release: 2021.4.6

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2022.4.1
+current_version = 2021.4.6
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
@@ -17,16 +17,28 @@ values =
 	beta
 	stable
 
-[bumpversion:file:pyproject.toml]
+[bumpversion:file:website/docs/installation/docker-compose.md]
+
+[bumpversion:file:website/docs/installation/kubernetes.md]
 
 [bumpversion:file:docker-compose.yml]
 
-[bumpversion:file:schema.yml]
+[bumpversion:file:helm/values.yaml]
 
-[bumpversion:file:.github/workflows/release-publish.yml]
+[bumpversion:file:helm/README.md]
+
+[bumpversion:file:helm/Chart.yaml]
+
+[bumpversion:file:.github/workflows/release.yml]
 
 [bumpversion:file:authentik/__init__.py]
 
-[bumpversion:file:internal/constants/constants.go]
+[bumpversion:file:outpost/pkg/version.go]
 
 [bumpversion:file:web/src/constants.ts]
+
+[bumpversion:file:web/nginx.conf]
+
+[bumpversion:file:website/docs/outposts/manual-deploy-docker-compose.md]
+
+[bumpversion:file:website/docs/outposts/manual-deploy-kubernetes.md]

.dockerignore

@@ -1,8 +1,6 @@
 env
+helm
 static
 htmlcov
 *.env.yml
 **/node_modules
-dist/**
-build/**
-build_docs/**

.github/ISSUE_TEMPLATE/bug_report.md

@@ -27,7 +27,7 @@ If applicable, add screenshots to help explain your problem.
 Output of docker-compose logs or kubectl logs respectively
 
 **Version and Deployment (please complete the following information):**
- - authentik version: [e.g. 2021.8.5]
+ - authentik version: [e.g. 0.10.0-stable]
  - Deployment: [e.g. docker-compose, helm]
 
 **Additional context**

.github/ISSUE_TEMPLATE/question.md

@@ -1,27 +0,0 @@
----
-name: Question
-about: Ask a question about a feature or specific configuration
-title: ''
-labels: question
-assignees: ''
-
----
-
-**Describe your question/**
-A clear and concise description of what you're trying to do.
-
-**Relevant infos**
-i.e. Version of other software you're using, specifics of your setup
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Logs**
-Output of docker-compose logs or kubectl logs respectively
-
-**Version and Deployment (please complete the following information):**
- - authentik version: [e.g. 2021.8.5]
- - Deployment: [e.g. docker-compose, helm]
-
-**Additional context**
-Add any other context about the problem here.

.github/actions/docker-setup/action.yml

@@ -1,49 +0,0 @@
-name: 'Prepare docker environment variables'
-description: 'Prepare docker environment variables'
-
-outputs:
-  shouldBuild:
-    description: "Whether to build image or not"
-    value: ${{ steps.ev.outputs.shouldBuild }}
-  branchName:
-    description: "Branch name"
-    value: ${{ steps.ev.outputs.branchName }}
-  branchNameContainer:
-    description: "Branch name (for containers)"
-    value: ${{ steps.ev.outputs.branchNameContainer }}
-  timestamp:
-    description: "Timestamp"
-    value: ${{ steps.ev.outputs.timestamp }}
-  sha:
-    description: "sha"
-    value: ${{ steps.ev.outputs.sha }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate config
-      id: ev
-      shell: python
-      run: |
-        """Helper script to get the actual branch name, docker safe"""
-        import os
-        from time import time
-
-        env_pr_branch = "GITHUB_HEAD_REF"
-        default_branch = "GITHUB_REF"
-        sha = "GITHUB_SHA"
-
-        branch_name = os.environ[default_branch]
-        if os.environ.get(env_pr_branch, "") != "":
-            branch_name = os.environ[env_pr_branch]
-
-        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
-
-        print("##[set-output name=branchName]%s" % branch_name)
-        print(
-            "##[set-output name=branchNameContainer]%s"
-            % branch_name.replace("refs/heads/", "").replace("/", "-")
-        )
-        print("##[set-output name=timestamp]%s" % int(time()))
-        print("##[set-output name=sha]%s" % os.environ[sha])
-        print("##[set-output name=shouldBuild]%s" % should_build)

.github/actions/setup/action.yml

@@ -1,45 +0,0 @@
-name: 'Setup authentik testing environemnt'
-description: 'Setup authentik testing environemnt'
-
-runs:
-  using: "composite"
-  steps:
-    - name: Install poetry
-      shell: bash
-      run: |
-        pipx install poetry || true
-        sudo apt update
-        sudo apt install -y libxmlsec1-dev pkg-config gettext
-    - name: Setup python and restore poetry
-      uses: actions/setup-python@v3
-      with:
-        python-version: '3.10'
-        cache: 'poetry'
-    - name: Setup node
-      uses: actions/setup-node@v3.1.0
-      with:
-        node-version: '16'
-        cache: 'npm'
-        cache-dependency-path: web/package-lock.json
-    - name: Setup dependencies
-      shell: bash
-      run: |
-        docker-compose -f .github/actions/setup/docker-compose.yml up -d
-        poetry env use python3.10
-        poetry install
-        npm install -g pyright@1.1.136
-    - name: Generate config
-      shell: poetry run python {0}
-      run: |
-        from authentik.lib.generators import generate_id
-        from yaml import safe_dump
-
-        with open("local.env.yml", "w") as _config:
-            safe_dump(
-                {
-                    "log_level": "debug",
-                    "secret_key": generate_id(),
-                },
-                _config,
-                default_flow_style=False,
-            )

.github/codespell-words.txt

@@ -1,3 +0,0 @@
-keypair
-keypairs
-hass

.github/dependabot.yml

@@ -1,15 +1,7 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: daily
-    time: "04:00"
-  open-pull-requests-limit: 10
-  assignees:
-  - BeryJu
 - package-ecosystem: gomod
-  directory: "/"
+  directory: "/outpost"
   schedule:
     interval: daily
     time: "04:00"
@@ -48,3 +40,11 @@ updates:
   open-pull-requests-limit: 10
   assignees:
   - BeryJu
+- package-ecosystem: docker
+  directory: "/outpost"
+  schedule:
+    interval: daily
+    time: "04:00"
+  open-pull-requests-limit: 10
+  assignees:
+  - BeryJu

.github/pull_request_template.md

@@ -1,19 +0,0 @@
-<!--
-👋 Hello there! Welcome.
-
-Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/master/CONTRIBUTING.md#how-can-i-contribute).
--->
-
-# Details
-* **Does this resolve an issue?**
-Resolves #
-
-## Changes
-### New Features
-* Adds feature which does x, y, and z.
-
-### Breaking Changes
-* Adds breaking change which causes \<issue\>.
-
-## Additional
-Any further notes or comments you want to make.

.github/stale.yml

@@ -1,15 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 60
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - pinned
-  - security
-  - pr_wanted
-  - enhancement
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.

.github/workflows/ci-main.yml

@@ -1,234 +0,0 @@
-name: authentik-ci-main
-
-on:
-  push:
-    branches:
-      - master
-      - next
-      - version-*
-    paths-ignore:
-      - website
-  pull_request:
-    branches:
-      - master
-
-env:
-  POSTGRES_DB: authentik
-  POSTGRES_USER: authentik
-  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-
-jobs:
-  lint:
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - pylint
-          - black
-          - isort
-          - bandit
-          - pyright
-          - pending-migrations
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - name: run job
-        run: poetry run make ci-${{ matrix.job }}
-  test-migrations:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - name: run migrations
-        run: poetry run python -m lifecycle.migrate
-  test-migrations-from-stable:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - name: checkout stable
-        run: |
-          # Copy current, latest config to local
-          cp authentik/lib/default.yml local.env.yml
-          cp -R .github ..
-          cp -R scripts ..
-          git checkout $(git describe --abbrev=0 --match 'version/*')
-          rm -rf .github/ scripts/
-          mv ../.github ../scripts .
-      - name: Setup authentik env (ensure stable deps are installed)
-        uses: ./.github/actions/setup
-      - name: run migrations to stable
-        run: poetry run python -m lifecycle.migrate
-      - name: checkout current code
-        run: |
-          set -x
-          git fetch
-          git reset --hard HEAD
-          git clean -d -fx .
-          git checkout $GITHUB_SHA
-          poetry install
-      - name: Setup authentik env (ensure latest deps are installed)
-        uses: ./.github/actions/setup
-      - name: migrate to latest
-        run: poetry run python -m lifecycle.migrate
-  test-unittest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - uses: testspace-com/setup-testspace@v1
-        with:
-          domain: ${{github.repository_owner}}
-      - name: run unittest
-        run: |
-          poetry run make test
-          poetry run coverage xml
-      - name: run testspace
-        if: ${{ always() }}
-        run: |
-          testspace [unittest]unittest.xml --link=codecov
-      - if: ${{ always() }}
-        uses: codecov/codecov-action@v3
-  test-integration:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - uses: testspace-com/setup-testspace@v1
-        with:
-          domain: ${{github.repository_owner}}
-      - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.2.0
-      - name: run integration
-        run: |
-          poetry run make test-integration
-          poetry run coverage xml
-      - name: run testspace
-        if: ${{ always() }}
-        run: |
-          testspace [integration]unittest.xml --link=codecov
-      - if: ${{ always() }}
-        uses: codecov/codecov-action@v3
-  test-e2e-provider:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - uses: testspace-com/setup-testspace@v1
-        with:
-          domain: ${{github.repository_owner}}
-      - name: Setup authentik env
-        run: |
-          docker-compose -f tests/e2e/docker-compose.yml up -d
-      - id: cache-web
-        uses: actions/cache@v3
-        with:
-          path: web/dist
-          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/**') }}
-      - name: prepare web ui
-        if: steps.cache-web.outputs.cache-hit != 'true'
-        run: |
-          cd web
-          npm i
-          npm run build
-      - name: run e2e
-        run: |
-          poetry run make test-e2e-provider
-          poetry run coverage xml
-      - name: run testspace
-        if: ${{ always() }}
-        run: |
-          testspace [e2e-provider]unittest.xml --link=codecov
-      - if: ${{ always() }}
-        uses: codecov/codecov-action@v3
-  test-e2e-rest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - uses: testspace-com/setup-testspace@v1
-        with:
-          domain: ${{github.repository_owner}}
-      - name: Setup authentik env
-        run: |
-          docker-compose -f tests/e2e/docker-compose.yml up -d
-      - id: cache-web
-        uses: actions/cache@v3
-        with:
-          path: web/dist
-          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/**') }}
-      - name: prepare web ui
-        if: steps.cache-web.outputs.cache-hit != 'true'
-        run: |
-          cd web
-          npm i
-          npm run build
-      - name: run e2e
-        run: |
-          poetry run make test-e2e-rest
-          poetry run coverage xml
-      - name: run testspace
-        if: ${{ always() }}
-        run: |
-          testspace [e2e-rest]unittest.xml --link=codecov
-      - if: ${{ always() }}
-        uses: codecov/codecov-action@v3
-  ci-core-mark:
-    needs:
-      - lint
-      - test-migrations
-      - test-migrations-from-stable
-      - test-unittest
-      - test-integration
-      - test-e2e-rest
-      - test-e2e-provider
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo mark
-  build:
-    needs: ci-core-mark
-    runs-on: ubuntu-latest
-    timeout-minutes: 120
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - 'linux/amd64'
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.2.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: prepare variables
-        id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        uses: ./.github/actions/docker-setup
-      - name: Login to Container Registry
-        uses: docker/login-action@v1
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Building Docker Image
-        uses: docker/build-push-action@v2
-        with:
-          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
-          tags: |
-            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}
-            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}
-          build-args: |
-            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
-          platforms: ${{ matrix.arch }}

.github/workflows/ci-outpost.yml

@@ -1,130 +0,0 @@
-name: authentik-ci-outpost
-
-on:
-  push:
-    branches:
-      - master
-      - next
-      - version-*
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  lint-golint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "^1.17"
-      - name: Run linter
-        run: |
-          # Create folder structure for go embeds
-          mkdir -p web/dist
-          mkdir -p website/help
-          touch web/dist/test website/help/test
-          docker run \
-            --rm \
-            -v $(pwd):/app \
-            -w /app \
-            golangci/golangci-lint:v1.43 \
-            golangci-lint run -v --timeout 200s
-  test-unittest:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "^1.17"
-      - name: Go unittests
-        run: |
-          go test -timeout 0 -v -race -coverprofile=coverage.out -covermode=atomic -cover ./...
-  ci-outpost-mark:
-    needs:
-      - lint-golint
-      - test-unittest
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo mark
-  build:
-    timeout-minutes: 120
-    needs:
-      - ci-outpost-mark
-    strategy:
-      fail-fast: false
-      matrix:
-        type:
-          - proxy
-          - ldap
-        arch:
-          - 'linux/amd64'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.2.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: prepare variables
-        id: ev
-        uses: ./.github/actions/docker-setup
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      - name: Login to Container Registry
-        uses: docker/login-action@v1
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Building Docker Image
-        uses: docker/build-push-action@v2
-        with:
-          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
-          tags: |
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}
-            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
-          file: ${{ matrix.type }}.Dockerfile
-          build-args: |
-            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
-          platforms: ${{ matrix.arch }}
-  build-outpost-binary:
-    timeout-minutes: 120
-    needs:
-      - ci-outpost-mark
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        type:
-          - proxy
-          - ldap
-        goos: [linux]
-        goarch: [amd64, arm64]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "^1.17"
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - name: Build web
-        run: |
-          cd web
-          npm install
-          npm run build-proxy
-      - name: Build outpost
-        run: |
-          set -x
-          export GOOS=${{ matrix.goos }}
-          export GOARCH=${{ matrix.goarch }}
-          go build -tags=outpost_static_embed -v -o ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }} ./cmd/${{ matrix.type }}
-      - uses: actions/upload-artifact@v3
-        with:
-          name: authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}
-          path: ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}

.github/workflows/ci-web.yml

@@ -1,95 +0,0 @@
-name: authentik-ci-web
-
-on:
-  push:
-    branches:
-      - master
-      - next
-      - version-*
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  lint-eslint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - run: |
-          cd web
-          npm install
-      - name: Generate API
-        run: make gen-web
-      - name: Eslint
-        run: |
-          cd web
-          npm run lint
-  lint-prettier:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - run: |
-          cd web
-          npm install
-      - name: Generate API
-        run: make gen-web
-      - name: prettier
-        run: |
-          cd web
-          npm run prettier-check
-  lint-lit-analyse:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - run: |
-          cd web
-          npm install
-      - name: Generate API
-        run: make gen-web
-      - name: lit-analyse
-        run: |
-          cd web
-          npm run lit-analyse
-  ci-web-mark:
-    needs:
-      - lint-eslint
-      - lint-prettier
-      - lint-lit-analyse
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo mark
-  build:
-    needs:
-      - ci-web-mark
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - run: |
-          cd web
-          npm install
-      - name: Generate API
-        run: make gen-web
-      - name: build
-        run: |
-          cd web
-          npm run build

.github/workflows/codeql-analysis.yml

@@ -1,60 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches: [ master, '*', next, version* ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ master ]
-  schedule:
-    - cron: '30 6 * * 5'
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ 'go', 'javascript', 'python' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
-        # Learn more:
-        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1

.github/workflows/ghcr-retention.yml

@@ -1,22 +0,0 @@
-name: ghcr-retention
-
-on:
-  schedule:
-    - cron: '0 0 * * *'  # every day at midnight
-  workflow_dispatch:
-
-jobs:
-  clean-ghcr:
-    name: Delete old unused container images
-    runs-on: ubuntu-latest
-    steps:
-      - name: Delete 'dev' containers older than a week
-        uses: sondrelg/container-retention-policy@v1
-        with:
-          image-names: dev-server,dev-ldap,dev-proxy
-          cut-off: One week ago UTC
-          account-type: org
-          org-name: goauthentik
-          untagged-only: false
-          token: ${{ secrets.GHCR_CLEANUP_TOKEN }}
-          skip-tags: gh-next,gh-master

.github/workflows/release-publish.yml

@@ -1,158 +0,0 @@
-name: authentik-on-release
-
-on:
-  release:
-    types: [published, created]
-
-jobs:
-  # Build
-  build-server:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.2.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Docker Login Registry
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Building Docker Image
-        uses: docker/build-push-action@v2
-        with:
-          push: ${{ github.event_name == 'release' }}
-          tags: |
-            beryju/authentik:2022.4.1,
-            beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2022.4.1,
-            ghcr.io/goauthentik/server:latest
-          platforms: linux/amd64,linux/arm64
-          context: .
-  build-outpost:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        type:
-          - proxy
-          - ldap
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "^1.17"
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1.2.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Docker Login Registry
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Building Docker Image
-        uses: docker/build-push-action@v2
-        with:
-          push: ${{ github.event_name == 'release' }}
-          tags: |
-            beryju/authentik-${{ matrix.type }}:2022.4.1,
-            beryju/authentik-${{ matrix.type }}:latest,
-            ghcr.io/goauthentik/${{ matrix.type }}:2022.4.1,
-            ghcr.io/goauthentik/${{ matrix.type }}:latest
-          file: ${{ matrix.type }}.Dockerfile
-          platforms: linux/amd64,linux/arm64
-  build-outpost-binary:
-    timeout-minutes: 120
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        type:
-          - proxy
-          - ldap
-        goos: [linux, darwin]
-        goarch: [amd64, arm64]
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: "^1.17"
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          cache: 'npm'
-          cache-dependency-path: web/package-lock.json
-      - name: Build web
-        run: |
-          cd web
-          npm install
-          npm run build-proxy
-      - name: Build outpost
-        run: |
-          set -x
-          export GOOS=${{ matrix.goos }}
-          export GOARCH=${{ matrix.goarch }}
-          go build -tags=outpost_static_embed -v -o ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }} ./cmd/${{ matrix.type }}
-      - name: Upload binaries to release
-        uses: svenstaro/upload-release-action@v2
-        with:
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          file: ./authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}
-          asset_name: authentik-outpost-${{ matrix.type }}_${{ matrix.goos }}_${{ matrix.goarch }}
-          tag: ${{ github.ref }}
-  test-release:
-    needs:
-      - build-server
-      - build-outpost
-      - build-outpost-binary
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Run test suite in final docker images
-        run: |
-          echo "PG_PASS=$(openssl rand -base64 32)" >> .env
-          echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
-          docker-compose pull -q
-          docker-compose up --no-start
-          docker-compose start postgresql redis
-          docker-compose run -u root server test
-  sentry-release:
-    needs:
-      - build-server
-      - build-outpost
-      - build-outpost-binary
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Get static files from docker image
-        run: |
-          docker pull ghcr.io/goauthentik/server:latest
-          container=$(docker container create ghcr.io/goauthentik/server:latest)
-          docker cp ${container}:web/ .
-      - name: Create a Sentry.io release
-        uses: getsentry/action-release@v1
-        if: ${{ github.event_name == 'release' }}
-        env:
-          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_ORG: beryjuorg
-          SENTRY_PROJECT: authentik
-          SENTRY_URL: https://sentry.beryju.org
-        with:
-          version: authentik@2022.4.1
-          environment: beryjuorg-prod
-          sourcemaps: './web/dist'
-          url_prefix: '~/static/dist'

.github/workflows/release-tag.yml

@@ -1,44 +0,0 @@
-name: authentik-on-tag
-
-on:
-  push:
-    tags:
-    - 'version/*'
-
-jobs:
-  build:
-    name: Create Release from Tag
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Pre-release test
-        run: |
-          echo "PG_PASS=$(openssl rand -base64 32)" >> .env
-          echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
-          docker buildx install
-          docker build \
-            --no-cache \
-            -t testing:latest \
-            -f Dockerfile .
-          echo "AUTHENTIK_IMAGE=testing" >> .env
-          echo "AUTHENTIK_TAG=latest" >> .env
-          docker-compose up --no-start
-          docker-compose start postgresql redis
-          docker-compose run -u root server test
-      - name: Extract version number
-        id: get_version
-        uses: actions/github-script@v6
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
-      - name: Create Release
-        id: create_release
-        uses: actions/create-release@v1.1.4
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release ${{ steps.get_version.outputs.result }}
-          draft: true
-          prerelease: false

.github/workflows/release.yml

@@ -0,0 +1,114 @@
+name: authentik-on-release
+
+on:
+  release:
+    types: [published, created]
+
+jobs:
+  # Build
+  build-server:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: docker build
+          --no-cache
+          -t beryju/authentik:2021.4.6
+          -t beryju/authentik:latest
+          -f Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/authentik:2021.4.6
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/authentik:latest
+  build-proxy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - uses: actions/setup-go@v2
+        with:
+          go-version: "^1.15"
+      - name: prepare go api client
+        run: |
+          cd outpost
+          go get -u github.com/go-swagger/go-swagger/cmd/swagger
+          swagger generate client -f ../swagger.yaml -A authentik -t pkg/
+          go build -v .
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: |
+          cd outpost/
+          docker build \
+          --no-cache \
+          -t beryju/authentik-proxy:2021.4.6 \
+          -t beryju/authentik-proxy:latest \
+          -f proxy.Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/authentik-proxy:2021.4.6
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/authentik-proxy:latest
+  build-static:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: prepare ts api client
+        run: |
+          docker run --rm -v $(pwd):/local openapitools/openapi-generator-cli generate -i /local/swagger.yaml -g typescript-fetch -o /local/web/api --additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=authentik-api,npmVersion=1.0.0
+      - name: Docker Login Registry
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        run: docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD
+      - name: Building Docker Image
+        run: |
+          cd web/
+          docker build \
+          --no-cache \
+          -t beryju/authentik-static:2021.4.6 \
+          -t beryju/authentik-static:latest \
+          -f Dockerfile .
+      - name: Push Docker Container to Registry (versioned)
+        run: docker push beryju/authentik-static:2021.4.6
+      - name: Push Docker Container to Registry (latest)
+        run: docker push beryju/authentik-static:latest
+  test-release:
+    needs:
+      - build-server
+      - build-static
+      - build-proxy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Run test suite in final docker images
+        run: |
+          sudo apt-get install -y pwgen
+          echo "PG_PASS=$(pwgen 40 1)" >> .env
+          echo "AUTHENTIK_SECRET_KEY=$(pwgen 50 1)" >> .env
+          docker-compose pull -q
+          docker-compose up --no-start
+          docker-compose start postgresql redis
+          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
+  sentry-release:
+    needs:
+      - test-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Create a Sentry.io release
+        uses: tclindner/sentry-releases-action@v1.2.0
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: beryjuorg
+          SENTRY_PROJECT: authentik
+          SENTRY_URL: https://sentry.beryju.org
+        with:
+          tagName: 2021.4.6
+          environment: beryjuorg-prod

.github/workflows/tag.yml

@@ -0,0 +1,63 @@
+name: authentik-on-tag
+
+on:
+  push:
+    tags:
+    - 'version/*'
+
+jobs:
+  build:
+    name: Create Release from Tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Pre-release test
+        run: |
+          sudo apt-get install -y pwgen
+          echo "AUTHENTIK_TAG=latest" >> .env
+          echo "PG_PASS=$(pwgen 40 1)" >> .env
+          echo "AUTHENTIK_SECRET_KEY=$(pwgen 50 1)" >> .env
+          docker-compose pull -q
+          docker build \
+            --no-cache \
+            -t beryju/authentik:latest \
+            -f Dockerfile .
+          docker-compose up --no-start
+          docker-compose start postgresql redis
+          docker-compose run -u root --entrypoint /bin/bash server -c "pip install --no-cache -r requirements-dev.txt && ./manage.py test authentik"
+      - name: Install Helm
+        run: |
+          apt update && apt install -y curl
+          curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+      - name: Helm package
+        run: |
+          helm dependency update helm/
+          helm package helm/
+          mv authentik-*.tgz authentik-chart.tgz
+      - name: Extract version number
+        id: get_version
+        uses: actions/github-script@0.2.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
+      - name: Create Release
+        id: create_release
+        uses: actions/create-release@v1.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: Release ${{ steps.get_version.outputs.result }}
+          draft: true
+          prerelease: false
+      - name: Upload packaged Helm Chart
+        id: upload-release-asset
+        uses: actions/upload-release-asset@v1.0.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: ./authentik-chart.tgz
+          asset_name: authentik-chart.tgz
+          asset_content_type: application/gzip

