release: 2022.10.4

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

.bumpversion.cfg

@@ -1,32 +1,20 @@
 [bumpversion]
-current_version = 2022.5.3
+current_version = 2022.10.4
 tag = True
 commit = True
-parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)\-?(?P<release>.*)
+parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)
-serialize = 
+serialize = {major}.{minor}.{patch}
-	{major}.{minor}.{patch}-{release}
-	{major}.{minor}.{patch}
 message = release: {new_version}
 tag_name = version/{new_version}
 
-[bumpversion:part:release]
-optional_value = stable
-first_value = beta
-values = 
-	alpha
-	beta
-	stable
-
 [bumpversion:file:pyproject.toml]
 
 [bumpversion:file:docker-compose.yml]
 
 [bumpversion:file:schema.yml]
 
-[bumpversion:file:.github/workflows/release-publish.yml]
-
 [bumpversion:file:authentik/__init__.py]
 
 [bumpversion:file:internal/constants/constants.go]
 
-[bumpversion:file:web/src/constants.ts]
+[bumpversion:file:web/src/common/constants.ts]

.github/actions/comment-pr-instructions/action.yml

@@ -0,0 +1,59 @@
+name: 'Comment usage instructions on PRs'
+description: 'Comment usage instructions on PRs'
+
+inputs:
+  tag:
+    description: "Image tag to pull"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate config
+      id: ev
+      uses: ./.github/actions/docker-push-variables
+    - name: Find Comment
+      uses: peter-evans/find-comment@v2
+      id: fc
+      with:
+        issue-number: ${{ github.event.pull_request.number }}
+        comment-author: 'github-actions[bot]'
+        body-includes: authentik PR Installation instructions
+    - name: Create or update comment
+      uses: peter-evans/create-or-update-comment@v2
+      with:
+        comment-id: ${{ steps.fc.outputs.comment-id }}
+        issue-number: ${{ github.event.pull_request.number }}
+        body: |
+          authentik PR Installation instructions
+
+          <details>
+            <summary>Instructions for docker-compose</summary>
+
+            Add the following block to your `.env` file:
+
+            ```shell
+            AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
+            AUTHENTIK_TAG=${{ inputs.tag }}
+            AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
+            ```
+
+            Afterwards, run the upgrade commands from the latest release notes.
+          </details>
+          <details>
+            <summary>Instructions for Kubernetes</summary>
+
+            Add the following block to your `values.yml` file:
+
+            ```yaml
+            authentik:
+                outposts:
+                    container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
+            image:
+                repository: ghcr.io/goauthentik/dev-server
+                tag: ${{ inputs.tag }}
+            ```
+
+            Afterwards, run the upgrade commands from the latest release notes.
+          </details>
+        edit-mode: replace

.github/actions/docker-push-variables/action.yml

@@ -0,0 +1,58 @@
+name: 'Prepare docker environment variables'
+description: 'Prepare docker environment variables'
+
+outputs:
+  shouldBuild:
+    description: "Whether to build image or not"
+    value: ${{ steps.ev.outputs.shouldBuild }}
+  branchName:
+    description: "Branch name"
+    value: ${{ steps.ev.outputs.branchName }}
+  branchNameContainer:
+    description: "Branch name (for containers)"
+    value: ${{ steps.ev.outputs.branchNameContainer }}
+  timestamp:
+    description: "Timestamp"
+    value: ${{ steps.ev.outputs.timestamp }}
+  sha:
+    description: "sha"
+    value: ${{ steps.ev.outputs.sha }}
+  version:
+    description: "version"
+    value: ${{ steps.ev.outputs.version }}
+  versionFamily:
+    description: "versionFamily"
+    value: ${{ steps.ev.outputs.versionFamily }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate config
+      id: ev
+      shell: python
+      run: |
+        """Helper script to get the actual branch name, docker safe"""
+        import configparser
+        import os
+        from time import time
+
+        parser = configparser.ConfigParser()
+        parser.read(".bumpversion.cfg")
+
+        branch_name = os.environ["GITHUB_REF"]
+        if os.environ.get("GITHUB_HEAD_REF", "") != "":
+            branch_name = os.environ["GITHUB_HEAD_REF"]
+
+        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
+        version = parser.get("bumpversion", "current_version")
+        version_family = ".".join(version.split(".")[:-1])
+        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+            print("branchName=%s" % branch_name, file=_output)
+            print("branchNameContainer=%s" % safe_branch_name, file=_output)
+            print("timestamp=%s" % int(time()), file=_output)
+            print("sha=%s" % os.environ["GITHUB_SHA"], file=_output)
+            print("shouldBuild=%s" % should_build, file=_output)
+            print("version=%s" % version, file=_output)
+            print("versionFamily=%s" % version_family, file=_output)

.github/actions/docker-setup/action.yml

@@ -1,49 +0,0 @@
-name: 'Prepare docker environment variables'
-description: 'Prepare docker environment variables'
-
-outputs:
-  shouldBuild:
-    description: "Whether to build image or not"
-    value: ${{ steps.ev.outputs.shouldBuild }}
-  branchName:
-    description: "Branch name"
-    value: ${{ steps.ev.outputs.branchName }}
-  branchNameContainer:
-    description: "Branch name (for containers)"
-    value: ${{ steps.ev.outputs.branchNameContainer }}
-  timestamp:
-    description: "Timestamp"
-    value: ${{ steps.ev.outputs.timestamp }}
-  sha:
-    description: "sha"
-    value: ${{ steps.ev.outputs.sha }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate config
-      id: ev
-      shell: python
-      run: |
-        """Helper script to get the actual branch name, docker safe"""
-        import os
-        from time import time
-
-        env_pr_branch = "GITHUB_HEAD_REF"
-        default_branch = "GITHUB_REF"
-        sha = "GITHUB_SHA"
-
-        branch_name = os.environ[default_branch]
-        if os.environ.get(env_pr_branch, "") != "":
-            branch_name = os.environ[env_pr_branch]
-
-        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
-
-        print("##[set-output name=branchName]%s" % branch_name)
-        print(
-            "##[set-output name=branchNameContainer]%s"
-            % branch_name.replace("refs/heads/", "").replace("/", "-")
-        )
-        print("##[set-output name=timestamp]%s" % int(time()))
-        print("##[set-output name=sha]%s" % os.environ[sha])
-        print("##[set-output name=shouldBuild]%s" % should_build)

.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
-name: 'Setup authentik testing environemnt'
+name: 'Setup authentik testing environment'
-description: 'Setup authentik testing environemnt'
+description: 'Setup authentik testing environment'
 
 runs:
   using: "composite"
@@ -27,7 +27,7 @@ runs:
         docker-compose -f .github/actions/setup/docker-compose.yml up -d
         poetry env use python3.10
         poetry install
-        npm install -g pyright@1.1.136
+        cd web && npm ci
     - name: Generate config
       shell: poetry run python {0}
       run: |

.github/codespell-words.txt

@@ -1,3 +1,4 @@
 keypair
 keypairs
 hass
+warmup

.github/dependabot.yml

@@ -1,50 +1,62 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
+    - package-ecosystem: "github-actions"
       directory: "/"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
-- package-ecosystem: gomod
+      commit-message:
+          prefix: "ci:"
+    - package-ecosystem: gomod
       directory: "/"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
-- package-ecosystem: npm
+      commit-message:
+          prefix: "core:"
+    - package-ecosystem: npm
       directory: "/web"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
-- package-ecosystem: npm
+      commit-message:
+          prefix: "web:"
+    - package-ecosystem: npm
       directory: "/website"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
-- package-ecosystem: pip
+      commit-message:
+          prefix: "website:"
+    - package-ecosystem: pip
       directory: "/"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
-- package-ecosystem: docker
+      commit-message:
+          prefix: "core:"
+    - package-ecosystem: docker
       directory: "/"
       schedule:
           interval: daily
           time: "04:00"
       open-pull-requests-limit: 10
-  assignees:
+      reviewers:
-  - BeryJu
+          - "@goauthentik/core"
+      commit-message:
+          prefix: "core:"

.github/pull_request_template.md

@@ -1,7 +1,7 @@
 <!--
 👋 Hello there! Welcome.
 
-Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/master/CONTRIBUTING.md#how-can-i-contribute).
+Please check the [Contributing guidelines](https://github.com/goauthentik/authentik/blob/main/CONTRIBUTING.md#how-can-i-contribute).
 -->
 
 # Details

.github/transifex.yml

@@ -0,0 +1,16 @@
+git:
+  filters:
+    - filter_type: file
+      # all supported i18n types: https://docs.transifex.com/formats
+      file_format: PO
+      source_language: en
+      source_file: web/src/locales/en.po
+      # path expression to translation files, must contain <lang> placeholder
+      translation_files_expression: 'web/src/locales/<lang>.po'
+    - filter_type: file
+      # all supported i18n types: https://docs.transifex.com/formats
+      file_format: PO
+      source_language: en
+      source_file: locale/en/LC_MESSAGES/django.po
+      # path expression to translation files, must contain <lang> placeholder
+      translation_files_expression: 'locale/<lang>/LC_MESSAGES/django.po'

.github/workflows/ci-main.yml

@@ -3,14 +3,14 @@ name: authentik-ci-main
 on:
   push:
     branches:
-      - master
+      - main
       - next
       - version-*
     paths-ignore:
       - website
   pull_request:
     branches:
-      - master
+      - main
 
 env:
   POSTGRES_DB: authentik
@@ -96,6 +96,8 @@ jobs:
           testspace [unittest]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: unit
   test-integration:
     runs-on: ubuntu-latest
     steps:
@@ -106,7 +108,7 @@ jobs:
         with:
           domain: ${{github.repository_owner}}
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.2.0
+        uses: helm/kind-action@v1.4.0
       - name: run integration
         run: |
           poetry run make test-integration
@@ -117,6 +119,8 @@ jobs:
           testspace [integration]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: integration
   test-e2e-provider:
     runs-on: ubuntu-latest
     steps:
@@ -126,19 +130,20 @@ jobs:
       - uses: testspace-com/setup-testspace@v1
         with:
           domain: ${{github.repository_owner}}
-      - name: Setup authentik env
+      - name: Setup e2e env (chrome, etc)
         run: |
           docker-compose -f tests/e2e/docker-compose.yml up -d
       - id: cache-web
         uses: actions/cache@v3
         with:
           path: web/dist
-          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/**') }}
+          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/src/**') }}
       - name: prepare web ui
         if: steps.cache-web.outputs.cache-hit != 'true'
         working-directory: web
         run: |
           npm ci
+          make -C .. gen-client-ts
           npm run build
       - name: run e2e
         run: |
@@ -150,6 +155,8 @@ jobs:
           testspace [e2e-provider]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: e2e
   test-e2e-rest:
     runs-on: ubuntu-latest
     steps:
@@ -159,19 +166,20 @@ jobs:
       - uses: testspace-com/setup-testspace@v1
         with:
           domain: ${{github.repository_owner}}
-      - name: Setup authentik env
+      - name: Setup e2e env (chrome, etc)
         run: |
           docker-compose -f tests/e2e/docker-compose.yml up -d
       - id: cache-web
         uses: actions/cache@v3
         with:
           path: web/dist
-          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/**') }}
+          key: ${{ runner.os }}-web-${{ hashFiles('web/package-lock.json', 'web/src/**') }}
       - name: prepare web ui
         if: steps.cache-web.outputs.cache-hit != 'true'
         working-directory: web/
         run: |
           npm ci
+          make -C .. gen-client-ts
           npm run build
       - name: run e2e
         run: |
@@ -183,6 +191,8 @@ jobs:
           testspace [e2e-rest]unittest.xml --link=codecov
       - if: ${{ always() }}
         uses: codecov/codecov-action@v3
+        with:
+          flags: e2e
   ci-core-mark:
     needs:
       - lint
@@ -207,14 +217,14 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        uses: ./.github/actions/docker-setup
       - name: Login to Container Registry
         uses: docker/login-action@v2
         if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
@@ -231,4 +241,11 @@ jobs:
             ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: ${{ matrix.arch }}
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        continue-on-error: true
+        uses: ./.github/actions/comment-pr-instructions
+        with:
+          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.sha }}

.github/workflows/ci-outpost.yml

@@ -3,12 +3,12 @@ name: authentik-ci-outpost
 on:
   push:
     branches:
-      - master
+      - main
       - next
       - version-*
   pull_request:
     branches:
-      - master
+      - main
 
 jobs:
   lint-golint:
@@ -63,12 +63,12 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
         id: ev
-        uses: ./.github/actions/docker-setup
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
       - name: Login to Container Registry
@@ -91,6 +91,7 @@ jobs:
           file: ${{ matrix.type }}.Dockerfile
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: ${{ matrix.arch }}
   build-outpost-binary:
     timeout-minutes: 120
@@ -110,7 +111,7 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: "^1.17"
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/ci-web.yml

@@ -3,19 +3,19 @@ name: authentik-ci-web
 on:
   push:
     branches:
-      - master
+      - main
       - next
       - version-*
   pull_request:
     branches:
-      - master
+      - main
 
 jobs:
   lint-eslint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -23,7 +23,7 @@ jobs:
       - working-directory: web/
         run: npm ci
       - name: Generate API
-        run: make gen-client-web
+        run: make gen-client-ts
       - name: Eslint
         working-directory: web/
         run: npm run lint
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -39,7 +39,7 @@ jobs:
       - working-directory: web/
         run: npm ci
       - name: Generate API
-        run: make gen-client-web
+        run: make gen-client-ts
       - name: prettier
         working-directory: web/
         run: npm run prettier-check
@@ -47,15 +47,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
           cache-dependency-path: web/package-lock.json
       - working-directory: web/
-        run: npm ci
+        run: |
+          npm ci
+          # lit-analyse doesn't understand path rewrites, so make it
+          # belive it's an actual module
+          cd node_modules/@goauthentik
+          ln -s ../../src/ web
       - name: Generate API
-        run: make gen-client-web
+        run: make gen-client-ts
       - name: lit-analyse
         working-directory: web/
         run: npm run lit-analyse
@@ -73,7 +78,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -81,7 +86,7 @@ jobs:
       - working-directory: web/
         run: npm ci
       - name: Generate API
-        run: make gen-client-web
+        run: make gen-client-ts
       - name: build
         working-directory: web/
         run: npm run build

.github/workflows/ci-website.yml

@@ -3,19 +3,19 @@ name: authentik-ci-website
 on:
   push:
     branches:
-      - master
+      - main
       - next
       - version-*
   pull_request:
     branches:
-      - master
+      - main
 
 jobs:
   lint-prettier:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'

.github/workflows/codeql-analysis.yml

@@ -2,10 +2,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master, '*', next, version* ]
+    branches: [ main, '*', next, version* ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
   schedule:
     - cron: '30 6 * * 5'
 

.github/workflows/ghcr-retention.yml

@@ -19,4 +19,4 @@ jobs:
           org-name: goauthentik
           untagged-only: false
           token: ${{ secrets.GHCR_CLEANUP_TOKEN }}
-          skip-tags: gh-next,gh-master
+          skip-tags: gh-next,gh-main

.github/workflows/release-publish.yml

@@ -5,15 +5,17 @@ on:
     types: [published, created]
 
 jobs:
-  # Build
   build-server:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
+      - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
+        id: ev
       - name: Docker Login Registry
         uses: docker/login-action@v2
         with:
@@ -30,9 +32,11 @@ jobs:
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
-            beryju/authentik:2022.5.3,
+            beryju/authentik:${{ steps.ev.outputs.version }},
+            beryju/authentik:${{ steps.ev.outputs.versionFamily }},
             beryju/authentik:latest,
-            ghcr.io/goauthentik/server:2022.5.3,
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.versionFamily }},
             ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
           context: .
@@ -50,9 +54,12 @@ jobs:
         with:
           go-version: "^1.17"
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2.0.0
+        uses: docker/setup-qemu-action@v2.1.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
+      - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
+        id: ev
       - name: Docker Login Registry
         uses: docker/login-action@v2
         with:
@@ -69,9 +76,11 @@ jobs:
         with:
           push: ${{ github.event_name == 'release' }}
           tags: |
-            beryju/authentik-${{ matrix.type }}:2022.5.3,
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
             beryju/authentik-${{ matrix.type }}:latest,
-            ghcr.io/goauthentik/${{ matrix.type }}:2022.5.3,
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
             ghcr.io/goauthentik/${{ matrix.type }}:latest
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -91,7 +100,7 @@ jobs:
       - uses: actions/setup-go@v3
         with:
           go-version: "^1.17"
-      - uses: actions/setup-node@v3.2.0
+      - uses: actions/setup-node@v3.5.1
         with:
           node-version: '16'
           cache: 'npm'
@@ -129,7 +138,7 @@ jobs:
           docker-compose pull -q
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root server test
+          docker-compose run -u root server test-all
   sentry-release:
     needs:
       - build-server
@@ -138,6 +147,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
+        id: ev
       - name: Get static files from docker image
         run: |
           docker pull ghcr.io/goauthentik/server:latest
@@ -145,6 +157,7 @@ jobs:
           docker cp ${container}:web/ .
       - name: Create a Sentry.io release
         uses: getsentry/action-release@v1
+        continue-on-error: true
         if: ${{ github.event_name == 'release' }}
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
@@ -152,7 +165,7 @@ jobs:
           SENTRY_PROJECT: authentik
           SENTRY_URL: https://sentry.beryju.org
         with:
-          version: authentik@2022.5.3
+          version: authentik@${{ steps.ev.outputs.version }}
           environment: beryjuorg-prod
           sourcemaps: './web/dist'
           url_prefix: '~/static/dist'

