=_("Subject-alt name")
+    )
    validity_days = IntegerField(initial=365)


@ -161,7 +170,9 @@ class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
        builder = CertificateBuilder()
        builder.common_name = data.validated_data["common_name"]
        builder.build(
-            subject_alt_names=data.validated_data.get("subject_alt_name", "").split(","),
+            subject_alt_names=data.validated_data.get("subject_alt_name", "").split(
+                ","
+            ),
            validity_days=int(data.validated_data["validity_days"]),
        )
        instance = builder.save()
@ -197,7 +208,9 @@ class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
                "Content-Disposition"
            ] = f'attachment; filename="{certificate.name}_certificate.pem"'
            return response
-        return Response(CertificateDataSerializer({"data": certificate.certificate_data}).data)
+        return Response(
+            CertificateDataSerializer({"data": certificate.certificate_data}).data
+        )

    @extend_schema(
        parameters=[
@ -221,7 +234,9 @@ class CertificateKeyPairViewSet(UsedByMixin, ModelViewSet):
        ).from_http(request)
        if "download" in request._request.GET:
            # Mime type from https://pki-tutorial.readthedocs.io/en/latest/mime.html
-            response = HttpResponse(certificate.key_data, content_type="application/x-pem-file")
+            response = HttpResponse(
+                certificate.key_data, content_type="application/x-pem-file"
+            )
            response[
                "Content-Disposition"
            ] = f'attachment; filename="{certificate.name}_private_key.pem"'
--- a/authentik/crypto/builder.py
+++ b/authentik/crypto/builder.py
@ -46,7 +46,9 @@ class CertificateBuilder:
            public_exponent=65537, key_size=2048, backend=default_backend()
        )
        self.__public_key = self.__private_key.public_key()
-        alt_names: list[x509.GeneralName] = [x509.DNSName(x) for x in subject_alt_names or []]
+        alt_names: list[x509.GeneralName] = [
+            x509.DNSName(x) for x in subject_alt_names or []
+        ]
        self.__builder = (
            x509.CertificateBuilder()
            .subject_name(
@ -57,7 +59,9 @@ class CertificateBuilder:
                            self.common_name,
                        ),
                        x509.NameAttribute(NameOID.ORGANIZATION_NAME, "authentik"),
-                        x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Self-signed"),
+                        x509.NameAttribute(
+                            NameOID.ORGANIZATIONAL_UNIT_NAME, "Self-signed"
+                        ),
                    ]
                )
            )
@ -73,7 +77,9 @@ class CertificateBuilder:
            )
            .add_extension(x509.SubjectAlternativeName(alt_names), critical=True)
            .not_valid_before(datetime.datetime.today() - one_day)
-            .not_valid_after(datetime.datetime.today() + datetime.timedelta(days=validity_days))
+            .not_valid_after(
+                datetime.datetime.today() + datetime.timedelta(days=validity_days)
+            )
            .serial_number(int(uuid.uuid4()))
            .public_key(self.__public_key)
        )
--- a/authentik/crypto/models.py
+++ b/authentik/crypto/models.py
@ -57,7 +57,9 @@ class CertificateKeyPair(CreatedUpdatedModel):
        if not self._private_key and self._private_key != "":
            try:
                self._private_key = load_pem_private_key(
-                    str.encode("\n".join([x.strip() for x in self.key_data.split("\n")])),
+                    str.encode(
+                        "\n".join([x.strip() for x in self.key_data.split("\n")])
+                    ),
                    password=None,
                    backend=default_backend(),
                )
@ -68,18 +70,24 @@ class CertificateKeyPair(CreatedUpdatedModel):
    @property
    def fingerprint_sha256(self) -> str:
        """Get SHA256 Fingerprint of certificate_data"""
-        return hexlify(self.certificate.fingerprint(hashes.SHA256()), ":").decode("utf-8")
+        return hexlify(self.certificate.fingerprint(hashes.SHA256()), ":").decode(
+            "utf-8"
+        )

    @property
    def fingerprint_sha1(self) -> str:
        """Get SHA1 Fingerprint of certificate_data"""
-        return hexlify(self.certificate.fingerprint(hashes.SHA1()), ":").decode("utf-8")  # nosec
+        return hexlify(
+            self.certificate.fingerprint(hashes.SHA1()), ":"  # nosec
+        ).decode("utf-8")

    @property
    def kid(self):
        """Get Key ID used for JWKS"""
        return "{0}".format(
-            md5(self.key_data.encode("utf-8")).hexdigest() if self.key_data else ""  # nosec
+            md5(self.key_data.encode("utf-8")).hexdigest()  # nosec
+            if self.key_data
+            else ""
        )

    def __str__(self) -> str:
--- a/authentik/crypto/tests.py
+++ b/authentik/crypto/tests.py
@ -10,7 +10,7 @@ from authentik.crypto.api import CertificateKeyPairSerializer
 from authentik.crypto.builder import CertificateBuilder
 from authentik.crypto.models import CertificateKeyPair
 from authentik.flows.models import Flow
-from authentik.lib.generators import generate_key
+from authentik.providers.oauth2.generators import generate_client_secret
 from authentik.providers.oauth2.models import OAuth2Provider


@ -103,7 +103,7 @@ class TestCrypto(TestCase):
        provider = OAuth2Provider.objects.create(
            name="test",
            client_id="test",
-            client_secret=generate_key(),
+            client_secret=generate_client_secret(),
            authorization_flow=Flow.objects.first(),
            redirect_uris="http://localhost",
            rsa_key=CertificateKeyPair.objects.first(),
--- a/authentik/events/api/event.py
+++ b/authentik/events/api/event.py
@ -143,5 +143,7 @@ class EventViewSet(ModelViewSet):
        """Get all actions"""
        data = []
        for value, name in EventAction.choices:
-            data.append({"name": name, "description": "", "component": value, "model_name": ""})
+            data.append(
+                {"name": name, "description": "", "component": value, "model_name": ""}
+            )
        return Response(TypeCreateSerializer(data, many=True).data)
--- a/authentik/events/api/notification_rule.py
+++ b/authentik/events/api/notification_rule.py
@ -30,5 +30,3 @@ class NotificationRuleViewSet(UsedByMixin, ModelViewSet):

    queryset = NotificationRule.objects.all()
    serializer_class = NotificationRuleSerializer
-    filterset_fields = ["name", "severity", "group__name"]
-    ordering = ["name"]
--- a/authentik/events/api/notification_transport.py
+++ b/authentik/events/api/notification_transport.py
@ -5,12 +5,11 @@ from rest_framework.decorators import action
 from rest_framework.fields import CharField, ListField, SerializerMethodField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer
+from rest_framework.serializers import ModelSerializer, Serializer
 from rest_framework.viewsets import ModelViewSet