.github/workflows/translation-compile.yml

@@ -1,36 +0,0 @@
-name: authentik-backend-translate-compile
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - '/locale/'
-  pull_request:
-    paths:
-      - '/locale/'
-  workflow_dispatch:
-
-env:
-  POSTGRES_DB: authentik
-  POSTGRES_USER: authentik
-  POSTGRES_PASSWORD: "EK-5jnKfjrGRm<77"
-
-jobs:
-  compile:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Setup authentik env
-        uses: ./.github/actions/setup
-      - name: run compile
-        run: poetry run ./manage.py compilemessages
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4
-        id: cpr
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: compile-backend-translation
-          commit-message: "core: compile backend translations"
-          title: "core: compile backend translations"
-          body: "core: compile backend translations"
-          delete-branch: true
-          signoff: true

.github/workflows/web-api-publish.yml

@@ -1,41 +0,0 @@
-name: authentik-web-api-publish
-on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'schema.yml'
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3.1.1
-        with:
-          node-version: '16'
-          registry-url: 'https://registry.npmjs.org'
-      - name: Generate API Client
-        run: make gen-web
-      - name: Publish package
-        run: |
-          cd web-api/
-          npm i
-          npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-      - name: Upgrade /web
-        run: |
-          cd web/
-          export VERSION=`node -e 'console.log(require("../web-api/package.json").version)'`
-          npm i @goauthentik/api@$VERSION
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v4
-        id: cpr
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: update-web-api-client
-          commit-message: "web: Update Web API Client version"
-          title: "web: Update Web API Client version"
-          body: "web: Update Web API Client version"
-          delete-branch: true
-          signoff: true

.gitignore

@@ -66,9 +66,7 @@ coverage.xml
 unittest.xml
 
 # Translations
-# Have to include binary mo files as they are annoying to compile at build time
-# since a full postgres and redis instance are required
-# *.mo
+*.mo
 
 # Django stuff:
 
@@ -195,12 +193,12 @@ pip-selfcheck.json
 local.env.yml
 .vscode/
 
+### Helm ###
+# Chart dependencies
+**/charts/*.tgz
+
 # Selenium Screenshots
 selenium_screenshots/
 backups/
 media/
 *mmdb
-
-.idea/
-/api/
-/web-api/

.vscode/settings.json

@@ -1,25 +0,0 @@
-{
-    "cSpell.words": [
-        "asgi",
-        "authentik",
-        "authn",
-        "goauthentik",
-        "jwks",
-        "oidc",
-        "openid",
-        "plex",
-        "saml",
-        "totp",
-        "webauthn",
-        "traefik",
-        "passwordless",
-        "kubernetes"
-    ],
-    "python.linting.pylintEnabled": true,
-    "todo-tree.tree.showCountsInTree": true,
-    "todo-tree.tree.showBadges": true,
-    "python.formatting.provider": "black",
-    "files.associations": {
-        "*.akflow": "json"
-    }
-}

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-hello@beryju.org.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -1,175 +0,0 @@
-# Contributing to authentik
-
-:+1::tada: Thanks for taking the time to contribute! :tada::+1:
-
-The following is a set of guidelines for contributing to authentik and its components, which are hosted in the [goauthentik Organization](https://github.com/goauthentik) on GitHub. These are mostly guidelines, not rules. Use your best judgment, and feel free to propose changes to this document in a pull request.
-
-#### Table Of Contents
-
-[Code of Conduct](#code-of-conduct)
-
-[I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)
-
-[What should I know before I get started?](#what-should-i-know-before-i-get-started)
-  * [The components](#the-components)
-  * [authentik's structure](#authentiks-structure)
-
-[How Can I Contribute?](#how-can-i-contribute)
-  * [Reporting Bugs](#reporting-bugs)
-  * [Suggesting Enhancements](#suggesting-enhancements)
-  * [Your First Code Contribution](#your-first-code-contribution)
-  * [Pull Requests](#pull-requests)
-
-[Styleguides](#styleguides)
-  * [Git Commit Messages](#git-commit-messages)
-  * [Python Styleguide](#python-styleguide)
-  * [Documentation Styleguide](#documentation-styleguide)
-
-## Code of Conduct
-
-Basically, don't be a dickhead. This is an open-source non-profit project, that is made in the free time of Volunteers. If there's something you dislike or think can be done better, tell us! We'd love to hear any suggestions for improvement.
-
-## I don't want to read this whole thing I just have a question!!!
-
-Either [create a question on GitHub](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=question&template=question.md&title=) or join [the Discord server](https://goauthentik.io/discord)
-
-## What should I know before I get started?
-
-### The components
-
-authentik consists of a few larger components:
-
-- *authentik* the actual application server, is described below.
-- *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
-- *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
-- *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
-- *website* is the Website/documentation, which uses docusaurus.
-
-### authentik's structure
-
-authentik is at it's very core a Django project. It consists of many individual django applications. These applications are intended to separate concerns, and they may share code between each other.
-
-These are the current packages:
-<a id="authentik-packages"/>
-
-```
-authentik
-├── admin - Administrative tasks and APIs, no models (Version updates, Metrics, system tasks)
-├── api - General API Configuration (Routes, Schema and general API utilities)
-├── core - Core authentik functionality, central routes, core Models
-├── crypto - Cryptography, currently used to generate and hold Certificates and Private Keys
-├── events - Event Log, middleware and signals to generate signals
-├── flows - Flows, the FlowPlanner and the FlowExecutor, used for all flows for authentication, authorization, etc
-├── lib - Generic library of functions, few dependencies on other packages.
-├── managed - Handle managed models and their state.
-├── outposts - Configure and deploy outposts on kubernetes and docker.
-├── policies - General PolicyEngine
-│   ├── dummy - A Dummy policy used for testing
-│   ├── event_matcher - Match events based on different criteria
-│   ├── expiry - Check when a user's password was last set
-│   ├── expression - Execute any arbitrary python code
-│   ├── hibp - Check a password against HaveIBeenPwned
-│   ├── password - Check a password against several rules
-│   └── reputation - Check the user's/client's reputation
-├── providers
-│   ├── ldap - Provide LDAP access to authentik users/groups using an outpost
-│   ├── oauth2 - OIDC-compliant OAuth2 provider
-│   ├── proxy - Provides an identity-aware proxy using an outpost
-│   └── saml - SAML2 Provider
-├── recovery - Generate keys to use in case you lock yourself out
-├── root - Root django application, contains global settings and routes
-├── sources
-│   ├── ldap - Sync LDAP users from OpenLDAP or Active Directory into authentik
-│   ├── oauth - OAuth1 and OAuth2 Source
-│   ├── plex - Plex source
-│   └── saml - SAML2 Source
-├── stages
-│   ├── authenticator_duo - Configure a DUO authenticator
-│   ├── authenticator_static - Configure TOTP backup keys
-│   ├── authenticator_totp - Configure a TOTP authenticator
-│   ├── authenticator_validate - Validate any authenticator
-│   ├── authenticator_webauthn - Configure a WebAuthn authenticator
-│   ├── captcha - Make the user pass a captcha
-│   ├── consent - Let the user decide if they want to consent to an action
-│   ├── deny - Static deny, can be used with policies
-│   ├── dummy - Dummy stage to test
-│   ├── email - Send the user an email and block execution until they click the link
-│   ├── identification - Identify a user with any combination of fields
-│   ├── invitation - Invitation system to limit flows to certain users
-│   ├── password - Password authentication
-│   ├── prompt - Arbitrary prompts
-│   ├── user_delete - Delete the currently pending user
-│   ├── user_login - Login the currently pending user
-│   ├── user_logout - Logout the currently pending user
-│   └── user_write - Write any currenetly pending data to the user.
-└── tenants - Soft tennancy, configure defaults and branding per domain
-```
-
-This django project is running in gunicorn, which spawns multiple workers and threads. Gunicorn is run from a lightweight Go application which reverse-proxies it, handles static files and will eventually gain more functionality as more code is migrated to go.
-
-There are also several background tasks which run in Celery, the root celery application is defined in `authentik.root.celery`.
-
-## How Can I Contribute?
-
-### Reporting Bugs
-
-This section guides you through submitting a bug report for authentik. Following these guidelines helps maintainers and the community understand your report, reproduce the behavior, and find related reports.
-
-Whenever authentik encounters an error, it will be logged as an Event with the type `system_exception`. This event type has a button to directly open a pre-filled GitHub issue form.
-
-This form will have the full stack trace of the error that occurred and shouldn't contain any sensitive data.
-
-### Suggesting Enhancements
-
-This section guides you through submitting an enhancement suggestion for authentik, including completely new features and minor improvements to existing functionality. Following these guidelines helps maintainers and the community understand your suggestion and find related suggestions.
-
-When you are creating an enhancement suggestion, please fill in [the template](https://github.com/goauthentik/authentik/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=), including the steps that you imagine you would take if the feature you're requesting existed.
-
-### Your First Code Contribution
-
-#### Local development
-
-authentik can be run locally, all though depending on which part you want to work on, different pre-requisites are required.
-
-This is documented in the [developer docs](https://goauthentik.io/developer-docs/?utm_source=github)
-
-### Pull Requests
-
-The process described here has several goals:
-
-- Maintain authentik's quality
-- Fix problems that are important to users
-- Engage the community in working toward the best possible authentik
-- Enable a sustainable system for authentik's maintainers to review contributions
-
-Please follow these steps to have your contribution considered by the maintainers:
-
-1. Follow the [styleguides](#styleguides)
-2. After you submit your pull request, verify that all [status checks](https://help.github.com/articles/about-status-checks/) are passing <details><summary>What if the status checks are failing?</summary>If a status check is failing, and you believe that the failure is unrelated to your change, please leave a comment on the pull request explaining why you believe the failure is unrelated. A maintainer will re-run the status check for you. If we conclude that the failure was a false positive, then we will open an issue to track that problem with our status check suite.</details>
-3. Ensure your Code has tests. While it is not always possible to test every single case, the majority of the code should be tested.
-
-While the prerequisites above must be satisfied prior to having your pull request reviewed, the reviewer(s) may ask you to complete additional design work, tests, or other changes before your pull request can be ultimately accepted.
-
-## Styleguides
-
-### Git Commit Messages
-
-* Use the format of `<package>: <verb> <description>`
-  - See [here](#authentik-packages) for `package`
-  - Example: `providers/saml2: fix parsing of requests`
-* Reference issues and pull requests liberally after the first line
-
-### Python Styleguide
-
-All Python code is linted with [black](https://black.readthedocs.io/en/stable/), [PyLint](https://www.pylint.org/) and [isort](https://pycqa.github.io/isort/).
-
-authentik runs on Python 3.9 at the time of writing this.
-
-* Use native type-annotations wherever possible.
-* Add meaningful docstrings when possible.
-* Ensure any database migrations work properly from the last stable version (this is checked via CI)
-* If your code changes central functions, make sure nothing else is broken.
-
-### Documentation Styleguide
-
-* Use [MDX](https://mdxjs.com/) whenever appropriate.

Dockerfile

@@ -1,86 +1,52 @@
-# Stage 1: Build website
-FROM --platform=${BUILDPLATFORM} docker.io/node:16 as website-builder
+FROM python:3.9-slim-buster as locker
 
-COPY ./website /work/website/
+COPY ./Pipfile /app/
+COPY ./Pipfile.lock /app/
 
-ENV NODE_ENV=production
-RUN cd /work/website && npm i && npm run build-docs-only
+WORKDIR /app/
 
-# Stage 2: Build webui
-FROM --platform=${BUILDPLATFORM} docker.io/node:16 as web-builder
+RUN pip install pipenv && \
+    pipenv lock -r > requirements.txt && \
+    pipenv lock -rd > requirements-dev.txt
 
-COPY ./web /work/web/
-COPY ./website /work/website/
-
-ENV NODE_ENV=production
-RUN cd /work/web && npm i && npm run build
-
-# Stage 3: Build go proxy
-FROM docker.io/golang:1.18.0-bullseye AS builder
-
-WORKDIR /work
-
-COPY --from=web-builder /work/web/robots.txt /work/web/robots.txt
-COPY --from=web-builder /work/web/security.txt /work/web/security.txt
-
-COPY ./cmd /work/cmd
-COPY ./web/static.go /work/web/static.go
-COPY ./internal /work/internal
-COPY ./go.mod /work/go.mod
-COPY ./go.sum /work/go.sum
-
-RUN go build -o /work/authentik ./cmd/server/main.go
-
-# Stage 4: Run
-FROM docker.io/python:3.10.4-slim-bullseye
-
-LABEL org.opencontainers.image.url https://goauthentik.io
-LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
-LABEL org.opencontainers.image.source https://github.com/goauthentik/authentik
+FROM python:3.9-slim-buster
 
 WORKDIR /
+COPY --from=locker /app/requirements.txt /
+COPY --from=locker /app/requirements-dev.txt /
 
 ARG GIT_BUILD_HASH
 ENV GIT_BUILD_HASH=$GIT_BUILD_HASH
 
-COPY ./pyproject.toml /
-COPY ./poetry.lock /
-
 RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-        curl ca-certificates gnupg git runit libpq-dev \
-        postgresql-client build-essential libxmlsec1-dev \
-        pkg-config libmaxminddb0 && \
-    pip install poetry && \
-    poetry config virtualenvs.create false && \
-    poetry install --no-dev && \
-    rm -rf ~/.cache/pypoetry && \
-    apt-get remove --purge -y build-essential git && \
-    apt-get autoremove --purge -y && \
+    apt-get install -y --no-install-recommends curl ca-certificates gnupg && \
+    curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
+    echo "deb http://apt.postgresql.org/pub/repos/apt buster-pgdg main" > /etc/apt/sources.list.d/pgdg.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends postgresql-client-12 postgresql-client-11 build-essential libxmlsec1-dev pkg-config libmaxminddb0 && \
     apt-get clean && \
-    rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
+    pip install -r /requirements.txt --no-cache-dir && \
+    apt-get remove --purge -y build-essential && \
+    apt-get autoremove --purge -y && \
+    # This is quite hacky, but docker has no guaranteed Group ID
+    # we could instead check for the GID of the socket and add the user dynamically,
+    # but then we have to drop permmissions later
+    groupadd -g 998 docker_998 && \
+    groupadd -g 999 docker_999 && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
-    mkdir -p /certs /media && \
-    mkdir -p /authentik/.ssh && \
-    chown authentik:authentik /certs /media /authentik/.ssh
+    usermod -a -G docker_998 authentik && \
+    usermod -a -G docker_999 authentik && \
+    mkdir /backups && \
+    chown authentik:authentik /backups
 
 COPY ./authentik/ /authentik
 COPY ./pyproject.toml /
 COPY ./xml /xml
-COPY ./tests /tests
 COPY ./manage.py /
 COPY ./lifecycle/ /lifecycle
-COPY --from=builder /work/authentik /authentik-proxy
-COPY --from=web-builder /work/web/dist/ /web/dist/
-COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/help/ /website/help/
 
 USER authentik
-
+STOPSIGNAL SIGINT
 ENV TMPDIR /dev/shm/
-ENV PYTHONUNBUFFERED 1
-ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/lifecycle"
-
-HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "/lifecycle/ak", "healthcheck" ]
-
-ENTRYPOINT [ "/lifecycle/ak" ]
+ENV PYTHONUBUFFERED 1
+ENTRYPOINT [ "/lifecycle/bootstrap.sh" ]

Makefile

@@ -1,141 +1,37 @@
-.SHELLFLAGS += -x -e
-PWD = $(shell pwd)
-UID = $(shell id -u)
-GID = $(shell id -g)
-NPM_VERSION = $(shell python -m scripts.npm_version)
-
-all: lint-fix lint test gen web
+all: lint-fix lint coverage gen
 
 test-integration:
-	coverage run manage.py test tests/integration
+	k3d cluster create || exit 0
+	k3d kubeconfig write -o ~/.kube/config --overwrite
+	coverage run manage.py test -v 3 tests/integration
 
-test-e2e-provider:
-	coverage run manage.py test tests/e2e/test_provider*
+test-e2e:
+	coverage run manage.py test --failfast -v 3 tests/e2e
 
-test-e2e-rest:
-	coverage run manage.py test tests/e2e/test_flows* tests/e2e/test_source*
-
-test-go:
-	go test -timeout 0 -v -race -cover ./...
-
-test:
-	coverage run manage.py test authentik
+coverage:
+	coverage run manage.py test -v 3 authentik
 	coverage html
 	coverage report
 
 lint-fix:
 	isort authentik tests lifecycle
 	black authentik tests lifecycle
-	codespell -I .github/codespell-words.txt -S 'web/src/locales/**' -w \
-		authentik \
-		internal \
-		cmd \
-		web/src \
-		website/src \
-		website/docs \
-		website/developer-docs
 
 lint:
+	pyright authentik tests lifecycle
 	bandit -r authentik tests lifecycle -x node_modules
 	pylint authentik tests lifecycle
-	golangci-lint run -v
 
-i18n-extract: i18n-extract-core web-extract
+gen: coverage
+	./manage.py generate_swagger -o swagger.yaml -f yaml
 
-i18n-extract-core:
-	./manage.py makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
+local-stack:
+	export AUTHENTIK_TAG=testing
+	docker build -t beryju/authentik:testng .
+	docker-compose up -d
+	docker-compose run --rm server migrate
 
-gen-build:
-	./manage.py spectacular --file schema.yml
-
-gen-clean:
-	rm -rf web/api/src/
-	rm -rf api/
-
-gen-web:
-	docker run \
-		--rm -v ${PWD}:/local \
-		--user ${UID}:${GID} \
-		openapitools/openapi-generator-cli:v6.0.0-beta generate \
-		-i /local/schema.yml \
-		-g typescript-fetch \
-		-o /local/web-api \
-		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=@goauthentik/api,npmVersion=${NPM_VERSION}
-	mkdir -p web/node_modules/@goauthentik/api
-	\cp -fv scripts/web_api_readme.md web-api/README.md
-	cd web-api && npm i
-	\cp -rfv web-api/* web/node_modules/@goauthentik/api
-
-gen-outpost:
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O config.yaml
-	mkdir -p templates
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O templates/README.mustache
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/go.mod.mustache -O templates/go.mod.mustache
-	docker run \
-		--rm -v ${PWD}:/local \
-		--user ${UID}:${GID} \
-		openapitools/openapi-generator-cli:v6.0.0-beta generate \
-		-i /local/schema.yml \
-		-g go \
-		-o /local/api \
-		-c /local/config.yaml
-	go mod edit -replace goauthentik.io/api=./api
-	rm -rf config.yaml ./templates/
-
-gen: gen-build gen-clean gen-web
-
-migrate:
-	python -m lifecycle.migrate
-
-run:
-	go run -v cmd/server/main.go
-
-web-watch:
-	cd web && npm run watch
-
-web: web-lint-fix web-lint web-extract
-
-web-lint-fix:
-	cd web && npm run prettier
-
-web-lint:
-	cd web && npm run lint
-	cd web && npm run lit-analyse
-
-web-extract:
-	cd web && npm run extract
-
-# These targets are use by GitHub actions to allow usage of matrix
-# which makes the YAML File a lot smaller
-
-ci--meta-debug:
-	python -V
-	node --version
-
-ci-pylint: ci--meta-debug
-	pylint authentik tests lifecycle
-
-ci-black: ci--meta-debug
-	black --check authentik tests lifecycle
-
-ci-isort: ci--meta-debug
-	isort --check authentik tests lifecycle
-
-ci-bandit: ci--meta-debug
-	bandit -r authentik tests lifecycle
-
-ci-pyright: ci--meta-debug
-	pyright e2e lifecycle
-
-ci-pending-migrations: ci--meta-debug
-	./manage.py makemigrations --check
-
-install:
-	poetry install
-	cd web && npm i
-	cd website && npm i
-
-a: install
-	tmux \
-		new-session 'make run' \; \
-		split-window 'make web-watch'
+build-static:
+	docker-compose -f scripts/ci.docker-compose.yml up -d
+	docker build -t beryju/authentik-static -f static.Dockerfile --network=scripts_default .
+	docker-compose -f scripts/ci.docker-compose.yml down -v

Pipfile

@@ -0,0 +1,61 @@
+[[source]]
+name = "pypi"
+url = "https://pypi.org/simple"
+verify_ssl = true
+
+[packages]
+boto3 = "*"
+celery = "*"
+channels = "*"
+channels-redis = "*"
+dacite = "*"
+defusedxml = "*"
+django = "*"
+django-dbbackup = "*"
+django-filter = "*"
+django-guardian = "*"
+django-model-utils = "*"
+django-otp = "*"
+django-prometheus = "*"
+django-redis = "*"
+django-storages = "*"
+djangorestframework = "*"
+djangorestframework-guardian = "*"
+docker = "*"
+drf_yasg = "*"
+facebook-sdk = "*"
+geoip2 = "*"
+gunicorn = "*"
+kubernetes = "*"
+ldap3 = "*"
+lxml = ">=4.6.3"
+packaging = "*"
+psycopg2-binary = "*"
+pycryptodome = "*"
+pyjwkest = "*"
+pyyaml = "*"
+requests-oauthlib = "*"
+sentry-sdk = "*"
+service_identity = "*"
+structlog = "*"
+swagger-spec-validator = "*"
+twisted = "==20.3.0"
+urllib3 = {extras = ["secure"],version = "*"}
+uvicorn = {extras = ["standard"],version = "*"}
+webauthn = "*"
+xmlsec = "*"
+
+[requires]
+python_version = "3.9"
+
+[dev-packages]
+bandit = "*"
+black = "==20.8b1"
+bump2version = "*"
+colorama = "*"
+coverage = "*"
+pylint = "*"
+pylint-django = "*"
+pytest = "*"
+pytest-django = "*"
+selenium = "*"

README.md

@@ -4,15 +4,13 @@
 
 ---
 
-[![Join Discord](https://img.shields.io/discord/809154715984199690?label=Discord&style=for-the-badge)](https://goauthentik.io/discord)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-main?label=core%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-main.yml)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-outpost?label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
-[![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-web?label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
-[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=for-the-badge)](https://codecov.io/gh/goauthentik/authentik)
-[![Testspace tests](https://img.shields.io/testspace/total/goauthentik/goauthentik:authentik/master?style=for-the-badge)](https://goauthentik.testspace.com/)
-![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=for-the-badge)
-![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=for-the-badge)
-[![](https://img.shields.io/badge/Help%20translate-transifex-blue?style=for-the-badge)](https://www.transifex.com/beryjuorg/authentik/)
+[![](https://img.shields.io/discord/809154715984199690?label=Discord&style=flat-square)](https://discord.gg/jg33eMhnj6)
+[![CI Build status](https://img.shields.io/azure-devops/build/beryjuorg/authentik/6?style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Tests](https://img.shields.io/azure-devops/tests/beryjuorg/authentik/6?compact_message&style=flat-square)](https://dev.azure.com/beryjuorg/authentik/_build?definitionId=6)
+[![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=flat-square)](https://codecov.io/gh/goauthentik/authentik)
+![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=flat-square)
+![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=flat-square)
+![LGTM Grade](https://img.shields.io/lgtm/grade/python/github/goauthentik/authentik?style=flat-square)
 
 ## What is authentik?
 
@@ -20,9 +18,9 @@ authentik is an open-source Identity Provider focused on flexibility and versati
 
 ## Installation
 
-For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/?utm_source=github)
+For small/test setups it is recommended to use docker-compose, see the [documentation](https://goauthentik.io/docs/installation/docker-compose/)
 
-For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/helm). This is documented [here](https://goauthentik.io/docs/installation/kubernetes/?utm_source=github)
+For bigger setups, there is a Helm Chart in the `helm/` directory. This is documented [here](https://goauthentik.io/docs/installation/kubernetes/)
 
 ## Screenshots
 
@@ -33,28 +31,8 @@ Light | Dark
 
 ## Development
 
-See [Development Documentation](https://goauthentik.io/developer-docs/?utm_source=github)
+See [Development Documentation](https://goauthentik.io/developer-docs/)
 
 ## Security
 
 See [SECURITY.md](SECURITY.md)
-
-## Sponsors
-
-This project is proudly sponsored by:
-
-<p>
-    <a href="https://www.digitalocean.com/?utm_medium=opensource&utm_source=goauthentik.io">
-        <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" width="201px">
-    </a>
-</p>
-
-DigitalOcean provides development and testing resources for authentik.
-
-<p>
-    <a href="https://www.netlify.com">
-        <img src="https://www.netlify.com/img/global/badges/netlify-color-accent.svg" alt="Deploys by Netlify" />
-    </a>
-</p>
-
-Netlify hosts the [goauthentik.io](https://goauthentik.io) site.