.github/workflows/release-tag.yml

@@ -16,15 +16,12 @@ jobs:
           echo "PG_PASS=$(openssl rand -base64 32)" >> .env
           echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 32)" >> .env
           docker buildx install
-          docker build \
+          docker build -t testing:latest .
-            --no-cache \
-            -t testing:latest \
-            -f Dockerfile .
           echo "AUTHENTIK_IMAGE=testing" >> .env
           echo "AUTHENTIK_TAG=latest" >> .env
           docker-compose up --no-start
           docker-compose start postgresql redis
-          docker-compose run -u root server test
+          docker-compose run -u root server test-all
       - name: Extract version number
         id: get_version
         uses: actions/github-script@v6

.github/workflows/translation-compile.yml

@@ -1,7 +1,7 @@
 name: authentik-backend-translate-compile
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
     paths:
       - '/locale/'
   pull_request:

.github/workflows/web-api-publish.yml

@@ -1,7 +1,7 @@
 name: authentik-web-api-publish
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
     paths:
       - 'schema.yml'
   workflow_dispatch:
@@ -10,13 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      # Setup .npmrc file to publish to npm
+      - uses: actions/setup-node@v3.5.1
-      - uses: actions/setup-node@v3.2.0
         with:
           node-version: '16'
           registry-url: 'https://registry.npmjs.org'
       - name: Generate API Client
-        run: make gen-client-web
+        run: make gen-client-ts
       - name: Publish package
         working-directory: gen-ts-api/
         run: |
@@ -35,8 +34,8 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           branch: update-web-api-client
-          commit-message: "web: Update Web API Client version"
+          commit-message: "web: bump API Client version"
-          title: "web: Update Web API Client version"
+          title: "web: bump API Client version"
-          body: "web: Update Web API Client version"
+          body: "web: bump API Client version"
           delete-branch: true
           signoff: true

.gitignore

@@ -193,7 +193,6 @@ pip-selfcheck.json
 # End of https://www.gitignore.io/api/python,django
 /static/
 local.env.yml
-.vscode/
 
 # Selenium Screenshots
 selenium_screenshots/

.vscode/settings.json

@@ -1,5 +1,6 @@
 {
     "cSpell.words": [
+        "akadmin",
         "asgi",
         "authentik",
         "authn",
@@ -19,7 +20,15 @@
     "todo-tree.tree.showCountsInTree": true,
     "todo-tree.tree.showBadges": true,
     "python.formatting.provider": "black",
-    "files.associations": {
+    "yaml.customTags": [
-        "*.akflow": "json"
+        "!Find sequence",
+        "!KeyOf scalar"
+    ],
+    "typescript.preferences.importModuleSpecifier": "non-relative",
+    "typescript.preferences.importModuleSpecifierEnding": "index",
+    "typescript.tsdk": "./web/node_modules/typescript/lib",
+    "typescript.enablePromptUseWorkspaceTsdk": true,
+    "yaml.schemas": {
+        "./blueprints/schema.json": "blueprints/**/*.yaml"
     }
 }

.vscode/tasks.json

@@ -0,0 +1,86 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "authentik[core]: format & test",
+            "command": "poetry",
+            "args": [
+                "run",
+                "make"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "authentik[core]: run",
+            "command": "poetry",
+            "args": [
+                "run",
+                "make",
+                "run",
+            ],
+            "group": "build",
+            "presentation": {
+                "panel": "dedicated",
+                "group": "running"
+            },
+        },
+        {
+            "label": "authentik[web]: format",
+            "command": "make",
+            "args": ["web"],
+            "group": "build",
+        },
+        {
+            "label": "authentik[web]: watch",
+            "command": "make",
+            "args": ["web-watch"],
+            "group": "build",
+            "presentation": {
+                "panel": "dedicated",
+                "group": "running"
+            },
+        },
+        {
+            "label": "authentik: install",
+            "command": "make",
+            "args": ["install"],
+            "group": "build",
+        },
+        {
+            "label": "authentik: i18n-extract",
+            "command": "poetry",
+            "args": [
+                "run",
+                "make",
+                "i18n-extract"
+            ],
+            "group": "build",
+        },
+        {
+            "label": "authentik[website]: format",
+            "command": "make",
+            "args": ["website"],
+            "group": "build",
+        },
+        {
+            "label": "authentik[website]: watch",
+            "command": "make",
+            "args": ["website-watch"],
+            "group": "build",
+            "presentation": {
+                "panel": "dedicated",
+                "group": "running"
+            },
+        },
+        {
+            "label": "authentik[api]: generate",
+            "command": "poetry",
+            "args": [
+                "run",
+                "make",
+                "gen"
+            ],
+            "group": "build"
+        },
+    ]
+}

CODE_OF_CONDUCT.md

@@ -17,23 +17,23 @@ diverse, inclusive, and healthy community.
 Examples of behavior that contributes to a positive environment for our
 community include:
 
-* Demonstrating empathy and kindness toward other people
+-   Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
+-   Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
+-   Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
+-   Accepting responsibility and apologizing to those affected by our mistakes,
     and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
+-   Focusing on what is best not just for us as individuals, but for the
     overall community
 
 Examples of unacceptable behavior include:
 
-* The use of sexualized language or imagery, and sexual attention or
+-   The use of sexualized language or imagery, and sexual attention or
     advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
+-   Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
+-   Public or private harassment
-* Publishing others' private information, such as a physical or email
+-   Publishing others' private information, such as a physical or email
     address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
+-   Other conduct which could reasonably be considered inappropriate in a
     professional setting
 
 ## Enforcement Responsibilities
@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported to the community leaders responsible for enforcement at
-hello@beryju.org.
+hello@goauthentik.io.
 All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the

CONTRIBUTING.md

@@ -11,19 +11,22 @@ The following is a set of guidelines for contributing to authentik and its compo
 [I don't want to read this whole thing, I just have a question!!!](#i-dont-want-to-read-this-whole-thing-i-just-have-a-question)
 
 [What should I know before I get started?](#what-should-i-know-before-i-get-started)
-  * [The components](#the-components)
+
-  * [authentik's structure](#authentiks-structure)
+-   [The components](#the-components)
+-   [authentik's structure](#authentiks-structure)
 
 [How Can I Contribute?](#how-can-i-contribute)
-  * [Reporting Bugs](#reporting-bugs)
+
-  * [Suggesting Enhancements](#suggesting-enhancements)
+-   [Reporting Bugs](#reporting-bugs)
-  * [Your First Code Contribution](#your-first-code-contribution)
+-   [Suggesting Enhancements](#suggesting-enhancements)
-  * [Pull Requests](#pull-requests)
+-   [Your First Code Contribution](#your-first-code-contribution)
+-   [Pull Requests](#pull-requests)
 
 [Styleguides](#styleguides)
-  * [Git Commit Messages](#git-commit-messages)
+
-  * [Python Styleguide](#python-styleguide)
+-   [Git Commit Messages](#git-commit-messages)
-  * [Documentation Styleguide](#documentation-styleguide)
+-   [Python Styleguide](#python-styleguide)
+-   [Documentation Styleguide](#documentation-styleguide)
 
 ## Code of Conduct
 
@@ -39,11 +42,11 @@ Either [create a question on GitHub](https://github.com/goauthentik/authentik/is
 
 authentik consists of a few larger components:
 
-- *authentik* the actual application server, is described below.
+-   _authentik_ the actual application server, is described below.
-- *outpost-proxy* is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
+-   _outpost-proxy_ is a Go application based on a forked version of oauth2_proxy, which does identity-aware reverse proxying.
-- *outpost-ldap* is a Go LDAP server that uses the *authentik* application server as its backend
+-   _outpost-ldap_ is a Go LDAP server that uses the _authentik_ application server as its backend
-- *web* is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
+-   _web_ is the web frontend, both for administrating and using authentik. It is written in TypeScript using lit-html and the PatternFly CSS Library.
-- *website* is the Website/documentation, which uses docusaurus.
+-   _website_ is the Website/documentation, which uses docusaurus.
 
 ### authentik's structure
 
@@ -154,10 +157,10 @@ While the prerequisites above must be satisfied prior to having your pull reques
 
 ### Git Commit Messages
 
-* Use the format of `<package>: <verb> <description>`
+-   Use the format of `<package>: <verb> <description>`
     -   See [here](#authentik-packages) for `package`
     -   Example: `providers/saml2: fix parsing of requests`
-* Reference issues and pull requests liberally after the first line
+-   Reference issues and pull requests liberally after the first line
 
 ### Python Styleguide
 
@@ -165,11 +168,11 @@ All Python code is linted with [black](https://black.readthedocs.io/en/stable/),
 
 authentik runs on Python 3.9 at the time of writing this.
 
-* Use native type-annotations wherever possible.
+-   Use native type-annotations wherever possible.
-* Add meaningful docstrings when possible.
+-   Add meaningful docstrings when possible.
-* Ensure any database migrations work properly from the last stable version (this is checked via CI)
+-   Ensure any database migrations work properly from the last stable version (this is checked via CI)
-* If your code changes central functions, make sure nothing else is broken.
+-   If your code changes central functions, make sure nothing else is broken.
 
 ### Documentation Styleguide
 
-* Use [MDX](https://mdxjs.com/) whenever appropriate.
+-   Use [MDX](https://mdxjs.com/) whenever appropriate.

Dockerfile

@@ -2,6 +2,8 @@
 FROM --platform=${BUILDPLATFORM} docker.io/node:18 as website-builder
 
 COPY ./website /work/website/
+COPY ./blueprints /work/blueprints/
+COPY ./SECURITY.md /work/
 
 ENV NODE_ENV=production
 WORKDIR /work/website
@@ -18,7 +20,7 @@ WORKDIR /work/web
 RUN npm ci && npm run build
 
 # Stage 3: Poetry to requirements.txt export
-FROM docker.io/python:3.10.4-slim-bullseye AS poetry-locker
+FROM docker.io/python:3.10.7-slim-bullseye AS poetry-locker
 
 WORKDIR /work
 COPY ./pyproject.toml /work
@@ -29,7 +31,7 @@ RUN pip install --no-cache-dir poetry && \
     poetry export -f requirements.txt --dev --output requirements-dev.txt
 
 # Stage 4: Build go proxy
-FROM docker.io/golang:1.18.2-bullseye AS builder
+FROM docker.io/golang:1.19.2-bullseye AS go-builder
 
 WORKDIR /work
 
@@ -42,10 +44,10 @@ COPY ./internal /work/internal
 COPY ./go.mod /work/go.mod
 COPY ./go.sum /work/go.sum
 
-RUN go build -o /work/authentik ./cmd/server/main.go
+RUN go build -o /work/authentik ./cmd/server/
 
 # Stage 5: Run
-FROM docker.io/python:3.10.4-slim-bullseye
+FROM docker.io/python:3.10.7-slim-bullseye AS final-image
 
 LABEL org.opencontainers.image.url https://goauthentik.io
 LABEL org.opencontainers.image.description goauthentik.io Main server image, see https://goauthentik.io for more info.
@@ -72,7 +74,7 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
-    mkdir -p /certs /media && \
+    mkdir -p /certs /media /blueprints && \
     mkdir -p /authentik/.ssh && \
     chown authentik:authentik /certs /media /authentik/.ssh
 
@@ -81,13 +83,14 @@ COPY ./pyproject.toml /
 COPY ./xml /xml
 COPY ./tests /tests
 COPY ./manage.py /
+COPY ./blueprints /blueprints
 COPY ./lifecycle/ /lifecycle
-COPY --from=builder /work/authentik /authentik-proxy
+COPY --from=go-builder /work/authentik /authentik-proxy
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
 COPY --from=website-builder /work/website/help/ /website/help/
 
-USER authentik
+USER 1000
 
 ENV TMPDIR /dev/shm/
 ENV PYTHONUNBUFFERED 1
@@ -95,4 +98,4 @@ ENV PATH "/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin
 
 HEALTHCHECK --interval=30s --timeout=30s --start-period=60s --retries=3 CMD [ "/lifecycle/ak", "healthcheck" ]
 
-ENTRYPOINT [ "/lifecycle/ak" ]
+ENTRYPOINT [ "/usr/local/bin/dumb-init", "--", "/lifecycle/ak" ]

Makefile

@@ -28,13 +28,13 @@ test-docker:
 	rm -f .env
 
 test:
-	coverage run manage.py test authentik
+	coverage run manage.py test --keepdb authentik
 	coverage html
 	coverage report
 
 lint-fix:
-	isort authentik tests lifecycle
+	isort authentik tests scripts lifecycle
-	black authentik tests lifecycle
+	black authentik tests scripts lifecycle
 	codespell -I .github/codespell-words.txt -S 'web/src/locales/**' -w \
 		authentik \
 		internal \
@@ -45,33 +45,56 @@ lint-fix:
 		website/developer-docs
 
 lint:
-	bandit -r authentik tests lifecycle -x node_modules
 	pylint authentik tests lifecycle
+	bandit -r authentik tests lifecycle -x node_modules
 	golangci-lint run -v
 
+migrate:
+	python -m lifecycle.migrate
+
+run:
+	go run -v ./cmd/server/
+
 i18n-extract: i18n-extract-core web-extract
 
 i18n-extract-core:
-	./manage.py makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
+	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
+
+#########################
+## API Schema
+#########################
 
 gen-build:
-	./manage.py spectacular --file schema.yml
+	AUTHENTIK_DEBUG=true ak make_blueprint_schema > blueprints/schema.json
+	AUTHENTIK_DEBUG=true ak spectacular --file schema.yml
+
+gen-diff:
+	git show $(shell git tag -l | tail -n 1):schema.yml > old_schema.yml
+	docker run \
+		--rm -v ${PWD}:/local \
+		--user ${UID}:${GID} \
+		docker.io/openapitools/openapi-diff:2.1.0-beta.3 \
+		--markdown /local/diff.md \
+		/local/old_schema.yml /local/schema.yml
+	rm old_schema.yml
 
 gen-clean:
 	rm -rf web/api/src/
 	rm -rf api/
 
-gen-client-web:
+gen-client-ts:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		openapitools/openapi-generator-cli:v6.0.0 generate \
+		docker.io/openapitools/openapi-generator-cli:v6.0.0 generate \
 		-i /local/schema.yml \
 		-g typescript-fetch \
 		-o /local/gen-ts-api \
-		--additional-properties=typescriptThreePlus=true,supportsES6=true,npmName=@goauthentik/api,npmVersion=${NPM_VERSION}
+		-c /local/scripts/api-ts-config.yaml \
+		--additional-properties=npmVersion=${NPM_VERSION} \
+		--git-repo-id authentik \
+		--git-user-id goauthentik
 	mkdir -p web/node_modules/@goauthentik/api
-	\cp -fv scripts/web_api_readme.md gen-ts-api/README.md
 	cd gen-ts-api && npm i
 	\cp -rfv gen-ts-api/* web/node_modules/@goauthentik/api
 
@@ -83,7 +106,7 @@ gen-client-go:
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		openapitools/openapi-generator-cli:v6.0.0 generate \
+		docker.io/openapitools/openapi-generator-cli:v6.0.0 generate \
 		-i /local/schema.yml \
 		-g go \
 		-o /local/gen-go-api \
@@ -91,24 +114,27 @@ gen-client-go:
 	go mod edit -replace goauthentik.io/api/v3=./gen-go-api
 	rm -rf config.yaml ./templates/
 
-gen: gen-build gen-clean gen-client-web
+gen-dev-config:
+	python -m scripts.generate_config
 
-migrate:
+gen: gen-build gen-clean gen-client-ts
-	python -m lifecycle.migrate
-
-run:
-	go run -v cmd/server/main.go
 
 #########################
 ## Web
 #########################
 
-web: web-lint-fix web-lint web-extract
+web-build: web-install
+	cd web && npm run build
+
+web: web-lint-fix web-lint
 
 web-install:
 	cd web && npm ci
 
 web-watch:
+	rm -rf web/dist/
+	mkdir web/dist/
+	touch web/dist/.gitkeep
 	cd web && npm run watch
 
 web-lint-fix:
@@ -125,7 +151,7 @@ web-extract:
 ## Website
 #########################
 
-website: website-lint-fix
+website: website-lint-fix website-build
 
 website-install:
 	cd website && npm ci
@@ -133,38 +159,45 @@ website-install:
 website-lint-fix:
 	cd website && npm run prettier
 
+website-build:
+	cd website && npm run build
+
 website-watch:
 	cd website && npm run watch
 
 # These targets are use by GitHub actions to allow usage of matrix
 # which makes the YAML File a lot smaller
-
+PY_SOURCES=authentik tests lifecycle
 ci--meta-debug:
 	python -V
 	node --version
 
 ci-pylint: ci--meta-debug
-	pylint authentik tests lifecycle
+	pylint $(PY_SOURCES)
 
 ci-black: ci--meta-debug
-	black --check authentik tests lifecycle
+	black --check $(PY_SOURCES)
 
 ci-isort: ci--meta-debug
-	isort --check authentik tests lifecycle
+	isort --check $(PY_SOURCES)
 
 ci-bandit: ci--meta-debug
-	bandit -r authentik tests lifecycle
+	bandit -r $(PY_SOURCES)
 
 ci-pyright: ci--meta-debug
-	pyright e2e lifecycle
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
 
 ci-pending-migrations: ci--meta-debug
-	./manage.py makemigrations --check
+	ak makemigrations --check
 
 install: web-install website-install
 	poetry install
 
-a: install
+dev-reset:
-	tmux \
+	dropdb -U postgres -h localhost authentik
-		new-session 'make run' \; \
+	createdb -U postgres -h localhost authentik
-		split-window 'make web-watch'
+	redis-cli -n 0 flushall
+	redis-cli -n 1 flushall
+	redis-cli -n 2 flushall
+	redis-cli -n 3 flushall
+	make migrate