 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import PassiveSerializer
 from authentik.events.models import (
    Notification,
    NotificationSeverity,
@ -42,19 +41,23 @@ class NotificationTransportSerializer(ModelSerializer):
        ]


-class NotificationTransportTestSerializer(PassiveSerializer):
+class NotificationTransportTestSerializer(Serializer):
    """Notification test serializer"""

    messages = ListField(child=CharField())

+    def create(self, validated_data: Request) -> Response:
+        raise NotImplementedError
+
+    def update(self, request: Request) -> Response:
+        raise NotImplementedError
+

 class NotificationTransportViewSet(UsedByMixin, ModelViewSet):
    """NotificationTransport Viewset"""

    queryset = NotificationTransport.objects.all()
    serializer_class = NotificationTransportSerializer
-    filterset_fields = ["name", "mode", "webhook_url", "send_once"]
-    ordering = ["name"]

    @permission_required("authentik_events.change_notificationtransport")
    @extend_schema(
--- a/authentik/events/middleware.py
+++ b/authentik/events/middleware.py
@ -29,8 +29,12 @@ class AuditMiddleware:

    def __call__(self, request: HttpRequest) -> HttpResponse:
        # Connect signal for automatic logging
-        if hasattr(request, "user") and getattr(request.user, "is_authenticated", False):
-            post_save_handler = partial(self.post_save_handler, user=request.user, request=request)
+        if hasattr(request, "user") and getattr(
+            request.user, "is_authenticated", False
+        ):
+            post_save_handler = partial(
+                self.post_save_handler, user=request.user, request=request
+            )
            pre_delete_handler = partial(
                self.pre_delete_handler, user=request.user, request=request
            )
@ -90,9 +94,13 @@ class AuditMiddleware:

    @staticmethod
    # pylint: disable=unused-argument
-    def pre_delete_handler(user: User, request: HttpRequest, sender, instance: Model, **_):
+    def pre_delete_handler(
+        user: User, request: HttpRequest, sender, instance: Model, **_
+    ):
        """Signal handler for all object's pre_delete"""
-        if isinstance(instance, (Event, Notification, UserObjectPermission)):  # pragma: no cover
+        if isinstance(
+            instance, (Event, Notification, UserObjectPermission)
+        ):  # pragma: no cover
            return

        EventNewThread(
--- a/authentik/events/migrations/0003_auto_20200917_1155.py
+++ b/authentik/events/migrations/0003_auto_20200917_1155.py
@ -14,7 +14,9 @@ def convert_user_to_json(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
        event.delete()
        # Because event objects cannot be updated, we have to re-create them
        event.pk = None
-        event.user_json = authentik.events.models.get_user(event.user) if event.user else {}
+        event.user_json = (
+            authentik.events.models.get_user(event.user) if event.user else {}
+        )
        event._state.adding = True
        event.save()

@ -56,5 +58,7 @@ class Migration(migrations.Migration):
            model_name="event",
            name="user",
        ),
-        migrations.RenameField(model_name="event", old_name="user_json", new_name="user"),
+        migrations.RenameField(
+            model_name="event", old_name="user_json", new_name="user"
+        ),
    ]
--- a/authentik/events/migrations/0011_notification_rules_default_v1.py
+++ b/authentik/events/migrations/0011_notification_rules_default_v1.py
@ -11,12 +11,16 @@ def notify_configuration_error(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
    db_alias = schema_editor.connection.alias
    Group = apps.get_model("authentik_core", "Group")
    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")

    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
    )

    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
@ -28,7 +32,9 @@ def notify_configuration_error(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
    )
    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
    )
    trigger.save()
    PolicyBinding.objects.using(db_alias).update_or_create(
@ -44,12 +50,16 @@ def notify_update(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
    db_alias = schema_editor.connection.alias
    Group = apps.get_model("authentik_core", "Group")
    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")

    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
    )

    policy, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
@ -61,7 +71,9 @@ def notify_update(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
    )
    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
    )
    trigger.save()
    PolicyBinding.objects.using(db_alias).update_or_create(
@ -77,12 +89,16 @@ def notify_exception(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
    db_alias = schema_editor.connection.alias
    Group = apps.get_model("authentik_core", "Group")
    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")
-    EventMatcherPolicy = apps.get_model("authentik_policies_event_matcher", "EventMatcherPolicy")
+    EventMatcherPolicy = apps.get_model(
+        "authentik_policies_event_matcher", "EventMatcherPolicy"
+    )
    NotificationRule = apps.get_model("authentik_events", "NotificationRule")
    NotificationTransport = apps.get_model("authentik_events", "NotificationTransport")

    admin_group = (
-        Group.objects.using(db_alias).filter(name="authentik Admins", is_superuser=True).first()
+        Group.objects.using(db_alias)
+        .filter(name="authentik Admins", is_superuser=True)
+        .first()
    )

    policy_policy_exc, _ = EventMatcherPolicy.objects.using(db_alias).update_or_create(
@ -98,7 +114,9 @@ def notify_exception(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
        defaults={"group": admin_group, "severity": NotificationSeverity.ALERT},
    )
    trigger.transports.set(
-        NotificationTransport.objects.using(db_alias).filter(name="default-email-transport")
+        NotificationTransport.objects.using(db_alias).filter(
+            name="default-email-transport"
+        )
    )
    trigger.save()
    PolicyBinding.objects.using(db_alias).update_or_create(
--- a/authentik/events/migrations/0014_expiry.py
+++ b/authentik/events/migrations/0014_expiry.py
@ -38,7 +38,9 @@ def progress_bar(

    def print_progress_bar(iteration):
        """Progress Bar Printing Function"""
-        percent = ("{0:." + str(decimals) + "f}").format(100 * (iteration / float(total)))
+        percent = ("{0:." + str(decimals) + "f}").format(
+            100 * (iteration / float(total))
+        )
        filledLength = int(length * iteration // total)
        bar = fill * filledLength + "-" * (length - filledLength)
        print(f"\r{prefix} |{bar}| {percent}% {suffix}", end=print_end)
@ -76,7 +78,9 @@ class Migration(migrations.Migration):
        migrations.AddField(
            model_name="event",
            name="expires",
-            field=models.DateTimeField(default=authentik.events.models.default_event_duration),
+            field=models.DateTimeField(
+                default=authentik.events.models.default_event_duration
+            ),
        ),
        migrations.AddField(
            model_name="event",
--- a/authentik/events/migrations/0016_add_tenant.py
+++ b/authentik/events/migrations/0016_add_tenant.py
@ -15,7 +15,9 @@ class Migration(migrations.Migration):
        migrations.AddField(
            model_name="event",
            name="tenant",
-            field=models.JSONField(blank=True, default=authentik.events.models.default_tenant),
+            field=models.JSONField(
+                blank=True, default=authentik.events.models.default_tenant
+            ),
        ),
        migrations.AlterField(
            model_name="event",
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@ -15,7 +15,10 @@ from requests import RequestException, post
 from structlog.stdlib import get_logger