SECURITY.md

@@ -2,12 +2,10 @@
 
 ## Supported Versions
 
-(.x being the latest patch release for each version)
-
 | Version    | Supported          |
 | ---------- | ------------------ |
-| 2022.3.x   | :white_check_mark: |
-| 2022.4.x   | :white_check_mark: |
+| 2021.3.x   | :white_check_mark: |
+| 2021.4.x   | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

authentik/__init__.py

@@ -1,19 +1,3 @@
 """authentik"""
-from os import environ
-from typing import Optional
-
-__version__ = "2022.4.1"
+__version__ = "2021.4.6"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
-
-
-def get_build_hash(fallback: Optional[str] = None) -> str:
-    """Get build hash"""
-    return environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
-
-
-def get_full_version() -> str:
-    """Get full version, with build hash appended"""
-    version = __version__
-    if (build_hash := get_build_hash()) != "":
-        version += "." + build_hash
-    return version

authentik/admin/api/meta.py

@@ -1,5 +1,5 @@
 """Meta API"""
-from drf_spectacular.utils import extend_schema
+from drf_yasg.utils import swagger_auto_schema
 from rest_framework.fields import CharField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
@@ -22,7 +22,7 @@ class AppsViewSet(ViewSet):
 
     permission_classes = [IsAdminUser]
 
-    @extend_schema(responses={200: AppSerializer(many=True)})
+    @swagger_auto_schema(responses={200: AppSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """List current messages and pass into Serializer"""
         data = []

authentik/admin/api/metrics.py

@@ -1,14 +1,48 @@
 """authentik administration metrics"""
-from drf_spectacular.utils import extend_schema, extend_schema_field
-from guardian.shortcuts import get_objects_for_user
+import time
+from collections import Counter
+from datetime import timedelta
+
+from django.db.models import Count, ExpressionWrapper, F
+from django.db.models.fields import DurationField
+from django.db.models.functions import ExtractHour
+from django.utils.timezone import now
+from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
 from rest_framework.fields import IntegerField, SerializerMethodField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.views import APIView
+from rest_framework.viewsets import ViewSet
 
 from authentik.core.api.utils import PassiveSerializer
-from authentik.events.models import EventAction
+from authentik.events.models import Event, EventAction
+
+
+def get_events_per_1h(**filter_kwargs) -> list[dict[str, int]]:
+    """Get event count by hour in the last day, fill with zeros"""
+    date_from = now() - timedelta(days=1)
+    result = (
+        Event.objects.filter(created__gte=date_from, **filter_kwargs)
+        .annotate(
+            age=ExpressionWrapper(now() - F("created"), output_field=DurationField())
+        )
+        .annotate(age_hours=ExtractHour("age"))
+        .values("age_hours")
+        .annotate(count=Count("pk"))
+        .order_by("age_hours")
+    )
+    data = Counter({int(d["age_hours"]): d["count"] for d in result})
+    results = []
+    _now = now()
+    for hour in range(0, -24, -1):
+        results.append(
+            {
+                "x_cord": time.mktime((_now + timedelta(hours=hour)).timetuple())
+                * 1000,
+                "y_cord": data[hour * -1],
+            }
+        )
+    return results
 
 
 class CoordinateSerializer(PassiveSerializer):
@@ -24,35 +58,24 @@ class LoginMetricsSerializer(PassiveSerializer):
     logins_per_1h = SerializerMethodField()
     logins_failed_per_1h = SerializerMethodField()
 
-    @extend_schema_field(CoordinateSerializer(many=True))
+    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
         """Get successful logins per hour for the last 24 hours"""
-        user = self.context["user"]
-        return (
-            get_objects_for_user(user, "authentik_events.view_event")
-            .filter(action=EventAction.LOGIN)
-            .get_events_per_hour()
-        )
+        return get_events_per_1h(action=EventAction.LOGIN)
 
-    @extend_schema_field(CoordinateSerializer(many=True))
+    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
     def get_logins_failed_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
-        user = self.context["user"]
-        return (
-            get_objects_for_user(user, "authentik_events.view_event")
-            .filter(action=EventAction.LOGIN_FAILED)
-            .get_events_per_hour()
-        )
+        return get_events_per_1h(action=EventAction.LOGIN_FAILED)
 
 
-class AdministrationMetricsViewSet(APIView):
+class AdministrationMetricsViewSet(ViewSet):
     """Login Metrics per 1h"""
 
     permission_classes = [IsAdminUser]
 
-    @extend_schema(responses={200: LoginMetricsSerializer(many=False)})
-    def get(self, request: Request) -> Response:
+    @swagger_auto_schema(responses={200: LoginMetricsSerializer(many=False)})
+    def list(self, request: Request) -> Response:
         """Login Metrics per 1h"""
         serializer = LoginMetricsSerializer(True)
-        serializer.context["user"] = request.user
         return Response(serializer.data)

authentik/admin/api/system.py

@@ -1,104 +0,0 @@
-"""authentik administration overview"""
-import os
-import platform
-from datetime import datetime
-from sys import version as python_version
-from typing import TypedDict
-
-from django.utils.timezone import now
-from drf_spectacular.utils import extend_schema
-from gunicorn import version_info as gunicorn_version
-from kubernetes.config.incluster_config import SERVICE_HOST_ENV_NAME
-from rest_framework.fields import SerializerMethodField
-from rest_framework.permissions import IsAdminUser
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-
-from authentik.core.api.utils import PassiveSerializer
-from authentik.outposts.managed import MANAGED_OUTPOST
-from authentik.outposts.models import Outpost
-
-
-class RuntimeDict(TypedDict):
-    """Runtime information"""
-
-    python_version: str
-    gunicorn_version: str
-    environment: str
-    architecture: str
-    platform: str
-    uname: str
-
-
-class SystemSerializer(PassiveSerializer):
-    """Get system information."""
-
-    env = SerializerMethodField()
-    http_headers = SerializerMethodField()
-    http_host = SerializerMethodField()
-    http_is_secure = SerializerMethodField()
-    runtime = SerializerMethodField()
-    tenant = SerializerMethodField()
-    server_time = SerializerMethodField()
-    embedded_outpost_host = SerializerMethodField()
-
-    def get_env(self, request: Request) -> dict[str, str]:
-        """Get Environment"""
-        return os.environ.copy()
-
-    def get_http_headers(self, request: Request) -> dict[str, str]:
-        """Get HTTP Request headers"""
-        headers = {}
-        for key, value in request.META.items():
-            if not isinstance(value, str):
-                continue
-            headers[key] = value
-        return headers
-
-    def get_http_host(self, request: Request) -> str:
-        """Get HTTP host"""
-        return request._request.get_host()
-
-    def get_http_is_secure(self, request: Request) -> bool:
-        """Get HTTP Secure flag"""
-        return request._request.is_secure()
-
-    def get_runtime(self, request: Request) -> RuntimeDict:
-        """Get versions"""
-        return {
-            "python_version": python_version,
-            "gunicorn_version": ".".join(str(x) for x in gunicorn_version),
-            "environment": "kubernetes" if SERVICE_HOST_ENV_NAME in os.environ else "compose",
-            "architecture": platform.machine(),
-            "platform": platform.platform(),
-            "uname": " ".join(platform.uname()),
-        }
-
-    def get_tenant(self, request: Request) -> str:
-        """Currently active tenant"""
-        return str(request._request.tenant)
-
-    def get_server_time(self, request: Request) -> datetime:
-        """Current server time"""
-        return now()
-
-    def get_embedded_outpost_host(self, request: Request) -> str:
-        """Get the FQDN configured on the embedded outpost"""
-        outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
-        if not outposts.exists():  # pragma: no cover
-            return ""
-        return outposts.first().config.authentik_host
-
-
-class SystemView(APIView):
-    """Get system information."""
-
-    permission_classes = [IsAdminUser]
-    pagination_class = None
-    filter_backends = []
-
-    @extend_schema(responses={200: SystemSerializer(many=False)})
-    def get(self, request: Request) -> Response:
-        """Get system information."""
-        return Response(SystemSerializer(request).data)

authentik/admin/api/tasks.py

@@ -4,28 +4,24 @@ from importlib import import_module
 from django.contrib import messages
 from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
+from drf_yasg.utils import swagger_auto_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
-from structlog.stdlib import get_logger
 
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus
 
-LOGGER = get_logger()
-
 
 class TaskSerializer(PassiveSerializer):
     """Serialize TaskInfo and TaskResult"""
 
     task_name = CharField()
     task_description = CharField()
-    task_finish_timestamp = DateTimeField(source="finish_time")
+    task_finish_timestamp = DateTimeField(source="finish_timestamp")
 
     status = ChoiceField(
         source="result.status.name",
@@ -33,32 +29,14 @@ class TaskSerializer(PassiveSerializer):
     )
     messages = ListField(source="result.messages")
 
-    def to_representation(self, instance):
-        """When a new version of authentik adds fields to TaskInfo,
-        the API will fail with an AttributeError, as the classes
-        are pickled in cache. In that case, just delete the info"""
-        try:
-            return super().to_representation(instance)
-        except AttributeError:  # pragma: no cover
-            if isinstance(self.instance, list):
-                for inst in self.instance:
-                    inst.delete()
-            else:
-                self.instance.delete()
-            return {}
-
 
 class TaskViewSet(ViewSet):
     """Read-only view set that returns all background tasks"""
 
     permission_classes = [IsAdminUser]
-    serializer_class = TaskSerializer
 
-    @extend_schema(
-        responses={
-            200: TaskSerializer(many=False),
-            404: OpenApiResponse(description="Task not found"),
-        }
+    @swagger_auto_schema(
+        responses={200: TaskSerializer(many=False), 404: "Task not found"}
     )
     # pylint: disable=invalid-name
     def retrieve(self, request: Request, pk=None) -> Response:
@@ -68,19 +46,18 @@ class TaskViewSet(ViewSet):
             raise Http404
         return Response(TaskSerializer(task, many=False).data)
 
-    @extend_schema(responses={200: TaskSerializer(many=True)})
+    @swagger_auto_schema(responses={200: TaskSerializer(many=True)})
     def list(self, request: Request) -> Response:
         """List system tasks"""
         tasks = sorted(TaskInfo.all().values(), key=lambda task: task.task_name)
         return Response(TaskSerializer(tasks, many=True).data)
 
-    @extend_schema(
-        request=OpenApiTypes.NONE,
+    @swagger_auto_schema(
         responses={
-            204: OpenApiResponse(description="Task retried successfully"),
-            404: OpenApiResponse(description="Task not found"),
-            500: OpenApiResponse(description="Failed to retry task"),
-        },
+            204: "Task retried successfully",
+            404: "Task not found",
+            500: "Failed to retry task",
+        }
     )
     @action(detail=True, methods=["post"])
     # pylint: disable=invalid-name
@@ -92,15 +69,16 @@ class TaskViewSet(ViewSet):
         try:
             task_module = import_module(task.task_call_module)
             task_func = getattr(task_module, task.task_call_func)
-            LOGGER.debug("Running task", task=task_func)
             task_func.delay(*task.task_call_args, **task.task_call_kwargs)
             messages.success(
                 self.request,
-                _("Successfully re-scheduled Task %(name)s!" % {"name": task.task_name}),
+                _(
+                    "Successfully re-scheduled Task %(name)s!"
+                    % {"name": task.task_name}
+                ),
             )
             return Response(status=204)
-        except (ImportError, AttributeError):  # pragma: no cover
-            LOGGER.warning("Failed to run task, remove state", task=task)
+        except ImportError:  # pragma: no cover
             # if we get an import error, the module path has probably changed
             task.delete()
             return Response(status=500)

authentik/admin/api/version.py

@@ -1,14 +1,17 @@
 """authentik administration overview"""
+from os import environ
+
 from django.core.cache import cache
-from drf_spectacular.utils import extend_schema
+from drf_yasg.utils import swagger_auto_schema
 from packaging.version import parse
 from rest_framework.fields import SerializerMethodField
+from rest_framework.mixins import ListModelMixin
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.views import APIView
+from rest_framework.viewsets import GenericViewSet
 
-from authentik import __version__, get_build_hash
+from authentik import ENV_GIT_HASH_KEY, __version__
 from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
 from authentik.core.api.utils import PassiveSerializer
 
@@ -23,7 +26,7 @@ class VersionSerializer(PassiveSerializer):
 
     def get_build_hash(self, _) -> str:
         """Get build hash, if version is not latest or released"""
-        return get_build_hash()
+        return environ.get(ENV_GIT_HASH_KEY, "")
 
     def get_version_current(self, _) -> str:
         """Get current version"""
@@ -39,17 +42,22 @@ class VersionSerializer(PassiveSerializer):
 
     def get_outdated(self, instance) -> bool:
         """Check if we're running the latest version"""
-        return parse(self.get_version_current(instance)) < parse(self.get_version_latest(instance))
+        return parse(self.get_version_current(instance)) < parse(
+            self.get_version_latest(instance)
+        )
 
 
-class VersionView(APIView):
+class VersionViewSet(ListModelMixin, GenericViewSet):
     """Get running and latest version."""
 
     permission_classes = [IsAuthenticated]
     pagination_class = None
     filter_backends = []
 
-    @extend_schema(responses={200: VersionSerializer(many=False)})
-    def get(self, request: Request) -> Response:
+    def get_queryset(self):  # pragma: no cover
+        return None
+
+    @swagger_auto_schema(responses={200: VersionSerializer(many=False)})
+    def list(self, request: Request) -> Response:
         """Get running and latest version."""
         return Response(VersionSerializer(True).data)

authentik/admin/api/workers.py

@@ -1,28 +1,25 @@
 """authentik administration overview"""
-from django.conf import settings
-from drf_spectacular.utils import extend_schema, inline_serializer
-from prometheus_client import Gauge
-from rest_framework.fields import IntegerField
+from rest_framework.mixins import ListModelMixin
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.views import APIView
+from rest_framework.serializers import Serializer
+from rest_framework.viewsets import GenericViewSet
 
 from authentik.root.celery import CELERY_APP
 
-GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")
 
-
-class WorkerView(APIView):
+class WorkerViewSet(ListModelMixin, GenericViewSet):
     """Get currently connected worker count."""
 
+    serializer_class = Serializer
     permission_classes = [IsAdminUser]
 
-    @extend_schema(responses=inline_serializer("Workers", fields={"count": IntegerField()}))
-    def get(self, request: Request) -> Response:
+    def get_queryset(self):  # pragma: no cover
+        return None
+
+    def list(self, request: Request) -> Response:
         """Get currently connected worker count."""
-        count = len(CELERY_APP.control.ping(timeout=0.5))
-        # In debug we run with `CELERY_TASK_ALWAYS_EAGER`, so tasks are ran on the main process
-        if settings.DEBUG:  # pragma: no cover
-            count += 1
-        return Response({"count": count})
+        return Response(
+            {"pagination": {"count": len(CELERY_APP.control.ping(timeout=0.5))}}
+        )

authentik/admin/apps.py

@@ -1,6 +1,4 @@
 """authentik admin app config"""
-from importlib import import_module
-
 from django.apps import AppConfig
 
 
@@ -10,9 +8,3 @@ class AuthentikAdminConfig(AppConfig):
     name = "authentik.admin"
     label = "authentik_admin"
     verbose_name = "authentik Admin"
-
-    def ready(self):
-        from authentik.admin.tasks import clear_update_notifications
-
-        clear_update_notifications.delay()
-        import_module("authentik.admin.signals")

authentik/admin/signals.py

@@ -1,23 +0,0 @@
-"""admin signals"""
-from django.dispatch import receiver
-
-from authentik.admin.api.tasks import TaskInfo
-from authentik.admin.api.workers import GAUGE_WORKERS
-from authentik.root.celery import CELERY_APP
-from authentik.root.monitoring import monitoring_set
-
-
-@receiver(monitoring_set)
-# pylint: disable=unused-argument
-def monitoring_set_workers(sender, **kwargs):
-    """Set worker gauge"""
-    count = len(CELERY_APP.control.ping(timeout=0.5))
-    GAUGE_WORKERS.set(count)
-
-
-@receiver(monitoring_set)
-# pylint: disable=unused-argument
-def monitoring_set_tasks(sender, **kwargs):
-    """Set task gauges"""
-    for task in TaskInfo.all().values():
-        task.set_prom_metrics()

authentik/admin/tasks.py

@@ -4,20 +4,12 @@ import re
 from django.core.cache import cache
 from django.core.validators import URLValidator
 from packaging.version import parse
-from prometheus_client import Info
-from requests import RequestException
+from requests import RequestException, get
 from structlog.stdlib import get_logger
 
-from authentik import __version__, get_build_hash
-from authentik.events.models import Event, EventAction, Notification
-from authentik.events.monitored_tasks import (
-    MonitoredTask,
-    TaskResult,
-    TaskResultStatus,
-    prefill_task,
-)
-from authentik.lib.config import CONFIG
-from authentik.lib.utils.http import get_http_session
+from authentik import __version__
+from authentik.events.models import Event, EventAction
+from authentik.events.monitored_tasks import MonitoredTask, TaskResult, TaskResultStatus
 from authentik.root.celery import CELERY_APP
 
 LOGGER = get_logger()
@@ -25,56 +17,29 @@ VERSION_CACHE_KEY = "authentik_latest_version"
 VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
 # Chop of the first ^ because we want to search the entire string
 URL_FINDER = URLValidator.regex.pattern[1:]
-PROM_INFO = Info("authentik_version", "Currently running authentik version")
-LOCAL_VERSION = parse(__version__)
-
-
-def _set_prom_info():
-    """Set prometheus info for version"""
-    PROM_INFO.info(
-        {
-            "version": __version__,
-            "latest": cache.get(VERSION_CACHE_KEY, ""),
-            "build_hash": get_build_hash(),
-        }
-    )
-
-
-@CELERY_APP.task()
-def clear_update_notifications():
-    """Clear update notifications on startup if the notification was for the version
-    we're running now."""
-    for notification in Notification.objects.filter(event__action=EventAction.UPDATE_AVAILABLE):
-        if "new_version" not in notification.event.context:
-            continue
-        notification_version = notification.event.context["new_version"]
-        if LOCAL_VERSION >= parse(notification_version):
-            notification.delete()
 
 
 @CELERY_APP.task(bind=True, base=MonitoredTask)
-@prefill_task
 def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
-    if CONFIG.y_bool("disable_update_check"):
-        cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
-        return
     try:
-        response = get_http_session().get(
-            "https://version.goauthentik.io/version.json",
+        response = get(
+            "https://api.github.com/repos/goauthentik/authentik/releases/latest"
         )
         response.raise_for_status()
         data = response.json()
-        upstream_version = data.get("stable", {}).get("version")
+        tag_name = data.get("tag_name")
+        upstream_version = tag_name.split("/")[1]
         cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
         self.set_status(
-            TaskResult(TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"])
+            TaskResult(
+                TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"]
+            )
         )
-        _set_prom_info()
         # Check if upstream version is newer than what we're running,
         # and if no event exists yet, create one.
-        if LOCAL_VERSION < parse(upstream_version):
+        local_version = parse(__version__)
+        if local_version < parse(upstream_version):
             # Event has already been created, don't create duplicate
             if Event.objects.filter(
                 action=EventAction.UPDATE_AVAILABLE,
@@ -82,12 +47,9 @@ def update_latest_version(self: MonitoredTask):
             ).exists():
                 return
             event_dict = {"new_version": upstream_version}
-            if match := re.search(URL_FINDER, data.get("stable", {}).get("changelog", "")):
+            if match := re.search(URL_FINDER, data.get("body", "")):
                 event_dict["message"] = f"Changelog: {match.group()}"
             Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
     except (RequestException, IndexError) as exc:
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
         self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
-
-
-_set_prom_info()

authentik/admin/tests/test_api.py

@@ -7,8 +7,6 @@ from django.urls import reverse
 from authentik import __version__
 from authentik.core.models import Group, User
 from authentik.core.tasks import clean_expired_models
-from authentik.events.monitored_tasks import TaskResultStatus
-from authentik.managed.tasks import managed_reconcile
 
 
 class TestAdminAPI(TestCase):
@@ -28,25 +26,9 @@ class TestAdminAPI(TestCase):
         response = self.client.get(reverse("authentik_api:admin_system_tasks-list"))
         self.assertEqual(response.status_code, 200)
         body = loads(response.content)
-        self.assertTrue(any(task["task_name"] == "clean_expired_models" for task in body))
-
-    def test_tasks_single(self):
-        """Test Task API (read single)"""
-        clean_expired_models.delay()
-        response = self.client.get(
-            reverse(
-                "authentik_api:admin_system_tasks-detail",
-                kwargs={"pk": "clean_expired_models"},
-            )
+        self.assertTrue(
+            any(task["task_name"] == "clean_expired_models" for task in body)
         )
-        self.assertEqual(response.status_code, 200)
-        body = loads(response.content)
-        self.assertEqual(body["status"], TaskResultStatus.SUCCESSFUL.name)
-        self.assertEqual(body["task_name"], "clean_expired_models")
-        response = self.client.get(
-            reverse("authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"})
-        )
-        self.assertEqual(response.status_code, 404)
 
     def test_tasks_retry(self):
         """Test Task API (retry)"""
@@ -71,31 +53,24 @@ class TestAdminAPI(TestCase):
 
     def test_version(self):
         """Test Version API"""
-        response = self.client.get(reverse("authentik_api:admin_version"))
+        response = self.client.get(reverse("authentik_api:admin_version-list"))
         self.assertEqual(response.status_code, 200)
         body = loads(response.content)
         self.assertEqual(body["version_current"], __version__)
 
     def test_workers(self):
         """Test Workers API"""
-        response = self.client.get(reverse("authentik_api:admin_workers"))
+        response = self.client.get(reverse("authentik_api:admin_workers-list"))
         self.assertEqual(response.status_code, 200)
         body = loads(response.content)
-        self.assertEqual(body["count"], 0)
+        self.assertEqual(body["pagination"]["count"], 0)
 
     def test_metrics(self):
         """Test metrics API"""
-        response = self.client.get(reverse("authentik_api:admin_metrics"))
+        response = self.client.get(reverse("authentik_api:admin_metrics-list"))
         self.assertEqual(response.status_code, 200)
 
     def test_apps(self):
         """Test apps API"""
         response = self.client.get(reverse("authentik_api:apps-list"))
         self.assertEqual(response.status_code, 200)
-
-    def test_system(self):
-        """Test system API"""
-        # pyright: reportGeneralTypeIssues=false
-        managed_reconcile()  # pylint: disable=no-value-for-parameter
-        response = self.client.get(reverse("authentik_api:admin_system"))
-        self.assertEqual(response.status_code, 200)

authentik/admin/tests/test_tasks.py

@@ -1,83 +1,81 @@
 """test admin tasks"""
+import json
+from dataclasses import dataclass
+from unittest.mock import Mock, patch
+
 from django.core.cache import cache
 from django.test import TestCase
-from requests_mock import Mocker
+from requests.exceptions import RequestException
 
-from authentik.admin.tasks import (
-    VERSION_CACHE_KEY,
-    clear_update_notifications,
-    update_latest_version,
-)
+from authentik.admin.tasks import VERSION_CACHE_KEY, update_latest_version
 from authentik.events.models import Event, EventAction
-from authentik.lib.config import CONFIG
 
-RESPONSE_VALID = {
-    "$schema": "https://version.goauthentik.io/schema.json",
-    "stable": {
-        "version": "99999999.9999999",
-        "changelog": "See https://goauthentik.io/test",
-        "reason": "bugfix",
-    },
-}
+
+@dataclass
+class MockResponse:
+    """Mock class to emulate the methods of requests's Response we need"""
+
+    status_code: int
+    response: str
+
+    def json(self) -> dict:
+        """Get json parsed response"""
+        return json.loads(self.response)
+
+    def raise_for_status(self):
+        """raise RequestException if status code is 400 or more"""
+        if self.status_code >= 400:
+            raise RequestException
+
+
+REQUEST_MOCK_VALID = Mock(
+    return_value=MockResponse(
+        200,
+        """{
+            "tag_name": "version/99999999.9999999",
+            "body": "https://goauthentik.io/test"
+        }""",
+    )
+)
+
+REQUEST_MOCK_INVALID = Mock(return_value=MockResponse(400, "{}"))
 
 
 class TestAdminTasks(TestCase):
     """test admin tasks"""
 