README.md

@@ -9,7 +9,7 @@
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-outpost?label=outpost%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-outpost.yml)
 [![GitHub Workflow Status](https://img.shields.io/github/workflow/status/goauthentik/authentik/authentik-ci-web?label=web%20build&style=for-the-badge)](https://github.com/goauthentik/authentik/actions/workflows/ci-web.yml)
 [![Code Coverage](https://img.shields.io/codecov/c/gh/goauthentik/authentik?style=for-the-badge)](https://codecov.io/gh/goauthentik/authentik)
-[![Testspace tests](https://img.shields.io/testspace/total/goauthentik/goauthentik:authentik/master?style=for-the-badge)](https://goauthentik.testspace.com/)
+[![Testspace tests](https://img.shields.io/testspace/total/goauthentik/goauthentik:authentik/main?style=for-the-badge)](https://goauthentik.testspace.com/)
 ![Docker pulls](https://img.shields.io/docker/pulls/beryju/authentik.svg?style=for-the-badge)
 ![Latest version](https://img.shields.io/docker/v/beryju/authentik?sort=semver&style=for-the-badge)
 [![](https://img.shields.io/badge/Help%20translate-transifex-blue?style=for-the-badge)](https://www.transifex.com/beryjuorg/authentik/)
@@ -26,10 +26,10 @@ For bigger setups, there is a Helm Chart [here](https://github.com/goauthentik/h
 
 ## Screenshots
 
-Light | Dark
+| Light                                                  | Dark                                                  |
---- | ---
+| ------------------------------------------------------ | ----------------------------------------------------- |
-![](https://goauthentik.io/img/screen_apps_light.jpg) | ![](https://goauthentik.io/img/screen_apps_dark.jpg)
+| ![](https://goauthentik.io/img/screen_apps_light.jpg)  | ![](https://goauthentik.io/img/screen_apps_dark.jpg)  |
-![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg)
+| ![](https://goauthentik.io/img/screen_admin_light.jpg) | ![](https://goauthentik.io/img/screen_admin_dark.jpg) |
 
 ## Development
 

SECURITY.md

@@ -1,14 +1,44 @@
-# Security Policy
+Authentik takes security very seriously. We follow the rules of [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure), and we urge our community to do so as well, instead of reporting vulnerabilities publicly. This allows us to patch the issue quickly, announce it's existence and release the fixed version.
 
 ## Supported Versions
 
 (.x being the latest patch release for each version)
 
 | Version   | Supported          |
-| ---------- | ------------------ |
+| --------- | ------------------ |
-| 2022.3.x   | :white_check_mark: |
+| 2022.10.x | :white_check_mark: |
-| 2022.4.x   | :white_check_mark: |
+| 2022.11.x | :white_check_mark: |
 
 ## Reporting a Vulnerability
 
-To report a vulnerability, send an email to [security@beryju.org](mailto:security@beryju.org)
+To report a vulnerability, send an email to [security@goauthentik.io](mailto:security@goauthentik.io). Be sure to include relevant information like which version you've found the issue in, instructions on how to reproduce the issue, and anything else that might make it easier for us to find the bug.
+
+## Criticality levels
+
+### High
+
+-   Authorization bypass
+-   Circumvention of policies
+
+### Moderate
+
+-   Denial-of-Service attacks
+
+### Low
+
+-   Unvalidated redirects
+-   Issues requiring uncommon setups
+
+## Disclosure process
+
+1. Issue is reported via Email as listed above.
+2. The authentik Security team will try to reproduce the issue and ask for more information if required.
+3. A criticality level is assigned.
+4. A fix is created, and if possible tested by the issue reporter.
+5. The fix is backported to other supported versions, and if possible a workaround for other versions is created.
+6. An announcement is sent out with a fixed release date and criticality level of the issue. The announcement will be sent at least 24 hours before the release of the fix
+7. The fixed version is released for the supported versions.
+
+## Getting security notifications
+
+To get security notifications, join the [discord](https://goauthentik.io/discord) server. In the future there will be a mailing list too.

authentik/__init__.py

@@ -2,7 +2,7 @@
 from os import environ
 from typing import Optional
 
-__version__ = "2022.5.3"
+__version__ = "2022.10.4"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/meta.py

@@ -18,13 +18,13 @@ class AppSerializer(PassiveSerializer):
 
 
 class AppsViewSet(ViewSet):
-    """Read-only view set list all installed apps"""
+    """Read-only view list all installed apps"""
 
     permission_classes = [IsAdminUser]
 
     @extend_schema(responses={200: AppSerializer(many=True)})
     def list(self, request: Request) -> Response:
-        """List current messages and pass into Serializer"""
+        """Read-only view list all installed apps"""
         data = []
         for app in sorted(get_apps(), key=lambda app: app.name):
             data.append({"name": app.name, "label": app.verbose_name})

authentik/admin/api/metrics.py

@@ -23,6 +23,7 @@ class LoginMetricsSerializer(PassiveSerializer):
 
     logins_per_1h = SerializerMethodField()
     logins_failed_per_1h = SerializerMethodField()
+    authorizations_per_1h = SerializerMethodField()
 
     @extend_schema_field(CoordinateSerializer(many=True))
     def get_logins_per_1h(self, _):
@@ -44,6 +45,16 @@ class LoginMetricsSerializer(PassiveSerializer):
             .get_events_per_hour()
         )
 
+    @extend_schema_field(CoordinateSerializer(many=True))
+    def get_authorizations_per_1h(self, _):
+        """Get successful authorizations per hour for the last 24 hours"""
+        user = self.context["user"]
+        return (
+            get_objects_for_user(user, "authentik_events.view_event")
+            .filter(action=EventAction.AUTHORIZE_APPLICATION)
+            .get_events_per_hour()
+        )
+
 
 class AdministrationMetricsViewSet(APIView):
     """Login Metrics per 1h"""

authentik/admin/api/system.py

@@ -16,7 +16,7 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from authentik.core.api.utils import PassiveSerializer
-from authentik.outposts.managed import MANAGED_OUTPOST
+from authentik.outposts.apps import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost
 
 

authentik/admin/api/tasks.py

@@ -5,7 +5,7 @@ from django.contrib import messages
 from django.http.response import Http404
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.types import OpenApiTypes
-from drf_spectacular.utils import OpenApiResponse, extend_schema
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, ChoiceField, DateTimeField, ListField
 from rest_framework.permissions import IsAdminUser
@@ -58,7 +58,15 @@ class TaskViewSet(ViewSet):
         responses={
             200: TaskSerializer(many=False),
             404: OpenApiResponse(description="Task not found"),
-        }
+        },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
     )
     # pylint: disable=invalid-name
     def retrieve(self, request: Request, pk=None) -> Response:
@@ -81,6 +89,14 @@ class TaskViewSet(ViewSet):
             404: OpenApiResponse(description="Task not found"),
             500: OpenApiResponse(description="Failed to retry task"),
         },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
     )
     @action(detail=True, methods=["post"])
     # pylint: disable=invalid-name

authentik/admin/api/workers.py

@@ -1,7 +1,6 @@
 """authentik administration overview"""
 from django.conf import settings
 from drf_spectacular.utils import extend_schema, inline_serializer
-from prometheus_client import Gauge
 from rest_framework.fields import IntegerField
 from rest_framework.permissions import IsAdminUser
 from rest_framework.request import Request
@@ -10,8 +9,6 @@ from rest_framework.views import APIView
 
 from authentik.root.celery import CELERY_APP
 
-GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")
-
 
 class WorkerView(APIView):
     """Get currently connected worker count."""

authentik/admin/apps.py

@@ -1,18 +1,20 @@
 """authentik admin app config"""
-from importlib import import_module
+from prometheus_client import Gauge, Info
 
-from django.apps import AppConfig
+from authentik.blueprints.apps import ManagedAppConfig
+
+PROM_INFO = Info("authentik_version", "Currently running authentik version")
+GAUGE_WORKERS = Gauge("authentik_admin_workers", "Currently connected workers")
 
 
-class AuthentikAdminConfig(AppConfig):
+class AuthentikAdminConfig(ManagedAppConfig):
     """authentik admin app config"""
 
     name = "authentik.admin"
     label = "authentik_admin"
     verbose_name = "authentik Admin"
+    default = True
 
-    def ready(self):
+    def reconcile_load_admin_signals(self):
-        from authentik.admin.tasks import clear_update_notifications
+        """Load admin signals"""
-
+        self.import_module("authentik.admin.signals")
-        clear_update_notifications.delay()
-        import_module("authentik.admin.signals")

authentik/admin/signals.py

@@ -2,7 +2,7 @@
 from django.dispatch import receiver
 
 from authentik.admin.api.tasks import TaskInfo
-from authentik.admin.api.workers import GAUGE_WORKERS
+from authentik.admin.apps import GAUGE_WORKERS
 from authentik.root.celery import CELERY_APP
 from authentik.root.monitoring import monitoring_set
 

authentik/admin/tasks.py

@@ -3,12 +3,13 @@ import re
 
 from django.core.cache import cache
 from django.core.validators import URLValidator
+from django.db import DatabaseError, InternalError, ProgrammingError
 from packaging.version import parse
-from prometheus_client import Info
 from requests import RequestException
 from structlog.stdlib import get_logger
 
 from authentik import __version__, get_build_hash
+from authentik.admin.apps import PROM_INFO
 from authentik.events.models import Event, EventAction, Notification
 from authentik.events.monitored_tasks import (
     MonitoredTask,
@@ -25,7 +26,6 @@ VERSION_CACHE_KEY = "authentik_latest_version"
 VERSION_CACHE_TIMEOUT = 8 * 60 * 60  # 8 hours
 # Chop of the first ^ because we want to search the entire string
 URL_FINDER = URLValidator.regex.pattern[1:]
-PROM_INFO = Info("authentik_version", "Currently running authentik version")
 LOCAL_VERSION = parse(__version__)
 
 
@@ -40,7 +40,9 @@ def _set_prom_info():
     )
 
 
-@CELERY_APP.task()
+@CELERY_APP.task(
+    throws=(DatabaseError, ProgrammingError, InternalError),
+)
 def clear_update_notifications():
     """Clear update notifications on startup if the notification was for the version
     we're running now."""

authentik/admin/tests/test_api.py

@@ -5,10 +5,10 @@ from django.test import TestCase
 from django.urls import reverse
 
 from authentik import __version__
+from authentik.blueprints.tests import reconcile_app
 from authentik.core.models import Group, User
 from authentik.core.tasks import clean_expired_models
 from authentik.events.monitored_tasks import TaskResultStatus
-from authentik.managed.tasks import managed_reconcile
 
 
 class TestAdminAPI(TestCase):
@@ -93,9 +93,8 @@ class TestAdminAPI(TestCase):
         response = self.client.get(reverse("authentik_api:apps-list"))
         self.assertEqual(response.status_code, 200)
 
+    @reconcile_app("authentik_outposts")
     def test_system(self):
         """Test system API"""
-        # pyright: reportGeneralTypeIssues=false
-        managed_reconcile()  # pylint: disable=no-value-for-parameter
         response = self.client.get(reverse("authentik_api:admin_system"))
         self.assertEqual(response.status_code, 200)

authentik/api/authentication.py

@@ -7,14 +7,16 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from structlog.stdlib import get_logger
 
-from authentik.core.middleware import KEY_AUTH_VIA, LOCAL
+from authentik.core.middleware import CTX_AUTH_VIA
 from authentik.core.models import Token, TokenIntents, User
 from authentik.outposts.models import Outpost
+from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
+from authentik.providers.oauth2.models import RefreshToken
 
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> str:
+def validate_auth(header: bytes) -> Optional[str]:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -24,7 +26,7 @@ def validate_auth(header: bytes) -> str:
     if auth_type.lower() != "bearer":
         LOGGER.debug("Unsupported authentication type, denying", type=auth_type.lower())
         raise AuthenticationFailed("Unsupported authentication type")
-    if auth_credentials == "":  # nosec
+    if auth_credentials == "":  # nosec # noqa
         raise AuthenticationFailed("Malformed header")
     return auth_credentials
 
@@ -35,13 +37,27 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
     if not auth_credentials:
         return None
     # first, check traditional tokens
-    token = Token.filter_not_expired(key=auth_credentials, intent=TokenIntents.INTENT_API).first()
+    key_token = Token.filter_not_expired(
-    if hasattr(LOCAL, "authentik"):
+        key=auth_credentials, intent=TokenIntents.INTENT_API
-        LOCAL.authentik[KEY_AUTH_VIA] = "api_token"
+    ).first()
-    if token:
+    if key_token:
-        return token.user
+        CTX_AUTH_VIA.set("api_token")
+        return key_token.user
+    # then try to auth via JWT
+    jwt_token = RefreshToken.filter_not_expired(
+        refresh_token=auth_credentials, _scope__icontains=SCOPE_AUTHENTIK_API
+    ).first()
+    if jwt_token:
+        # Double-check scopes, since they are saved in a single string
+        # we want to check the parsed version too
+        if SCOPE_AUTHENTIK_API not in jwt_token.scope:
+            raise AuthenticationFailed("Token invalid/expired")
+        CTX_AUTH_VIA.set("jwt")
+        return jwt_token.user
+    # then try to auth via secret key (for embedded outpost/etc)
     user = token_secret_key(auth_credentials)
     if user:
+        CTX_AUTH_VIA.set("secret_key")
         return user
     raise AuthenticationFailed("Token invalid/expired")
 
@@ -49,15 +65,13 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
 def token_secret_key(value: str) -> Optional[User]:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
-    from authentik.outposts.managed import MANAGED_OUTPOST
+    from authentik.outposts.apps import MANAGED_OUTPOST
 
     if value != settings.SECRET_KEY:
         return None
     outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)
     if not outposts:
         return None
-    if hasattr(LOCAL, "authentik"):
-        LOCAL.authentik[KEY_AUTH_VIA] = "secret_key"
     outpost = outposts.first()
     return outpost.user
 

authentik/api/schema.py

@@ -60,8 +60,28 @@ def postprocess_schema_responses(result, generator, **kwargs):  # noqa: W0613
 
     for path in result["paths"].values():
         for method in path.values():
-            method["responses"].setdefault("400", validation_error.ref)
+            method["responses"].setdefault(
-            method["responses"].setdefault("403", generic_error.ref)
+                "400",
+                {
+                    "content": {
+                        "application/json": {
+                            "schema": validation_error.ref,
+                        }
+                    },
+                    "description": "",
+                },
+            )
+            method["responses"].setdefault(
+                "403",
+                {
+                    "content": {
+                        "application/json": {
+                            "schema": generic_error.ref,
+                        }
+                    },
+                    "description": "",
+                },
+            )
 
     result["components"] = generator.registry.build(spectacular_settings.APPEND_COMPONENTS)
 

authentik/api/tests/test_auth.py

@@ -7,34 +7,72 @@ from guardian.shortcuts import get_anonymous_user
 from rest_framework.exceptions import AuthenticationFailed
 
 from authentik.api.authentication import bearer_auth
+from authentik.blueprints.tests import reconcile_app
 from authentik.core.models import USER_ATTRIBUTE_SA, Token, TokenIntents
-from authentik.outposts.managed import OutpostManager
+from authentik.core.tests.utils import create_test_flow
+from authentik.lib.generators import generate_id
+from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
+from authentik.providers.oauth2.models import OAuth2Provider, RefreshToken
 
 
 class TestAPIAuth(TestCase):
     """Test API Authentication"""
 
-    def test_valid_bearer(self):
-        """Test valid token"""
-        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
-        self.assertEqual(bearer_auth(f"Bearer {token.key}".encode()), token.user)
-
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
             bearer_auth("foo bar".encode())
 
+    def test_invalid_empty(self):
+        """Test invalid type"""
+        self.assertIsNone(bearer_auth("Bearer ".encode()))
+        self.assertIsNone(bearer_auth("".encode()))
+
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
             auth = b64encode(":abc".encode()).decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
+    def test_bearer_valid(self):
+        """Test valid token"""
+        token = Token.objects.create(intent=TokenIntents.INTENT_API, user=get_anonymous_user())
+        self.assertEqual(bearer_auth(f"Bearer {token.key}".encode()), token.user)
+
     def test_managed_outpost(self):
         """Test managed outpost"""
         with self.assertRaises(AuthenticationFailed):
-            user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
+            bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
 