 from authentik import __version__
-from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
+from authentik.core.middleware import (
+    SESSION_IMPERSONATE_ORIGINAL_USER,
+    SESSION_IMPERSONATE_USER,
+)
 from authentik.core.models import ExpiringModel, Group, User
 from authentik.events.geo import GEOIP_READER
 from authentik.events.utils import cleanse_dict, get_user, model_to_dict, sanitize_dict
@ -156,7 +159,9 @@ class Event(ExpiringModel):
        if hasattr(request, "user"):
            original_user = None
            if hasattr(request, "session"):
-                original_user = request.session.get(SESSION_IMPERSONATE_ORIGINAL_USER, None)
+                original_user = request.session.get(
+                    SESSION_IMPERSONATE_ORIGINAL_USER, None
+                )
            self.user = get_user(request.user, original_user)
        if user:
            self.user = get_user(user)
@ -164,7 +169,9 @@ class Event(ExpiringModel):
        if hasattr(request, "session"):
            if SESSION_IMPERSONATE_ORIGINAL_USER in request.session:
                self.user = get_user(request.session[SESSION_IMPERSONATE_ORIGINAL_USER])
-                self.user["on_behalf_of"] = get_user(request.session[SESSION_IMPERSONATE_USER])
+                self.user["on_behalf_of"] = get_user(
+                    request.session[SESSION_IMPERSONATE_USER]
+                )
        # User 255.255.255.255 as fallback if IP cannot be determined
        self.client_ip = get_client_ip(request)
        # Apply GeoIP Data, when enabled
@ -407,7 +414,9 @@ class NotificationRule(PolicyBindingModel):
    severity = models.TextField(
        choices=NotificationSeverity.choices,
        default=NotificationSeverity.NOTICE,
-        help_text=_("Controls which severity level the created notifications will have."),
+        help_text=_(
+            "Controls which severity level the created notifications will have."
+        ),
    )
    group = models.ForeignKey(
        Group,
--- a/authentik/events/monitored_tasks.py
+++ b/authentik/events/monitored_tasks.py
@ -135,7 +135,9 @@ class MonitoredTask(Task):
        self._result = result

    # pylint: disable=too-many-arguments
-    def after_return(self, status, retval, task_id, args: list[Any], kwargs: dict[str, Any], einfo):
+    def after_return(
+        self, status, retval, task_id, args: list[Any], kwargs: dict[str, Any], einfo
+    ):
        if self._result:
            if not self._result.uid:
                self._result.uid = self._uid
@ -157,7 +159,9 @@ class MonitoredTask(Task):
    # pylint: disable=too-many-arguments
    def on_failure(self, exc, task_id, args, kwargs, einfo):
        if not self._result:
-            self._result = TaskResult(status=TaskResultStatus.ERROR, messages=[str(exc)])
+            self._result = TaskResult(
+                status=TaskResultStatus.ERROR, messages=[str(exc)]
+            )
        if not self._result.uid:
            self._result.uid = self._uid
        TaskInfo(
@ -175,7 +179,8 @@ class MonitoredTask(Task):
        Event.new(
            EventAction.SYSTEM_TASK_EXCEPTION,
            message=(
-                f"Task {self.__name__} encountered an error: " "\n".join(self._result.messages)
+                f"Task {self.__name__} encountered an error: "
+                "\n".join(self._result.messages)
            ),
        ).save()
        return super().on_failure(exc, task_id, args, kwargs, einfo=einfo)
--- a/authentik/events/signals.py
+++ b/authentik/events/signals.py
@ -2,7 +2,11 @@
 from threading import Thread
 from typing import Any, Optional

-from django.contrib.auth.signals import user_logged_in, user_logged_out, user_login_failed
+from django.contrib.auth.signals import (
+    user_logged_in,
+    user_logged_out,
+    user_login_failed,
+)
 from django.db.models.signals import post_save
 from django.dispatch import receiver
 from django.http import HttpRequest
@ -15,7 +19,6 @@ from authentik.flows.planner import PLAN_CONTEXT_SOURCE, FlowPlan
 from authentik.flows.views import SESSION_KEY_PLAN
 from authentik.stages.invitation.models import Invitation
 from authentik.stages.invitation.signals import invitation_used
-from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
 from authentik.stages.user_write.signals import user_write


@ -27,7 +30,9 @@ class EventNewThread(Thread):
    kwargs: dict[str, Any]
    user: Optional[User] = None

-    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
+    def __init__(
+        self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs
+    ):
        super().__init__()
        self.action = action
        self.request = request
@ -47,13 +52,7 @@ def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
        flow_plan: FlowPlan = request.session[SESSION_KEY_PLAN]
        if PLAN_CONTEXT_SOURCE in flow_plan.context:
            # Login request came from an external source, save it in the context
-            thread.kwargs[PLAN_CONTEXT_SOURCE] = flow_plan.context[PLAN_CONTEXT_SOURCE]
-        if PLAN_CONTEXT_METHOD in flow_plan.context:
-            thread.kwargs[PLAN_CONTEXT_METHOD] = flow_plan.context[PLAN_CONTEXT_METHOD]
-            # Save the login method used
-            thread.kwargs[PLAN_CONTEXT_METHOD_ARGS] = flow_plan.context.get(
-                PLAN_CONTEXT_METHOD_ARGS, {}
-            )
+            thread.kwargs["using_source"] = flow_plan.context[PLAN_CONTEXT_SOURCE]
    thread.user = user
    thread.run()

@ -69,7 +68,9 @@ def on_user_logged_out(sender, request: HttpRequest, user: User, **_):

@receiver(user_write)
 # pylint: disable=unused-argument
-def on_user_write(sender, request: HttpRequest, user: User, data: dict[str, Any], **kwargs):
+def on_user_write(
+    sender, request: HttpRequest, user: User, data: dict[str, Any], **kwargs
+):
    """Log User write"""
    thread = EventNewThread(EventAction.USER_WRITE, request, **data)
    thread.kwargs["created"] = kwargs.get("created", False)
@ -79,7 +80,9 @@ def on_user_write(sender, request: HttpRequest, user: User, data: dict[str, Any]