+    @patch("authentik.admin.tasks.get", REQUEST_MOCK_VALID)
     def test_version_valid_response(self):
         """Test Update checker with valid response"""
-        with Mocker() as mocker:
-            mocker.get("https://version.goauthentik.io/version.json", json=RESPONSE_VALID)
-            update_latest_version.delay().get()
-            self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
-            self.assertTrue(
+        update_latest_version.delay().get()
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "99999999.9999999")
+        self.assertTrue(
+            Event.objects.filter(
+                action=EventAction.UPDATE_AVAILABLE,
+                context__new_version="99999999.9999999",
+                context__message="Changelog: https://goauthentik.io/test",
+            ).exists()
+        )
+        # test that a consecutive check doesn't create a duplicate event
+        update_latest_version.delay().get()
+        self.assertEqual(
+            len(
                 Event.objects.filter(
                     action=EventAction.UPDATE_AVAILABLE,
                     context__new_version="99999999.9999999",
                     context__message="Changelog: https://goauthentik.io/test",
-                ).exists()
-            )
-            # test that a consecutive check doesn't create a duplicate event
-            update_latest_version.delay().get()
-            self.assertEqual(
-                len(
-                    Event.objects.filter(
-                        action=EventAction.UPDATE_AVAILABLE,
-                        context__new_version="99999999.9999999",
-                        context__message="Changelog: https://goauthentik.io/test",
-                    )
-                ),
-                1,
-            )
+                )
+            ),
+            1,
+        )
 
+    @patch("authentik.admin.tasks.get", REQUEST_MOCK_INVALID)
     def test_version_error(self):
         """Test Update checker with invalid response"""
-        with Mocker() as mocker:
-            mocker.get("https://version.goauthentik.io/version.json", status_code=400)
-            update_latest_version.delay().get()
-            self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
-            self.assertFalse(
-                Event.objects.filter(
-                    action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
-                ).exists()
-            )
-
-    def test_version_disabled(self):
-        """Test Update checker while its disabled"""
-        with CONFIG.patch("disable_update_check", True):
-            update_latest_version.delay().get()
-            self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
-
-    def test_clear_update_notifications(self):
-        """Test clear of previous notification"""
-        Event.objects.create(
-            action=EventAction.UPDATE_AVAILABLE, context={"new_version": "99999999.9999999.9999999"}
-        )
-        Event.objects.create(action=EventAction.UPDATE_AVAILABLE, context={"new_version": "1.1.1"})
-        Event.objects.create(action=EventAction.UPDATE_AVAILABLE, context={})
-        clear_update_notifications()
+        update_latest_version.delay().get()
+        self.assertEqual(cache.get(VERSION_CACHE_KEY), "0.0.0")
         self.assertFalse(
             Event.objects.filter(
-                action=EventAction.UPDATE_AVAILABLE, context__new_version="1.1"
+                action=EventAction.UPDATE_AVAILABLE, context__new_version="0.0.0"
             ).exists()
         )

authentik/api/apps.py

@@ -10,25 +10,3 @@ class AuthentikAPIConfig(AppConfig):
     label = "authentik_api"
     mountpoint = "api/"
     verbose_name = "authentik API"
-
-    def ready(self) -> None:
-        from drf_spectacular.extensions import OpenApiAuthenticationExtension
-
-        from authentik.api.authentication import TokenAuthentication
-
-        # Class is defined here as it needs to be created early enough that drf-spectacular will
-        # find it, but also won't cause any import issues
-        # pylint: disable=unused-variable
-        class TokenSchema(OpenApiAuthenticationExtension):
-            """Auth schema"""
-
-            target_class = TokenAuthentication
-            name = "authentik"
-
-            def get_security_definition(self, auto_schema):
-                """Auth schema"""
-                return {
-                    "type": "apiKey",
-                    "in": "header",
-                    "name": "Authorization",
-                }

authentik/api/auth.py

@@ -0,0 +1,65 @@
+"""API Authentication"""
+from base64 import b64decode, b64encode
+from binascii import Error
+from typing import Any, Optional, Union
+
+from rest_framework.authentication import BaseAuthentication, get_authorization_header
+from rest_framework.exceptions import AuthenticationFailed
+from rest_framework.request import Request
+from structlog.stdlib import get_logger
+
+from authentik.core.models import Token, TokenIntents, User
+
+LOGGER = get_logger()
+
+
+# pylint: disable=too-many-return-statements
+def token_from_header(raw_header: bytes) -> Optional[Token]:
+    """raw_header in the Format of `Bearer dGVzdDp0ZXN0`"""
+    auth_credentials = raw_header.decode()
+    if auth_credentials == "":
+        return None
+    # Legacy, accept basic auth thats fully encoded (2021.3 outposts)
+    if " " not in auth_credentials:
+        try:
+            plain = b64decode(auth_credentials.encode()).decode()
+            auth_type, body = plain.split()
+            auth_credentials = f"{auth_type} {b64encode(body.encode()).decode()}"
+        except (UnicodeDecodeError, Error):
+            raise AuthenticationFailed("Malformed header")
+    auth_type, auth_credentials = auth_credentials.split()
+    if auth_type.lower() not in ["basic", "bearer"]:
+        LOGGER.debug("Unsupported authentication type, denying", type=auth_type.lower())
+        raise AuthenticationFailed("Unsupported authentication type")
+    password = auth_credentials
+    if auth_type.lower() == "basic":
+        try:
+            auth_credentials = b64decode(auth_credentials.encode()).decode()
+        except (UnicodeDecodeError, Error):
+            raise AuthenticationFailed("Malformed header")
+        # Accept credentials with username and without
+        if ":" in auth_credentials:
+            _, password = auth_credentials.split(":")
+        else:
+            password = auth_credentials
+    if password == "":  # nosec
+        raise AuthenticationFailed("Malformed header")
+    tokens = Token.filter_not_expired(key=password, intent=TokenIntents.INTENT_API)
+    if not tokens.exists():
+        raise AuthenticationFailed("Token invalid/expired")
+    return tokens.first()
+
+
+class AuthentikTokenAuthentication(BaseAuthentication):
+    """Token-based authentication using HTTP Bearer authentication"""
+
+    def authenticate(self, request: Request) -> Union[tuple[User, Any], None]:
+        """Token-based authentication using HTTP Bearer authentication"""
+        auth = get_authorization_header(request)
+
+        token = token_from_header(auth)
+        # None is only returned when the header isn't set.
+        if not token:
+            return None
+
+        return (token.user, None)

authentik/api/authentication.py

@@ -1,77 +0,0 @@
-"""API Authentication"""
-from typing import Any, Optional
-
-from django.conf import settings
-from rest_framework.authentication import BaseAuthentication, get_authorization_header
-from rest_framework.exceptions import AuthenticationFailed
-from rest_framework.request import Request
-from structlog.stdlib import get_logger
-
-from authentik.core.middleware import KEY_AUTH_VIA, LOCAL
-from authentik.core.models import Token, TokenIntents, User
-from authentik.outposts.models import Outpost
-
-LOGGER = get_logger()
-
-
-def validate_auth(header: bytes) -> str:
-    """Validate that the header is in a correct format,
-    returns type and credentials"""
-    auth_credentials = header.decode().strip()
-    if auth_credentials == "" or " " not in auth_credentials:
-        return None
-    auth_type, _, auth_credentials = auth_credentials.partition(" ")
-    if auth_type.lower() != "bearer":
-        LOGGER.debug("Unsupported authentication type, denying", type=auth_type.lower())
-        raise AuthenticationFailed("Unsupported authentication type")
-    if auth_credentials == "":  # nosec
-        raise AuthenticationFailed("Malformed header")
-    return auth_credentials
-
-
-def bearer_auth(raw_header: bytes) -> Optional[User]:
-    """raw_header in the Format of `Bearer ....`"""
-    auth_credentials = validate_auth(raw_header)
-    if not auth_credentials:
-        return None
-    # first, check traditional tokens
-    token = Token.filter_not_expired(key=auth_credentials, intent=TokenIntents.INTENT_API).first()
-    if hasattr(LOCAL, "authentik"):
-        LOCAL.authentik[KEY_AUTH_VIA] = "api_token"
-    if token:
-        return token.user
-    user = token_secret_key(auth_credentials)
-    if user:
-        return user
-    raise AuthenticationFailed("Token invalid/expired")
-
-
-def token_secret_key(value: str) -> Optional[User]:
-    """Check if the token is the secret key
-    and return the service account for the managed outpost"""
-    from authentik.outposts.managed import MANAGED_OUTPOST
-
-    if value != settings.SECRET_KEY:
-        return None
-    outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
-    if not outposts:
-        return None
-    if hasattr(LOCAL, "authentik"):
-        LOCAL.authentik[KEY_AUTH_VIA] = "secret_key"
-    outpost = outposts.first()
-    return outpost.user
-
-
-class TokenAuthentication(BaseAuthentication):
-    """Token-based authentication using HTTP Bearer authentication"""
-
-    def authenticate(self, request: Request) -> tuple[User, Any] | None:
-        """Token-based authentication using HTTP Bearer authentication"""
-        auth = get_authorization_header(request)
-
-        user = bearer_auth(auth)
-        # None is only returned when the header isn't set.
-        if not user:
-            return None
-
-        return (user, None)  # pragma: no cover

authentik/api/authorization.py

@@ -1,44 +0,0 @@
-"""API Authorization"""
-from django.db.models import Model
-from django.db.models.query import QuerySet
-from rest_framework.filters import BaseFilterBackend
-from rest_framework.permissions import BasePermission
-from rest_framework.request import Request
-
-
-class OwnerFilter(BaseFilterBackend):
-    """Filter objects by their owner"""
-
-    owner_key = "user"
-
-    def filter_queryset(self, request: Request, queryset: QuerySet, view) -> QuerySet:
-        return queryset.filter(**{self.owner_key: request.user})
-
-
-class OwnerPermissions(BasePermission):
-    """Authorize requests by an object's owner matching the requesting user"""
-
-    owner_key = "user"
-
-    def has_permission(self, request: Request, view) -> bool:
-        """If the user is authenticated, we allow all requests here. For listing, the
-        object-level permissions are done by the filter backend"""
-        return request.user.is_authenticated
-
-    def has_object_permission(self, request: Request, view, obj: Model) -> bool:
-        """Check if the object's owner matches the currently logged in user"""
-        if not hasattr(obj, self.owner_key):
-            return False
-        owner = getattr(obj, self.owner_key)
-        if owner != request.user:
-            return False
-        return True
-
-
-class OwnerSuperuserPermissions(OwnerPermissions):
-    """Similar to OwnerPermissions, except always allow access for superusers"""
-
-    def has_object_permission(self, request: Request, view, obj: Model) -> bool:
-        if request.user.is_superuser:
-            return True
-        return super().has_object_permission(request, view, obj)

authentik/api/decorators.py

@@ -5,12 +5,11 @@ from typing import Callable, Optional
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ModelViewSet
-from structlog.stdlib import get_logger
-
-LOGGER = get_logger()
 
 
-def permission_required(perm: Optional[str] = None, other_perms: Optional[list[str]] = None):
+def permission_required(
+    perm: Optional[str] = None, other_perms: Optional[list[str]] = None
+):
     """Check permissions for a single custom action"""
 
     def wrapper_outter(func: Callable):
@@ -21,12 +20,10 @@ def permission_required(perm: Optional[str] = None, other_perms: Optional[list[s
             if perm:
                 obj = self.get_object()
                 if not request.user.has_perm(perm, obj):
-                    LOGGER.debug("denying access for object", user=request.user, perm=perm, obj=obj)
                     return self.permission_denied(request)
             if other_perms:
                 for other_perm in other_perms:
                     if not request.user.has_perm(other_perm):
-                        LOGGER.debug("denying access for other", user=request.user, perm=perm)
                         return self.permission_denied(request)
             return func(self, request, *args, **kwargs)
 

authentik/api/pagination.py

@@ -30,47 +30,3 @@ class Pagination(pagination.PageNumberPagination):
                 "results": data,
             }
         )
-
-    def get_paginated_response_schema(self, schema):
-        return {
-            "type": "object",
-            "properties": {
-                "pagination": {
-                    "type": "object",
-                    "properties": {
-                        "next": {
-                            "type": "number",
-                        },
-                        "previous": {
-                            "type": "number",
-                        },
-                        "count": {
-                            "type": "number",
-                        },
-                        "current": {
-                            "type": "number",
-                        },
-                        "total_pages": {
-                            "type": "number",
-                        },
-                        "start_index": {
-                            "type": "number",
-                        },
-                        "end_index": {
-                            "type": "number",
-                        },
-                    },
-                    "required": [
-                        "next",
-                        "previous",
-                        "count",
-                        "current",
-                        "total_pages",
-                        "start_index",
-                        "end_index",
-                    ],
-                },
-                "results": schema,
-            },
-            "required": ["pagination", "results"],
-        }

authentik/api/pagination_schema.py

@@ -0,0 +1,97 @@
+"""Swagger Pagination Schema class"""
+from typing import OrderedDict
+
+from drf_yasg import openapi
+from drf_yasg.inspectors import PaginatorInspector
+
+
+class PaginationInspector(PaginatorInspector):
+    """Swagger Pagination Schema class"""
+
+    def get_paginated_response(self, paginator, response_schema):
+        """
+        :param BasePagination paginator: the paginator
+        :param openapi.Schema response_schema: the response schema that must be paged.
+        :rtype: openapi.Schema
+        """
+
+        return openapi.Schema(
+            type=openapi.TYPE_OBJECT,
+            properties=OrderedDict(
+                (
+                    (
+                        "pagination",
+                        openapi.Schema(
+                            type=openapi.TYPE_OBJECT,
+                            properties=OrderedDict(
+                                (
+                                    ("next", openapi.Schema(type=openapi.TYPE_NUMBER)),
+                                    (
+                                        "previous",
+                                        openapi.Schema(type=openapi.TYPE_NUMBER),
+                                    ),
+                                    ("count", openapi.Schema(type=openapi.TYPE_NUMBER)),
+                                    (
+                                        "current",
+                                        openapi.Schema(type=openapi.TYPE_NUMBER),
+                                    ),
+                                    (
+                                        "total_pages",
+                                        openapi.Schema(type=openapi.TYPE_NUMBER),
+                                    ),
+                                    (
+                                        "start_index",
+                                        openapi.Schema(type=openapi.TYPE_NUMBER),
+                                    ),
+                                    (
+                                        "end_index",
+                                        openapi.Schema(type=openapi.TYPE_NUMBER),
+                                    ),
+                                )
+                            ),
+                            required=[
+                                "next",
+                                "previous",
+                                "count",
+                                "current",
+                                "total_pages",
+                                "start_index",
+                                "end_index",
+                            ],
+                        ),
+                    ),
+                    ("results", response_schema),
+                )
+            ),
+            required=["results", "pagination"],
+        )
+
+    def get_paginator_parameters(self, paginator):
+        """
+        Get the pagination parameters for a single paginator **instance**.
+
+        Should return :data:`.NotHandled` if this inspector
+        does not know how to handle the given `paginator`.
+
+        :param BasePagination paginator: the paginator
+        :rtype: list[openapi.Parameter]
+        """
+
+        return [
+            openapi.Parameter(
+                "page",
+                openapi.IN_QUERY,
+                "Page Index",
+                False,
+                None,
+                openapi.TYPE_INTEGER,
+            ),
+            openapi.Parameter(
+                "page_size",
+                openapi.IN_QUERY,
+                "Page Size",
+                False,
+                None,
+                openapi.TYPE_INTEGER,
+            ),
+        ]

authentik/api/schema.py

@@ -1,75 +1,102 @@
 """Error Response schema, from https://github.com/axnsan12/drf-yasg/issues/224"""
-from django.utils.translation import gettext_lazy as _
-from drf_spectacular.plumbing import (
-    ResolvedComponent,
-    build_array_type,
-    build_basic_type,
-    build_object_type,
-)
-from drf_spectacular.settings import spectacular_settings
-from drf_spectacular.types import OpenApiTypes
+from drf_yasg import openapi
+from drf_yasg.inspectors.view import SwaggerAutoSchema
+from drf_yasg.utils import force_real_str, is_list_view
+from rest_framework import exceptions, status
+from rest_framework.settings import api_settings
 
 
-def build_standard_type(obj, **kwargs):
-    """Build a basic type with optional add owns."""
-    schema = build_basic_type(obj)
-    schema.update(kwargs)
-    return schema
+class ErrorResponseAutoSchema(SwaggerAutoSchema):
+    """Inspector which includes an error schema"""
 
-
-GENERIC_ERROR = build_object_type(
-    description=_("Generic API Error"),
-    properties={
-        "detail": build_standard_type(OpenApiTypes.STR),
-        "code": build_standard_type(OpenApiTypes.STR),
-    },
-    required=["detail"],
-)
-VALIDATION_ERROR = build_object_type(
-    description=_("Validation Error"),
-    properties={
-        "non_field_errors": build_array_type(build_standard_type(OpenApiTypes.STR)),
-        "code": build_standard_type(OpenApiTypes.STR),
-    },
-    required=[],
-    additionalProperties={},
-)
-
-
-def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
-    """Workaround to set a default response for endpoints.
-    Workaround suggested at
-    <https://github.com/tfranzel/drf-spectacular/issues/119#issuecomment-656970357>
-    for the missing drf-spectacular feature discussed in
-    <https://github.com/tfranzel/drf-spectacular/issues/101>.
-    """
-
-    def create_component(name, schema, type_=ResolvedComponent.SCHEMA):
-        """Register a component and return a reference to it."""
-        component = ResolvedComponent(
-            name=name,
-            type=type_,
-            schema=schema,
-            object=name,
+    def get_generic_error_schema(self):
+        """Get a generic error schema"""
+        return openapi.Schema(
+            "Generic API Error",
+            type=openapi.TYPE_OBJECT,
+            properties={
+                "detail": openapi.Schema(
+                    type=openapi.TYPE_STRING, description="Error details"
+                ),
+                "code": openapi.Schema(
+                    type=openapi.TYPE_STRING, description="Error code"
+                ),
+            },
+            required=["detail"],
         )
-        generator.registry.register_on_missing(component)
-        return component
 
-    generic_error = create_component("GenericError", GENERIC_ERROR)
-    validation_error = create_component("ValidationError", VALIDATION_ERROR)
+    def get_validation_error_schema(self):
+        """Get a generic validation error schema"""
+        return openapi.Schema(
+            "Validation Error",
+            type=openapi.TYPE_OBJECT,
+            properties={
+                api_settings.NON_FIELD_ERRORS_KEY: openapi.Schema(
+                    description="List of validation errors not related to any field",
+                    type=openapi.TYPE_ARRAY,
+                    items=openapi.Schema(type=openapi.TYPE_STRING),
+                ),
+            },
+            additional_properties=openapi.Schema(
+                description=(
+                    "A list of error messages for each "
+                    "field that triggered a validation error"
+                ),
+                type=openapi.TYPE_ARRAY,
+                items=openapi.Schema(type=openapi.TYPE_STRING),
+            ),
+        )
 
-    for path in result["paths"].values():
-        for method in path.values():
-            method["responses"].setdefault("400", validation_error.ref)
-            method["responses"].setdefault("403", generic_error.ref)
+    def get_response_serializers(self):
+        responses = super().get_response_serializers()
+        definitions = self.components.with_scope(
+            openapi.SCHEMA_DEFINITIONS
+        )  # type: openapi.ReferenceResolver
 
-    result["components"] = generator.registry.build(spectacular_settings.APPEND_COMPONENTS)
+        definitions.setdefault("GenericError", self.get_generic_error_schema)
+        definitions.setdefault("ValidationError", self.get_validation_error_schema)
+        definitions.setdefault("APIException", self.get_generic_error_schema)
 
-    # This is a workaround for authentik/stages/prompt/stage.py
-    # since the serializer PromptChallengeResponse
-    # accepts dynamic keys
-    for component in result["components"]["schemas"]:
-        if component == "PromptChallengeResponseRequest":
-            comp = result["components"]["schemas"][component]
-            comp["additionalProperties"] = {}
-    return result
+        if self.get_request_serializer() or self.get_query_serializer():
+            responses.setdefault(
+                exceptions.ValidationError.status_code,
+                openapi.Response(
+                    description=force_real_str(
+                        exceptions.ValidationError.default_detail
+                    ),
+                    schema=openapi.SchemaRef(definitions, "ValidationError"),
+                ),
+            )
+
+        security = self.get_security()
+        if security is None or len(security) > 0:
+            # Note: 401 error codes are coerced  into 403 see
+            # rest_framework/views.py:433:handle_exception
+            # This is b/c the API uses token auth which doesn't have WWW-Authenticate header
+            responses.setdefault(
+                status.HTTP_403_FORBIDDEN,
+                openapi.Response(
+                    description="Authentication credentials were invalid, absent or insufficient.",
+                    schema=openapi.SchemaRef(definitions, "GenericError"),
+                ),
+            )
+        if not is_list_view(self.path, self.method, self.view):
+            responses.setdefault(
+                exceptions.PermissionDenied.status_code,
+                openapi.Response(
+                    description="Permission denied.",
+                    schema=openapi.SchemaRef(definitions, "APIException"),
+                ),
+            )
+            responses.setdefault(
+                exceptions.NotFound.status_code,
+                openapi.Response(
+                    description=(
+                        "Object does not exist or caller "
+                        "has insufficient permissions to access it."
+                    ),
+                    schema=openapi.SchemaRef(definitions, "APIException"),
+                ),
+            )
+
+        return responses

authentik/api/templates/api/swagger.html

@@ -3,7 +3,7 @@
 {% load static %}
 
 {% block title %}
-API Browser - {{ tenant.branding_title }}
+authentik API Browser
 {% endblock %}
 
 {% block head %}
@@ -30,7 +30,7 @@ function getCookie(name) {
 window.addEventListener('DOMContentLoaded', (event) => {
     const rapidocEl = document.querySelector('rapi-doc');
     rapidocEl.addEventListener('before-try', (e) => {
-        e.detail.request.headers.append('X-authentik-CSRF', getCookie("authentik_csrf"));
+        e.detail.request.headers.append('X-CSRFToken', getCookie("authentik_csrf"));
     });
 });
 </script>

authentik/api/tests/test_auth.py

@@ -1,40 +1,49 @@
 """Test API Authentication"""
 from base64 import b64encode
 
-from django.conf import settings
 from django.test import TestCase
 from guardian.shortcuts import get_anonymous_user
 from rest_framework.exceptions import AuthenticationFailed
 
-from authentik.api.authentication import bearer_auth
-from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
-from authentik.outposts.managed import OutpostManager
+from authentik.api.auth import token_from_header
+from authentik.core.models import Token, TokenIntents
 
 
 class TestAPIAuth(TestCase):
     """Test API Authentication"""
 
+    def test_valid_basic(self):
+        """Test valid token"""
+        token = Token.objects.create(
+            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        )
+        auth = b64encode(f":{token.key}".encode()).decode()
+        self.assertEqual(token_from_header(f"Basic {auth}".encode()), token)
+
     def test_valid_bearer(self):
         """Test valid token"""
-        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
-        self.assertEqual(bearer_auth(f"Bearer {token.key}".encode()), token.user)
+        token = Token.objects.create(
+            intent=TokenIntents.INTENT_API, user=get_anonymous_user()
+        )
+        self.assertEqual(token_from_header(f"Bearer {token.key}".encode()), token)
 