-        OutpostManager().run()
+    @reconcile_app("authentik_outposts")
+    def test_managed_outpost_success(self):
+        """Test managed outpost"""
         user = bearer_auth(f"Bearer {settings.SECRET_KEY}".encode())
         self.assertEqual(user.attributes[USER_ATTRIBUTE_SA], True)
+
+    def test_jwt_valid(self):
+        """Test valid JWT"""
+        provider = OAuth2Provider.objects.create(
+            name=generate_id(), client_id=generate_id(), authorization_flow=create_test_flow()
+        )
+        refresh = RefreshToken.objects.create(
+            user=get_anonymous_user(),
+            provider=provider,
+            refresh_token=generate_id(),
+            _scope=SCOPE_AUTHENTIK_API,
+        )
+        self.assertEqual(bearer_auth(f"Bearer {refresh.refresh_token}".encode()), refresh.user)
+
+    def test_jwt_missing_scope(self):
+        """Test valid JWT"""
+        provider = OAuth2Provider.objects.create(
+            name=generate_id(), client_id=generate_id(), authorization_flow=create_test_flow()
+        )
+        refresh = RefreshToken.objects.create(
+            user=get_anonymous_user(),
+            provider=provider,
+            refresh_token=generate_id(),
+            _scope="",
+        )
+        with self.assertRaises(AuthenticationFailed):
+            self.assertEqual(bearer_auth(f"Bearer {refresh.refresh_token}".encode()), refresh.user)

authentik/api/v3/config.py

@@ -28,6 +28,7 @@ class Capabilities(models.TextChoices):
     CAN_SAVE_MEDIA = "can_save_media"
     CAN_GEO_IP = "can_geo_ip"
     CAN_IMPERSONATE = "can_impersonate"
+    CAN_DEBUG = "can_debug"
 
 
 class ErrorReportingConfigSerializer(PassiveSerializer):
@@ -66,15 +67,16 @@ class ConfigView(APIView):
             caps.append(Capabilities.CAN_GEO_IP)
         if CONFIG.y_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
+        if settings.DEBUG:
+            caps.append(Capabilities.CAN_DEBUG)
         return caps
 
-    @extend_schema(responses={200: ConfigSerializer(many=False)})
+    def get_config(self) -> ConfigSerializer:
-    def get(self, request: Request) -> Response:
+        """Get Config"""
-        """Retrieve public configuration options"""
+        return ConfigSerializer(
-        config = ConfigSerializer(
             {
                 "error_reporting": {
-                    "enabled": CONFIG.y("error_reporting.enabled") and not settings.DEBUG,
+                    "enabled": CONFIG.y("error_reporting.enabled"),
                     "environment": CONFIG.y("error_reporting.environment"),
                     "send_pii": CONFIG.y("error_reporting.send_pii"),
                     "traces_sample_rate": float(CONFIG.y("error_reporting.sample_rate", 0.4)),
@@ -86,4 +88,8 @@ class ConfigView(APIView):
                 "cache_timeout_reputation": int(CONFIG.y("redis.cache_timeout_reputation")),
             }
         )
-        return Response(config.data)
+
+    @extend_schema(responses={200: ConfigSerializer(many=False)})
+    def get(self, request: Request) -> Response:
+        """Retrieve public configuration options"""
+        return Response(self.get_config().data)

authentik/api/v3/urls.py

@@ -12,9 +12,10 @@ from authentik.admin.api.version import VersionView
 from authentik.admin.api.workers import WorkerView
 from authentik.api.v3.config import ConfigView
 from authentik.api.views import APIBrowserView
+from authentik.blueprints.api import BlueprintInstanceViewSet
 from authentik.core.api.applications import ApplicationViewSet
 from authentik.core.api.authenticated_sessions import AuthenticatedSessionViewSet
-from authentik.core.api.devices import DeviceViewSet
+from authentik.core.api.devices import AdminDeviceViewSet, DeviceViewSet
 from authentik.core.api.groups import GroupViewSet
 from authentik.core.api.propertymappings import PropertyMappingViewSet
 from authentik.core.api.providers import ProviderViewSet
@@ -58,7 +59,8 @@ from authentik.sources.oauth.api.source import OAuthSourceViewSet
 from authentik.sources.oauth.api.source_connection import UserOAuthSourceConnectionViewSet
 from authentik.sources.plex.api.source import PlexSourceViewSet
 from authentik.sources.plex.api.source_connection import PlexSourceConnectionViewSet
-from authentik.sources.saml.api import SAMLSourceViewSet
+from authentik.sources.saml.api.source import SAMLSourceViewSet
+from authentik.sources.saml.api.source_connection import UserSAMLSourceConnectionViewSet
 from authentik.stages.authenticator_duo.api import (
     AuthenticatorDuoStageViewSet,
     DuoAdminDeviceViewSet,
@@ -131,10 +133,13 @@ router.register("events/notifications", NotificationViewSet)
 router.register("events/transports", NotificationTransportViewSet)
 router.register("events/rules", NotificationRuleViewSet)
 
+router.register("managed/blueprints", BlueprintInstanceViewSet)
+
 router.register("sources/all", SourceViewSet)
 router.register("sources/user_connections/all", UserSourceConnectionViewSet)
 router.register("sources/user_connections/oauth", UserOAuthSourceConnectionViewSet)
 router.register("sources/user_connections/plex", PlexSourceConnectionViewSet)
+router.register("sources/user_connections/saml", UserSAMLSourceConnectionViewSet)
 router.register("sources/ldap", LDAPSourceViewSet)
 router.register("sources/saml", SAMLSourceViewSet)
 router.register("sources/oauth", OAuthSourceViewSet)
@@ -171,6 +176,11 @@ router.register("authenticators/sms", SMSDeviceViewSet)
 router.register("authenticators/static", StaticDeviceViewSet)
 router.register("authenticators/totp", TOTPDeviceViewSet)
 router.register("authenticators/webauthn", WebAuthnDeviceViewSet)
+router.register(
+    "authenticators/admin/all",
+    AdminDeviceViewSet,
+    basename="admin-device",
+)
 router.register(
     "authenticators/admin/duo",
     DuoAdminDeviceViewSet,

authentik/blueprints/api.py

@@ -0,0 +1,109 @@
+"""Serializer mixin for managed models"""
+from drf_spectacular.utils import extend_schema, inline_serializer
+from rest_framework.decorators import action
+from rest_framework.exceptions import ValidationError
+from rest_framework.fields import CharField, DateTimeField, JSONField
+from rest_framework.permissions import IsAdminUser
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.serializers import ListSerializer, ModelSerializer
+from rest_framework.viewsets import ModelViewSet
+
+from authentik.api.decorators import permission_required
+from authentik.blueprints.models import BlueprintInstance, BlueprintRetrievalFailed
+from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
+from authentik.core.api.used_by import UsedByMixin
+from authentik.core.api.utils import PassiveSerializer
+
+
+class ManagedSerializer:
+    """Managed Serializer"""
+
+    managed = CharField(read_only=True, allow_null=True)
+
+
+class MetadataSerializer(PassiveSerializer):
+    """Serializer for blueprint metadata"""
+
+    name = CharField()
+    labels = JSONField()
+
+
+class BlueprintInstanceSerializer(ModelSerializer):
+    """Info about a single blueprint instance file"""
+
+    def validate_path(self, path: str) -> str:
+        """Ensure the path specified is retrievable"""
+        try:
+            BlueprintInstance(path=path).retrieve()
+        except BlueprintRetrievalFailed as exc:
+            raise ValidationError(exc) from exc
+        return path
+
+    class Meta:
+
+        model = BlueprintInstance
+        fields = [
+            "pk",
+            "name",
+            "path",
+            "context",
+            "last_applied",
+            "last_applied_hash",
+            "status",
+            "enabled",
+            "managed_models",
+            "metadata",
+        ]
+        extra_kwargs = {
+            "status": {"read_only": True},
+            "last_applied": {"read_only": True},
+            "last_applied_hash": {"read_only": True},
+            "managed_models": {"read_only": True},
+            "metadata": {"read_only": True},
+        }
+
+
+class BlueprintInstanceViewSet(UsedByMixin, ModelViewSet):
+    """Blueprint instances"""
+
+    permission_classes = [IsAdminUser]
+    serializer_class = BlueprintInstanceSerializer
+    queryset = BlueprintInstance.objects.all()
+    search_fields = ["name", "path"]
+    filterset_fields = ["name", "path"]
+
+    @extend_schema(
+        responses={
+            200: ListSerializer(
+                child=inline_serializer(
+                    "BlueprintFile",
+                    fields={
+                        "path": CharField(),
+                        "last_m": DateTimeField(),
+                        "hash": CharField(),
+                        "meta": MetadataSerializer(required=False, read_only=True),
+                    },
+                )
+            )
+        }
+    )
+    @action(detail=False, pagination_class=None, filter_backends=[])
+    def available(self, request: Request) -> Response:
+        """Get blueprints"""
+        files: list[dict] = blueprints_find_dict.delay().get()
+        return Response(files)
+
+    @permission_required("authentik_blueprints.view_blueprintinstance")
+    @extend_schema(
+        request=None,
+        responses={
+            200: BlueprintInstanceSerializer(),
+        },
+    )
+    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    def apply(self, request: Request, *args, **kwargs) -> Response:
+        """Apply a blueprint"""
+        blueprint = self.get_object()
+        apply_blueprint.delay(str(blueprint.pk)).get()
+        return self.retrieve(request, *args, **kwargs)

authentik/blueprints/apps.py

@@ -0,0 +1,66 @@
+"""authentik Blueprints app"""
+
+from importlib import import_module
+from inspect import ismethod
+
+from django.apps import AppConfig
+from django.db import DatabaseError, InternalError, ProgrammingError
+from structlog.stdlib import BoundLogger, get_logger
+
+
+class ManagedAppConfig(AppConfig):
+    """Basic reconciliation logic for apps"""
+
+    _logger: BoundLogger
+
+    def __init__(self, app_name: str, *args, **kwargs) -> None:
+        super().__init__(app_name, *args, **kwargs)
+        self._logger = get_logger().bind(app_name=app_name)
+
+    def ready(self) -> None:
+        self.reconcile()
+        return super().ready()
+
+    def import_module(self, path: str):
+        """Load module"""
+        import_module(path)
+
+    def reconcile(self) -> None:
+        """reconcile ourselves"""
+        prefix = "reconcile_"
+        for meth_name in dir(self):
+            meth = getattr(self, meth_name)
+            if not ismethod(meth):
+                continue
+            if not meth_name.startswith(prefix):
+                continue
+            name = meth_name.replace(prefix, "")
+            try:
+                self._logger.debug("Starting reconciler", name=name)
+                meth()
+                self._logger.debug("Successfully reconciled", name=name)
+            except (DatabaseError, ProgrammingError, InternalError) as exc:
+                self._logger.debug("Failed to run reconcile", name=name, exc=exc)
+
+
+class AuthentikBlueprintsConfig(ManagedAppConfig):
+    """authentik Blueprints app"""
+
+    name = "authentik.blueprints"
+    label = "authentik_blueprints"
+    verbose_name = "authentik Blueprints"
+    default = True
+
+    def reconcile_load_blueprints_v1_tasks(self):
+        """Load v1 tasks"""
+        self.import_module("authentik.blueprints.v1.tasks")
+
+    def reconcile_blueprints_discover(self):
+        """Run blueprint discovery"""
+        from authentik.blueprints.v1.tasks import blueprints_discover
+
+        blueprints_discover.delay()
+
+    def import_models(self):
+        super().import_models()
+        self.import_module("authentik.blueprints.v1.meta.apply_blueprint")

authentik/blueprints/management/commands/apply_blueprint.py

@@ -0,0 +1,31 @@
+"""Apply blueprint from commandline"""
+from sys import exit as sys_exit
+
+from django.core.management.base import BaseCommand, no_translations
+from structlog.stdlib import get_logger
+
+from authentik.blueprints.models import BlueprintInstance
+from authentik.blueprints.v1.importer import Importer
+
+LOGGER = get_logger()
+
+
+class Command(BaseCommand):
+    """Apply blueprint from commandline"""
+
+    @no_translations
+    def handle(self, *args, **options):
+        """Apply all blueprints in order, abort when one fails to import"""
+        for blueprint_path in options.get("blueprints", []):
+            content = BlueprintInstance(path=blueprint_path).retrieve()
+            importer = Importer(content)
+            valid, logs = importer.validate()
+            if not valid:
+                for log in logs:
+                    getattr(LOGGER, log.pop("log_level"))(**log)
+                self.stderr.write("blueprint invalid")
+                sys_exit(1)
+            importer.apply()
+
+    def add_arguments(self, parser):
+        parser.add_argument("blueprints", nargs="+", type=str)

authentik/blueprints/management/commands/export_blueprint.py

@@ -0,0 +1,17 @@
+"""Export blueprint of current authentik install"""
+from django.core.management.base import BaseCommand, no_translations
+from structlog.stdlib import get_logger
+
+from authentik.blueprints.v1.exporter import Exporter
+
+LOGGER = get_logger()
+
+
+class Command(BaseCommand):
+    """Export blueprint of current authentik install"""
+
+    @no_translations
+    def handle(self, *args, **options):
+        """Export blueprint of current authentik install"""
+        exporter = Exporter()
+        self.stdout.write(exporter.export_to_string())

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -0,0 +1,36 @@
+"""Generate JSON Schema for blueprints"""
+from json import dumps, loads
+from pathlib import Path
+
+from django.core.management.base import BaseCommand, no_translations
+from structlog.stdlib import get_logger
+
+from authentik.blueprints.v1.importer import is_model_allowed
+from authentik.blueprints.v1.meta.registry import registry
+
+LOGGER = get_logger()
+
+
+class Command(BaseCommand):
+    """Generate JSON Schema for blueprints"""
+
+    schema: dict
+
+    @no_translations
+    def handle(self, *args, **options):
+        """Generate JSON Schema for blueprints"""
+        path = Path(__file__).parent.joinpath("./schema_template.json")
+        with open(path, "r", encoding="utf-8") as _template_file:
+            self.schema = loads(_template_file.read())
+        self.set_model_allowed()
+        self.stdout.write(dumps(self.schema, indent=4))
+
+    def set_model_allowed(self):
+        """Set model enum"""
+        model_names = []
+        for model in registry.get_models():
+            if not is_model_allowed(model):
+                continue
+            model_names.append(f"{model._meta.app_label}.{model._meta.model_name}")
+        model_names.sort()
+        self.schema["properties"]["entries"]["items"]["properties"]["model"]["enum"] = model_names

authentik/blueprints/management/commands/schema_template.json

@@ -0,0 +1,90 @@
+{
+    "$schema": "http://json-schema.org/draft-07/schema",
+    "$id": "http://example.com/example.json",
+    "type": "object",
+    "title": "authentik Blueprint schema",
+    "default": {},
+    "required": [
+        "version",
+        "entries"
+    ],
+    "properties": {
+        "version": {
+            "$id": "#/properties/version",
+            "type": "integer",
+            "title": "Blueprint version",
+            "default": 1
+        },
+        "metadata": {
+            "$id": "#/properties/metadata",
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "name": {
+                    "type": "string"
+                },
+                "labels": {
+                    "type": "object"
+                }
+            }
+        },
+        "context": {
+            "$id": "#/properties/context",
+            "type": "object",
+            "additionalProperties": true
+        },
+        "entries": {
+            "type": "array",
+            "items": {
+                "$id": "#entry",
+                "type": "object",
+                "required": [
+                    "model"
+                ],
+                "properties": {
+                    "model": {
+                        "type": "string",
+                        "enum": [
+                            "placeholder"
+                        ]
+                    },
+                    "id": {
+                        "type": "string"
+                    },
+                    "attrs": {
+                        "type": "object",
+                        "properties": {
+                            "name": {
+                                "type": "string",
+                                "description": "Commonly available field, may not exist on all models"
+                            }
+                        },
+                        "default": {},
+                        "additionalProperties": true
+                    },
+                    "identifiers": {
+                        "type": "object",
+                        "default": {},
+                        "properties": {
+                            "pk": {
+                                "description": "Commonly available field, may not exist on all models",
+                                "anyOf": [
+                                    {
+                                        "type": "number"
+                                    },
+                                    {
+                                        "type": "string",
+                                        "format": "uuid"
+                                    }
+                                ]
+                            }
+                        },
+                        "additionalProperties": true
+                    }
+                }
+            }
+        }
+    }
+}