@receiver(user_login_failed)
 # pylint: disable=unused-argument
-def on_user_login_failed(sender, credentials: dict[str, str], request: HttpRequest, **_):
+def on_user_login_failed(
+    sender, credentials: dict[str, str], request: HttpRequest, **_
+):
    """Failed Login"""
    thread = EventNewThread(EventAction.LOGIN_FAILED, request, **credentials)
    thread.run()
--- a/authentik/events/tasks.py
+++ b/authentik/events/tasks.py
@ -22,7 +22,9 @@ LOGGER = get_logger()
 def event_notification_handler(event_uuid: str):
    """Start task for each trigger definition"""
    for trigger in NotificationRule.objects.all():
-        event_trigger_handler.apply_async(args=[event_uuid, trigger.name], queue="authentik_events")
+        event_trigger_handler.apply_async(
+            args=[event_uuid, trigger.name], queue="authentik_events"
+        )


@CELERY_APP.task()
@ -41,13 +43,17 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):
    if "policy_uuid" in event.context:
        policy_uuid = event.context["policy_uuid"]
        if PolicyBinding.objects.filter(
-            target__in=NotificationRule.objects.all().values_list("pbm_uuid", flat=True),
+            target__in=NotificationRule.objects.all().values_list(
+                "pbm_uuid", flat=True
+            ),
            policy=policy_uuid,
        ).exists():
            # If policy that caused this event to be created is attached
            # to *any* NotificationRule, we return early.
            # This is the most effective way to prevent infinite loops.
-            LOGGER.debug("e(trigger): attempting to prevent infinite loop", trigger=trigger)
+            LOGGER.debug(
+                "e(trigger): attempting to prevent infinite loop", trigger=trigger
+            )
            return

    if not trigger.group:
@ -56,7 +62,9 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):

    LOGGER.debug("e(trigger): checking if trigger applies", trigger=trigger)
    try:
-        user = User.objects.filter(pk=event.user.get("pk")).first() or get_anonymous_user()
+        user = (
+            User.objects.filter(pk=event.user.get("pk")).first() or get_anonymous_user()
+        )
    except User.DoesNotExist:
        LOGGER.warning("e(trigger): failed to get user", trigger=trigger)
        return
@ -91,14 +99,20 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):
    retry_backoff=True,
    base=MonitoredTask,
 )
-def notification_transport(self: MonitoredTask, notification_pk: int, transport_pk: int):
+def notification_transport(
+    self: MonitoredTask, notification_pk: int, transport_pk: int
+):
    """Send notification over specified transport"""
    self.save_on_success = False
    try:
-        notification: Notification = Notification.objects.filter(pk=notification_pk).first()
+        notification: Notification = Notification.objects.filter(
+            pk=notification_pk
+        ).first()
        if not notification:
            return
-        transport: NotificationTransport = NotificationTransport.objects.get(pk=transport_pk)
+        transport: NotificationTransport = NotificationTransport.objects.get(
+            pk=transport_pk
+        )
        transport.send(notification)
        self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
    except NotificationTransportError as exc:
--- a/authentik/events/tests/test_event.py
+++ b/authentik/events/tests/test_event.py
@ -38,5 +38,7 @@ class TestEvents(TestCase):
        event = Event.new("unittest", model=temp_model)
        event.save()  # We save to ensure nothing is un-saveable
        model_content_type = ContentType.objects.get_for_model(temp_model)
-        self.assertEqual(event.context.get("model").get("app"), model_content_type.app_label)
+        self.assertEqual(
+            event.context.get("model").get("app"), model_content_type.app_label
+        )
        self.assertEqual(event.context.get("model").get("pk"), temp_model.pk.hex)
--- a/authentik/events/tests/test_notifications.py
+++ b/authentik/events/tests/test_notifications.py
@ -81,8 +81,12 @@ class TestEventsNotifications(TestCase):

        execute_mock = MagicMock()
        passes = MagicMock(side_effect=PolicyException)
-        with patch("authentik.policies.event_matcher.models.EventMatcherPolicy.passes", passes):
-            with patch("authentik.events.models.NotificationTransport.send", execute_mock):
+        with patch(
+            "authentik.policies.event_matcher.models.EventMatcherPolicy.passes", passes
+        ):
+            with patch(
+                "authentik.events.models.NotificationTransport.send", execute_mock
+            ):
                Event.new(EventAction.CUSTOM_PREFIX).save()
        self.assertEqual(passes.call_count, 1)

@ -92,7 +96,9 @@ class TestEventsNotifications(TestCase):
        self.group.users.add(user2)
        self.group.save()

-        transport = NotificationTransport.objects.create(name="transport", send_once=True)
+        transport = NotificationTransport.objects.create(
+            name="transport", send_once=True
+        )
        NotificationRule.objects.filter(name__startswith="default").delete()
        trigger = NotificationRule.objects.create(name="trigger", group=self.group)
        trigger.transports.add(transport)
--- a/authentik/flows/api/flows.py
+++ b/authentik/flows/api/flows.py
@ -7,25 +7,25 @@ from django.http.response import HttpResponseBadRequest, JsonResponse
 from django.urls import reverse
 from django.utils.translation import gettext as _
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
+from drf_spectacular.utils import OpenApiResponse, extend_schema, inline_serializer
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import ReadOnlyField
+from rest_framework.fields import BooleanField, FileField, ReadOnlyField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import CharField, ModelSerializer, Serializer, SerializerMethodField
+from rest_framework.serializers import (
+    CharField,
+    ModelSerializer,
+    Serializer,
+    SerializerMethodField,
+)
 from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger

 from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import (
-    CacheSerializer,
-    FilePathSerializer,
-    FileUploadSerializer,
-    LinkSerializer,
-)
+from authentik.core.api.utils import CacheSerializer, LinkSerializer
 from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.models import Flow
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner, cache_key
@ -152,7 +152,11 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
        ],
    )
    @extend_schema(
-        request={"multipart/form-data": FileUploadSerializer},
+        request={
+            "multipart/form-data": inline_serializer(
+                "SetIcon", fields={"file": FileField()}
+            )
+        },
        responses={
            204: OpenApiResponse(description="Successfully imported flow"),
            400: OpenApiResponse(description="Bad request"),
@ -217,7 +221,9 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
            .order_by("order")
        ):
            for p_index, policy_binding in enumerate(
-                get_objects_for_user(request.user, "authentik_policies.view_policybinding")
+                get_objects_for_user(
+                    request.user, "authentik_policies.view_policybinding"
+                )
                .filter(target=stage_binding)
                .exclude(policy__isnull=True)
                .order_by("order")
@ -250,21 +256,33 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
                element: DiagramElement = body[index]
                if element.type == "condition":
                    # Policy passes, link policy yes to next stage
-                    footer.append(f"{element.identifier}(yes, right)->{body[index + 1].identifier}")
+                    footer.append(
+                        f"{element.identifier}(yes, right)->{body[index + 1].identifier}"
+                    )
                    # Policy doesn't pass, go to stage after next stage
                    no_element = body[index + 1]
                    if no_element.type != "end":
                        no_element = body[index + 2]
-                    footer.append(f"{element.identifier}(no, bottom)->{no_element.identifier}")
+                    footer.append(
+                        f"{element.identifier}(no, bottom)->{no_element.identifier}"
+                    )
                elif element.type == "operation":
-                    footer.append(f"{element.identifier}(bottom)->{body[index + 1].identifier}")
+                    footer.append(
+                        f"{element.identifier}(bottom)->{body[index + 1].identifier}"
+                    )
        diagram = "\n".join([str(x) for x in header + body + footer])
        return Response({"diagram": diagram})