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth("foo bar".encode())
+            token_from_header("foo bar".encode())
+
+    def test_invalid_decode(self):
+        """Test invalid bas64"""
+        with self.assertRaises(AuthenticationFailed):
+            token_from_header("Basic bar".encode())
+
+    def test_invalid_empty_password(self):
+        """Test invalid with empty password"""
+        with self.assertRaises(AuthenticationFailed):
+            token_from_header("Basic :".encode())
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
             auth = b64encode(":abc".encode()).decode()
-            self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
-
-    def test_managed_outpost(self):
-        """Test managed outpost"""
-        with self.assertRaises(AuthenticationFailed):
-            user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-
-        OutpostManager().run()
-        user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
-        self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
+            self.assertIsNone(token_from_header(f"Basic :{auth}".encode()))

authentik/api/tests/test_config.py

@@ -1,16 +0,0 @@
-"""Test config API"""
-from json import loads
-
-from django.urls import reverse
-from rest_framework.test import APITestCase
-
-
-class TestConfig(APITestCase):
-    """Test config API"""
-
-    def test_config(self):
-        """Test YAML generation"""
-        response = self.client.get(
-            reverse("authentik_api:config"),
-        )
-        self.assertTrue(loads(response.content.decode()))

authentik/api/tests/test_decorators.py

@@ -1,33 +0,0 @@
-"""test decorators api"""
-from django.urls import reverse
-from guardian.shortcuts import assign_perm
-from rest_framework.test import APITestCase
-
-from authentik.core.models import Application, User
-
-
-class TestAPIDecorators(APITestCase):
-    """test decorators api"""
-
-    def setUp(self) -> None:
-        super().setUp()
-        self.user = User.objects.create(username="test-user")
-
-    def test_obj_perm_denied(self):
-        """Test object perm denied"""
-        self.client.force_login(self.user)
-        app = Application.objects.create(name="denied", slug="denied")
-        response = self.client.get(
-            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
-        )
-        self.assertEqual(response.status_code, 403)
-
-    def test_other_perm_denied(self):
-        """Test other perm denied"""
-        self.client.force_login(self.user)
-        app = Application.objects.create(name="denied", slug="denied")
-        assign_perm("authentik_core.view_application", self.user, app)
-        response = self.client.get(
-            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
-        )
-        self.assertEqual(response.status_code, 403)

authentik/api/tests/test_schema.py

@@ -1,22 +0,0 @@
-"""Schema generation tests"""
-from django.urls import reverse
-from rest_framework.test import APITestCase
-from yaml import safe_load
-
-
-class TestSchemaGeneration(APITestCase):
-    """Generic admin tests"""
-
-    def test_schema(self):
-        """Test generation"""
-        response = self.client.get(
-            reverse("authentik_api:schema"),
-        )
-        self.assertTrue(safe_load(response.content.decode()))
-
-    def test_browser(self):
-        """Test API Browser"""
-        response = self.client.get(
-            reverse("authentik_api:schema-browser"),
-        )
-        self.assertEqual(response.status_code, 200)

authentik/api/tests/test_swagger.py

@@ -0,0 +1,24 @@
+"""Swagger generation tests"""
+from json import loads
+
+from django.urls import reverse
+from rest_framework.test import APITestCase
+from yaml import safe_load
+
+
+class TestSwaggerGeneration(APITestCase):
+    """Generic admin tests"""
+
+    def test_yaml(self):
+        """Test YAML generation"""
+        response = self.client.get(
+            reverse("authentik_api:schema-json", kwargs={"format": ".yaml"}),
+        )
+        self.assertTrue(safe_load(response.content.decode()))
+
+    def test_json(self):
+        """Test JSON generation"""
+        response = self.client.get(
+            reverse("authentik_api:schema-json", kwargs={"format": ".json"}),
+        )
+        self.assertTrue(loads(response.content.decode()))

authentik/api/urls.py

@@ -1,8 +1,8 @@
 """authentik api urls"""
 from django.urls import include, path
 
-from authentik.api.v3.urls import urlpatterns as v3_urls
+from authentik.api.v2.urls import urlpatterns as v2_urls
 
 urlpatterns = [
-    path("v3/", include(v3_urls)),
+    path("v2beta/", include(v2_urls)),
 ]

authentik/api/v2/config.py

@@ -0,0 +1,50 @@
+"""core Configs API"""
+from drf_yasg.utils import swagger_auto_schema
+from rest_framework.fields import BooleanField, CharField, ListField
+from rest_framework.permissions import AllowAny
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.viewsets import ViewSet
+
+from authentik.core.api.utils import PassiveSerializer
+from authentik.lib.config import CONFIG
+
+
+class FooterLinkSerializer(PassiveSerializer):
+    """Links returned in Config API"""
+
+    href = CharField(read_only=True)
+    name = CharField(read_only=True)
+
+
+class ConfigSerializer(PassiveSerializer):
+    """Serialize authentik Config into DRF Object"""
+
+    branding_logo = CharField(read_only=True)
+    branding_title = CharField(read_only=True)
+    ui_footer_links = ListField(child=FooterLinkSerializer(), read_only=True)
+
+    error_reporting_enabled = BooleanField(read_only=True)
+    error_reporting_environment = CharField(read_only=True)
+    error_reporting_send_pii = BooleanField(read_only=True)
+
+
+class ConfigsViewSet(ViewSet):
+    """Read-only view set that returns the current session's Configs"""
+
+    permission_classes = [AllowAny]
+
+    @swagger_auto_schema(responses={200: ConfigSerializer(many=False)})
+    def list(self, request: Request) -> Response:
+        """Retrive public configuration options"""
+        config = ConfigSerializer(
+            {
+                "branding_logo": CONFIG.y("authentik.branding.logo"),
+                "branding_title": CONFIG.y("authentik.branding.title"),
+                "error_reporting_enabled": CONFIG.y("error_reporting.enabled"),
+                "error_reporting_environment": CONFIG.y("error_reporting.environment"),
+                "error_reporting_send_pii": CONFIG.y("error_reporting.send_pii"),
+                "ui_footer_links": CONFIG.y("authentik.footer_links"),
+            }
+        )
+        return Response(config.data)

authentik/api/v2/urls.py

@@ -1,43 +1,39 @@
-"""api v3 urls"""
-from django.urls import path
-from django.views.decorators.cache import cache_page
-from drf_spectacular.views import SpectacularAPIView
+"""api v2 urls"""
+from django.urls import path, re_path
+from drf_yasg import openapi
+from drf_yasg.views import get_schema_view
 from rest_framework import routers
+from rest_framework.permissions import AllowAny
 
 from authentik.admin.api.meta import AppsViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
-from authentik.admin.api.system import SystemView
 from authentik.admin.api.tasks import TaskViewSet
-from authentik.admin.api.version import VersionView
-from authentik.admin.api.workers import WorkerView
-from authentik.api.v3.config import ConfigView
-from authentik.api.views import APIBrowserView
+from authentik.admin.api.version import VersionViewSet
+from authentik.admin.api.workers import WorkerViewSet
+from authentik.api.v2.config import ConfigsViewSet
+from authentik.api.views import SwaggerView
 from authentik.core.api.applications import ApplicationViewSet
-from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
-from authentik.core.api.devices import DeviceViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
-from authentik.core.api.sources import SourceViewSet, UserSourceConnectionViewSet
+from authentik.core.api.sources import SourceViewSet
 from authentik.core.api.tokens import TokenViewSet
 from authentik.core.api.users import UserViewSet
 from authentik.crypto.api import CertificateKeyPairViewSet
 from authentik.events.api.event import EventViewSet
 from authentik.events.api.notification import NotificationViewSet
-from authentik.events.api.notification_mapping import NotificationWebhookMappingViewSet
 from authentik.events.api.notification_rule import NotificationRuleViewSet
 from authentik.events.api.notification_transport import NotificationTransportViewSet
 from authentik.flows.api.bindings import FlowStageBindingViewSet
 from authentik.flows.api.flows import FlowViewSet
 from authentik.flows.api.stages import StageViewSet
-from authentik.flows.views.executor import FlowExecutorView
-from authentik.flows.views.inspector import FlowInspectorView
-from authentik.outposts.api.outposts import OutpostViewSet
-from authentik.outposts.api.service_connections import (
+from authentik.flows.views import FlowExecutorView
+from authentik.outposts.api.outpost_service_connections import (
     DockerServiceConnectionViewSet,
     KubernetesServiceConnectionViewSet,
     ServiceConnectionViewSet,
 )
+from authentik.outposts.api.outposts import OutpostViewSet
 from authentik.policies.api.bindings import PolicyBindingViewSet
 from authentik.policies.api.policies import PolicyViewSet
 from authentik.policies.dummy.api import DummyPolicyViewSet
@@ -46,29 +42,28 @@ from authentik.policies.expiry.api import PasswordExpiryPolicyViewSet
 from authentik.policies.expression.api import ExpressionPolicyViewSet
 from authentik.policies.hibp.api import HaveIBeenPwendPolicyViewSet
 from authentik.policies.password.api import PasswordPolicyViewSet
-from authentik.policies.reputation.api import ReputationPolicyViewSet, ReputationViewSet
-from authentik.providers.ldap.api import LDAPOutpostConfigViewSet, LDAPProviderViewSet
+from authentik.policies.reputation.api import (
+    IPReputationViewSet,
+    ReputationPolicyViewSet,
+    UserReputationViewSet,
+)
 from authentik.providers.oauth2.api.provider import OAuth2ProviderViewSet
 from authentik.providers.oauth2.api.scope import ScopeMappingViewSet
-from authentik.providers.oauth2.api.tokens import AuthorizationCodeViewSet, RefreshTokenViewSet
-from authentik.providers.proxy.api import ProxyOutpostConfigViewSet, ProxyProviderViewSet
+from authentik.providers.oauth2.api.tokens import (
+    AuthorizationCodeViewSet,
+    RefreshTokenViewSet,
+)
+from authentik.providers.proxy.api import (
+    ProxyOutpostConfigViewSet,
+    ProxyProviderViewSet,
+)
 from authentik.providers.saml.api import SAMLPropertyMappingViewSet, SAMLProviderViewSet
 from authentik.sources.ldap.api import LDAPPropertyMappingViewSet, LDAPSourceViewSet
 from authentik.sources.oauth.api.source import OAuthSourceViewSet
-from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
-from authentik.sources.plex.api.source import PlexSourceViewSet
-from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
+from authentik.sources.oauth.api.source_connection import (
+    UserOAuthSourceConnectionViewSet,
+)
 from authentik.sources.saml.api import SAMLSourceViewSet
-from authentik.stages.authenticator_duo.api import (
-    AuthenticatorDuoStageViewSet,
-    DuoAdminDeviceViewSet,
-    DuoDeviceViewSet,
-)
-from authentik.stages.authenticator_sms.api import (
-    AuthenticatorSMSStageViewSet,
-    SMSAdminDeviceViewSet,
-    SMSDeviceViewSet,
-)
 from authentik.stages.authenticator_static.api import (
     AuthenticatorStaticStageViewSet,
     StaticAdminDeviceViewSet,
@@ -79,7 +74,9 @@ from authentik.stages.authenticator_totp.api import (
     TOTPAdminDeviceViewSet,
     TOTPDeviceViewSet,
 )
-from authentik.stages.authenticator_validate.api import AuthenticatorValidateStageViewSet
+from authentik.stages.authenticator_validate.api import (
+    AuthenticatorValidateStageViewSet,
+)
 from authentik.stages.authenticator_webauthn.api import (
     AuthenticateWebAuthnStageViewSet,
     WebAuthnAdminDeviceViewSet,
@@ -98,28 +95,31 @@ from authentik.stages.user_delete.api import UserDeleteStageViewSet
 from authentik.stages.user_login.api import UserLoginStageViewSet
 from authentik.stages.user_logout.api import UserLogoutStageViewSet
 from authentik.stages.user_write.api import UserWriteStageViewSet
-from authentik.tenants.api import TenantViewSet
 
 router = routers.DefaultRouter()
-router.include_format_suffixes = False
 
+router.register("root/config", ConfigsViewSet, basename="configs")
+
+router.register("admin/version", VersionViewSet, basename="admin_version")
+router.register("admin/workers", WorkerViewSet, basename="admin_workers")
+router.register("admin/metrics", AdministrationMetricsViewSet, basename="admin_metrics")
 router.register("admin/system_tasks", TaskViewSet, basename="admin_system_tasks")
 router.register("admin/apps", AppsViewSet, basename="apps")
 
-router.register("core/authenticated_sessions", AuthenticatedSessionViewSet)
 router.register("core/applications", ApplicationViewSet)
 router.register("core/groups", GroupViewSet)
 router.register("core/users", UserViewSet)
 router.register("core/user_consent", UserConsentViewSet)
 router.register("core/tokens", TokenViewSet)
-router.register("core/tenants", TenantViewSet)
 
+router.register("outposts/outposts", OutpostViewSet)
 router.register("outposts/instances", OutpostViewSet)
 router.register("outposts/service_connections/all", ServiceConnectionViewSet)
 router.register("outposts/service_connections/docker", DockerServiceConnectionViewSet)
-router.register("outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet)
+router.register(
+    "outposts/service_connections/kubernetes", KubernetesServiceConnectionViewSet
+)
 router.register("outposts/proxy", ProxyOutpostConfigViewSet)
-router.register("outposts/ldap", LDAPOutpostConfigViewSet)
 
 router.register("flows/instances", FlowViewSet)
 router.register("flows/bindings", FlowStageBindingViewSet)
@@ -132,13 +132,10 @@ router.register("events/transports", NotificationTransportViewSet)
 router.register("events/rules", NotificationRuleViewSet)
 
 router.register("sources/all", SourceViewSet)
-router.register("sources/user_connections/all", UserSourceConnectionViewSet)
-router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
-router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
+router.register("sources/oauth_user_connections", UserOAuthSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
-router.register("sources/plex", PlexSourceViewSet)
 
 router.register("policies/all", PolicyViewSet)
 router.register("policies/bindings", PolicyBindingViewSet)
@@ -147,11 +144,11 @@ router.register("policies/event_matcher", EventMatcherPolicyViewSet)
 router.register("policies/haveibeenpwned", HaveIBeenPwendPolicyViewSet)
 router.register("policies/password_expiry", PasswordExpiryPolicyViewSet)
 router.register("policies/password", PasswordPolicyViewSet)
-router.register("policies/reputation/scores", ReputationViewSet)
+router.register("policies/reputation/users", UserReputationViewSet)
+router.register("policies/reputation/ips", IPReputationViewSet)
 router.register("policies/reputation", ReputationPolicyViewSet)
 
 router.register("providers/all", ProviderViewSet)
-router.register("providers/ldap", LDAPProviderViewSet)
 router.register("providers/proxy", ProxyProviderViewSet)
 router.register("providers/oauth2", OAuth2ProviderViewSet)
 router.register("providers/saml", SAMLProviderViewSet)
@@ -163,39 +160,15 @@ router.register("propertymappings/all", PropertyMappingViewSet)
 router.register("propertymappings/ldap", LDAPPropertyMappingViewSet)
 router.register("propertymappings/saml", SAMLPropertyMappingViewSet)
 router.register("propertymappings/scope", ScopeMappingViewSet)
-router.register("propertymappings/notification", NotificationWebhookMappingViewSet)
 
-router.register("authenticators/all", DeviceViewSet, basename="device")
-router.register("authenticators/duo", DuoDeviceViewSet)
-router.register("authenticators/sms", SMSDeviceViewSet)
 router.register("authenticators/static", StaticDeviceViewSet)
 router.register("authenticators/totp", TOTPDeviceViewSet)
 router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
-router.register(
-    "authenticators/admin/duo",
-    DuoAdminDeviceViewSet,
-    basename="admin-duodevice",
-)
-router.register(
-    "authenticators/admin/sms",
-    SMSAdminDeviceViewSet,
-    basename="admin-smsdevice",
-)
-router.register(
-    "authenticators/admin/static",
-    StaticAdminDeviceViewSet,
-    basename="admin-staticdevice",
-)
-router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet, basename="admin-totpdevice")
-router.register(
-    "authenticators/admin/webauthn",
-    WebAuthnAdminDeviceViewSet,
-    basename="admin-webauthndevice",
-)
+router.register("authenticators/admin/static", StaticAdminDeviceViewSet)
+router.register("authenticators/admin/totp", TOTPAdminDeviceViewSet)
+router.register("authenticators/admin/webauthn", WebAuthnAdminDeviceViewSet)
 
 router.register("stages/all", StageViewSet)
-router.register("stages/authenticator/duo", AuthenticatorDuoStageViewSet)
-router.register("stages/authenticator/sms", AuthenticatorSMSStageViewSet)
 router.register("stages/authenticator/static", AuthenticatorStaticStageViewSet)
 router.register("stages/authenticator/totp", AuthenticatorTOTPStageViewSet)
 router.register("stages/authenticator/validate", AuthenticatorValidateStageViewSet)
@@ -218,31 +191,32 @@ router.register("stages/user_write", UserWriteStageViewSet)
 router.register("stages/dummy", DummyStageViewSet)
 router.register("policies/dummy", DummyPolicyViewSet)
 
+info = openapi.Info(
+    title="authentik API",
+    default_version="v2beta",
+    contact=openapi.Contact(email="hello@beryju.org"),
+    license=openapi.License(
+        name="GNU GPLv3",
+        url="https://github.com/goauthentik/authentik/blob/master/LICENSE",
+    ),
+)
+SchemaView = get_schema_view(info, public=True, permission_classes=(AllowAny,))
+
 urlpatterns = (
     [
-        path("", APIBrowserView.as_view(), name="schema-browser"),
+        path("", SwaggerView.as_view(), name="swagger"),
     ]
     + router.urls
     + [
-        path(
-            "admin/metrics/",
-            AdministrationMetricsViewSet.as_view(),
-            name="admin_metrics",
-        ),
-        path("admin/version/", VersionView.as_view(), name="admin_version"),
-        path("admin/workers/", WorkerView.as_view(), name="admin_workers"),
-        path("admin/system/", SystemView.as_view(), name="admin_system"),
-        path("root/config/", ConfigView.as_view(), name="config"),
         path(
             "flows/executor/<slug:flow_slug>/",
             FlowExecutorView.as_view(),
             name="flow-executor",
         ),
-        path(
-            "flows/inspector/<slug:flow_slug>/",
-            FlowInspectorView.as_view(),
-            name="flow-inspector",
+        re_path(
+            r"^swagger(?P<format>\.json|\.yaml)$",
+            SchemaView.without_ui(cache_timeout=0),
+            name="schema-json",
         ),
-        path("schema/", cache_page(86400)(SpectacularAPIView.as_view()), name="schema"),
     ]
 )

authentik/api/v3/config.py

@@ -1,86 +0,0 @@
-"""core Configs API"""
-from os import path
-
-from django.conf import settings
-from django.db import models
-from drf_spectacular.utils import extend_schema
-from rest_framework.fields import (
-    BooleanField,
-    CharField,
-    ChoiceField,
-    FloatField,
-    IntegerField,
-    ListField,
-)
-from rest_framework.permissions import AllowAny
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.views import APIView
-
-from authentik.core.api.utils import PassiveSerializer
-from authentik.events.geo import GEOIP_READER
-from authentik.lib.config import CONFIG
-
-
-class Capabilities(models.TextChoices):
-    """Define capabilities which influence which APIs can/should be used"""
-
-    CAN_SAVE_MEDIA = "can_save_media"
-    CAN_GEO_IP = "can_geo_ip"
-
-
-class ErrorReportingConfigSerializer(PassiveSerializer):
-    """Config for error reporting"""
-
-    enabled = BooleanField(read_only=True)
-    environment = CharField(read_only=True)
-    send_pii = BooleanField(read_only=True)
-    traces_sample_rate = FloatField(read_only=True)
-
-
-class ConfigSerializer(PassiveSerializer):
-    """Serialize authentik Config into DRF Object"""
-
-    error_reporting = ErrorReportingConfigSerializer(required=True)
-    capabilities = ListField(child=ChoiceField(choices=Capabilities.choices))
-
-    cache_timeout = IntegerField(required=True)
-    cache_timeout_flows = IntegerField(required=True)
-    cache_timeout_policies = IntegerField(required=True)
-    cache_timeout_reputation = IntegerField(required=True)
-
-
-class ConfigView(APIView):
-    """Read-only view set that returns the current session's Configs"""
-
-    permission_classes = [AllowAny]
-
-    def get_capabilities(self) -> list[Capabilities]:
-        """Get all capabilities this server instance supports"""
-        caps = []
-        deb_test = settings.DEBUG or settings.TEST
-        if path.ismount(settings.MEDIA_ROOT) or deb_test:
-            caps.append(Capabilities.CAN_SAVE_MEDIA)
-        if GEOIP_READER.enabled:
-            caps.append(Capabilities.CAN_GEO_IP)
-        return caps
-
-    @extend_schema(responses={200: ConfigSerializer(many=False)})
-    def get(self, request: Request) -> Response:
-        """Retrieve public configuration options"""
-        config = ConfigSerializer(
-            {
-                "error_reporting": {
-                    "enabled": CONFIG.y("error_reporting.enabled") and not settings.DEBUG,
-                    "environment": CONFIG.y("error_reporting.environment"),
-                    "send_pii": CONFIG.y("error_reporting.send_pii"),
-                    "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
-                },
-                "capabilities": self.get_capabilities(),
-                "cache_timeout": int(CONFIG.y("redis.cache_timeout")),
-                "cache_timeout_flows": int(CONFIG.y("redis.cache_timeout_flows")),
-                "cache_timeout_policies": int(CONFIG.y("redis.cache_timeout_policies")),
-                "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
-            }
-        )
-        return Response(config.data)

authentik/api/views.py

@@ -5,15 +5,18 @@ from django.urls import reverse
 from django.views.generic import TemplateView
 
 
-class APIBrowserView(TemplateView):
-    """Show browser view based on rapi-doc"""
+class SwaggerView(TemplateView):
+    """Show swagger view based on rapi-doc"""
 
-    template_name = "api/browser.html"
+    template_name = "api/swagger.html"
 
     def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
         path = self.request.build_absolute_uri(
             reverse(
-                "authentik_api:schema",
+                "authentik_api:schema-json",
+                kwargs={
+                    "format": ".json",
+                },
             )
         )
         return super().get_context_data(path=path, **kwargs)

authentik/core/api/applications.py

@@ -4,12 +4,10 @@ from typing import Optional
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.http.response import HttpResponseBadRequest
-from django.shortcuts import get_object_or_404
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
-from guardian.shortcuts import get_objects_for_user
+from drf_yasg import openapi
+from drf_yasg.utils import no_body, swagger_auto_schema
 from rest_framework.decorators import action
-from rest_framework.fields import ReadOnlyField, SerializerMethodField
+from rest_framework.fields import SerializerMethodField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -17,20 +15,13 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 from structlog.stdlib import get_logger
-from structlog.testing import capture_logs
 
-from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
 from authentik.core.api.providers import ProviderSerializer
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import FilePathSerializer, FileUploadSerializer
-from authentik.core.models import Application, User
+from authentik.core.models import Application
 from authentik.events.models import EventAction
-from authentik.events.utils import sanitize_dict
-from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
-from authentik.policies.types import PolicyResult
-from authentik.stages.user_login.stage import USER_LOGIN_AUTHENTICATED
 
 LOGGER = get_logger()
 
@@ -44,14 +35,11 @@ class ApplicationSerializer(ModelSerializer):
     """Application Serializer"""
 
     launch_url = SerializerMethodField()
-    provider_obj = ProviderSerializer(source="get_provider", required=False, read_only=True)
+    provider_obj = ProviderSerializer(source="get_provider", required=False)
 
-    meta_icon = ReadOnlyField(source="get_meta_icon")
-
-    def get_launch_url(self, app: Application) -> Optional[str]:
-        """Allow formatting of launch URL"""
-        user = self.context["request"].user
-        return app.get_launch_url(user)
+    def get_launch_url(self, instance: Application) -> Optional[str]:
+        """Get generated launch URL"""
+        return instance.get_launch_url()
 
     class Meta:
 
@@ -68,17 +56,13 @@ class ApplicationSerializer(ModelSerializer):
             "meta_description",
             "meta_publisher",
             "policy_engine_mode",
-            "group",
         ]
-        extra_kwargs = {
-            "meta_icon": {"read_only": True},
-        }
 
 
-class ApplicationViewSet(UsedByMixin, ModelViewSet):
+class ApplicationViewSet(ModelViewSet):
     """Application Viewset"""
 
-    queryset = Application.objects.all().prefetch_related("provider")
+    queryset = Application.objects.all()
     serializer_class = ApplicationSerializer
     search_fields = [
         "name",
@@ -86,7 +70,6 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         "meta_launch_url",
         "meta_description",
         "meta_publisher",
-        "group",
     ]
     lookup_field = "slug"
     ordering = ["name"]
@@ -108,74 +91,29 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
                 applications.append(application)
         return applications
 