authentik/blueprints/migrations/0001_initial.py

@@ -0,0 +1,135 @@
+# Generated by Django 4.0.6 on 2022-07-31 17:35
+import uuid
+from glob import glob
+from pathlib import Path
+
+import django.contrib.postgres.fields
+from dacite.core import from_dict
+from django.apps.registry import Apps
+from django.conf import settings
+from django.db import migrations, models
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+from yaml import load
+
+from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_SYSTEM
+from authentik.lib.config import CONFIG
+
+
+def check_blueprint_v1_file(BlueprintInstance: type["BlueprintInstance"], path: Path):
+    """Check if blueprint should be imported"""
+    from authentik.blueprints.models import BlueprintInstanceStatus
+    from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata
+    from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_INSTANTIATE
+
+    with open(path, "r", encoding="utf-8") as blueprint_file:
+        raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
+        if not raw_blueprint:
+            return
+        metadata = raw_blueprint.get("metadata", None)
+        version = raw_blueprint.get("version", 1)
+        if version != 1:
+            return
+        blueprint_file.seek(0)
+    instance: BlueprintInstance = BlueprintInstance.objects.filter(path=path).first()
+    rel_path = path.relative_to(Path(CONFIG.y("blueprints_dir")))
+    meta = None
+    if metadata:
+        meta = from_dict(BlueprintMetadata, metadata)
+        if meta.labels.get(LABEL_AUTHENTIK_INSTANTIATE, "").lower() == "false":
+            return
+    if not instance:
+        instance = BlueprintInstance(
+            name=meta.name if meta else str(rel_path),
+            path=str(rel_path),
+            context={},
+            status=BlueprintInstanceStatus.UNKNOWN,
+            enabled=True,
+            managed_models=[],
+            last_applied_hash="",
+            metadata=metadata,
+        )
+        instance.save()
+
+
+def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
+    BlueprintInstance = apps.get_model("authentik_blueprints", "BlueprintInstance")
+    Flow = apps.get_model("authentik_flows", "Flow")
+
+    db_alias = schema_editor.connection.alias
+    for file in glob(f"{CONFIG.y('blueprints_dir')}/**/*.yaml", recursive=True):
+        check_blueprint_v1_file(BlueprintInstance, Path(file))
+
+    for blueprint in BlueprintInstance.objects.using(db_alias).all():
+        # If we already have flows (and we should always run before flow migrations)
+        # then this is an existing install and we want to disable all blueprints
+        if Flow.objects.using(db_alias).all().exists():
+            blueprint.enabled = False
+        # System blueprints are always enabled
+        if blueprint.metadata.get("labels", {}).get(LABEL_AUTHENTIK_SYSTEM, "").lower() == "true":
+            blueprint.enabled = True
+        blueprint.save()
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [("authentik_flows", "0001_initial")]
+
+    operations = [
+        migrations.CreateModel(
+            name="BlueprintInstance",
+            fields=[
+                ("created", models.DateTimeField(auto_now_add=True)),
+                ("last_updated", models.DateTimeField(auto_now=True)),
+                (
+                    "managed",
+                    models.TextField(
+                        default=None,
+                        help_text="Objects which are managed by authentik. These objects are created and updated automatically. This is flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.",
+                        null=True,
+                        unique=True,
+                        verbose_name="Managed by authentik",
+                    ),
+                ),
+                (
+                    "instance_uuid",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("name", models.TextField()),
+                ("metadata", models.JSONField(default=dict)),
+                ("path", models.TextField()),
+                ("context", models.JSONField(default=dict)),
+                ("last_applied", models.DateTimeField(auto_now=True)),
+                ("last_applied_hash", models.TextField()),
+                (
+                    "status",
+                    models.TextField(
+                        choices=[
+                            ("successful", "Successful"),
+                            ("warning", "Warning"),
+                            ("error", "Error"),
+                            ("orphaned", "Orphaned"),
+                            ("unknown", "Unknown"),
+                        ],
+                        default="unknown",
+                    ),
+                ),
+                ("enabled", models.BooleanField(default=True)),
+                (
+                    "managed_models",
+                    django.contrib.postgres.fields.ArrayField(
+                        base_field=models.TextField(), default=list, size=None
+                    ),
+                ),
+            ],
+            options={
+                "verbose_name": "Blueprint Instance",
+                "verbose_name_plural": "Blueprint Instances",
+                "unique_together": {("name", "path")},
+            },
+        ),
+        migrations.RunPython(migration_blueprint_import),
+    ]

authentik/blueprints/models.py

@@ -0,0 +1,163 @@
+"""blueprint models"""
+from pathlib import Path
+from urllib.parse import urlparse
+from uuid import uuid4
+
+from django.contrib.postgres.fields import ArrayField
+from django.db import models
+from django.utils.translation import gettext_lazy as _
+from opencontainers.distribution.reggie import (
+    NewClient,
+    WithDebug,
+    WithDefaultName,
+    WithDigest,
+    WithReference,
+    WithUserAgent,
+    WithUsernamePassword,
+)
+from requests.exceptions import RequestException
+from rest_framework.serializers import Serializer
+from structlog import get_logger
+
+from authentik.lib.config import CONFIG
+from authentik.lib.models import CreatedUpdatedModel, SerializerModel
+from authentik.lib.sentry import SentryIgnoredException
+from authentik.lib.utils.http import authentik_user_agent
+
+OCI_MEDIA_TYPE = "application/vnd.goauthentik.blueprint.v1+yaml"
+LOGGER = get_logger()
+
+
+class BlueprintRetrievalFailed(SentryIgnoredException):
+    """Error raised when we're unable to fetch the blueprint contents, whether it be HTTP files
+    not being accessible or local files not being readable"""
+
+
+class ManagedModel(models.Model):
+    """Model which can be managed by authentik exclusively"""
+
+    managed = models.TextField(
+        default=None,
+        null=True,
+        verbose_name=_("Managed by authentik"),
+        help_text=_(
+            (
+                "Objects which are managed by authentik. These objects are created and updated "
+                "automatically. This is flag only indicates that an object can be overwritten by "
+                "migrations. You can still modify the objects via the API, but expect changes "
+                "to be overwritten in a later update."
+            )
+        ),
+        unique=True,
+    )
+
+    class Meta:
+
+        abstract = True
+
+
+class BlueprintInstanceStatus(models.TextChoices):
+    """Instance status"""
+
+    SUCCESSFUL = "successful"
+    WARNING = "warning"
+    ERROR = "error"
+    ORPHANED = "orphaned"
+    UNKNOWN = "unknown"
+
+
+class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
+    """Instance of a single blueprint. Can be parameterized via context attribute when
+    blueprint in `path` has inputs."""
+
+    instance_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
+
+    name = models.TextField()
+    metadata = models.JSONField(default=dict)
+    path = models.TextField()
+    context = models.JSONField(default=dict)
+    last_applied = models.DateTimeField(auto_now=True)
+    last_applied_hash = models.TextField()
+    status = models.TextField(
+        choices=BlueprintInstanceStatus.choices, default=BlueprintInstanceStatus.UNKNOWN
+    )
+    enabled = models.BooleanField(default=True)
+    managed_models = ArrayField(models.TextField(), default=list)
+
+    def retrieve_oci(self) -> str:
+        """Get blueprint from an OCI registry"""
+        url = urlparse(self.path)
+        ref = "latest"
+        path = url.path[1:]
+        if ":" in url.path:
+            path, _, ref = path.partition(":")
+        client = NewClient(
+            f"{url.scheme}://{url.hostname}",
+            WithUserAgent(authentik_user_agent()),
+            WithUsernamePassword(url.username, url.password),
+            WithDefaultName(path),
+            WithDebug(True),
+        )
+        LOGGER.info("Fetching OCI manifests for blueprint", instance=self)
+        manifest_request = client.NewRequest(
+            "GET",
+            "/v2/<name>/manifests/<reference>",
+            WithReference(ref),
+        ).SetHeader("Accept", "application/vnd.oci.image.manifest.v1+json")
+        try:
+            manifest_response = client.Do(manifest_request)
+            manifest_response.raise_for_status()
+        except RequestException as exc:
+            raise BlueprintRetrievalFailed(exc) from exc
+        manifest = manifest_response.json()
+        if "errors" in manifest:
+            raise BlueprintRetrievalFailed(manifest["errors"])
+
+        blob = None
+        for layer in manifest.get("layers", []):
+            if layer.get("mediaType", "") == OCI_MEDIA_TYPE:
+                blob = layer.get("digest")
+                LOGGER.debug("Found layer with matching media type", instance=self, blob=blob)
+        if not blob:
+            raise BlueprintRetrievalFailed("Blob not found")
+
+        blob_request = client.NewRequest(
+            "GET",
+            "/v2/<name>/blobs/<digest>",
+            WithDigest(blob),
+        )
+        try:
+            blob_response = client.Do(blob_request)
+            blob_response.raise_for_status()
+            return blob_response.text
+        except RequestException as exc:
+            raise BlueprintRetrievalFailed(exc) from exc
+
+    def retrieve(self) -> str:
+        """Retrieve blueprint contents"""
+        full_path = Path(CONFIG.y("blueprints_dir")).joinpath(Path(self.path))
+        if full_path.exists():
+            LOGGER.debug("Blueprint path exists locally", instance=self)
+            with full_path.open("r", encoding="utf-8") as _file:
+                return _file.read()
+        return self.retrieve_oci()
+
+    @property
+    def serializer(self) -> Serializer:
+        from authentik.blueprints.api import BlueprintInstanceSerializer
+
+        return BlueprintInstanceSerializer
+
+    def __str__(self) -> str:
+        return f"Blueprint Instance {self.name}"
+
+    class Meta:
+
+        verbose_name = _("Blueprint Instance")
+        verbose_name_plural = _("Blueprint Instances")
+        unique_together = (
+            (
+                "name",
+                "path",
+            ),
+        )

authentik/blueprints/settings.py

@@ -0,0 +1,12 @@
+"""blueprint Settings"""
+from celery.schedules import crontab
+
+from authentik.lib.utils.time import fqdn_rand
+
+CELERY_BEAT_SCHEDULE = {
+    "blueprints_v1_discover": {
+        "task": "authentik.blueprints.v1.tasks.blueprints_discover",
+        "schedule": crontab(minute=fqdn_rand("blueprints_v1_discover"), hour="*"),
+        "options": {"queue": "authentik_scheduled"},
+    },
+}

authentik/blueprints/tests/__init__.py

@@ -0,0 +1,48 @@
+"""Blueprint helpers"""
+from functools import wraps
+from pathlib import Path
+from typing import Callable
+
+from django.apps import apps
+
+from authentik.blueprints.apps import ManagedAppConfig
+from authentik.blueprints.models import BlueprintInstance
+from authentik.lib.config import CONFIG
+
+
+def apply_blueprint(*files: str):
+    """Apply blueprint before test"""
+
+    from authentik.blueprints.v1.importer import Importer
+
+    def wrapper_outer(func: Callable):
+        """Apply blueprint before test"""
+
+        @wraps(func)
+        def wrapper(*args, **kwargs):
+            for file in files:
+                content = BlueprintInstance(path=file).retrieve()
+                Importer(content).apply()
+            return func(*args, **kwargs)
+
+        return wrapper
+
+    return wrapper_outer
+
+
+def reconcile_app(app_name: str):
+    """Re-reconcile AppConfig methods"""
+
+    def wrapper_outer(func: Callable):
+        """Re-reconcile AppConfig methods"""
+
+        @wraps(func)
+        def wrapper(*args, **kwargs):
+            config = apps.get_app_config(app_name)
+            if isinstance(config, ManagedAppConfig):
+                config.reconcile()
+            return func(*args, **kwargs)
+
+        return wrapper
+
+    return wrapper_outer

authentik/blueprints/tests/test_models.py

@@ -0,0 +1,34 @@
+"""authentik managed models tests"""
+from typing import Callable, Type
+
+from django.apps import apps
+from django.test import TestCase
+
+from authentik.blueprints.v1.importer import is_model_allowed
+from authentik.lib.models import SerializerModel
+
+
+class TestModels(TestCase):
+    """Test Models"""
+
+
+def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
+    """Test serializer"""
+
+    def tester(self: TestModels):
+        if test_model._meta.abstract:
+            return
+        model_class = test_model()
+        self.assertTrue(isinstance(model_class, SerializerModel))
+        self.assertIsNotNone(model_class.serializer)
+
+    return tester
+
+
+for app in apps.get_app_configs():
+    if not app.label.startswith("authentik"):
+        continue
+    for model in app.get_models():
+        if not is_model_allowed(model):
+            continue
+        setattr(TestModels, f"test_{app.label}_{model.__name__}", serializer_tester_factory(model))

authentik/blueprints/tests/test_oci.py

@@ -0,0 +1,97 @@
+"""Test blueprints OCI"""
+from django.test import TransactionTestCase
+from requests_mock import Mocker
+
+from authentik.blueprints.models import OCI_MEDIA_TYPE, BlueprintInstance, BlueprintRetrievalFailed
+
+
+class TestBlueprintOCI(TransactionTestCase):
+    """Test Blueprints OCI Tasks"""
+
+    def test_successful(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE,
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            mocker.get("https://ghcr.io/v2/goauthentik/blueprints/test/blobs/foo", text="foo")
+
+            self.assertEqual(
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci(),
+                "foo",
+            )
+
+    def test_manifests_error(self):
+        """Test manifests request erroring"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest", status_code=401
+            )
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_manifests_error_response(self):
+        """Test manifests request erroring"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={"errors": ["foo"]},
+            )
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_no_matching_blob(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE + "foo",
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()
+
+    def test_blob_error(self):
+        """Successful retrieval"""
+        with Mocker() as mocker:
+            mocker.get(
+                "https://ghcr.io/v2/goauthentik/blueprints/test/manifests/latest",
+                json={
+                    "layers": [
+                        {
+                            "mediaType": OCI_MEDIA_TYPE,
+                            "digest": "foo",
+                        }
+                    ]
+                },
+            )
+            mocker.get("https://ghcr.io/v2/goauthentik/blueprints/test/blobs/foo", status_code=401)
+
+            with self.assertRaises(BlueprintRetrievalFailed):
+                BlueprintInstance(
+                    path="https://ghcr.io/goauthentik/blueprints/test:latest"
+                ).retrieve_oci()

authentik/blueprints/tests/test_packaged.py

@@ -0,0 +1,38 @@
+"""test packaged blueprints"""
+from pathlib import Path
+from typing import Callable
+
+from django.test import TransactionTestCase
+
+from authentik.blueprints.models import BlueprintInstance
+from authentik.blueprints.tests import apply_blueprint
+from authentik.blueprints.v1.importer import Importer
+from authentik.tenants.models import Tenant
+
+
+class TestPackaged(TransactionTestCase):
+    """Empty class, test methods are added dynamically"""
+
+    @apply_blueprint("default/90-default-tenant.yaml")
+    def test_decorator_static(self):
+        """Test @apply_blueprint decorator"""
+        self.assertTrue(Tenant.objects.filter(domain="authentik-default").exists())
+
+
+def blueprint_tester(file_name: Path) -> Callable:
+    """This is used instead of subTest for better visibility"""
+
+    def tester(self: TestPackaged):
+        base = Path("blueprints/")
+        rel_path = Path(file_name).relative_to(base)
+        importer = Importer(BlueprintInstance(path=str(rel_path)).retrieve())
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+
+    return tester
+
+
+for blueprint_file in Path("blueprints/").glob("**/*.yaml"):
+    if "local" in str(blueprint_file):
+        continue
+    setattr(TestPackaged, f"test_blueprint_{blueprint_file}", blueprint_tester(blueprint_file))

authentik/blueprints/tests/test_v1.py

@@ -1,53 +1,56 @@
-"""Test flow transfer"""
+"""Test blueprints v1"""
-from json import dumps
-
 from django.test import TransactionTestCase
 
+from authentik.blueprints.v1.exporter import FlowExporter
+from authentik.blueprints.v1.importer import Importer, transaction_rollback
 from authentik.flows.models import Flow, FlowDesignation, FlowStageBinding
-from authentik.flows.transfer.common import DataclassEncoder
-from authentik.flows.transfer.exporter import FlowExporter
-from authentik.flows.transfer.importer import FlowImporter, transaction_rollback
 from authentik.lib.generators import generate_id
 from authentik.policies.expression.models import ExpressionPolicy
 from authentik.policies.models import PolicyBinding
 from authentik.stages.prompt.models import FieldTypes, Prompt, PromptStage
 from authentik.stages.user_login.models import UserLoginStage
 
-STATIC_PROMPT_EXPORT = """{
+STATIC_PROMPT_EXPORT = """version: 1
-    "version": 1,
+entries:
-    "entries": [
+- identifiers:
-        {
+    pk: cb954fd4-65a5-4ad9-b1ee-180ee9559cf4
-            "identifiers": {
+  model: authentik_stages_prompt.prompt
-                "pk": "cb954fd4-65a5-4ad9-b1ee-180ee9559cf4"
+  attrs:
-            },
+    field_key: username
-            "model": "authentik_stages_prompt.prompt",
+    label: Username
-            "attrs": {
+    type: username
-                "field_key": "username",
+    required: true
-                "label": "Username",
+    placeholder: Username
-                "type": "username",
+    order: 0
-                "required": true,
+"""
-                "placeholder": "Username",
+
-                "order": 0
+YAML_TAG_TESTS = """version: 1
-            }
+context:
-        }
+    foo: bar
-    ]
+entries:
-}"""
+- attrs:
+    expression: return True
+  identifiers:
+    name: !Format [foo-%s-%s, !Context foo, !Context bar]
+  id: default-source-enrollment-if-username
+  model: authentik_policies_expression.expressionpolicy
+"""
 
 
-class TestFlowTransfer(TransactionTestCase):
+class TestBlueprintsV1(TransactionTestCase):
-    """Test flow transfer"""
+    """Test Blueprints"""
 
-    def test_bundle_invalid_format(self):
+    def test_blueprint_invalid_format(self):
-        """Test bundle with invalid format"""
+        """Test blueprint with invalid format"""
-        importer = FlowImporter('{"version": 3}')
+        importer = Importer('{"version": 3}')
-        self.assertFalse(importer.validate())
+        self.assertFalse(importer.validate()[0])
-        importer = FlowImporter(
+        importer = Importer(
             (
                 '{"version": 1,"entries":[{"identifiers":{},"attrs":{},'
                 '"model": "authentik_core.User"}]}'
             )
         )
-        self.assertFalse(importer.validate())
+        self.assertFalse(importer.validate()[0])
 
     def test_export_validate_import(self):
         """Test export and validate it"""
@@ -70,10 +73,10 @@ class TestFlowTransfer(TransactionTestCase):
             exporter = FlowExporter(flow)
             export = exporter.export()
             self.assertEqual(len(export.entries), 3)
-            export_json = exporter.export_to_string()
+            export_yaml = exporter.export_to_string()
 