    @permission_required("authentik_flows.change_flow")
    @extend_schema(
        request={
-            "multipart/form-data": FileUploadSerializer,
+            "multipart/form-data": inline_serializer(
+                "SetIcon",
+                fields={
+                    "file": FileField(required=False),
+                    "clear": BooleanField(default=False),
+                },
+            )
        },
        responses={
            200: OpenApiResponse(description="Success"),
@ -300,7 +318,7 @@ class FlowViewSet(UsedByMixin, ModelViewSet):

    @permission_required("authentik_core.change_application")
    @extend_schema(
-        request=FilePathSerializer,
+        request=inline_serializer("SetIconURL", fields={"url": CharField()}),
        responses={
            200: OpenApiResponse(description="Success"),
            400: OpenApiResponse(description="Bad request"),
--- a/authentik/flows/management/commands/apply_flow.py
+++ b/authentik/flows/management/commands/apply_flow.py
@ -11,7 +11,7 @@ class Command(BaseCommand):  # pragma: no cover
    def handle(self, *args, **options):
        """Apply all flows in order, abort when one fails to import"""
        for flow_path in options.get("flows", []):
-            with open(flow_path, "r", encoding="utf8") as flow_file:
+            with open(flow_path, "r") as flow_file:
                importer = FlowImporter(flow_file.read())
                valid = importer.validate()
                if not valid:
--- a/authentik/flows/management/commands/benchmark.py
+++ b/authentik/flows/management/commands/benchmark.py
@ -95,7 +95,9 @@ class Command(BaseCommand):  # pragma: no cover
        """Output results human readable"""
        total_max: int = max([max(inner) for inner in values])
        total_min: int = min([min(inner) for inner in values])
-        total_avg = sum([sum(inner) for inner in values]) / sum([len(inner) for inner in values])
+        total_avg = sum([sum(inner) for inner in values]) / sum(
+            [len(inner) for inner in values]
+        )

        print(f"Version: {__version__}")
        print(f"Processes: {len(values)}")
--- a/authentik/flows/migrations/0008_default_flows.py
+++ b/authentik/flows/migrations/0008_default_flows.py
@ -6,18 +6,24 @@ from django.db.backends.base.schema import BaseDatabaseSchemaEditor

 from authentik.flows.models import FlowDesignation
 from authentik.stages.identification.models import UserFields
-from authentik.stages.password import BACKEND_APP_PASSWORD, BACKEND_INBUILT, BACKEND_LDAP
+from authentik.stages.password import BACKEND_DJANGO, BACKEND_LDAP


-def create_default_authentication_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+def create_default_authentication_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
    Flow = apps.get_model("authentik_flows", "Flow")
    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
    PasswordStage = apps.get_model("authentik_stages_password", "PasswordStage")
    UserLoginStage = apps.get_model("authentik_stages_user_login", "UserLoginStage")
-    IdentificationStage = apps.get_model("authentik_stages_identification", "IdentificationStage")
+    IdentificationStage = apps.get_model(
+        "authentik_stages_identification", "IdentificationStage"
+    )
    db_alias = schema_editor.connection.alias

-    identification_stage, _ = IdentificationStage.objects.using(db_alias).update_or_create(
+    identification_stage, _ = IdentificationStage.objects.using(
+        db_alias
+    ).update_or_create(
        name="default-authentication-identification",
        defaults={
            "user_fields": [UserFields.E_MAIL, UserFields.USERNAME],
@ -26,7 +32,7 @@ def create_default_authentication_flow(apps: Apps, schema_editor: BaseDatabaseSc

    password_stage, _ = PasswordStage.objects.using(db_alias).update_or_create(
        name="default-authentication-password",
-        defaults={"backends": [BACKEND_INBUILT, BACKEND_LDAP, BACKEND_APP_PASSWORD]},
+        defaults={"backends": [BACKEND_DJANGO, BACKEND_LDAP]},
    )

    login_stage, _ = UserLoginStage.objects.using(db_alias).update_or_create(
@ -63,13 +69,17 @@ def create_default_authentication_flow(apps: Apps, schema_editor: BaseDatabaseSc
    )


-def create_default_invalidation_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+def create_default_invalidation_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
    Flow = apps.get_model("authentik_flows", "Flow")
    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
    UserLogoutStage = apps.get_model("authentik_stages_user_logout", "UserLogoutStage")
    db_alias = schema_editor.connection.alias

-    UserLogoutStage.objects.using(db_alias).update_or_create(name="default-invalidation-logout")
+    UserLogoutStage.objects.using(db_alias).update_or_create(
+        name="default-invalidation-logout"
+    )

    flow, _ = Flow.objects.using(db_alias).update_or_create(
        slug="default-invalidation-flow",
--- a/authentik/flows/migrations/0009_source_flows.py
+++ b/authentik/flows/migrations/0009_source_flows.py
@ -15,12 +15,16 @@ PROMPT_POLICY_EXPRESSION = """# Check if we've not been given a username by the
 return 'username' not in context.get('prompt_data', {})"""


-def create_default_source_enrollment_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+def create_default_source_enrollment_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
    Flow = apps.get_model("authentik_flows", "Flow")
    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")

-    ExpressionPolicy = apps.get_model("authentik_policies_expression", "ExpressionPolicy")
+    ExpressionPolicy = apps.get_model(
+        "authentik_policies_expression", "ExpressionPolicy"
+    )

    PromptStage = apps.get_model("authentik_stages_prompt", "PromptStage")
    Prompt = apps.get_model("authentik_stages_prompt", "Prompt")
@ -95,12 +99,16 @@ def create_default_source_enrollment_flow(apps: Apps, schema_editor: BaseDatabas
    )


-def create_default_source_authentication_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+def create_default_source_authentication_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
    Flow = apps.get_model("authentik_flows", "Flow")
    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")
    PolicyBinding = apps.get_model("authentik_policies", "PolicyBinding")