-    @extend_schema(
-        parameters=[
-            OpenApiParameter(
-                name="for_user",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.INT,
-            )
-        ],
-        responses={
-            200: PolicyTestResultSerializer(),
-            404: OpenApiResponse(description="for_user user not found"),
-        },
-    )
-    @action(detail=True, methods=["GET"])
-    def check_access(self, request: Request, slug: str) -> Response:
-        """Check access to a single application by slug"""
-        # Don't use self.get_object as that checks for view_application permission
-        # which the user might not have, even if they have access
-        application = get_object_or_404(Application, slug=slug)
-        # If the current user is superuser, they can set `for_user`
-        for_user = request.user
-        if request.user.is_superuser and "for_user" in request.query_params:
-            try:
-                for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
-            except ValueError:
-                return HttpResponseBadRequest("for_user must be numerical")
-        engine = PolicyEngine(application, for_user, request)
-        engine.use_cache = False
-        with capture_logs() as logs:
-            engine.build()
-            result = engine.result
-        response = PolicyTestResultSerializer(PolicyResult(False))
-        if result.passing:
-            response = PolicyTestResultSerializer(PolicyResult(True))
-        if request.user.is_superuser:
-            log_messages = []
-            for log in logs:
-                if log.get("process", "") == "PolicyProcess":
-                    continue
-                log_messages.append(sanitize_dict(log))
-            result.log_messages = log_messages
-            response = PolicyTestResultSerializer(result)
-        return Response(response.data)
-
-    @extend_schema(
-        parameters=[
-            OpenApiParameter(
+    @swagger_auto_schema(
+        manual_parameters=[
+            openapi.Parameter(
                 name="superuser_full_list",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.BOOL,
+                in_=openapi.IN_QUERY,
+                type=openapi.TYPE_BOOLEAN,
             )
         ]
     )
     def list(self, request: Request) -> Response:
         """Custom list method that checks Policy based access instead of guardian"""
-        should_cache = request.GET.get("search", "") == ""
-
-        superuser_full_list = str(request.GET.get("superuser_full_list", "false")).lower() == "true"
-        if superuser_full_list and request.user.is_superuser:
-            return super().list(request)
-
-        # To prevent the user from having to double login when prompt is set to login
-        # and the user has just signed it. This session variable is set in the UserLoginStage
-        # and is (quite hackily) removed from the session in applications's API's List method
-        self.request.session.pop(USER_LOGIN_AUTHENTICATED, None)
         queryset = self._filter_queryset_for_list(self.get_queryset())
         self.paginate_queryset(queryset)
 
+        should_cache = request.GET.get("search", "") == ""
+
+        superuser_full_list = (
+            str(request.GET.get("superuser_full_list", "false")).lower() == "true"
+        )
+        if superuser_full_list and request.user.is_superuser:
+            serializer = self.get_serializer(queryset, many=True)
+            return self.get_paginated_response(serializer.data)
+
         allowed_applications = []
         if not should_cache:
             allowed_applications = self._get_allowed_applications(queryset)
@@ -193,14 +131,17 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         return self.get_paginated_response(serializer.data)
 
     @permission_required("authentik_core.change_application")
-    @extend_schema(
-        request={
-            "multipart/form-data": FileUploadSerializer,
-        },
-        responses={
-            200: OpenApiResponse(description="Success"),
-            400: OpenApiResponse(description="Bad request"),
-        },
+    @swagger_auto_schema(
+        request_body=no_body,
+        manual_parameters=[
+            openapi.Parameter(
+                name="file",
+                in_=openapi.IN_FORM,
+                type=openapi.TYPE_FILE,
+                required=True,
+            )
+        ],
+        responses={200: "Success", 400: "Bad request"},
     )
     @action(
         detail=True,
@@ -214,54 +155,24 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         """Set application icon"""
         app: Application = self.get_object()
         icon = request.FILES.get("file", None)
-        clear = request.data.get("clear", "false").lower() == "true"
-        if clear:
-            # .delete() saves the model by default
-            app.meta_icon.delete()
-            return Response({})
-        if icon:
-            app.meta_icon = icon
-            app.save()
-            return Response({})
-        return HttpResponseBadRequest()
-
-    @permission_required("authentik_core.change_application")
-    @extend_schema(
-        request=FilePathSerializer,
-        responses={
-            200: OpenApiResponse(description="Success"),
-            400: OpenApiResponse(description="Bad request"),
-        },
-    )
-    @action(
-        detail=True,
-        pagination_class=None,
-        filter_backends=[],
-        methods=["POST"],
-    )
-    # pylint: disable=unused-argument
-    def set_icon_url(self, request: Request, slug: str):
-        """Set application icon (as URL)"""
-        app: Application = self.get_object()
-        url = request.data.get("url", None)
-        if url is None:
+        if not icon:
             return HttpResponseBadRequest()
-        app.meta_icon.name = url
+        app.meta_icon = icon
         app.save()
         return Response({})
 
-    @permission_required("authentik_core.view_application", ["authentik_events.view_event"])
-    @extend_schema(responses={200: CoordinateSerializer(many=True)})
+    @permission_required(
+        "authentik_core.view_application", ["authentik_events.view_event"]
+    )
+    @swagger_auto_schema(responses={200: CoordinateSerializer(many=True)})
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=unused-argument
     def metrics(self, request: Request, slug: str):
         """Metrics for application logins"""
         app = self.get_object()
         return Response(
-            get_objects_for_user(request.user, "authentik_events.view_event")
-            .filter(
+            get_events_per_1h(
                 action=EventAction.AUTHORIZE_APPLICATION,
                 context__authorized_application__pk=app.pk.hex,
             )
-            .get_events_per_hour()
         )

authentik/core/api/authenticated_sessions.py

@@ -1,113 +0,0 @@
-"""AuthenticatedSessions API Viewset"""
-from typing import Optional, TypedDict
-
-from django_filters.rest_framework import DjangoFilterBackend
-from guardian.utils import get_anonymous_user
-from rest_framework import mixins
-from rest_framework.fields import SerializerMethodField
-from rest_framework.filters import OrderingFilter, SearchFilter
-from rest_framework.request import Request
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import GenericViewSet
-from ua_parser import user_agent_parser
-
-from authentik.api.authorization import OwnerSuperuserPermissions
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.models import AuthenticatedSession
-from authentik.events.geo import GEOIP_READER, GeoIPDict
-
-
-class UserAgentDeviceDict(TypedDict):
-    """User agent device"""
-
-    brand: str
-    family: str
-    model: str
-
-
-class UserAgentOSDict(TypedDict):
-    """User agent os"""
-
-    family: str
-    major: str
-    minor: str
-    patch: str
-    patch_minor: str
-
-
-class UserAgentBrowserDict(TypedDict):
-    """User agent browser"""
-
-    family: str
-    major: str
-    minor: str
-    patch: str
-
-
-class UserAgentDict(TypedDict):
-    """User agent details"""
-
-    device: UserAgentDeviceDict
-    os: UserAgentOSDict
-    user_agent: UserAgentBrowserDict
-    string: str
-
-
-class AuthenticatedSessionSerializer(ModelSerializer):
-    """AuthenticatedSession Serializer"""
-
-    current = SerializerMethodField()
-    user_agent = SerializerMethodField()
-    geo_ip = SerializerMethodField()
-
-    def get_current(self, instance: AuthenticatedSession) -> bool:
-        """Check if session is currently active session"""
-        request: Request = self.context["request"]
-        return request._request.session.session_key == instance.session_key
-
-    def get_user_agent(self, instance: AuthenticatedSession) -> UserAgentDict:
-        """Get parsed user agent"""
-        return user_agent_parser.Parse(instance.last_user_agent)
-
-    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
-        """Get parsed user agent"""
-        return GEOIP_READER.city_dict(instance.last_ip)
-
-    class Meta:
-
-        model = AuthenticatedSession
-        fields = [
-            "uuid",
-            "current",
-            "user_agent",
-            "geo_ip",
-            "user",
-            "last_ip",
-            "last_user_agent",
-            "last_used",
-            "expires",
-        ]
-
-
-class AuthenticatedSessionViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.DestroyModelMixin,
-    UsedByMixin,
-    mixins.ListModelMixin,
-    GenericViewSet,
-):
-    """AuthenticatedSession Viewset"""
-
-    queryset = AuthenticatedSession.objects.all()
-    serializer_class = AuthenticatedSessionSerializer
-    search_fields = ["user__username", "last_ip", "last_user_agent"]
-    filterset_fields = ["user__username", "last_ip", "last_user_agent"]
-    ordering = ["user__username"]
-    permission_classes = [OwnerSuperuserPermissions]
-    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
-
-    def get_queryset(self):
-        user = self.request.user if self.request else get_anonymous_user()
-        if user.is_superuser:
-            return super().get_queryset()
-        return super().get_queryset().filter(user=user.pk)

authentik/core/api/devices.py

@@ -1,36 +0,0 @@
-"""Authenticator Devices API Views"""
-from django_otp import devices_for_user
-from django_otp.models import Device
-from drf_spectacular.utils import extend_schema
-from rest_framework.fields import CharField, IntegerField, SerializerMethodField
-from rest_framework.permissions import IsAuthenticated
-from rest_framework.request import Request
-from rest_framework.response import Response
-from rest_framework.viewsets import ViewSet
-
-from authentik.core.api.utils import MetaNameSerializer
-
-
-class DeviceSerializer(MetaNameSerializer):
-    """Serializer for Duo authenticator devices"""
-
-    pk = IntegerField()
-    name = CharField()
-    type = SerializerMethodField()
-
-    def get_type(self, instance: Device) -> str:
-        """Get type of device"""
-        return instance._meta.label
-
-
-class DeviceViewSet(ViewSet):
-    """Viewset for authenticator devices"""
-
-    serializer_class = DeviceSerializer
-    permission_classes = [IsAuthenticated]
-
-    @extend_schema(responses={200: DeviceSerializer(many=True)})
-    def list(self, request: Request) -> Response:
-        """Get all devices for current user"""
-        devices = devices_for_user(request.user)
-        return Response(DeviceSerializer(devices, many=True).data)

authentik/core/api/groups.py

@@ -1,131 +1,28 @@
 """Groups API Viewset"""
-from json import loads
-
-from django.db.models.query import QuerySet
-from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
-from django_filters.filterset import FilterSet
-from rest_framework.fields import CharField, IntegerField, JSONField
-from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
+from rest_framework.fields import JSONField
+from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
-from rest_framework_guardian.filters import ObjectPermissionsFilter
 
-from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import is_dict
-from authentik.core.models import Group, User
-
-
-class GroupMemberSerializer(ModelSerializer):
-    """Stripped down user serializer to show relevant users for groups"""
-
-    avatar = CharField(read_only=True)
-    attributes = JSONField(validators=[is_dict], required=False)
-    uid = CharField(read_only=True)
-
-    class Meta:
-
-        model = User
-        fields = [
-            "pk",
-            "username",
-            "name",
-            "is_active",
-            "last_login",
-            "email",
-            "avatar",
-            "attributes",
-            "uid",
-        ]
+from authentik.core.models import Group
 
 
 class GroupSerializer(ModelSerializer):
     """Group Serializer"""
 
     attributes = JSONField(validators=[is_dict], required=False)
-    users_obj = ListSerializer(
-        child=GroupMemberSerializer(), read_only=True, source="users", required=False
-    )
-    parent_name = CharField(source="parent.name", read_only=True)
-
-    num_pk = IntegerField(read_only=True)
 
     class Meta:
 
         model = Group
-        fields = [
-            "pk",
-            "num_pk",
-            "name",
-            "is_superuser",
-            "parent",
-            "parent_name",
-            "users",
-            "attributes",
-            "users_obj",
-        ]
+        fields = ["pk", "name", "is_superuser", "parent", "users", "attributes"]
 
 
-class GroupFilter(FilterSet):
-    """Filter for groups"""
-
-    attributes = CharFilter(
-        field_name="attributes",
-        lookup_expr="",
-        label="Attributes",
-        method="filter_attributes",
-    )
-
-    members_by_username = ModelMultipleChoiceFilter(
-        field_name="users__username",
-        to_field_name="username",
-        queryset=User.objects.all(),
-    )
-    members_by_pk = ModelMultipleChoiceFilter(
-        field_name="users",
-        queryset=User.objects.all(),
-    )
-
-    # pylint: disable=unused-argument
-    def filter_attributes(self, queryset, name, value):
-        """Filter attributes by query args"""
-        try:
-            value = loads(value)
-        except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON")
-        if not isinstance(value, dict):
-            raise ValidationError(detail="filter: value must be key:value mapping")
-        qs = {}
-        for key, _value in value.items():
-            qs[f"attributes__{key}"] = _value
-        try:
-            _ = len(queryset.filter(**qs))
-            return queryset.filter(**qs)
-        except ValueError:
-            return queryset
-
-    class Meta:
-
-        model = Group
-        fields = ["name", "is_superuser", "members_by_pk", "attributes", "members_by_username"]
-
-
-class GroupViewSet(UsedByMixin, ModelViewSet):
+class GroupViewSet(ModelViewSet):
     """Group Viewset"""
 
-    queryset = Group.objects.all().select_related("parent").prefetch_related("users")
+    queryset = Group.objects.all()
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]
-    filterset_class = GroupFilter
+    filterset_fields = ["name", "is_superuser"]
     ordering = ["name"]
-
-    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
-        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
-        for backend in list(self.filter_backends):
-            if backend == ObjectPermissionsFilter:
-                continue
-            queryset = backend().filter_queryset(self.request, queryset, self)
-        return queryset
-
-    def filter_queryset(self, queryset):
-        if self.request.user.has_perm("authentik_core.view_group"):
-            return self._filter_queryset_for_list(queryset)
-        return super().filter_queryset(queryset)

authentik/core/api/propertymappings.py

@@ -1,8 +1,8 @@
 """PropertyMapping API Views"""
 from json import dumps
 
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
+from drf_yasg import openapi
+from drf_yasg.utils import swagger_auto_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework import mixins
 from rest_framework.decorators import action
@@ -14,8 +14,11 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
 from authentik.api.decorators import permission_required
-from authentik.core.api.used_by import UsedByMixin
-from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
+from authentik.core.api.utils import (
+    MetaNameSerializer,
+    PassiveSerializer,
+    TypeCreateSerializer,
+)
 from authentik.core.expression import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
 from authentik.lib.utils.reflection import all_subclasses
@@ -56,14 +59,12 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
             "component",
             "verbose_name",
             "verbose_name_plural",
-            "meta_model_name",
         ]
 
 
 class PropertyMappingViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
-    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -77,10 +78,10 @@ class PropertyMappingViewSet(
     filterset_fields = {"managed": ["isnull"]}
     ordering = ["name"]
 
-    def get_queryset(self):  # pragma: no cover
+    def get_queryset(self):
         return PropertyMapping.objects.select_subclasses()
 
-    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
+    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable property-mapping types"""
@@ -99,17 +100,14 @@ class PropertyMappingViewSet(
         return Response(TypeCreateSerializer(data, many=True).data)
 
     @permission_required("authentik_core.view_propertymapping")
-    @extend_schema(
-        request=PolicyTestSerializer(),
-        responses={
-            200: PropertyMappingTestResultSerializer,
-            400: OpenApiResponse(description="Invalid parameters"),
-        },
-        parameters=[
-            OpenApiParameter(
+    @swagger_auto_schema(
+        request_body=PolicyTestSerializer(),
+        responses={200: PropertyMappingTestResultSerializer, 400: "Invalid parameters"},
+        manual_parameters=[
+            openapi.Parameter(
                 name="format_result",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.BOOL,
+                in_=openapi.IN_QUERY,
+                type=openapi.TYPE_BOOLEAN,
             )
         ],
     )
@@ -138,7 +136,9 @@ class PropertyMappingViewSet(
                 self.request,
                 **test_params.validated_data.get("context", {}),
             )
-            response_data["result"] = dumps(result, indent=(4 if format_result else None))
+            response_data["result"] = dumps(
+                result, indent=(4 if format_result else None)
+            )
         except Exception as exc:  # pylint: disable=broad-except
             response_data["result"] = str(exc)
             response_data["successful"] = False

authentik/core/api/providers.py

@@ -1,6 +1,6 @@
 """Provider API Views"""
 from django.utils.translation import gettext_lazy as _
-from drf_spectacular.utils import extend_schema
+from drf_yasg.utils import swagger_auto_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
 from rest_framework.fields import ReadOnlyField
@@ -9,7 +9,6 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
-from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
 from authentik.core.models import Provider
 from authentik.lib.utils.reflection import all_subclasses
@@ -23,7 +22,7 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
 
     component = SerializerMethodField()
 
-    def get_component(self, obj: Provider) -> str:  # pragma: no cover
+    def get_component(self, obj: Provider):  # pragma: no cover
         """Get object component so that we know how to edit the object"""
         # pyright: reportGeneralTypeIssues=false
         if obj.__class__ == Provider:
@@ -43,14 +42,12 @@ class ProviderSerializer(ModelSerializer, MetaNameSerializer):
             "assigned_application_name",
             "verbose_name",
             "verbose_name_plural",
-            "meta_model_name",
         ]
 
 
 class ProviderViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
-    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -66,10 +63,10 @@ class ProviderViewSet(
         "application__name",
     ]
 
-    def get_queryset(self):  # pragma: no cover
+    def get_queryset(self):
         return Provider.objects.select_subclasses()
 
-    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
+    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable provider types"""

authentik/core/api/sources.py

@@ -1,21 +1,17 @@
 """Source API Views"""
 from typing import Iterable
 
-from django_filters.rest_framework import DjangoFilterBackend
-from drf_spectacular.utils import extend_schema
+from drf_yasg.utils import swagger_auto_schema
 from rest_framework import mixins
 from rest_framework.decorators import action
-from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
-from authentik.api.authorization import OwnerFilter, OwnerPermissions
-from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
-from authentik.core.models import Source, UserSourceConnection
+from authentik.core.models import Source
 from authentik.core.types import UserSettingSerializer
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.engine import PolicyEngine
@@ -28,7 +24,7 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
 
     component = SerializerMethodField()
 
-    def get_component(self, obj: Source) -> str:
+    def get_component(self, obj: Source):
         """Get object component so that we know how to edit the object"""
         # pyright: reportGeneralTypeIssues=false
         if obj.__class__ == Source:
@@ -48,16 +44,13 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
             "component",
             "verbose_name",
             "verbose_name_plural",
-            "meta_model_name",
             "policy_engine_mode",
-            "user_matching_mode",
         ]
 
 
 class SourceViewSet(
     mixins.RetrieveModelMixin,
     mixins.DestroyModelMixin,
-    UsedByMixin,
     mixins.ListModelMixin,
     GenericViewSet,
 ):
@@ -67,10 +60,10 @@ class SourceViewSet(
     serializer_class = SourceSerializer
     lookup_field = "slug"
 
-    def get_queryset(self):  # pragma: no cover
+    def get_queryset(self):
         return Source.objects.select_subclasses()
 
-    @extend_schema(responses={200: TypeCreateSerializer(many=True)})
+    @swagger_auto_schema(responses={200: TypeCreateSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def types(self, request: Request) -> Response:
         """Get all creatable source types"""
@@ -78,8 +71,6 @@ class SourceViewSet(
         for subclass in all_subclasses(self.queryset.model):
             subclass: Source
             component = ""
-            if len(subclass.__subclasses__()) > 0:
-                continue
             if subclass._meta.abstract:
                 component = subclass.__bases__[0]().component
             else:
@@ -95,61 +86,25 @@ class SourceViewSet(
             )
         return Response(TypeCreateSerializer(data, many=True).data)
 
-    @extend_schema(responses={200: UserSettingSerializer(many=True)})
+    @swagger_auto_schema(responses={200: UserSettingSerializer(many=True)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     def user_settings(self, request: Request) -> Response:
         """Get all sources the user can configure"""
-        _all_sources: Iterable[Source] = (
-            Source.objects.filter(enabled=True).select_subclasses().order_by("name")
-        )
+        _all_sources: Iterable[Source] = Source.objects.filter(
+            enabled=True
+        ).select_subclasses()
         matching_sources: list[UserSettingSerializer] = []
         for source in _all_sources:
-            user_settings = source.ui_user_settings()
+            user_settings = source.ui_user_settings
             if not user_settings:
                 continue
             policy_engine = PolicyEngine(source, request.user, request)
             policy_engine.build()
             if not policy_engine.passing:
                 continue
-            source_settings = source.ui_user_settings()
+            source_settings = source.ui_user_settings
             source_settings.initial_data["object_uid"] = source.slug
             if not source_settings.is_valid():
                 LOGGER.warning(source_settings.errors)
             matching_sources.append(source_settings.validated_data)
         return Response(matching_sources)
-
-
-class UserSourceConnectionSerializer(SourceSerializer):
-    """OAuth Source Serializer"""
-
-    source = SourceSerializer(read_only=True)
-
-    class Meta:
-        model = UserSourceConnection
-        fields = [
-            "pk",
-            "user",
-            "source",
-            "created",
-        ]
-        extra_kwargs = {
-            "user": {"read_only": True},
-            "created": {"read_only": True},
-        }
-
-
-class UserSourceConnectionViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    mixins.DestroyModelMixin,
-    UsedByMixin,
-    mixins.ListModelMixin,
-    GenericViewSet,
-):
-    """User-source connection Viewset"""
-
-    queryset = UserSourceConnection.objects.all()
-    serializer_class = UserSourceConnectionSerializer
-    permission_classes = [OwnerPermissions]
-    filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]
-    ordering = ["pk"]

authentik/core/api/tokens.py

@@ -1,42 +1,25 @@
 """Tokens API Viewset"""
-from typing import Any
-
-from django_filters.rest_framework import DjangoFilterBackend
-from drf_spectacular.utils import OpenApiResponse, extend_schema, inline_serializer
-from guardian.shortcuts import assign_perm, get_anonymous_user
+from django.http.response import Http404
+from drf_yasg.utils import swagger_auto_schema
 from rest_framework.decorators import action
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField
-from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.api.decorators import permission_required
-from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
+from authentik.core.models import Token, TokenIntents
 from authentik.events.models import Event, EventAction
-from authentik.events.utils import model_to_dict
 from authentik.managed.api import ManagedSerializer
 
 
 class TokenSerializer(ManagedSerializer, ModelSerializer):
     """Token Serializer"""
 
-    user_obj = UserSerializer(required=False, source="user", read_only=True)
-
-    def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
-        """Ensure only API or App password tokens are created."""
-        request: Request = self.context["request"]
-        attrs.setdefault("user", request.user)
-        attrs.setdefault("intent", TokenIntents.INTENT_API)
-        if attrs.get("intent") not in [TokenIntents.INTENT_API, TokenIntents.INTENT_APP_PASSWORD]:
-            raise ValidationError(f"Invalid intent {attrs.get('intent')}")
-        return attrs
+    user = UserSerializer(required=False)
 
     class Meta:
 
@@ -47,14 +30,11 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
             "identifier",
             "intent",
             "user",
-            "user_obj",
             "description",
             "expires",
             "expiring",
         ]
-        extra_kwargs = {
-            "user": {"required": False},
-        }
+        depth = 2
 
 
 class TokenViewSerializer(PassiveSerializer):
@@ -63,11 +43,11 @@ class TokenViewSerializer(PassiveSerializer):
     key = CharField(read_only=True)
 
 
-class TokenViewSet(UsedByMixin, ModelViewSet):
+class TokenViewSet(ModelViewSet):
     """Token Viewset"""
 
     lookup_field = "identifier"
-    queryset = Token.objects.all()
+    queryset = Token.filter_not_expired()
     serializer_class = TokenSerializer
     search_fields = [
         "identifier",
@@ -80,70 +60,27 @@ class TokenViewSet(UsedByMixin, ModelViewSet):
         "intent",
         "user__username",
         "description",
-        "expires",
-        "expiring",
-        "managed",
     ]
-    ordering = ["identifier", "expires"]
-    permission_classes = [OwnerSuperuserPermissions]
-    filter_backends = [DjangoFilterBackend, OrderingFilter, SearchFilter]
-
-    def get_queryset(self):
-        user = self.request.user if self.request else get_anonymous_user()
-        if user.is_superuser:
-            return super().get_queryset()
-        return super().get_queryset().filter(user=user.pk)
+    ordering = ["expires"]
 
     def perform_create(self, serializer: TokenSerializer):
-        if not self.request.user.is_superuser:
-            instance = serializer.save(
-                user=self.request.user,
-                expiring=self.request.user.attributes.get(USER_ATTRIBUTE_TOKEN_EXPIRING, True),
-            )
-            assign_perm("authentik_core.view_token_key", self.request.user, instance)
-            return instance
-        return super().perform_create(serializer)
+        serializer.save(user=self.request.user, intent=TokenIntents.INTENT_API)
 