-        importer = FlowImporter(export_json)
+        importer = Importer(export_yaml)
-        self.assertTrue(importer.validate())
+        self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 
         self.assertTrue(Flow.objects.filter(slug=flow_slug).exists())
@@ -82,18 +85,26 @@ class TestFlowTransfer(TransactionTestCase):
         """Test export and import it twice"""
         count_initial = Prompt.objects.filter(field_key="username").count()
 
-        importer = FlowImporter(STATIC_PROMPT_EXPORT)
+        importer = Importer(STATIC_PROMPT_EXPORT)
-        self.assertTrue(importer.validate())
+        self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())
 
         count_before = Prompt.objects.filter(field_key="username").count()
         self.assertEqual(count_initial + 1, count_before)
 
-        importer = FlowImporter(STATIC_PROMPT_EXPORT)
+        importer = Importer(STATIC_PROMPT_EXPORT)
         self.assertTrue(importer.apply())
 
         self.assertEqual(Prompt.objects.filter(field_key="username").count(), count_before)
 
+    def test_import_yaml_tags(self):
+        """Test some yaml tags"""
+        ExpressionPolicy.objects.filter(name="foo-foo-bar").delete()
+        importer = Importer(YAML_TAG_TESTS, {"bar": "baz"})
+        self.assertTrue(importer.validate()[0])
+        self.assertTrue(importer.apply())
+        self.assertTrue(ExpressionPolicy.objects.filter(name="foo-foo-bar"))
+
     def test_export_validate_import_policies(self):
         """Test export and validate it"""
         flow_slug = generate_id()
@@ -116,12 +127,10 @@ class TestFlowTransfer(TransactionTestCase):
             PolicyBinding.objects.create(policy=flow_policy, target=fsb, order=0)
 
             exporter = FlowExporter(flow)
-            export = exporter.export()
+            export_yaml = exporter.export_to_string()
 
-            export_json = dumps(export, cls=DataclassEncoder)
+        importer = Importer(export_yaml)
-
+        self.assertTrue(importer.validate()[0])
-        importer = FlowImporter(export_json)
-        self.assertTrue(importer.validate())
         self.assertTrue(importer.apply())
         self.assertTrue(UserLoginStage.objects.filter(name=stage_name).exists())
         self.assertTrue(Flow.objects.filter(slug=flow_slug).exists())
@@ -161,10 +170,9 @@ class TestFlowTransfer(TransactionTestCase):
             FlowStageBinding.objects.create(target=flow, stage=first_stage, order=0)
 
             exporter = FlowExporter(flow)
-            export = exporter.export()
+            export_yaml = exporter.export_to_string()
-            export_json = dumps(export, cls=DataclassEncoder)
 
-        importer = FlowImporter(export_json)
+        importer = Importer(export_yaml)
 
-        self.assertTrue(importer.validate())
+        self.assertTrue(importer.validate()[0])
         self.assertTrue(importer.apply())

authentik/blueprints/tests/test_v1_api.py

@@ -0,0 +1,45 @@
+"""Test blueprints v1 api"""
+from json import loads
+from tempfile import NamedTemporaryFile, mkdtemp
+
+from django.urls import reverse
+from rest_framework.test import APITestCase
+from yaml import dump
+
+from authentik.core.tests.utils import create_test_admin_user
+from authentik.lib.config import CONFIG
+
+TMP = mkdtemp("authentik-blueprints")
+
+
+class TestBlueprintsV1API(APITestCase):
+    """Test Blueprints API"""
+
+    def setUp(self) -> None:
+        self.user = create_test_admin_user()
+        self.client.force_login(self.user)
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_api_available(self):
+        """Test valid file"""
+        with NamedTemporaryFile(mode="w+", suffix=".yaml", dir=TMP) as file:
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                    }
+                )
+            )
+            file.flush()
+            res = self.client.get(reverse("authentik_api:blueprintinstance-available"))
+            self.assertEqual(res.status_code, 200)
+            response = loads(res.content.decode())
+            self.assertEqual(len(response), 1)
+            self.assertEqual(
+                response[0]["hash"],
+                (
+                    "e52bb445b03cd36057258dc9f0ce0fbed8278498ee1470e45315293e5f026d1bd1f9b352"
+                    "6871c0003f5c07be5c3316d9d4a08444bd8fed1b3f03294e51e44522"
+                ),
+            )

authentik/blueprints/tests/test_v1_tasks.py

@@ -0,0 +1,148 @@
+"""Test blueprints v1 tasks"""
+from hashlib import sha512
+from tempfile import NamedTemporaryFile, mkdtemp
+
+from django.test import TransactionTestCase
+from yaml import dump
+
+from authentik.blueprints.models import BlueprintInstance, BlueprintInstanceStatus
+from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_discover, blueprints_find
+from authentik.lib.config import CONFIG
+from authentik.lib.generators import generate_id
+
+TMP = mkdtemp("authentik-blueprints")
+
+
+class TestBlueprintsV1Tasks(TransactionTestCase):
+    """Test Blueprints v1 Tasks"""
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_invalid_file_syntax(self):
+        """Test syntactically invalid file"""
+        with NamedTemporaryFile(suffix=".yaml", dir=TMP) as file:
+            file.write(b"{")
+            file.flush()
+            blueprints = blueprints_find()
+            self.assertEqual(blueprints, [])
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_invalid_file_version(self):
+        """Test invalid file"""
+        with NamedTemporaryFile(suffix=".yaml", dir=TMP) as file:
+            file.write(b"version: 2")
+            file.flush()
+            blueprints = blueprints_find()
+            self.assertEqual(blueprints, [])
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_valid(self):
+        """Test valid file"""
+        blueprint_id = generate_id()
+        with NamedTemporaryFile(mode="w+", suffix=".yaml", dir=TMP) as file:
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                        "metadata": {
+                            "name": blueprint_id,
+                        },
+                    }
+                )
+            )
+            file.seek(0)
+            file_hash = sha512(file.read().encode()).hexdigest()
+            file.flush()
+            blueprints_discover()  # pylint: disable=no-value-for-parameter
+            instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
+            self.assertEqual(instance.last_applied_hash, file_hash)
+            self.assertEqual(
+                instance.metadata,
+                {
+                    "name": blueprint_id,
+                    "labels": {},
+                },
+            )
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_valid_updated(self):
+        """Test valid file"""
+        with NamedTemporaryFile(mode="w+", suffix=".yaml", dir=TMP) as file:
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                    }
+                )
+            )
+            file.flush()
+            blueprints_discover()  # pylint: disable=no-value-for-parameter
+            self.assertEqual(
+                BlueprintInstance.objects.first().last_applied_hash,
+                (
+                    "e52bb445b03cd36057258dc9f0ce0fbed8278498ee1470e45315293e5f026d1b"
+                    "d1f9b3526871c0003f5c07be5c3316d9d4a08444bd8fed1b3f03294e51e44522"
+                ),
+            )
+            self.assertEqual(BlueprintInstance.objects.first().metadata, {})
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                        "metadata": {
+                            "name": "foo",
+                        },
+                    }
+                )
+            )
+            file.flush()
+            blueprints_discover()  # pylint: disable=no-value-for-parameter
+            self.assertEqual(
+                BlueprintInstance.objects.first().last_applied_hash,
+                (
+                    "fc62fea96067da8592bdf90927246d0ca150b045447df93b0652a0e20a8bc327"
+                    "681510b5db37ea98759c61f9a98dd2381f46a3b5a2da69dfb45158897f14e824"
+                ),
+            )
+            self.assertEqual(
+                BlueprintInstance.objects.first().metadata,
+                {
+                    "name": "foo",
+                    "labels": {},
+                },
+            )
+
+    @CONFIG.patch("blueprints_dir", TMP)
+    def test_valid_disabled(self):
+        """Test valid file"""
+        with NamedTemporaryFile(mode="w+", suffix=".yaml", dir=TMP) as file:
+            file.write(
+                dump(
+                    {
+                        "version": 1,
+                        "entries": [],
+                    }
+                )
+            )
+            file.flush()
+            instance: BlueprintInstance = BlueprintInstance.objects.create(
+                name=generate_id(),
+                path=file.name,
+                enabled=False,
+                status=BlueprintInstanceStatus.UNKNOWN,
+            )
+            instance.refresh_from_db()
+            self.assertEqual(instance.last_applied_hash, "")
+            self.assertEqual(
+                instance.status,
+                BlueprintInstanceStatus.UNKNOWN,
+            )
+            apply_blueprint(instance.pk)  # pylint: disable=no-value-for-parameter
+            instance.refresh_from_db()
+            self.assertEqual(instance.last_applied_hash, "")
+            self.assertEqual(
+                instance.status,
+                BlueprintInstanceStatus.UNKNOWN,
+            )

authentik/blueprints/v1/common.py

@@ -0,0 +1,262 @@
+"""transfer common classes"""
+from collections import OrderedDict
+from dataclasses import asdict, dataclass, field, is_dataclass
+from enum import Enum
+from typing import Any, Optional
+from uuid import UUID
+
+from django.apps import apps
+from django.db.models import Model, Q
+from rest_framework.fields import Field
+from rest_framework.serializers import Serializer
+from yaml import SafeDumper, SafeLoader, ScalarNode, SequenceNode
+
+from authentik.lib.models import SerializerModel
+from authentik.lib.sentry import SentryIgnoredException
+from authentik.policies.models import PolicyBindingModel
+
+
+def get_attrs(obj: SerializerModel) -> dict[str, Any]:
+    """Get object's attributes via their serializer, and convert it to a normal dict"""
+    serializer: Serializer = obj.serializer(obj)
+    data = dict(serializer.data)
+
+    for field_name, _field in serializer.fields.items():
+        _field: Field
+        if field_name not in data:
+            continue
+        if _field.read_only:
+            data.pop(field_name, None)
+        if _field.get_initial() == data.get(field_name, None):
+            data.pop(field_name, None)
+        if field_name.endswith("_set"):
+            data.pop(field_name, None)
+    return data
+
+
+@dataclass
+class BlueprintEntryState:
+    """State of a single instance"""
+
+    instance: Optional[Model] = None
+
+
+@dataclass
+class BlueprintEntry:
+    """Single entry of a blueprint"""
+
+    model: str
+    identifiers: dict[str, Any] = field(default_factory=dict)
+    attrs: Optional[dict[str, Any]] = field(default_factory=dict)
+
+    # pylint: disable=invalid-name
+    id: Optional[str] = None
+
+    _state: BlueprintEntryState = field(default_factory=BlueprintEntryState)
+
+    @staticmethod
+    def from_model(model: SerializerModel, *extra_identifier_names: str) -> "BlueprintEntry":
+        """Convert a SerializerModel instance to a blueprint Entry"""
+        identifiers = {
+            "pk": model.pk,
+        }
+        all_attrs = get_attrs(model)
+
+        for extra_identifier_name in extra_identifier_names:
+            identifiers[extra_identifier_name] = all_attrs.pop(extra_identifier_name, None)
+        return BlueprintEntry(
+            identifiers=identifiers,
+            model=f"{model._meta.app_label}.{model._meta.model_name}",
+            attrs=all_attrs,
+        )
+
+    def tag_resolver(self, value: Any, blueprint: "Blueprint") -> Any:
+        """Check if we have any special tags that need handling"""
+        if isinstance(value, YAMLTag):
+            return value.resolve(self, blueprint)
+        if isinstance(value, dict):
+            for key, inner_value in value.items():
+                value[key] = self.tag_resolver(inner_value, blueprint)
+        if isinstance(value, list):
+            for idx, inner_value in enumerate(value):
+                value[idx] = self.tag_resolver(inner_value, blueprint)
+        return value
+
+    def get_attrs(self, blueprint: "Blueprint") -> dict[str, Any]:
+        """Get attributes of this entry, with all yaml tags resolved"""
+        return self.tag_resolver(self.attrs, blueprint)
+
+    def get_identifiers(self, blueprint: "Blueprint") -> dict[str, Any]:
+        """Get attributes of this entry, with all yaml tags resolved"""
+        return self.tag_resolver(self.identifiers, blueprint)
+
+
+@dataclass
+class BlueprintMetadata:
+    """Optional blueprint metadata"""
+
+    name: str
+    labels: dict[str, str] = field(default_factory=dict)
+
+
+@dataclass
+class Blueprint:
+    """Dataclass used for a full export"""
+
+    version: int = field(default=1)
+    entries: list[BlueprintEntry] = field(default_factory=list)
+    context: dict = field(default_factory=dict)
+
+    metadata: Optional[BlueprintMetadata] = field(default=None)
+
+
+class YAMLTag:
+    """Base class for all YAML Tags"""
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        """Implement yaml tag logic"""
+        raise NotImplementedError
+
+
+class KeyOf(YAMLTag):
+    """Reference another object by their ID"""
+
+    id_from: str
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
+        super().__init__()
+        self.id_from = node.value
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        for _entry in blueprint.entries:
+            if _entry.id == self.id_from and _entry._state.instance:
+                # Special handling for PolicyBindingModels, as they'll have a different PK
+                # which is used when creating policy bindings
+                if (
+                    isinstance(_entry._state.instance, PolicyBindingModel)
+                    and entry.model.lower() == "authentik_policies.policybinding"
+                ):
+                    return _entry._state.instance.pbm_uuid
+                return _entry._state.instance.pk
+        raise EntryInvalidError(
+            f"KeyOf: failed to find entry with `id` of `{self.id_from}` and a model instance"
+        )
+
+
+class Context(YAMLTag):
+    """Lookup key from instance context"""
+
+    key: str
+    default: Optional[Any]
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
+        super().__init__()
+        self.default = None
+        if isinstance(node, ScalarNode):
+            self.key = node.value
+        if isinstance(node, SequenceNode):
+            self.key = node.value[0].value
+            self.default = node.value[1].value
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        value = self.default
+        if self.key in blueprint.context:
+            value = blueprint.context[self.key]
+        return value
+
+
+class Format(YAMLTag):
+    """Format a string"""
+
+    format_string: str
+    args: list[Any]
+
+    # pylint: disable=unused-argument
+    def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
+        super().__init__()
+        self.format_string = node.value[0].value
+        self.args = []
+        for raw_node in node.value[1:]:
+            self.args.append(raw_node.value)
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        try:
+            return self.format_string % tuple(self.args)
+        except TypeError as exc:
+            raise EntryInvalidError(exc)
+
+
+class Find(YAMLTag):
+    """Find any object"""
+
+    model_name: str
+    conditions: list[list]
+
+    model_class: type[Model]
+
+    def __init__(self, loader: "BlueprintLoader", node: SequenceNode) -> None:
+        super().__init__()
+        self.model_name = node.value[0].value
+        self.model_class = apps.get_model(*self.model_name.split("."))
+        self.conditions = []
+        for raw_node in node.value[1:]:
+            values = []
+            for node_values in raw_node.value:
+                values.append(loader.construct_object(node_values))
+            self.conditions.append(values)
+
+    def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
+        query = Q()
+        for cond in self.conditions:
+            query &= Q(**{cond[0]: cond[1]})
+        instance = self.model_class.objects.filter(query).first()
+        if instance:
+            return instance.pk
+        return None
+
+
+class BlueprintDumper(SafeDumper):
+    """Dump dataclasses to yaml"""
+
+    default_flow_style = False
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.add_representer(UUID, lambda self, data: self.represent_str(str(data)))
+        self.add_representer(OrderedDict, lambda self, data: self.represent_dict(dict(data)))
+        self.add_representer(Enum, lambda self, data: self.represent_str(data.value))
+        self.add_representer(None, lambda self, data: self.represent_str(str(data)))
+
+    def represent(self, data) -> None:
+        if is_dataclass(data):
+
+            def factory(items):
+                final_dict = dict(items)
+                final_dict.pop("_state", None)
+                return final_dict
+
+            data = asdict(data, dict_factory=factory)
+        return super().represent(data)
+
+
+class BlueprintLoader(SafeLoader):
+    """Loader for blueprints with custom tag support"""
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.add_constructor("!KeyOf", KeyOf)
+        self.add_constructor("!Find", Find)
+        self.add_constructor("!Context", Context)
+        self.add_constructor("!Format", Format)
+
+
+class EntryInvalidError(SentryIgnoredException):
+    """Error raised when an entry is invalid"""
+
+    serializer_errors: Optional[dict]
+
+    def __init__(self, *args: object, serializer_errors: Optional[dict] = None) -> None:
+        super().__init__(*args)
+        self.serializer_errors = serializer_errors