-    ExpressionPolicy = apps.get_model("authentik_policies_expression", "ExpressionPolicy")
+    ExpressionPolicy = apps.get_model(
+        "authentik_policies_expression", "ExpressionPolicy"
+    )

    UserLoginStage = apps.get_model("authentik_stages_user_login", "UserLoginStage")

--- a/authentik/flows/migrations/0010_provider_flows.py
+++ b/authentik/flows/migrations/0010_provider_flows.py
@ -7,7 +7,9 @@ from django.db.backends.base.schema import BaseDatabaseSchemaEditor
 from authentik.flows.models import FlowDesignation


-def create_default_provider_authorization_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+def create_default_provider_authorization_flow(
+    apps: Apps, schema_editor: BaseDatabaseSchemaEditor
+):
    Flow = apps.get_model("authentik_flows", "Flow")
    FlowStageBinding = apps.get_model("authentik_flows", "FlowStageBinding")

--- a/authentik/flows/migrations/0018_oob_flows.py
+++ b/authentik/flows/migrations/0018_oob_flows.py
@ -32,7 +32,9 @@ def create_default_oobe_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor
    PromptStage = apps.get_model("authentik_stages_prompt", "PromptStage")
    Prompt = apps.get_model("authentik_stages_prompt", "Prompt")

-    ExpressionPolicy = apps.get_model("authentik_policies_expression", "ExpressionPolicy")
+    ExpressionPolicy = apps.get_model(
+        "authentik_policies_expression", "ExpressionPolicy"
+    )

    db_alias = schema_editor.connection.alias

@ -50,7 +52,9 @@ def create_default_oobe_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor
        name="default-oobe-prefill-user",
        defaults={"expression": PREFILL_POLICY_EXPRESSION},
    )
-    password_usable_policy, _ = ExpressionPolicy.objects.using(db_alias).update_or_create(
+    password_usable_policy, _ = ExpressionPolicy.objects.using(
+        db_alias
+    ).update_or_create(
        name="default-oobe-password-usable",
        defaults={"expression": PW_USABLE_POLICY_EXPRESSION},
    )
@ -79,7 +83,9 @@ def create_default_oobe_flow(apps: Apps, schema_editor: BaseDatabaseSchemaEditor
    prompt_stage, _ = PromptStage.objects.using(db_alias).update_or_create(
        name="default-oobe-password",
    )
-    prompt_stage.fields.set([prompt_header, prompt_email, password_first, password_second])
+    prompt_stage.fields.set(
+        [prompt_header, prompt_email, password_first, password_second]
+    )
    prompt_stage.save()

    user_write, _ = UserWriteStage.objects.using(db_alias).update_or_create(
--- a/authentik/flows/models.py
+++ b/authentik/flows/models.py
@ -138,7 +138,9 @@ class Flow(SerializerModel, PolicyBindingModel):
        it is returned as-is"""
        if not self.background:
            return "/static/dist/assets/images/flow_background.jpg"
-        if self.background.name.startswith("http") or self.background.name.startswith("/static"):
+        if self.background.name.startswith("http") or self.background.name.startswith(
+            "/static"
+        ):
            return self.background.name
        return self.background.url

@ -163,7 +165,9 @@ class Flow(SerializerModel, PolicyBindingModel):
            if result.passing:
                LOGGER.debug("with_policy: flow passing", flow=flow)
                return flow
-            LOGGER.warning("with_policy: flow not passing", flow=flow, messages=result.messages)
+            LOGGER.warning(
+                "with_policy: flow not passing", flow=flow, messages=result.messages
+            )
        LOGGER.debug("with_policy: no flow found", filters=flow_filter)
        return None

--- a/authentik/flows/planner.py
+++ b/authentik/flows/planner.py
@ -78,10 +78,14 @@ class FlowPlan:
        marker = self.markers[0]

        if marker.__class__ is not StageMarker:
-            LOGGER.debug("f(plan_inst): stage has marker", binding=binding, marker=marker)
+            LOGGER.debug(
+                "f(plan_inst): stage has marker", binding=binding, marker=marker
+            )
        marked_stage = marker.process(self, binding, http_request)
        if not marked_stage:
-            LOGGER.debug("f(plan_inst): marker returned none, next stage", binding=binding)
+            LOGGER.debug(
+                "f(plan_inst): marker returned none, next stage", binding=binding
+            )
            self.bindings.remove(binding)
            self.markers.remove(marker)
            if not self.has_stages:
@ -189,9 +193,9 @@ class FlowPlanner:
            if default_context:
                plan.context = default_context
            # Check Flow policies
-            for binding in FlowStageBinding.objects.filter(target__pk=self.flow.pk).order_by(
-                "order"
-            ):
+            for binding in FlowStageBinding.objects.filter(
+                target__pk=self.flow.pk
+            ).order_by("order"):
                binding: FlowStageBinding
                stage = binding.stage
                marker = StageMarker()
--- a/authentik/flows/signals.py
+++ b/authentik/flows/signals.py
@ -26,7 +26,9 @@ def invalidate_flow_cache(sender, instance, **_):
        LOGGER.debug("Invalidating Flow cache", flow=instance, len=total)
    if isinstance(instance, FlowStageBinding):
        total = delete_cache_prefix(f"{cache_key(instance.target)}*")
-        LOGGER.debug("Invalidating Flow cache from FlowStageBinding", binding=instance, len=total)
+        LOGGER.debug(
+            "Invalidating Flow cache from FlowStageBinding", binding=instance, len=total
+        )
    if isinstance(instance, Stage):
        total = 0
        for binding in FlowStageBinding.objects.filter(stage=instance):
--- a/authentik/flows/stage.py
+++ b/authentik/flows/stage.py
@ -42,9 +42,14 @@ class StageView(View):
        other things besides the form display.