     @permission_required("authentik_core.view_token_key")
-    @extend_schema(
+    @swagger_auto_schema(
         responses={
             200: TokenViewSerializer(many=False),
-            404: OpenApiResponse(description="Token not found or expired"),
+            404: "Token not found or expired",
         }
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["GET"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=unused-argument
     def view_key(self, request: Request, identifier: str) -> Response:
         """Return token key and log access"""
         token: Token = self.get_object()
-        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(request)  # noqa # nosec
-        return Response(TokenViewSerializer({"key": token.key}).data)
-
-    @permission_required("authentik_core.set_token_key")
-    @extend_schema(
-        request=inline_serializer(
-            "TokenSetKey",
-            {
-                "key": CharField(),
-            },
-        ),
-        responses={
-            204: OpenApiResponse(description="Successfully changed key"),
-            400: OpenApiResponse(description="Missing key"),
-            404: OpenApiResponse(description="Token not found or expired"),
-        },
-    )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
-    # pylint: disable=unused-argument
-    def set_key(self, request: Request, identifier: str) -> Response:
-        """Return token key and log access"""
-        token: Token = self.get_object()
-        key = request.POST.get("key")
-        if not key:
-            return Response(status=400)
-        token.key = key
-        token.save()
-        Event.new(EventAction.MODEL_UPDATED, model=model_to_dict(token)).from_http(
+        if token.is_expired:
+            raise Http404
+        Event.new(EventAction.SECRET_VIEW, secret=token).from_http(  # noqa # nosec
             request
-        )  # noqa # nosec
-        return Response(status=204)
+        )
+        return Response(TokenViewSerializer({"key": token.key}).data)

authentik/core/api/used_by.py

@@ -1,100 +0,0 @@
-"""used_by mixin"""
-from enum import Enum
-from inspect import getmembers
-
-from django.db.models.base import Model
-from django.db.models.deletion import SET_DEFAULT, SET_NULL
-from django.db.models.manager import Manager
-from drf_spectacular.utils import extend_schema
-from guardian.shortcuts import get_objects_for_user
-from rest_framework.decorators import action
-from rest_framework.fields import CharField, ChoiceField
-from rest_framework.request import Request
-from rest_framework.response import Response
-
-from authentik.core.api.utils import PassiveSerializer
-
-
-class DeleteAction(Enum):
-    """Which action a delete will have on a used object"""
-
-    CASCADE = "cascade"
-    CASCADE_MANY = "cascade_many"
-    SET_NULL = "set_null"
-    SET_DEFAULT = "set_default"
-
-
-class UsedBySerializer(PassiveSerializer):
-    """A list of all objects referencing the queried object"""
-
-    app = CharField()
-    model_name = CharField()
-    pk = CharField()
-    name = CharField()
-    action = ChoiceField(choices=[(x.name, x.name) for x in DeleteAction])
-
-
-def get_delete_action(manager: Manager) -> str:
-    """Get the delete action from the Foreign key, falls back to cascade"""
-    if hasattr(manager, "field"):
-        if manager.field.remote_field.on_delete.__name__ == SET_NULL.__name__:
-            return DeleteAction.SET_NULL.name
-        if manager.field.remote_field.on_delete.__name__ == SET_DEFAULT.__name__:
-            return DeleteAction.SET_DEFAULT.name
-    if hasattr(manager, "source_field"):
-        return DeleteAction.CASCADE_MANY.name
-    return DeleteAction.CASCADE.name
-
-
-class UsedByMixin:
-    """Mixin to add a used_by endpoint to return a list of all objects using this object"""
-
-    @extend_schema(
-        responses={200: UsedBySerializer(many=True)},
-    )
-    @action(detail=True, pagination_class=None, filter_backends=[])
-    # pylint: disable=invalid-name, unused-argument, too-many-locals
-    def used_by(self, request: Request, *args, **kwargs) -> Response:
-        """Get a list of all objects that use this object"""
-        # pyright: reportGeneralTypeIssues=false
-        model: Model = self.get_object()
-        used_by = []
-        shadows = []
-        for attr_name, manager in getmembers(model, lambda x: isinstance(x, Manager)):
-            if attr_name == "objects":  # pragma: no cover
-                continue
-            manager: Manager
-            if manager.model._meta.abstract:
-                continue
-            app = manager.model._meta.app_label
-            model_name = manager.model._meta.model_name
-            delete_action = get_delete_action(manager)
-
-            # To make sure we only apply shadows when there are any objects,
-            # but so we only apply them once, have a simple flag for the first object
-            first_object = True
-
-            for obj in get_objects_for_user(
-                request.user, f"{app}.view_{model_name}", manager
-            ).all():
-                # Only merge shadows on first object
-                if first_object:
-                    shadows += getattr(manager.model._meta, "authentik_used_by_shadows", [])
-                first_object = False
-                serializer = UsedBySerializer(
-                    data={
-                        "app": app,
-                        "model_name": model_name,
-                        "pk": str(obj.pk),
-                        "name": str(obj),
-                        "action": delete_action,
-                    }
-                )
-                serializer.is_valid()
-                used_by.append(serializer.data)
-        # Check the shadows map and remove anything that should be shadowed
-        for idx, user in enumerate(used_by):
-            full_model_name = f"{user['app']}.{user['model_name']}"
-            if full_model_name in shadows:
-                del used_by[idx]
-        return Response(used_by)

authentik/core/api/users.py

@@ -1,64 +1,26 @@
 """User API Views"""
-from datetime import timedelta
-from json import loads
-from typing import Any, Optional
-
-from django.contrib.auth import update_session_auth_hash
-from django.db.models.query import QuerySet
-from django.db.transaction import atomic
-from django.db.utils import IntegrityError
+from django.http.response import Http404
 from django.urls import reverse_lazy
 from django.utils.http import urlencode
-from django.utils.text import slugify
-from django.utils.timezone import now
-from django.utils.translation import gettext as _
-from django_filters.filters import BooleanFilter, CharFilter, ModelMultipleChoiceFilter
-from django_filters.filterset import FilterSet
-from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import (
-    OpenApiParameter,
-    extend_schema,
-    extend_schema_field,
-    inline_serializer,
-)
-from guardian.shortcuts import get_anonymous_user, get_objects_for_user
+from drf_yasg.utils import swagger_auto_schema, swagger_serializer_method
+from guardian.utils import get_anonymous_user
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, JSONField, SerializerMethodField
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import (
-    BooleanField,
-    ListSerializer,
-    ModelSerializer,
-    PrimaryKeyRelatedField,
-    Serializer,
-    ValidationError,
-)
+from rest_framework.serializers import BooleanField, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
-from rest_framework_guardian.filters import ObjectPermissionsFilter
-from structlog.stdlib import get_logger
 
-from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.admin.api.metrics import CoordinateSerializer, get_events_per_1h
 from authentik.api.decorators import permission_required
-from authentik.core.api.groups import GroupSerializer
-from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
-from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
-from authentik.core.models import (
-    USER_ATTRIBUTE_SA,
-    USER_ATTRIBUTE_TOKEN_EXPIRING,
-    Group,
-    Token,
-    TokenIntents,
-    User,
+from authentik.core.middleware import (
+    SESSION_IMPERSONATE_ORIGINAL_USER,
+    SESSION_IMPERSONATE_USER,
 )
+from authentik.core.models import Token, TokenIntents, User
 from authentik.events.models import EventAction
-from authentik.stages.email.models import EmailStage
-from authentik.stages.email.tasks import send_mails
-from authentik.stages.email.utils import TemplateEmailMessage
-from authentik.tenants.models import Tenant
-
-LOGGER = get_logger()
+from authentik.flows.models import Flow, FlowDesignation
 
 
 class UserSerializer(ModelSerializer):
@@ -67,11 +29,6 @@ class UserSerializer(ModelSerializer):
     is_superuser = BooleanField(read_only=True)
     avatar = CharField(read_only=True)
     attributes = JSONField(validators=[is_dict], required=False)
-    groups = PrimaryKeyRelatedField(
-        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all()
-    )
-    groups_obj = ListSerializer(child=GroupSerializer(), read_only=True, source="ak_groups")
-    uid = CharField(read_only=True)
 
     class Meta:
 
@@ -83,74 +40,18 @@ class UserSerializer(ModelSerializer):
             "is_active",
             "last_login",
             "is_superuser",
-            "groups",
-            "groups_obj",
             "email",
             "avatar",
             "attributes",
-            "uid",
         ]
-        extra_kwargs = {
-            "name": {"allow_blank": True},
-        }
-
-
-class UserSelfSerializer(ModelSerializer):
-    """User Serializer for information a user can retrieve about themselves"""
-
-    is_superuser = BooleanField(read_only=True)
-    avatar = CharField(read_only=True)
-    groups = SerializerMethodField()
-    uid = CharField(read_only=True)
-    settings = SerializerMethodField()
-
-    @extend_schema_field(
-        ListSerializer(
-            child=inline_serializer(
-                "UserSelfGroups",
-                {"name": CharField(read_only=True), "pk": CharField(read_only=True)},
-            )
-        )
-    )
-    def get_groups(self, _: User):
-        """Return only the group names a user is member of"""
-        for group in self.instance.ak_groups.all():
-            yield {
-                "name": group.name,
-                "pk": group.pk,
-            }
-
-    def get_settings(self, user: User) -> dict[str, Any]:
-        """Get user settings with tenant and group settings applied"""
-        return user.group_attributes(self._context["request"]).get("settings", {})
-
-    class Meta:
-
-        model = User
-        fields = [
-            "pk",
-            "username",
-            "name",
-            "is_active",
-            "is_superuser",
-            "groups",
-            "email",
-            "avatar",
-            "uid",
-            "settings",
-        ]
-        extra_kwargs = {
-            "is_active": {"read_only": True},
-            "name": {"allow_blank": True},
-        }
 
 
 class SessionUserSerializer(PassiveSerializer):
     """Response for the /user/me endpoint, returns the currently active user (as `user` property)
     and, if this user is being impersonated, the original user in the `original` property."""
 
-    user = UserSelfSerializer()
-    original = UserSelfSerializer(required=False)
+    user = UserSerializer()
+    original = UserSerializer(required=False)
 
 
 class UserMetricsSerializer(PassiveSerializer):
@@ -160,219 +61,57 @@ class UserMetricsSerializer(PassiveSerializer):
     logins_failed_per_1h = SerializerMethodField()
     authorizations_per_1h = SerializerMethodField()
 
-    @extend_schema_field(CoordinateSerializer(many=True))
+    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
         """Get successful logins per hour for the last 24 hours"""
         user = self.context["user"]
-        return (
-            get_objects_for_user(user, "authentik_events.view_event")
-            .filter(action=EventAction.LOGIN, user__pk=user.pk)
-            .get_events_per_hour()
-        )
+        return get_events_per_1h(action=EventAction.LOGIN, user__pk=user.pk)
 
-    @extend_schema_field(CoordinateSerializer(many=True))
+    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
     def get_logins_failed_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
         user = self.context["user"]
-        return (
-            get_objects_for_user(user, "authentik_events.view_event")
-            .filter(action=EventAction.LOGIN_FAILED, context__username=user.username)
-            .get_events_per_hour()
+        return get_events_per_1h(
+            action=EventAction.LOGIN_FAILED, context__username=user.username
         )
 
-    @extend_schema_field(CoordinateSerializer(many=True))
+    @swagger_serializer_method(serializer_or_field=CoordinateSerializer(many=True))
     def get_authorizations_per_1h(self, _):
         """Get failed logins per hour for the last 24 hours"""
         user = self.context["user"]
-        return (
-            get_objects_for_user(user, "authentik_events.view_event")
-            .filter(action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk)
-            .get_events_per_hour()
+        return get_events_per_1h(
+            action=EventAction.AUTHORIZE_APPLICATION, user__pk=user.pk
         )
 
 
-class UsersFilter(FilterSet):
-    """Filter for users"""
-
-    attributes = CharFilter(
-        field_name="attributes",
-        lookup_expr="",
-        label="Attributes",
-        method="filter_attributes",
-    )
-
-    is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
-    uuid = CharFilter(field_name="uuid")
-
-    groups_by_name = ModelMultipleChoiceFilter(
-        field_name="ak_groups__name",
-        to_field_name="name",
-        queryset=Group.objects.all(),
-    )
-    groups_by_pk = ModelMultipleChoiceFilter(
-        field_name="ak_groups",
-        queryset=Group.objects.all(),
-    )
-
-    # pylint: disable=unused-argument
-    def filter_attributes(self, queryset, name, value):
-        """Filter attributes by query args"""
-        try:
-            value = loads(value)
-        except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON")
-        if not isinstance(value, dict):
-            raise ValidationError(detail="filter: value must be key:value mapping")
-        qs = {}
-        for key, _value in value.items():
-            qs[f"attributes__{key}"] = _value
-        try:
-            _ = len(queryset.filter(**qs))
-            return queryset.filter(**qs)
-        except ValueError:
-            return queryset
-
-    class Meta:
-        model = User
-        fields = [
-            "username",
-            "email",
-            "name",
-            "is_active",
-            "is_superuser",
-            "attributes",
-            "groups_by_name",
-            "groups_by_pk",
-        ]
-
-
-class UserViewSet(UsedByMixin, ModelViewSet):
+class UserViewSet(ModelViewSet):
     """User Viewset"""
 
     queryset = User.objects.none()
-    ordering = ["username"]
     serializer_class = UserSerializer
-    search_fields = ["username", "name", "is_active", "email", "uuid"]
-    filterset_class = UsersFilter
+    search_fields = ["username", "name", "is_active"]
+    filterset_fields = ["username", "name", "is_active"]
 
-    def get_queryset(self):  # pragma: no cover
+    def get_queryset(self):
         return User.objects.all().exclude(pk=get_anonymous_user().pk)
 
-    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
-        """Create a recovery link (when the current tenant has a recovery flow set),
-        that can either be shown to an admin or sent to the user directly"""
-        tenant: Tenant = self.request._request.tenant
-        # Check that there is a recovery flow, if not return an error
-        flow = tenant.flow_recovery
-        if not flow:
-            LOGGER.debug("No recovery flow set")
-            return None, None
-        user: User = self.get_object()
-        token, __ = Token.objects.get_or_create(
-            identifier=f"{user.uid}-password-reset",
-            user=user,
-            intent=TokenIntents.INTENT_RECOVERY,
-        )
-        querystring = urlencode({"token": token.key})
-        link = self.request.build_absolute_uri(
-            reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
-            + f"?{querystring}"
-        )
-        return link, token
-
-    @permission_required(None, ["authentik_core.add_user", "authentik_core.add_token"])
-    @extend_schema(
-        request=inline_serializer(
-            "UserServiceAccountSerializer",
-            {
-                "name": CharField(required=True),
-                "create_group": BooleanField(default=False),
-            },
-        ),
-        responses={
-            200: inline_serializer(
-                "UserServiceAccountResponse",
-                {
-                    "username": CharField(required=True),
-                    "token": CharField(required=True),
-                },
-            )
-        },
-    )
-    @action(detail=False, methods=["POST"], pagination_class=None, filter_backends=[])
-    def service_account(self, request: Request) -> Response:
-        """Create a new user account that is marked as a service account"""
-        username = request.data.get("name")
-        create_group = request.data.get("create_group", False)
-        with atomic():
-            try:
-                user = User.objects.create(
-                    username=username,
-                    name=username,
-                    attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False},
-                )
-                if create_group and self.request.user.has_perm("authentik_core.add_group"):
-                    group = Group.objects.create(
-                        name=username,
-                    )
-                    group.users.add(user)
-                token = Token.objects.create(
-                    identifier=slugify(f"service-account-{username}-password"),
-                    intent=TokenIntents.INTENT_APP_PASSWORD,
-                    user=user,
-                    expires=now() + timedelta(days=360),
-                )
-                return Response({"username": user.username, "token": token.key})
-            except (IntegrityError) as exc:
-                return Response(data={"non_field_errors": [str(exc)]}, status=400)
-
-    @extend_schema(responses={200: SessionUserSerializer(many=False)})
+    @swagger_auto_schema(responses={200: SessionUserSerializer(many=False)})
     @action(detail=False, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name
     def me(self, request: Request) -> Response:
         """Get information about current user"""
-        context = {"request": request}
         serializer = SessionUserSerializer(
-            data={"user": UserSelfSerializer(instance=request.user, context=context).data}
+            data={"user": UserSerializer(request.user).data}
         )
         if SESSION_IMPERSONATE_USER in request._request.session:
-            serializer.initial_data["original"] = UserSelfSerializer(
-                instance=request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER],
-                context=context,
+            serializer.initial_data["original"] = UserSerializer(
+                request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER]
             ).data
-        return Response(serializer.initial_data)
-
-    @permission_required("authentik_core.reset_user_password")
-    @extend_schema(
-        request=inline_serializer(
-            "UserPasswordSetSerializer",
-            {
-                "password": CharField(required=True),
-            },
-        ),
-        responses={
-            204: "",
-            400: "",
-        },
-    )
-    @action(detail=True, methods=["POST"])
-    # pylint: disable=invalid-name, unused-argument
-    def set_password(self, request: Request, pk: int) -> Response:
-        """Set password for user"""
-        user: User = self.get_object()
-        try:
-            user.set_password(request.data.get("password"))
-            user.save()
-        except (ValidationError, IntegrityError) as exc:
-            LOGGER.debug("Failed to set password", exc=exc)
-            return Response(status=400)
-        if user.pk == request.user.pk and SESSION_IMPERSONATE_USER not in self.request.session:
-            LOGGER.debug("Updating session hash after password change")
-            update_session_auth_hash(self.request, user)
-        return Response(status=204)
+        serializer.is_valid()
+        return Response(serializer.data)
 
     @permission_required("authentik_core.view_user", ["authentik_events.view_event"])
-    @extend_schema(responses={200: UserMetricsSerializer(many=False)})
+    @swagger_auto_schema(responses={200: UserMetricsSerializer(many=False)})
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def metrics(self, request: Request, pk: int) -> Response:
@@ -383,79 +122,25 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         return Response(serializer.data)
 
     @permission_required("authentik_core.reset_user_password")
-    @extend_schema(
-        responses={
-            "200": LinkSerializer(many=False),
-            "404": LinkSerializer(many=False),
-        },
+    @swagger_auto_schema(
+        responses={"200": LinkSerializer(many=False), "404": "No recovery flow found."},
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
     # pylint: disable=invalid-name, unused-argument
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
-        link, _ = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
-            return Response({"link": ""}, status=404)
-        return Response({"link": link})
-
-    @permission_required("authentik_core.reset_user_password")
-    @extend_schema(
-        parameters=[
-            OpenApiParameter(
-                name="email_stage",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.STR,
-                required=True,
-            )
-        ],
-        responses={
-            "204": Serializer(),
-            "404": Serializer(),
-        },
-    )
-    @action(detail=True, pagination_class=None, filter_backends=[])
-    # pylint: disable=invalid-name, unused-argument
-    def recovery_email(self, request: Request, pk: int) -> Response:
-        """Create a temporary link that a user can use to recover their accounts"""
-        for_user = self.get_object()
-        if for_user.email == "":
-            LOGGER.debug("User doesn't have an email address")
-            return Response(status=404)
-        link, token = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
-            return Response(status=404)
-        # Lookup the email stage to assure the current user can access it
-        stages = get_objects_for_user(
-            request.user, "authentik_stages_email.view_emailstage"
-        ).filter(pk=request.query_params.get("email_stage"))
-        if not stages.exists():
-            LOGGER.debug("Email stage does not exist/user has no permissions")
-            return Response(status=404)
-        email_stage: EmailStage = stages.first()
-        message = TemplateEmailMessage(
-            subject=_(email_stage.subject),
-            template_name=email_stage.template,
-            to=[for_user.email],
-            template_context={
-                "url": link,
-                "user": for_user,
-                "expires": token.expires,
-            },
+        # Check that there is a recovery flow, if not return an error
+        flow = Flow.with_policy(request, designation=FlowDesignation.RECOVERY)
+        if not flow:
+            raise Http404
+        user: User = self.get_object()
+        token, __ = Token.objects.get_or_create(
+            identifier=f"{user.uid}-password-reset",
+            user=user,
+            intent=TokenIntents.INTENT_RECOVERY,
         )
-        send_mails(email_stage, message)
-        return Response(status=204)
-
-    def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
-        """Custom filter_queryset method which ignores guardian, but still supports sorting"""
-        for backend in list(self.filter_backends):
-            if backend == ObjectPermissionsFilter:
-                continue
-            queryset = backend().filter_queryset(self.request, queryset, self)
-        return queryset
-
-    def filter_queryset(self, queryset):
-        if self.request.user.has_perm("authentik_core.view_user"):
-            return self._filter_queryset_for_list(queryset)
-        return super().filter_queryset(queryset)
+        querystring = urlencode({"token": token.key})
+        link = request.build_absolute_uri(
+            reverse_lazy("authentik_flows:default-recovery") + f"?{querystring}"
+        )
+        return Response({"link": link})

authentik/core/api/utils.py

@@ -2,46 +2,36 @@
 from typing import Any
 
 from django.db.models import Model
-from rest_framework.fields import BooleanField, CharField, FileField, IntegerField
-from rest_framework.serializers import Serializer, SerializerMethodField, ValidationError
+from rest_framework.fields import CharField, IntegerField
+from rest_framework.serializers import (
+    Serializer,
+    SerializerMethodField,
+    ValidationError,
+)
 
 
 def is_dict(value: Any):
     """Ensure a value is a dictionary, useful for JSONFields"""
     if isinstance(value, dict):
         return
-    raise ValidationError("Value must be a dictionary, and not have any duplicate keys.")
+    raise ValidationError("Value must be a dictionary.")
 
 
 class PassiveSerializer(Serializer):
     """Base serializer class which doesn't implement create/update methods"""
 
-    def create(self, validated_data: dict) -> Model:  # pragma: no cover
+    def create(self, validated_data: dict) -> Model:
         return Model()
 
-    def update(self, instance: Model, validated_data: dict) -> Model:  # pragma: no cover
+    def update(self, instance: Model, validated_data: dict) -> Model:
         return Model()
 
 
-class FileUploadSerializer(PassiveSerializer):
-    """Serializer to upload file"""
-
-    file = FileField(required=False)
-    clear = BooleanField(default=False)
-
-
-class FilePathSerializer(PassiveSerializer):
-    """Serializer to upload file"""
-
-    url = CharField()
-
-
 class MetaNameSerializer(PassiveSerializer):
     """Add verbose names to response"""
 
     verbose_name = SerializerMethodField()
     verbose_name_plural = SerializerMethodField()
-    meta_model_name = SerializerMethodField()
 
     def get_verbose_name(self, obj: Model) -> str:
         """Return object's verbose_name"""
@@ -51,10 +41,6 @@ class MetaNameSerializer(PassiveSerializer):
         """Return object's plural verbose_name"""
         return obj._meta.verbose_name_plural
 
-    def get_meta_model_name(self, obj: Model) -> str:
-        """Return internal model name"""
-        return f"{obj._meta.app_label}.{obj._meta.model_name}"
-
 
 class TypeCreateSerializer(PassiveSerializer):
     """Types of an object that can be created"""

authentik/core/apps.py

@@ -2,10 +2,6 @@
 from importlib import import_module
 
 from django.apps import AppConfig
-from django.db import ProgrammingError
-
-from authentik.core.signals import GAUGE_MODELS
-from authentik.lib.utils.reflection import get_apps
 
 
 class AuthentikCoreConfig(AppConfig):
@@ -19,12 +15,3 @@ class AuthentikCoreConfig(AppConfig):
     def ready(self):
         import_module("authentik.core.signals")
         import_module("authentik.core.managed")
-        try:
-            for app in get_apps():
-                for model in app.get_models():
-                    GAUGE_MODELS.labels(
-                        model_name=model._meta.model_name,
-                        app=model._meta.app_label,
-                    ).set(model.objects.count())
-        except ProgrammingError:
-            pass

authentik/core/auth.py

@@ -1,60 +0,0 @@
-"""Authenticate with tokens"""
-
-from typing import Any, Optional
-
-from django.contrib.auth.backends import ModelBackend
-from django.http.request import HttpRequest
-
-from authentik.core.models import Token, TokenIntents, User
-from authentik.events.utils import cleanse_dict, sanitize_dict
-from authentik.flows.planner import FlowPlan
-from authentik.flows.views.executor import SESSION_KEY_PLAN
-from authentik.stages.password.stage import PLAN_CONTEXT_METHOD, PLAN_CONTEXT_METHOD_ARGS
-
-
-class InbuiltBackend(ModelBackend):
-    """Inbuilt backend"""
-
-    def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> Optional[User]:
-        user = super().authenticate(request, username=username, password=password, **kwargs)
-        if not user:
-            return None
-        self.set_method("password", request)
-        return user
-
-    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
-        """Set method data on current flow, if possbiel"""
-        if not request:
-            return
-        # Since we can't directly pass other variables to signals, and we want to log the method
-        # and the token used, we assume we're running in a flow and set a variable in the context
-        flow_plan: FlowPlan = request.session.get(SESSION_KEY_PLAN, FlowPlan(""))
-        flow_plan.context[PLAN_CONTEXT_METHOD] = method
-        flow_plan.context[PLAN_CONTEXT_METHOD_ARGS] = cleanse_dict(sanitize_dict(kwargs))
-        request.session[SESSION_KEY_PLAN] = flow_plan
-
-
-class TokenBackend(InbuiltBackend):
-    """Authenticate with token"""
-
-    def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> Optional[User]:
-        try:
-            user = User._default_manager.get_by_natural_key(username)
-        except User.DoesNotExist:
-            # Run the default password hasher once to reduce the timing
-            # difference between an existing and a nonexistent user (#20760).
-            User().set_password(password)
-            return None
-        # pylint: disable=no-member
-        tokens = Token.filter_not_expired(
-            user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
-        )
-        if not tokens.exists():
-            return None
-        token = tokens.first()
-        self.set_method("token", request, token=token)
-        return token.user

authentik/core/channels.py

@@ -4,7 +4,7 @@ from channels.generic.websocket import JsonWebsocketConsumer
 from rest_framework.exceptions import AuthenticationFailed
 from structlog.stdlib import get_logger
 