authentik/blueprints/v1/exporter.py

@@ -0,0 +1,149 @@
+"""Blueprint exporter"""
+from typing import Iterable
+from uuid import UUID
+
+from django.apps import apps
+from django.contrib.auth import get_user_model
+from django.db.models import Model, Q, QuerySet
+from django.utils.timezone import now
+from django.utils.translation import gettext as _
+from guardian.shortcuts import get_anonymous_user
+from yaml import dump
+
+from authentik.blueprints.v1.common import (
+    Blueprint,
+    BlueprintDumper,
+    BlueprintEntry,
+    BlueprintMetadata,
+)
+from authentik.blueprints.v1.importer import is_model_allowed
+from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_GENERATED
+from authentik.events.models import Event
+from authentik.flows.models import Flow, FlowStageBinding, Stage
+from authentik.policies.models import Policy, PolicyBinding
+from authentik.stages.prompt.models import PromptStage
+
+
+class Exporter:
+    """Export flow with attached stages into yaml"""
+
+    excluded_models: list[type[Model]] = []
+
+    def __init__(self):
+        self.excluded_models = [
+            Event,
+        ]
+
+    def get_entries(self) -> Iterable[BlueprintEntry]:
+        """Get blueprint entries"""
+        for model in apps.get_models():
+            if not is_model_allowed(model):
+                continue
+            if model in self.excluded_models:
+                continue
+            for obj in self.get_model_instances(model):
+                yield BlueprintEntry.from_model(obj)
+
+    def get_model_instances(self, model: type[Model]) -> QuerySet:
+        """Return a queryset for `model`. Can be used to filter some
+        objects on some models"""
+        if model == get_user_model():
+            return model.objects.exclude(pk=get_anonymous_user().pk)
+        return model.objects.all()
+
+    def _pre_export(self, blueprint: Blueprint):
+        """Hook to run anything pre-export"""
+
+    def export(self) -> Blueprint:
+        """Create a list of all objects and create a blueprint"""
+        blueprint = Blueprint()
+        self._pre_export(blueprint)
+        blueprint.metadata = BlueprintMetadata(
+            name=_("authentik Export - %(date)s" % {"date": str(now())}),
+            labels={
+                LABEL_AUTHENTIK_GENERATED: "true",
+            },
+        )
+        blueprint.entries = list(self.get_entries())
+        return blueprint
+
+    def export_to_string(self) -> str:
+        """Call export and convert it to yaml"""
+        blueprint = self.export()
+        return dump(blueprint, Dumper=BlueprintDumper)
+
+
+class FlowExporter(Exporter):
+    """Exporter customised to only return objects related to `flow`"""
+
+    flow: Flow
+    with_policies: bool
+    with_stage_prompts: bool
+
+    pbm_uuids: list[UUID]
+
+    def __init__(self, flow: Flow):
+        super().__init__()
+        self.flow = flow
+        self.with_policies = True
+        self.with_stage_prompts = True
+
+    def _pre_export(self, blueprint: Blueprint):
+        if not self.with_policies:
+            return
+        self.pbm_uuids = [self.flow.pbm_uuid]
+        self.pbm_uuids += FlowStageBinding.objects.filter(target=self.flow).values_list(
+            "pbm_uuid", flat=True
+        )
+
+    def walk_stages(self) -> Iterable[BlueprintEntry]:
+        """Convert all stages attached to self.flow into BlueprintEntry objects"""
+        stages = Stage.objects.filter(flow=self.flow).select_related().select_subclasses()
+        for stage in stages:
+            if isinstance(stage, PromptStage):
+                pass
+            yield BlueprintEntry.from_model(stage, "name")
+
+    def walk_stage_bindings(self) -> Iterable[BlueprintEntry]:
+        """Convert all bindings attached to self.flow into BlueprintEntry objects"""
+        bindings = FlowStageBinding.objects.filter(target=self.flow).select_related()
+        for binding in bindings:
+            yield BlueprintEntry.from_model(binding, "target", "stage", "order")
+
+    def walk_policies(self) -> Iterable[BlueprintEntry]:
+        """Walk over all policies. This is done at the beginning of the export for stages that have
+        a direct foreign key to a policy."""
+        # Special case for PromptStage as that has a direct M2M to policy, we have to ensure
+        # all policies referenced in there we also include here
+        prompt_stages = PromptStage.objects.filter(flow=self.flow).values_list("pk", flat=True)
+        query = Q(bindings__in=self.pbm_uuids) | Q(promptstage__in=prompt_stages)
+        policies = Policy.objects.filter(query).select_related()
+        for policy in policies:
+            yield BlueprintEntry.from_model(policy)
+
+    def walk_policy_bindings(self) -> Iterable[BlueprintEntry]:
+        """Walk over all policybindings relative to us. This is run at the end of the export, as
+        we are sure all objects exist now."""
+        bindings = PolicyBinding.objects.filter(target__in=self.pbm_uuids).select_related()
+        for binding in bindings:
+            yield BlueprintEntry.from_model(binding, "policy", "target", "order")
+
+    def walk_stage_prompts(self) -> Iterable[BlueprintEntry]:
+        """Walk over all prompts associated with any PromptStages"""
+        prompt_stages = PromptStage.objects.filter(flow=self.flow)
+        for stage in prompt_stages:
+            for prompt in stage.fields.all():
+                yield BlueprintEntry.from_model(prompt)
+
+    def get_entries(self) -> Iterable[BlueprintEntry]:
+        entries = []
+        entries.append(BlueprintEntry.from_model(self.flow, "slug"))
+        if self.with_stage_prompts:
+            entries.extend(self.walk_stage_prompts())
+        if self.with_policies:
+            entries.extend(self.walk_policies())
+        entries.extend(self.walk_stages())
+        entries.extend(self.walk_stage_bindings())
+        if self.with_policies:
+            entries.extend(self.walk_policy_bindings())
+        return entries

authentik/blueprints/v1/importer.py

@@ -1,12 +1,11 @@
-"""Flow importer"""
+"""Blueprint importer"""
 from contextlib import contextmanager
 from copy import deepcopy
-from json import loads
+from typing import Any, Optional
-from typing import Any
 
-from dacite import from_dict
+from dacite.core import from_dict
 from dacite.exceptions import DaciteError
-from django.apps import apps
+from deepmerge import always_merger
 from django.db import transaction
 from django.db.models import Model
 from django.db.models.query_utils import Q
@@ -14,38 +13,88 @@ from django.db.utils import IntegrityError
 from rest_framework.exceptions import ValidationError
 from rest_framework.serializers import BaseSerializer, Serializer
 from structlog.stdlib import BoundLogger, get_logger
+from structlog.testing import capture_logs
+from structlog.types import EventDict
+from yaml import load
 
-from authentik.flows.models import Flow, FlowStageBinding, Stage
+from authentik.blueprints.v1.common import (
-from authentik.flows.transfer.common import EntryInvalidError, FlowBundle, FlowBundleEntry
+    Blueprint,
+    BlueprintEntry,
+    BlueprintEntryState,
+    BlueprintLoader,
+    EntryInvalidError,
+)
+from authentik.blueprints.v1.meta.registry import BaseMetaModel, registry
+from authentik.core.models import (
+    AuthenticatedSession,
+    PropertyMapping,
+    Provider,
+    Source,
+    UserSourceConnection,
+)
+from authentik.flows.models import Stage
 from authentik.lib.models import SerializerModel
-from authentik.policies.models import Policy, PolicyBinding
+from authentik.outposts.models import OutpostServiceConnection
-from authentik.stages.prompt.models import Prompt
+from authentik.policies.models import Policy, PolicyBindingModel
 
-ALLOWED_MODELS = (Flow, FlowStageBinding, Stage, Policy, PolicyBinding, Prompt)
+
+def is_model_allowed(model: type[Model]) -> bool:
+    """Check if model is allowed"""
+    # pylint: disable=imported-auth-user
+    from django.contrib.auth.models import Group as DjangoGroup
+    from django.contrib.auth.models import User as DjangoUser
+
+    excluded_models = (
+        DjangoUser,
+        DjangoGroup,
+        # Base classes
+        Provider,
+        Source,
+        PropertyMapping,
+        UserSourceConnection,
+        Stage,
+        OutpostServiceConnection,
+        Policy,
+        PolicyBindingModel,
+        # Classes that have other dependencies
+        AuthenticatedSession,
+    )
+    return model not in excluded_models and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 @contextmanager
 def transaction_rollback():
     """Enters an atomic transaction and always triggers a rollback at the end of the block."""
     atomic = transaction.atomic()
+    # pylint: disable=unnecessary-dunder-call
     atomic.__enter__()
     yield
     atomic.__exit__(IntegrityError, None, None)
 
 
-class FlowImporter:
+class Importer:
-    """Import Flow from json"""
+    """Import Blueprint from YAML"""
 
     logger: BoundLogger
 
-    def __init__(self, json_input: str):
+    def __init__(self, yaml_input: str, context: Optional[dict] = None):
         self.__pk_map: dict[Any, Model] = {}
         self.logger = get_logger()
-        import_dict = loads(json_input)
+        import_dict = load(yaml_input, BlueprintLoader)
         try:
-            self.__import = from_dict(FlowBundle, import_dict)
+            self.__import = from_dict(Blueprint, import_dict)
         except DaciteError as exc:
             raise EntryInvalidError from exc
+        context = {}
+        always_merger.merge(context, self.__import.context)
+        if context:
+            always_merger.merge(context, context)
+        self.__import.context = context
+
+    @property
+    def blueprint(self) -> Blueprint:
+        """Get imported blueprint"""
+        return self.__import
 
     def __update_pks_for_attrs(self, attrs: dict[str, Any]) -> dict[str, Any]:
         """Replace any value if it is a known primary key of an other object"""
@@ -74,6 +123,8 @@ class FlowImporter:
         """Generate an or'd query from all identifiers in an entry"""
         # Since identifiers can also be pk-references to other objects (see FlowStageBinding)
         # we have to ensure those references are also replaced
+        main_query = Q()
+        if "pk" in attrs:
             main_query = Q(pk=attrs["pk"])
         sub_query = Q()
         for identifier, value in attrs.items():
@@ -84,19 +135,32 @@ class FlowImporter:
             sub_query &= Q(**{identifier: value})
         return main_query | sub_query
 
-    def _validate_single(self, entry: FlowBundleEntry) -> BaseSerializer:
+    def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer:
         """Validate a single entry"""
         model_app_label, model_name = entry.model.split(".")
-        model: type[SerializerModel] = apps.get_model(model_app_label, model_name)
+        model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
-        if not isinstance(model(), ALLOWED_MODELS):
+        # Don't use isinstance since we don't want to check for inheritance
+        if not is_model_allowed(model):
             raise EntryInvalidError(f"Model {model} not allowed")
+        if issubclass(model, BaseMetaModel):
+            serializer_class: type[Serializer] = model.serializer()
+            serializer = serializer_class(data=entry.get_attrs(self.__import))
+            try:
+                serializer.is_valid(raise_exception=True)
+            except ValidationError as exc:
+                raise EntryInvalidError(
+                    f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
+                ) from exc
+            return serializer
+        if entry.identifiers == {}:
+            raise EntryInvalidError("No identifiers")
 
         # If we try to validate without referencing a possible instance
         # we'll get a duplicate error, hence we load the model here and return
         # the full serializer for later usage
         # Because a model might have multiple unique columns, we chain all identifiers together
         # to create an OR query.
-        updated_identifiers = self.__update_pks_for_attrs(entry.identifiers)
+        updated_identifiers = self.__update_pks_for_attrs(entry.get_identifiers(self.__import))
         for key, value in list(updated_identifiers.items()):
             if isinstance(value, dict) and "pk" in value:
                 del updated_identifiers[key]
@@ -104,7 +168,7 @@ class FlowImporter:
         existing_models = model.objects.filter(self.__query_from_identifier(updated_identifiers))
 
         serializer_kwargs = {}
-        if existing_models.exists():
+        if not isinstance(model(), BaseMetaModel) and existing_models.exists():
             model_instance = existing_models.first()
             self.logger.debug(
                 "initialise serializer with instance",
@@ -113,14 +177,20 @@ class FlowImporter:
                 pk=model_instance.pk,
             )
             serializer_kwargs["instance"] = model_instance
+            serializer_kwargs["partial"] = True
         else:
-            self.logger.debug("initialise new instance", model=model, **updated_identifiers)
+            self.logger.debug(
+                "initialised new serializer instance", model=model, **updated_identifiers
+            )
             model_instance = model()
             # pk needs to be set on the model instance otherwise a new one will be generated
             if "pk" in updated_identifiers:
                 model_instance.pk = updated_identifiers["pk"]
             serializer_kwargs["instance"] = model_instance
-        full_data = self.__update_pks_for_attrs(entry.attrs)
+        try:
+            full_data = self.__update_pks_for_attrs(entry.get_attrs(self.__import))
+        except ValueError as exc:
+            raise EntryInvalidError(exc) from exc
         full_data.update(updated_identifiers)
         serializer_kwargs["data"] = full_data
 
@@ -128,11 +198,13 @@ class FlowImporter:
         try:
             serializer.is_valid(raise_exception=True)
         except ValidationError as exc:
-            raise EntryInvalidError(f"Serializer errors {serializer.errors}") from exc
+            raise EntryInvalidError(
+                f"Serializer errors {serializer.errors}", serializer_errors=serializer.errors
+            ) from exc
         return serializer
 
     def apply(self) -> bool:
-        """Apply (create/update) flow json, in database transaction"""
+        """Apply (create/update) models yaml, in database transaction"""
         try:
             with transaction.atomic():
                 if not self._apply_models():
@@ -145,13 +217,12 @@ class FlowImporter:
         return True
 
     def _apply_models(self) -> bool:
-        """Apply (create/update) flow json"""
+        """Apply (create/update) models yaml"""
         self.__pk_map = {}
-        entries = deepcopy(self.__import.entries)
+        for entry in self.__import.entries:
-        for entry in entries:
             model_app_label, model_name = entry.model.split(".")
             try:
-                model: SerializerModel = apps.get_model(model_app_label, model_name)
+                model: type[SerializerModel] = registry.get_model(model_app_label, model_name)
             except LookupError:
                 self.logger.warning(
                     "app or model does not exist", app=model_app_label, model=model_name
@@ -161,23 +232,32 @@ class FlowImporter:
             try:
                 serializer = self._validate_single(entry)
             except EntryInvalidError as exc:
-                self.logger.warning("entry not valid", entry=entry, error=exc)
+                self.logger.warning(f"entry invalid: {exc}", entry=entry, error=exc)
                 return False
 
             model = serializer.save()
+            if "pk" in entry.identifiers:
                 self.__pk_map[entry.identifiers["pk"]] = model.pk
-            self.logger.debug("updated model", model=model, pk=model.pk)
+            entry._state = BlueprintEntryState(model)
+            self.logger.debug("updated model", model=model)
         return True
 
-    def validate(self) -> bool:
+    def validate(self) -> tuple[bool, list[EventDict]]:
-        """Validate loaded flow export, ensure all models are allowed
+        """Validate loaded blueprint export, ensure all models are allowed
         and serializers have no errors"""
-        self.logger.debug("Starting flow import validation")
+        self.logger.debug("Starting blueprint import validation")
+        orig_import = deepcopy(self.__import)
         if self.__import.version != 1:
-            self.logger.warning("Invalid bundle version")
+            self.logger.warning("Invalid blueprint version")
-            return False
+            return False, []
-        with transaction_rollback():
+        with (
+            transaction_rollback(),
+            capture_logs() as logs,
+        ):
             successful = self._apply_models()
             if not successful:
-                self.logger.debug("Flow validation failed")
+                self.logger.debug("Blueprint validation failed")
-        return successful
+        for log in logs:
+            getattr(self.logger, log.get("log_level"))(**log)
+        self.__import = orig_import
+        return successful, logs

authentik/blueprints/v1/labels.py

@@ -0,0 +1,5 @@
+"""Blueprint labels"""
+
+LABEL_AUTHENTIK_SYSTEM = "blueprints.goauthentik.io/system"
+LABEL_AUTHENTIK_INSTANTIATE = "blueprints.goauthentik.io/instantiate"
+LABEL_AUTHENTIK_GENERATED = "blueprints.goauthentik.io/generated"