        If no user is pending, returns request.user"""
-        if PLAN_CONTEXT_PENDING_USER_IDENTIFIER in self.executor.plan.context and for_display:
+        if (
+            PLAN_CONTEXT_PENDING_USER_IDENTIFIER in self.executor.plan.context
+            and for_display
+        ):
            return User(
-                username=self.executor.plan.context.get(PLAN_CONTEXT_PENDING_USER_IDENTIFIER),
+                username=self.executor.plan.context.get(
+                    PLAN_CONTEXT_PENDING_USER_IDENTIFIER
+                ),
                email="",
            )
        if PLAN_CONTEXT_PENDING_USER in self.executor.plan.context:
--- a/authentik/flows/tests/test_planner.py
+++ b/authentik/flows/tests/test_planner.py
@ -3,6 +3,7 @@ from unittest.mock import MagicMock, Mock, PropertyMock, patch

 from django.contrib.sessions.middleware import SessionMiddleware
 from django.core.cache import cache
+from django.http import HttpRequest
 from django.test import RequestFactory, TestCase
 from django.urls import reverse
 from guardian.shortcuts import get_anonymous_user
@ -12,7 +13,6 @@ from authentik.flows.exceptions import EmptyFlowException, FlowNonApplicableExce
 from authentik.flows.markers import ReevaluateMarker, StageMarker
 from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner, cache_key
-from authentik.lib.tests.utils import dummy_get_response
 from authentik.policies.dummy.models import DummyPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.policies.types import PolicyResult
@ -24,6 +24,11 @@ CACHE_MOCK = Mock(wraps=cache)
 POLICY_RETURN_TRUE = MagicMock(return_value=PolicyResult(True))


+def dummy_get_response(request: HttpRequest):  # pragma: no cover
+    """Dummy get_response for SessionMiddleware"""
+    return None
+
+
 class TestFlowPlanner(TestCase):
    """Test planner logic"""

@ -84,10 +89,14 @@ class TestFlowPlanner(TestCase):

        planner = FlowPlanner(flow)
        planner.plan(request)
-        self.assertEqual(CACHE_MOCK.set.call_count, 1)  # Ensure plan is written to cache
+        self.assertEqual(
+            CACHE_MOCK.set.call_count, 1
+        )  # Ensure plan is written to cache
        planner = FlowPlanner(flow)
        planner.plan(request)
-        self.assertEqual(CACHE_MOCK.set.call_count, 1)  # Ensure nothing is written to cache
+        self.assertEqual(
+            CACHE_MOCK.set.call_count, 1
+        )  # Ensure nothing is written to cache
        self.assertEqual(CACHE_MOCK.get.call_count, 2)  # Get is called twice

    def test_planner_default_context(self):
@ -167,7 +176,9 @@ class TestFlowPlanner(TestCase):
        request.session.save()

        # Here we patch the dummy policy to evaluate to true so the stage is included
-        with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
+        with patch(
+            "authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):
            planner = FlowPlanner(flow)
            plan = planner.plan(request)

--- a/authentik/flows/tests/test_transfer.py
+++ b/authentik/flows/tests/test_transfer.py
@ -7,9 +7,9 @@ from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
 from authentik.flows.transfer.common import DataclassEncoder
 from authentik.flows.transfer.exporter import FlowExporter
 from authentik.flows.transfer.importer import FlowImporter, transaction_rollback
-from authentik.lib.generators import generate_id
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
+from authentik.providers.oauth2.generators import generate_client_id
 from authentik.stages.prompt.models import FieldTypes, Prompt, PromptStage
 from authentik.stages.user_login.models import UserLoginStage

@ -31,15 +31,15 @@ class TestFlowTransfer(TransactionTestCase):

    def test_export_validate_import(self):
        """Test export and validate it"""
-        flow_slug = generate_id()
+        flow_slug = generate_client_id()
        with transaction_rollback():
-            login_stage = UserLoginStage.objects.create(name=generate_id())
+            login_stage = UserLoginStage.objects.create(name=generate_client_id())

            flow = Flow.objects.create(
                slug=flow_slug,
                designation=FlowDesignation.AUTHENTICATION,
-                name=generate_id(),
-                title=generate_id(),
+                name=generate_client_id(),
+                title=generate_client_id(),
            )
            FlowStageBinding.objects.update_or_create(
                target=flow,
@ -60,23 +60,25 @@ class TestFlowTransfer(TransactionTestCase):

    def test_export_validate_import_policies(self):
        """Test export and validate it"""
-        flow_slug = generate_id()
-        stage_name = generate_id()
+        flow_slug = generate_client_id()
+        stage_name = generate_client_id()
        with transaction_rollback():
            flow_policy = ExpressionPolicy.objects.create(
-                name=generate_id(),
+                name=generate_client_id(),
                expression="return True",
            )
            flow = Flow.objects.create(
                slug=flow_slug,
                designation=FlowDesignation.AUTHENTICATION,
-                name=generate_id(),
-                title=generate_id(),
+                name=generate_client_id(),
+                title=generate_client_id(),
            )
            PolicyBinding.objects.create(policy=flow_policy, target=flow, order=0)

            user_login = UserLoginStage.objects.create(name=stage_name)
-            fsb = FlowStageBinding.objects.create(target=flow, stage=user_login, order=0)
+            fsb = FlowStageBinding.objects.create(
+                target=flow, stage=user_login, order=0
+            )
            PolicyBinding.objects.create(policy=flow_policy, target=fsb, order=0)

            exporter = FlowExporter(flow)
@ -111,15 +113,15 @@ class TestFlowTransfer(TransactionTestCase):
            )

            # Stages
-            first_stage = PromptStage.objects.create(name=generate_id())
+            first_stage = PromptStage.objects.create(name=generate_client_id())
            first_stage.fields.set([username_prompt, password, password_repeat])
            first_stage.save()

            flow = Flow.objects.create(
-                name=generate_id(),
-                slug=generate_id(),
+                name=generate_client_id(),
+                slug=generate_client_id(),
                designation=FlowDesignation.ENROLLMENT,
-                title=generate_id(),
+                title=generate_client_id(),
            )

            FlowStageBinding.objects.create(target=flow, stage=first_stage, order=0)
--- a/authentik/flows/tests/test_transfer_docs.py
+++ b/authentik/flows/tests/test_transfer_docs.py
@ -16,7 +16,7 @@ def pbflow_tester(file_name: str) -> Callable:
    """This is used instead of subTest for better visibility"""

    def tester(self: TestTransferDocs):
-        with open(file_name, "r", encoding="utf8") as flow_json:
+        with open(file_name, "r") as flow_json:
            importer = FlowImporter(flow_json.read())
        self.assertTrue(importer.validate())
        self.assertTrue(importer.apply())
--- a/authentik/flows/tests/test_views.py
+++ b/authentik/flows/tests/test_views.py
@ -11,7 +11,12 @@ from authentik.core.models import User
 from authentik.flows.challenge import ChallengeTypes
 from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.markers import ReevaluateMarker, StageMarker
-from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding, InvalidResponseAction
+from authentik.flows.models import (
+    Flow,
+    FlowDesignation,
+    FlowStageBinding,
+    InvalidResponseAction,
+)
 from authentik.flows.planner import FlowPlan, FlowPlanner
 from authentik.flows.stage import PLAN_CONTEXT_PENDING_USER_IDENTIFIER, StageView
 from authentik.flows.views import NEXT_ARG_NAME, SESSION_KEY_PLAN, FlowExecutorView
@ -56,7 +61,9 @@ class TestFlowExecutor(TestCase):
        )
        stage = DummyStage.objects.create(name="dummy")
        binding = FlowStageBinding(target=flow, stage=stage, order=0)
-        plan = FlowPlan(flow_pk=flow.pk.hex + "a", bindings=[binding], markers=[StageMarker()])
+        plan = FlowPlan(
+            flow_pk=flow.pk.hex + "a", bindings=[binding], markers=[StageMarker()]
+        )
        session = self.client.session
        session[SESSION_KEY_PLAN] = plan
        session.save()
@ -156,7 +163,9 @@ class TestFlowExecutor(TestCase):
            target=flow, stage=DummyStage.objects.create(name="dummy2"), order=1
        )