-from authentik.api.authentication import bearer_auth
+from authentik.api.auth import token_from_header
 from authentik.core.models import User
 
 LOGGER = get_logger()
@@ -24,12 +24,12 @@ class AuthJsonConsumer(JsonWebsocketConsumer):
         raw_header = headers[b"authorization"]
 
         try:
-            user = bearer_auth(raw_header)
-            # user is only None when no header was given, in which case we deny too
-            if not user:
+            token = token_from_header(raw_header)
+            # token is only None when no header was given, in which case we deny too
+            if not token:
                 raise DenyConnection()
         except AuthenticationFailed as exc:
             LOGGER.warning("Failed to authenticate", exc=exc)
             raise DenyConnection()
 
-        self.user = user
+        self.user = token.user

authentik/core/expression.py

@@ -3,33 +3,23 @@ from traceback import format_tb
 from typing import Optional
 
 from django.http import HttpRequest
-from guardian.utils import get_anonymous_user
 
-from authentik.core.models import PropertyMapping, User
+from authentik.core.models import User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
-from authentik.policies.types import PolicyRequest
 
 
 class PropertyMappingEvaluator(BaseEvaluator):
     """Custom Evalautor that adds some different context variables."""
 
     def set_context(
-        self,
-        user: Optional[User],
-        request: Optional[HttpRequest],
-        mapping: PropertyMapping,
-        **kwargs,
+        self, user: Optional[User], request: Optional[HttpRequest], **kwargs
     ):
         """Update context with context from PropertyMapping's evaluate"""
-        req = PolicyRequest(user=get_anonymous_user())
-        req.obj = mapping
         if user:
-            req.user = user
             self._context["user"] = user
         if request:
-            req.http_request = request
-        self._context["request"] = req
+            self._context["request"] = request
         self._context.update(**kwargs)
 
     def handle_error(self, exc: Exception, expression_source: str):
@@ -40,8 +30,9 @@ class PropertyMappingEvaluator(BaseEvaluator):
             expression=expression_source,
             message=error_string,
         )
+        if "user" in self._context:
+            event.set_user(self._context["user"])
         if "request" in self._context:
-            req: PolicyRequest = self._context["request"]
-            event.from_http(req.http_request, req.user)
+            event.from_http(self._context["request"])
             return
         event.save()

authentik/core/middleware.py

@@ -5,14 +5,11 @@ from typing import Callable
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
-from sentry_sdk.api import set_tag
 
 SESSION_IMPERSONATE_USER = "authentik_impersonate_user"
 SESSION_IMPERSONATE_ORIGINAL_USER = "authentik_impersonate_original_user"
 LOCAL = local()
 RESPONSE_HEADER_ID = "X-authentik-id"
-KEY_AUTH_VIA = "auth_via"
-KEY_USER = "user"
 
 
 class ImpersonateMiddleware:
@@ -29,8 +26,6 @@ class ImpersonateMiddleware:
 
         if SESSION_IMPERSONATE_USER in request.session:
             request.user = request.session[SESSION_IMPERSONATE_USER]
-            # Ensure that the user is active, otherwise nothing will work
-            request.user.is_active = True
 
         return self.get_response(request)
 
@@ -47,26 +42,16 @@ class RequestIDMiddleware:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
             setattr(request, "request_id", request_id)
-            LOCAL.authentik = {
-                "request_id": request_id,
-                "host": request.get_host(),
-            }
-            set_tag("authentik.request_id", request_id)
+            LOCAL.authentik = {"request_id": request_id}
         response = self.get_response(request)
         response[RESPONSE_HEADER_ID] = request.request_id
-        setattr(response, "ak_context", {})
-        response.ak_context.update(LOCAL.authentik)
-        response.ak_context[KEY_USER] = request.user.username
-        for key in list(LOCAL.authentik.keys()):
-            del LOCAL.authentik[key]
+        del LOCAL.authentik["request_id"]
         return response
 
 
 # pylint: disable=unused-argument
-def structlog_add_request_id(logger: Logger, method_name: str, event_dict: dict):
+def structlog_add_request_id(logger: Logger, method_name: str, event_dict):
     """If threadlocal has authentik defined, add request_id to log"""
     if hasattr(LOCAL, "authentik"):
-        event_dict.update(LOCAL.authentik)
-    if hasattr(LOCAL, "authentik_task"):
-        event_dict.update(LOCAL.authentik_task)
+        event_dict["request_id"] = LOCAL.authentik.get("request_id", "")
     return event_dict

authentik/core/migrations/0001_initial.py

@@ -38,7 +38,9 @@ class Migration(migrations.Migration):
                 ("password", models.CharField(max_length=128, verbose_name="password")),
                 (
                     "last_login",
-                    models.DateTimeField(blank=True, null=True, verbose_name="last login"),
+                    models.DateTimeField(
+                        blank=True, null=True, verbose_name="last login"
+                    ),
                 ),
                 (
                     "is_superuser",
@@ -51,25 +53,35 @@ class Migration(migrations.Migration):
                 (
                     "username",
                     models.CharField(
-                        error_messages={"unique": "A user with that username already exists."},
+                        error_messages={
+                            "unique": "A user with that username already exists."
+                        },
                         help_text="Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.",
                         max_length=150,
                         unique=True,
-                        validators=[django.contrib.auth.validators.UnicodeUsernameValidator()],
+                        validators=[
+                            django.contrib.auth.validators.UnicodeUsernameValidator()
+                        ],
                         verbose_name="username",
                     ),
                 ),
                 (
                     "first_name",
-                    models.CharField(blank=True, max_length=30, verbose_name="first name"),
+                    models.CharField(
+                        blank=True, max_length=30, verbose_name="first name"
+                    ),
                 ),
                 (
                     "last_name",
-                    models.CharField(blank=True, max_length=150, verbose_name="last name"),
+                    models.CharField(
+                        blank=True, max_length=150, verbose_name="last name"
+                    ),
                 ),
                 (
                     "email",
-                    models.EmailField(blank=True, max_length=254, verbose_name="email address"),
+                    models.EmailField(
+                        blank=True, max_length=254, verbose_name="email address"
+                    ),
                 ),
                 (
                     "is_staff",
@@ -205,7 +217,9 @@ class Migration(migrations.Migration):
                 ),
                 (
                     "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
+                    models.DateTimeField(
+                        default=authentik.core.models.default_token_duration
+                    ),
                 ),
                 ("expiring", models.BooleanField(default=True)),
                 ("description", models.TextField(blank=True, default="")),
@@ -292,7 +306,9 @@ class Migration(migrations.Migration):
                 ("name", models.TextField(help_text="Application's display Name.")),
                 (
                     "slug",
-                    models.SlugField(help_text="Internal application name, used in URLs."),
+                    models.SlugField(
+                        help_text="Internal application name, used in URLs."
+                    ),
                 ),
                 ("skip_authorization", models.BooleanField(default=False)),
                 ("meta_launch_url", models.URLField(blank=True, default="")),

authentik/core/migrations/0002_auto_20200523_1133_squashed_0011_provider_name_temp.py

@@ -1,221 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:16
-
-from os import environ
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin, _ = User.objects.using(db_alias).get_or_create(
-        username="akadmin", email="root@localhost", name="authentik Default Admin"
-    )
-    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
-    else:
-        akadmin.set_unusable_password()
-    akadmin.save()
-
-
-def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    User = apps.get_model("authentik_core", "User")
-
-    # Creates a default admin group
-    group, _ = Group.objects.using(db_alias).get_or_create(
-        is_superuser=True,
-        defaults={
-            "name": "authentik Admins",
-        },
-    )
-    group.users.set(User.objects.filter(username="akadmin"))
-    group.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0002_auto_20200523_1133"),
-        ("authentik_core", "0003_default_user"),
-        ("authentik_core", "0004_auto_20200703_2213"),
-        ("authentik_core", "0005_token_intent"),
-        ("authentik_core", "0006_auto_20200709_1608"),
-        ("authentik_core", "0007_auto_20200815_1841"),
-        ("authentik_core", "0008_auto_20200824_1532"),
-        ("authentik_core", "0009_group_is_superuser"),
-        ("authentik_core", "0010_auto_20200917_1021"),
-        ("authentik_core", "0011_provider_name_temp"),
-    ]
-
-    dependencies = [
-        ("authentik_core", "0001_initial"),
-        ("authentik_flows", "0003_auto_20200523_1133"),
-        ("auth", "0012_alter_user_first_name_max_length"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="application",
-            name="skip_authorization",
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="authentication_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when authenticating existing users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_authentication",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="enrollment_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when enrolling new users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_enrollment",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="authorization_flow",
-            field=models.ForeignKey(
-                help_text="Flow used when authorizing this provider.",
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="provider_authorization",
-                to="authentik_flows.flow",
-            ),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.RunPython(
-            code=create_default_user,
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="is_superuser",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="is_staff",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AlterModelOptions(
-            name="application",
-            options={"verbose_name": "Application", "verbose_name_plural": "Applications"},
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (("reset_user_password", "Reset Password"),),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[("verification", "Intent Verification"), ("api", "Intent Api")],
-                default="verification",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="source",
-            name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
-        ),
-        migrations.AlterField(
-            model_name="user",
-            name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="groups",
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(
-                blank=True,
-                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
-                related_name="user_set",
-                related_query_name="user",
-                to="auth.Group",
-                verbose_name="groups",
-            ),
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="group",
-            name="is_superuser",
-            field=models.BooleanField(
-                default=False, help_text="Users added to this group will be superusers."
-            ),
-        ),
-        migrations.RunPython(
-            code=create_default_admin_group,
-        ),
-        migrations.AlterModelManagers(
-            name="user",
-            managers=[
-                ("objects", authentik.core.models.UserManager()),
-            ],
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (
-                    ("reset_user_password", "Reset Password"),
-                    ("impersonate", "Can impersonate other users"),
-                ),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="name_temp",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-    ]

authentik/core/migrations/0003_default_user.py

@@ -17,7 +17,9 @@ def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
         username="akadmin", email="root@localhost", name="authentik Default Admin"
     )
     if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
+        akadmin.set_password(
+            environ.get("AK_ADMIN_PASS", "akadmin"), signal=False
+        )  # noqa # nosec
     else:
         akadmin.set_unusable_password()
     akadmin.save()

authentik/core/migrations/0006_auto_20200709_1608.py

@@ -13,6 +13,8 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name="source",
             name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
+            field=models.SlugField(
+                help_text="Internal source name, used in URLs.", unique=True
+            ),
         ),
     ]

authentik/core/migrations/0007_auto_20200815_1841.py

@@ -13,6 +13,8 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name="user",
             name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
+            field=models.CharField(
+                blank=True, max_length=150, verbose_name="first name"
+            ),
         ),
     ]

authentik/core/migrations/0009_group_is_superuser.py

@@ -40,7 +40,9 @@ class Migration(migrations.Migration):
         migrations.AlterField(
             model_name="user",
             name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
+            field=models.ManyToManyField(
+                related_name="users", to="authentik_core.Group"
+            ),
         ),
         migrations.AddField(
             model_name="group",

authentik/core/migrations/0012_auto_20201003_1737_squashed_0016_auto_20201202_2234.py

@@ -1,118 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-12 15:36
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def set_default_token_key(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "Token")
-
-    for token in Token.objects.using(db_alias).all():
-        token.key = token.pk.hex
-        token.save()
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0012_auto_20201003_1737"),
-        ("authentik_core", "0013_auto_20201003_2132"),
-        ("authentik_core", "0014_auto_20201018_1158"),
-        ("authentik_core", "0015_application_icon"),
-        ("authentik_core", "0016_auto_20201202_2234"),
-    ]
-
-    dependencies = [
-        ("authentik_providers_saml", "0006_remove_samlprovider_name"),
-        ("authentik_providers_oauth2", "0006_remove_oauth2provider_name"),
-        ("authentik_core", "0011_provider_name_temp"),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="provider",
-            old_name="name_temp",
-            new_name="name",
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="identifier",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                ],
-                default="verification",
-            ),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together={("identifier", "user")},
-        ),
-        migrations.AddField(
-            model_name="token",
-            name="key",
-            field=models.TextField(default=authentik.core.models.default_token_key),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together=set(),
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_co_key_e45007_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
-        ),
-        migrations.RunPython(
-            code=set_default_token_key,
-        ),
-        migrations.RemoveField(
-            model_name="application",
-            name="meta_icon_url",
-        ),
-        migrations.AddField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
-        ),
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_key_e45007_idx",
-        ),
-        migrations.RemoveIndex(
-            model_name="token",
-            name="authentik_co_identif_1a34a8_idx",
-        ),
-        migrations.RenameField(
-            model_name="user",
-            old_name="pb_groups",
-            new_name="ak_groups",
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
-        ),
-        migrations.AddIndex(
-            model_name="token",
-            index=models.Index(fields=["key"], name="authentik_c_key_f71355_idx"),
-        ),
-    ]

authentik/core/migrations/0014_auto_20201018_1158.py

@@ -42,7 +42,9 @@ class Migration(migrations.Migration):
         ),
         migrations.AddIndex(
             model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_co_identif_1a34a8_idx"),
+            index=models.Index(
+                fields=["identifier"], name="authentik_co_identif_1a34a8_idx"
+            ),
         ),
         migrations.RunPython(set_default_token_key),
     ]

authentik/core/migrations/0015_application_icon.py

@@ -17,6 +17,8 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name="application",
             name="meta_icon",
-            field=models.FileField(blank=True, default="", upload_to="application-icons/"),
+            field=models.FileField(
+                blank=True, default="", upload_to="application-icons/"
+            ),
         ),
     ]

authentik/core/migrations/0016_auto_20201202_2234.py

@@ -25,7 +25,9 @@ class Migration(migrations.Migration):
         ),
         migrations.AddIndex(
             model_name="token",
-            index=models.Index(fields=["identifier"], name="authentik_c_identif_d9d032_idx"),
+            index=models.Index(
+                fields=["identifier"], name="authentik_c_identif_d9d032_idx"
+            ),
         ),
         migrations.AddIndex(
             model_name="token",

authentik/core/migrations/0018_auto_20210330_1345_squashed_0028_alter_token_intent.py

@@ -1,209 +0,0 @@
-# Generated by Django 3.2.8 on 2021-10-10 16:12
-
-import uuid
-from os import environ
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-from django.db.models import Count
-
-import authentik.core.models
-import authentik.lib.models
-
-
-def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from django.contrib.sessions.backends.cache import KEY_PREFIX
-    from django.core.cache import cache
-
-    session_keys = cache.keys(KEY_PREFIX + "*")
-    cache.delete_many(session_keys)
-
-
-def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "token")
-    identifiers = (
-        Token.objects.using(db_alias)
-        .values("identifier")
-        .annotate(identifier_count=Count("identifier"))
-        .filter(identifier_count__gt=1)
-    )
-    for ident in identifiers:
-        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
-
-
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import Token, TokenIntents, User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    if "AK_ADMIN_TOKEN" not in environ:
-        return
-    Token.objects.using(db_alias).create(
-        identifier="authentik-boostrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=environ["AK_ADMIN_TOKEN"],
-    )
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_core", "0018_auto_20210330_1345"),
-        ("authentik_core", "0019_source_managed"),
-        ("authentik_core", "0020_source_user_matching_mode"),
-        ("authentik_core", "0021_alter_application_slug"),
-        ("authentik_core", "0022_authenticatedsession"),
-        ("authentik_core", "0023_alter_application_meta_launch_url"),
-        ("authentik_core", "0024_alter_token_identifier"),
-        ("authentik_core", "0025_alter_application_meta_icon"),
-        ("authentik_core", "0026_alter_application_meta_icon"),
-        ("authentik_core", "0027_bootstrap_token"),
-        ("authentik_core", "0028_alter_token_intent"),
-    ]
-
-    dependencies = [
-        ("authentik_core", "0017_managed"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="token",
-            options={
-                "permissions": (("view_token_key", "View token's key"),),
-                "verbose_name": "Token",
-                "verbose_name_plural": "Tokens",
-            },
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="managed",
-            field=models.TextField(
-                default=None,
-                help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
-                null=True,
-                unique=True,
-                verbose_name="Managed by authentik",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="user_matching_mode",
-            field=models.TextField(
-                choices=[
-                    ("identifier", "Use the source-specific identifier"),
-                    (
-                        "email_link",
-                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
-                    ),
-                    (
-                        "email_deny",
-                        "Use the user's email address, but deny enrollment when the email address already exists.",
-                    ),
-                    (
-                        "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
-                    ),
-                    (
-                        "username_deny",
-                        "Use the user's username, but deny enrollment when the username already exists.",
-                    ),
-                ],
-                default="identifier",
-                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
-            ),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="slug",
-            field=models.SlugField(
-                help_text="Internal application name, used in URLs.", unique=True
-            ),
-        ),
-        migrations.CreateModel(
-            name="AuthenticatedSession",
-            fields=[
-                (
-                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
-                ),
-                ("expiring", models.BooleanField(default=True)),
-                ("uuid", models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False)),
-                ("session_key", models.CharField(max_length=40)),
-                ("last_ip", models.TextField()),
-                ("last_user_agent", models.TextField(blank=True)),
-                ("last_used", models.DateTimeField(auto_now=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to=settings.AUTH_USER_MODEL
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-            },
-        ),
-        migrations.RunPython(
-            code=migrate_sessions,
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_launch_url",
-            field=models.TextField(
-                blank=True, default="", validators=[authentik.lib.models.DomainlessURLValidator()]
-            ),
-        ),
-        migrations.RunPython(
-            code=fix_duplicates,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255, unique=True),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
-        ),
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(
-                default=None, max_length=500, null=True, upload_to="application-icons/"
-            ),
-        ),
-        migrations.AlterModelOptions(
-            name="authenticatedsession",
-            options={
-                "verbose_name": "Authenticated Session",
-                "verbose_name_plural": "Authenticated Sessions",
-            },
-        ),
-        migrations.RunPython(
-            code=create_default_user_token,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                    ("app_password", "Intent App Password"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]

authentik/core/migrations/0019_application_group.py

@@ -1,18 +0,0 @@
-# Generated by Django 4.0.3 on 2022-04-02 19:48
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0018_auto_20210330_1345_squashed_0028_alter_token_intent"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="application",
-            name="group",
-            field=models.TextField(blank=True, default=""),
-        ),
-    ]

authentik/core/migrations/0020_source_user_matching_mode.py

@@ -1,40 +0,0 @@
-# Generated by Django 3.2 on 2021-05-03 17:06
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0019_source_managed"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="source",
-            name="user_matching_mode",
-            field=models.TextField(
-                choices=[
-                    ("identifier", "Use the source-specific identifier"),
-                    (
-                        "email_link",
-                        "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses.",
-                    ),
-                    (
-                        "email_deny",
-                        "Use the user's email address, but deny enrollment when the email address already exists.",
-                    ),
-                    (
-                        "username_link",
-                        "Link to a user with identical username. Can have security implications when a username is used with another source.",
-                    ),
-                    (
-                        "username_deny",
-                        "Use the user's username, but deny enrollment when the username already exists.",
-                    ),
-                ],
-                default="identifier",
-                help_text="How the source determines if an existing user should be authenticated or a new user enrolled.",
-            ),
-        ),
-    ]

authentik/core/migrations/0021_alter_application_slug.py

@@ -1,20 +0,0 @@
-# Generated by Django 3.2.3 on 2021-05-14 08:48
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0020_source_user_matching_mode"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="slug",
-            field=models.SlugField(
-                help_text="Internal application name, used in URLs.", unique=True
-            ),
-        ),
-    ]

authentik/core/migrations/0022_authenticatedsession.py

@@ -1,58 +0,0 @@
-# Generated by Django 3.2.3 on 2021-05-29 22:14
-
-import uuid
-
-import django.db.models.deletion
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def migrate_sessions(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    from django.contrib.sessions.backends.cache import KEY_PREFIX
-    from django.core.cache import cache
-
-    session_keys = cache.keys(KEY_PREFIX + "*")
-    cache.delete_many(session_keys)
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0021_alter_application_slug"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="AuthenticatedSession",
-            fields=[
-                (
-                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
-                ),
-                ("expiring", models.BooleanField(default=True)),
-                (
-                    "uuid",
-                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
-                ),
-                ("session_key", models.CharField(max_length=40)),
-                ("last_ip", models.TextField()),
-                ("last_user_agent", models.TextField(blank=True)),
-                ("last_used", models.DateTimeField(auto_now=True)),
-                (
-                    "user",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to=settings.AUTH_USER_MODEL,
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-            },
-        ),
-        migrations.RunPython(migrate_sessions),
-    ]

authentik/core/migrations/0023_alter_application_meta_launch_url.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-02 21:51
-
-from django.db import migrations, models
-
-import authentik.lib.models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0022_authenticatedsession"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_launch_url",
-            field=models.TextField(
-                blank=True,
-                default="",
-                validators=[authentik.lib.models.DomainlessURLValidator()],
-            ),
-        ),
-    ]

authentik/core/migrations/0024_alter_token_identifier.py

@@ -1,35 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-03 09:33
-
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-from django.db.models import Count
-
-
-def fix_duplicates(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Token = apps.get_model("authentik_core", "token")
-    identifiers = (
-        Token.objects.using(db_alias)
-        .values("identifier")
-        .annotate(identifier_count=Count("identifier"))
-        .filter(identifier_count__gt=1)
-    )
-    for ident in identifiers:
-        Token.objects.using(db_alias).filter(identifier=ident["identifier"]).delete()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0023_alter_application_meta_launch_url"),
-    ]
-
-    operations = [
-        migrations.RunPython(fix_duplicates),
-        migrations.AlterField(
-            model_name="token",
-            name="identifier",
-            field=models.SlugField(max_length=255, unique=True),
-        ),
-    ]

authentik/core/migrations/0025_alter_application_meta_icon.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.2.3 on 2021-06-05 19:04
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0024_alter_token_identifier"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(default=None, null=True, upload_to="application-icons/"),
-        ),
-    ]

authentik/core/migrations/0026_alter_application_meta_icon.py

@@ -1,27 +0,0 @@
-# Generated by Django 3.2.5 on 2021-07-09 17:27
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0025_alter_application_meta_icon"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="application",
-            name="meta_icon",
-            field=models.FileField(
-                default=None, max_length=500, null=True, upload_to="application-icons/"
-            ),
-        ),
-        migrations.AlterModelOptions(
-            name="authenticatedsession",
-            options={
-                "verbose_name": "Authenticated Session",
-                "verbose_name_plural": "Authenticated Sessions",
-            },
-        ),
-    ]

authentik/core/migrations/0027_bootstrap_token.py

@@ -1,37 +0,0 @@
-# Generated by Django 3.2.5 on 2021-08-11 19:40
-from os import environ
-
-from django.apps.registry import Apps
-from django.db import migrations
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def create_default_user_token(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import Token, TokenIntents, User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin = User.objects.using(db_alias).filter(username="akadmin")
-    if not akadmin.exists():
-        return
-    if "AK_ADMIN_TOKEN" not in environ:
-        return
-    Token.objects.using(db_alias).create(
-        identifier="authentik-boostrap-token",
-        user=akadmin.first(),
-        intent=TokenIntents.INTENT_API,
-        expiring=False,
-        key=environ["AK_ADMIN_TOKEN"],
-    )
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0026_alter_application_meta_icon"),
-    ]
-
-    operations = [
-        migrations.RunPython(create_default_user_token),
-    ]

authentik/core/migrations/0028_alter_token_intent.py

@@ -1,26 +0,0 @@
-# Generated by Django 3.2.6 on 2021-08-23 14:35
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0027_bootstrap_token"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                    ("app_password", "Intent App Password"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]