-        exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+        exec_url = reverse(
+            "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+        )
        # First Request, start planning, renders form
        response = self.client.get(exec_url)
        self.assertEqual(response.status_code, 200)
@ -200,9 +209,13 @@ class TestFlowExecutor(TestCase):
        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)

        # Here we patch the dummy policy to evaluate to true so the stage is included
-        with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
+        with patch(
+            "authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):

-            exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+            exec_url = reverse(
+                "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
            # First request, run the planner
            response = self.client.get(exec_url)
            self.assertEqual(response.status_code, 200)
@ -250,9 +263,13 @@ class TestFlowExecutor(TestCase):
        PolicyBinding.objects.create(policy=false_policy, target=binding2, order=0)

        # Here we patch the dummy policy to evaluate to true so the stage is included
-        with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
+        with patch(
+            "authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):

-            exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+            exec_url = reverse(
+                "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
            # First request, run the planner
            response = self.client.get(exec_url)

@ -317,9 +334,13 @@ class TestFlowExecutor(TestCase):
        PolicyBinding.objects.create(policy=true_policy, target=binding2, order=0)

        # Here we patch the dummy policy to evaluate to true so the stage is included
-        with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
+        with patch(
+            "authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):

-            exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+            exec_url = reverse(
+                "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
            # First request, run the planner
            response = self.client.get(exec_url)

@ -401,9 +422,13 @@ class TestFlowExecutor(TestCase):
        PolicyBinding.objects.create(policy=false_policy, target=binding3, order=0)

        # Here we patch the dummy policy to evaluate to true so the stage is included
-        with patch("authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE):
+        with patch(
+            "authentik.policies.dummy.models.DummyPolicy.passes", POLICY_RETURN_TRUE
+        ):

-            exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+            exec_url = reverse(
+                "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+            )
            # First request, run the planner
            response = self.client.get(exec_url)
            self.assertEqual(response.status_code, 200)
@ -486,7 +511,9 @@ class TestFlowExecutor(TestCase):
        )
        request.user = user
        planner = FlowPlanner(flow)
-        plan = planner.plan(request, default_context={PLAN_CONTEXT_PENDING_USER_IDENTIFIER: ident})
+        plan = planner.plan(
+            request, default_context={PLAN_CONTEXT_PENDING_USER_IDENTIFIER: ident}
+        )

        executor = FlowExecutorView()
        executor.plan = plan
@ -515,7 +542,9 @@ class TestFlowExecutor(TestCase):
            evaluate_on_plan=False,
            re_evaluate_policies=True,
        )
-        PolicyBinding.objects.create(policy=reputation_policy, target=deny_binding, order=0)
+        PolicyBinding.objects.create(
+            policy=reputation_policy, target=deny_binding, order=0
+        )

        # Stage 1 is an identification stage
        ident_stage = IdentificationStage.objects.create(
@ -528,7 +557,9 @@ class TestFlowExecutor(TestCase):
            order=1,
            invalid_response_action=InvalidResponseAction.RESTART_WITH_CONTEXT,
        )
-        exec_url = reverse("authentik_api:flow-executor", kwargs={"flow_slug": flow.slug})
+        exec_url = reverse(
+            "authentik_api:flow-executor", kwargs={"flow_slug": flow.slug}
+        )
        # First request, run the planner
        response = self.client.get(exec_url)
        self.assertEqual(response.status_code, 200)
@ -548,7 +579,9 @@ class TestFlowExecutor(TestCase):
                "user_fields": [UserFields.E_MAIL],
            },
        )
-        response = self.client.post(exec_url, {"uid_field": "invalid-string"}, follow=True)
+        response = self.client.post(
+            exec_url, {"uid_field": "invalid-string"}, follow=True
+        )
        self.assertEqual(response.status_code, 200)
        self.assertJSONEqual(
            force_str(response.content),
--- a/authentik/flows/tests/test_views_helper.py
+++ b/authentik/flows/tests/test_views_helper.py
@ -21,7 +21,9 @@ class TestHelperView(TestCase):
        response = self.client.get(
            reverse("authentik_flows:default-invalidation"),
        )
-        expected_url = reverse("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
+        expected_url = reverse(
+            "authentik_core:if-flow", kwargs={"flow_slug": flow.slug}
+        )
        self.assertEqual(response.status_code, 302)
        self.assertEqual(response.url, expected_url)

@ -38,6 +40,8 @@ class TestHelperView(TestCase):
        response = self.client.get(
            reverse("authentik_flows:default-invalidation"),
        )
-        expected_url = reverse("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
+        expected_url = reverse(
+            "authentik_core:if-flow", kwargs={"flow_slug": flow.slug}
+        )
        self.assertEqual(response.status_code, 302)
        self.assertEqual(response.url, expected_url)
--- a/authentik/flows/transfer/common.py
+++ b/authentik/flows/transfer/common.py
@ -25,8 +25,6 @@ def get_attrs(obj: SerializerModel) -> dict[str, Any]:
        "component",
        "flow_set",
        "promptstage_set",
-        "policybindingmodel_ptr_id",
-        "export_url",
    )
    for to_remove_name in to_remove:
        if to_remove_name in data:
@ -46,7 +44,9 @@ class FlowBundleEntry:
    attrs: dict[str, Any]

    @staticmethod
-    def from_model(model: SerializerModel, *extra_identifier_names: str) -> "FlowBundleEntry":
+    def from_model(
+        model: SerializerModel, *extra_identifier_names: str
+    ) -> "FlowBundleEntry":
        """Convert a SerializerModel instance to a Bundle Entry"""
        identifiers = {
            "pk": model.pk,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jens Langhammer	5a7508d2e0	core: fix token expiration not being updated upon key rotation Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>	2021-08-12 17:24:19 +02:00
Jens Langhammer	9c31ea1aa6	core: fix expired tokens not being returned by API Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>	2021-08-12 17:24:19 +02:00