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -0,0 +1,60 @@
+"""Apply Blueprint meta model"""
+from typing import TYPE_CHECKING
+
+from rest_framework.exceptions import ValidationError
+from rest_framework.fields import BooleanField, JSONField
+from structlog.stdlib import get_logger
+
+from authentik.blueprints.v1.meta.registry import BaseMetaModel, MetaResult, registry
+from authentik.core.api.utils import PassiveSerializer, is_dict
+
+if TYPE_CHECKING:
+    from authentik.blueprints.models import BlueprintInstance
+
+LOGGER = get_logger()
+
+
+class ApplyBlueprintMetaSerializer(PassiveSerializer):
+    """Serializer for meta apply blueprint model"""
+
+    identifiers = JSONField(validators=[is_dict])
+    required = BooleanField(default=True)
+
+    # We cannot override `instance` as that will confuse rest_framework
+    # and make it attempt to update the instance
+    blueprint_instance: "BlueprintInstance"
+
+    def validate(self, attrs):
+        from authentik.blueprints.models import BlueprintInstance
+
+        identifiers = attrs["identifiers"]
+        required = attrs["required"]
+        instance = BlueprintInstance.objects.filter(**identifiers).first()
+        if not instance and required:
+            raise ValidationError("Required blueprint does not exist")
+        self.blueprint_instance = instance
+        return super().validate(attrs)
+
+    def create(self, validated_data: dict) -> MetaResult:
+        from authentik.blueprints.v1.tasks import apply_blueprint
+
+        if not self.blueprint_instance:
+            LOGGER.info("Blueprint does not exist, but not required")
+            return MetaResult()
+        LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
+        # pylint: disable=no-value-for-parameter
+        apply_blueprint(str(self.blueprint_instance.pk))
+        return MetaResult()
+
+
+@registry.register("metaapplyblueprint")
+class MetaApplyBlueprint(BaseMetaModel):
+    """Meta model to apply another blueprint"""
+
+    @staticmethod
+    def serializer() -> ApplyBlueprintMetaSerializer:
+        return ApplyBlueprintMetaSerializer
+
+    class Meta:
+
+        abstract = True

authentik/blueprints/v1/meta/registry.py

@@ -0,0 +1,61 @@
+"""Base models"""
+from django.apps import apps
+from django.db.models import Model
+from rest_framework.serializers import Serializer
+
+
+class BaseMetaModel(Model):
+    """Base models"""
+
+    @staticmethod
+    def serializer() -> Serializer:
+        """Serializer similar to SerializerModel, but as a static method since
+        this is an abstract model"""
+        raise NotImplementedError
+
+    class Meta:
+
+        abstract = True
+
+
+class MetaResult:
+    """Result returned by Meta Models' serializers. Empty class but we can't return none as
+    the framework doesn't allow that"""
+
+
+class MetaModelRegistry:
+    """Registry for pseudo meta models"""
+
+    models: dict[str, BaseMetaModel]
+    virtual_prefix: str
+
+    def __init__(self, prefix: str) -> None:
+        self.models = {}
+        self.virtual_prefix = prefix
+
+    def register(self, model_id: str):
+        """Register model class under `model_id`"""
+
+        def inner_wrapper(cls):
+            self.models[model_id] = cls
+            return cls
+
+        return inner_wrapper
+
+    def get_models(self):
+        """Wrapper for django's `get_models` to list all models"""
+        models = apps.get_models()
+        for _, value in self.models.items():
+            models.append(value)
+        return models
+
+    def get_model(self, app_label: str, model_id: str) -> type[Model]:
+        """Get model checks if any virtual models are registered, and falls back
+        to actual django models"""
+        if app_label.lower() == self.virtual_prefix:
+            if model_id.lower() in self.models:
+                return self.models[model_id]
+        return apps.get_model(app_label, model_id)
+
+
+registry = MetaModelRegistry("authentik_blueprints")

authentik/blueprints/v1/tasks.py

@@ -0,0 +1,181 @@
+"""v1 blueprints tasks"""
+from dataclasses import asdict, dataclass, field
+from hashlib import sha512
+from pathlib import Path
+from typing import Optional
+
+from dacite.core import from_dict
+from django.db import DatabaseError, InternalError, ProgrammingError
+from django.utils.text import slugify
+from django.utils.timezone import now
+from django.utils.translation import gettext_lazy as _
+from structlog.stdlib import get_logger
+from yaml import load
+from yaml.error import YAMLError
+
+from authentik.blueprints.models import (
+    BlueprintInstance,
+    BlueprintInstanceStatus,
+    BlueprintRetrievalFailed,
+)
+from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata, EntryInvalidError
+from authentik.blueprints.v1.importer import Importer
+from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_INSTANTIATE
+from authentik.events.monitored_tasks import (
+    MonitoredTask,
+    TaskResult,
+    TaskResultStatus,
+    prefill_task,
+)
+from authentik.events.utils import sanitize_dict
+from authentik.lib.config import CONFIG
+from authentik.root.celery import CELERY_APP
+
+LOGGER = get_logger()
+
+
+@dataclass
+class BlueprintFile:
+    """Basic info about a blueprint file"""
+
+    path: str
+    version: int
+    hash: str
+    last_m: int
+    meta: Optional[BlueprintMetadata] = field(default=None)
+
+
+@CELERY_APP.task(
+    throws=(DatabaseError, ProgrammingError, InternalError),
+)
+def blueprints_find_dict():
+    """Find blueprints as `blueprints_find` does, but return a safe dict"""
+    blueprints = []
+    for blueprint in blueprints_find():
+        blueprints.append(sanitize_dict(asdict(blueprint)))
+    return blueprints
+
+
+def blueprints_find():
+    """Find blueprints and return valid ones"""
+    blueprints = []
+    root = Path(CONFIG.y("blueprints_dir"))
+    for file in root.glob("**/*.yaml"):
+        path = Path(file)
+        LOGGER.debug("found blueprint", path=str(path))
+        with open(path, "r", encoding="utf-8") as blueprint_file:
+            try:
+                raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
+            except YAMLError as exc:
+                raw_blueprint = None
+                LOGGER.warning("failed to parse blueprint", exc=exc, path=str(path))
+            if not raw_blueprint:
+                continue
+            metadata = raw_blueprint.get("metadata", None)
+            version = raw_blueprint.get("version", 1)
+            if version != 1:
+                LOGGER.warning("invalid blueprint version", version=version, path=str(path))
+                continue
+        file_hash = sha512(path.read_bytes()).hexdigest()
+        blueprint = BlueprintFile(
+            str(path.relative_to(root)), version, file_hash, int(path.stat().st_mtime)
+        )
+        blueprint.meta = from_dict(BlueprintMetadata, metadata) if metadata else None
+        blueprints.append(blueprint)
+        LOGGER.info(
+            "parsed & loaded blueprint",
+            hash=file_hash,
+            path=str(path),
+        )
+    return blueprints
+
+
+@CELERY_APP.task(
+    throws=(DatabaseError, ProgrammingError, InternalError), base=MonitoredTask, bind=True
+)
+@prefill_task
+def blueprints_discover(self: MonitoredTask):
+    """Find blueprints and check if they need to be created in the database"""
+    count = 0
+    for blueprint in blueprints_find():
+        check_blueprint_v1_file(blueprint)
+        count += 1
+    self.set_status(
+        TaskResult(
+            TaskResultStatus.SUCCESSFUL,
+            messages=[_("Successfully imported %(count)d files." % {"count": count})],
+        )
+    )
+
+
+def check_blueprint_v1_file(blueprint: BlueprintFile):
+    """Check if blueprint should be imported"""
+    instance: BlueprintInstance = BlueprintInstance.objects.filter(path=blueprint.path).first()
+    if (
+        blueprint.meta
+        and blueprint.meta.labels.get(LABEL_AUTHENTIK_INSTANTIATE, "").lower() == "false"
+    ):
+        return
+    if not instance:
+        instance = BlueprintInstance(
+            name=blueprint.meta.name if blueprint.meta else str(blueprint.path),
+            path=blueprint.path,
+            context={},
+            status=BlueprintInstanceStatus.UNKNOWN,
+            enabled=True,
+            managed_models=[],
+            metadata={},
+        )
+        instance.save()
+    if instance.last_applied_hash != blueprint.hash:
+        apply_blueprint.delay(str(instance.pk))
+
+
+@CELERY_APP.task(
+    bind=True,
+    base=MonitoredTask,
+)
+def apply_blueprint(self: MonitoredTask, instance_pk: str):
+    """Apply single blueprint"""
+    self.save_on_success = False
+    instance: Optional[BlueprintInstance] = None
+    try:
+        instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
+        self.set_uid(slugify(instance.name))
+        if not instance or not instance.enabled:
+            return
+        blueprint_content = instance.retrieve()
+        file_hash = sha512(blueprint_content.encode()).hexdigest()
+        importer = Importer(blueprint_content, instance.context)
+        if importer.blueprint.metadata:
+            instance.metadata = asdict(importer.blueprint.metadata)
+        valid, logs = importer.validate()
+        if not valid:
+            instance.status = BlueprintInstanceStatus.ERROR
+            instance.save()
+            self.set_status(TaskResult(TaskResultStatus.ERROR, [x["event"] for x in logs]))
+            return
+        applied = importer.apply()
+        if not applied:
+            instance.status = BlueprintInstanceStatus.ERROR
+            instance.save()
+            self.set_status(TaskResult(TaskResultStatus.ERROR, "Failed to apply"))
+            return
+        instance.status = BlueprintInstanceStatus.SUCCESSFUL
+        instance.last_applied_hash = file_hash
+        instance.last_applied = now()
+        self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
+    except (
+        DatabaseError,
+        ProgrammingError,
+        InternalError,
+        IOError,
+        BlueprintRetrievalFailed,
+        EntryInvalidError,
+    ) as exc:
+        if instance:
+            instance.status = BlueprintInstanceStatus.ERROR
+        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
+    finally:
+        if instance:
+            instance.save()

authentik/core/api/applications.py

@@ -50,6 +50,8 @@ class ApplicationSerializer(ModelSerializer):
 
     def get_launch_url(self, app: Application) -> Optional[str]:
         """Allow formatting of launch URL"""
+        user = None
+        if "request" in self.context:
             user = self.context["request"].user
         return app.get_launch_url(user)
 
@@ -63,6 +65,7 @@ class ApplicationSerializer(ModelSerializer):
             "provider",
             "provider_obj",
             "launch_url",
+            "open_in_new_tab",
             "meta_launch_url",
             "meta_icon",
             "meta_description",
@@ -88,8 +91,15 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         "meta_publisher",
         "group",
     ]
+    filterset_fields = [
+        "name",
+        "slug",
+        "meta_launch_url",
+        "meta_description",
+        "meta_publisher",
+        "group",
+    ]
     lookup_field = "slug"
-    filterset_fields = ["name", "slug"]
     ordering = ["name"]
 
     def _filter_queryset_for_list(self, queryset: QuerySet) -> QuerySet:
@@ -222,7 +232,11 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             return Response({})
         if icon:
             app.meta_icon = icon
+            try:
                 app.save()
+            except PermissionError as exc:
+                LOGGER.warning("Failed to save icon", exc=exc)
+                return HttpResponseBadRequest()
             return Response({})
         return HttpResponseBadRequest()
 

authentik/core/api/devices.py

@@ -1,9 +1,10 @@
 """Authenticator Devices API Views"""
-from django_otp import devices_for_user
+from django_otp import device_classes, devices_for_user
 from django_otp.models import Device
-from drf_spectacular.utils import extend_schema
+from drf_spectacular.types import OpenApiTypes
-from rest_framework.fields import CharField, IntegerField, SerializerMethodField
+from drf_spectacular.utils import OpenApiParameter, extend_schema
-from rest_framework.permissions import IsAuthenticated
+from rest_framework.fields import BooleanField, CharField, IntegerField, SerializerMethodField
+from rest_framework.permissions import IsAdminUser, IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
@@ -17,6 +18,7 @@ class DeviceSerializer(MetaNameSerializer):
     pk = IntegerField()
     name = CharField()
     type = SerializerMethodField()
+    confirmed = BooleanField()
 
     def get_type(self, instance: Device) -> str:
         """Get type of device"""
@@ -34,3 +36,33 @@ class DeviceViewSet(ViewSet):
         """Get all devices for current user"""
         devices = devices_for_user(request.user)
         return Response(DeviceSerializer(devices, many=True).data)
+
+
+class AdminDeviceViewSet(ViewSet):
+    """Viewset for authenticator devices"""
+
+    serializer_class = DeviceSerializer
+    permission_classes = [IsAdminUser]
+
+    def get_devices(self, **kwargs):
+        """Get all devices in all child classes"""
+        for model in device_classes():
+            device_set = model.objects.filter(**kwargs)
+            yield from device_set
+
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(
+                name="user",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.INT,
+            )
+        ],
+        responses={200: DeviceSerializer(many=True)},
+    )
+    def list(self, request: Request) -> Response:
+        """Get all devices for current user"""
+        kwargs = {}
+        if "user" in request.query_params:
+            kwargs = {"user": request.query_params["user"]}
+        return Response(DeviceSerializer(self.get_devices(**kwargs), many=True).data)

authentik/core/api/groups.py

@@ -62,6 +62,11 @@ class GroupSerializer(ModelSerializer):
             "attributes",
             "users_obj",
         ]
+        extra_kwargs = {
+            "users": {
+                "default": list,
+            }
+        }
 
 
 class GroupFilter(FilterSet):

authentik/core/api/propertymappings.py

@@ -14,12 +14,12 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
 from authentik.api.decorators import permission_required
+from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
-from authentik.core.expression import PropertyMappingEvaluator
+from authentik.core.expression.evaluator import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
 from authentik.lib.utils.reflection import all_subclasses
-from authentik.managed.api import ManagedSerializer
 from authentik.policies.api.exec import PolicyTestSerializer
 
 
@@ -41,7 +41,9 @@ class PropertyMappingSerializer(ManagedSerializer, ModelSerializer, MetaNameSeri
 
     def validate_expression(self, expression: str) -> str:
         """Test Syntax"""
-        evaluator = PropertyMappingEvaluator()
+        evaluator = PropertyMappingEvaluator(
+            self.instance,
+        )
         evaluator.validate(expression)
         return expression
 

authentik/core/api/sources.py

@@ -8,7 +8,7 @@ from rest_framework.decorators import action
 from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
-from rest_framework.serializers import ModelSerializer, SerializerMethodField
+from rest_framework.serializers import ModelSerializer, ReadOnlyField, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
@@ -26,6 +26,7 @@ LOGGER = get_logger()
 class SourceSerializer(ModelSerializer, MetaNameSerializer):
     """Source Serializer"""
 
+    managed = ReadOnlyField()
     component = SerializerMethodField()
 
     def get_component(self, obj: Source) -> str:
@@ -51,6 +52,8 @@ class SourceSerializer(ModelSerializer, MetaNameSerializer):
             "meta_model_name",
             "policy_engine_mode",
             "user_matching_mode",
+            "managed",
+            "user_path_template",
         ]
 
 
@@ -67,6 +70,7 @@ class SourceViewSet(
     serializer_class = SourceSerializer
     lookup_field = "slug"
     search_fields = ["slug", "name"]
+    filterset_fields = ["slug", "name", "managed"]
 
     def get_queryset(self):  # pragma: no cover
         return Source.objects.select_subclasses()

authentik/core/api/tokens.py

@@ -15,13 +15,13 @@ from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.authorization import OwnerSuperuserPermissions
 from authentik.api.decorators import permission_required
+from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
-from authentik.managed.api import ManagedSerializer
 
 
 class TokenSerializer(ManagedSerializer, ModelSerializer):

authentik/core/api/users.py

@@ -24,7 +24,13 @@ from drf_spectacular.utils import (
 )
 from guardian.shortcuts import get_anonymous_user, get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.fields import CharField, JSONField, SerializerMethodField
+from rest_framework.fields import (
+    CharField,
+    IntegerField,
+    JSONField,
+    ListField,
+    SerializerMethodField,
+)
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import (
@@ -43,16 +49,23 @@ from authentik.api.decorators import permission_required
 from authentik.core.api.groups import GroupSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import LinkSerializer, PassiveSerializer, is_dict
-from authentik.core.middleware import SESSION_IMPERSONATE_ORIGINAL_USER, SESSION_IMPERSONATE_USER
+from authentik.core.middleware import (
+    SESSION_KEY_IMPERSONATE_ORIGINAL_USER,
+    SESSION_KEY_IMPERSONATE_USER,
+)
 from authentik.core.models import (
     USER_ATTRIBUTE_SA,
     USER_ATTRIBUTE_TOKEN_EXPIRING,
+    USER_PATH_SERVICE_ACCOUNT,
     Group,
     Token,
     TokenIntents,
     User,
 )
 from authentik.events.models import EventAction
+from authentik.flows.models import FlowToken
+from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
+from authentik.flows.views.executor import QS_KEY_TOKEN
 from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
@@ -74,6 +87,15 @@ class UserSerializer(ModelSerializer):
     uid = CharField(read_only=True)
     username = CharField(max_length=150)
 
+    def validate_path(self, path: str) -> str:
+        """Validate path"""
+        if path[:1] == "/" or path[-1] == "/":
+            raise ValidationError(_("No leading or trailing slashes allowed."))
+        for segment in path.split("/"):
+            if segment == "":
+                raise ValidationError(_("No empty segments in user path allowed."))
+        return path
+
     class Meta:
 
         model = User
@@ -90,6 +112,7 @@ class UserSerializer(ModelSerializer):
             "avatar",
             "attributes",
             "uid",
+            "path",
         ]
         extra_kwargs = {
             "name": {"allow_blank": True},
@@ -205,6 +228,11 @@ class UsersFilter(FilterSet):
     is_superuser = BooleanFilter(field_name="ak_groups", lookup_expr="is_superuser")
     uuid = CharFilter(field_name="uuid")
 
+    path = CharFilter(
+        field_name="path",
+    )
+    path_startswith = CharFilter(field_name="path", lookup_expr="startswith")
+
     groups_by_name = ModelMultipleChoiceFilter(
         field_name="ak_groups__name",
         to_field_name="name",
@@ -269,12 +297,23 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             LOGGER.debug("No recovery flow set")
             return None, None
         user: User = self.get_object()
-        token, __ = Token.objects.get_or_create(
+        planner = FlowPlanner(flow)
-            identifier=f"{user.uid}-password-reset",
+        planner.allow_empty_flows = True
-            user=user,
+        plan = planner.plan(
-            intent=TokenIntents.INTENT_RECOVERY,
+            self.request._request,
+            {
+                PLAN_CONTEXT_PENDING_USER: user,
+            },
         )
-        querystring = urlencode({"token": token.key})
+        token, __ = FlowToken.objects.update_or_create(
+            identifier=f"{user.uid}-password-reset",
+            defaults={
+                "user": user,
+                "flow": flow,
+                "_plan": FlowToken.pickle(plan),
+            },
+        )
+        querystring = urlencode({QS_KEY_TOKEN: token.key})
         link = self.request.build_absolute_uri(
             reverse_lazy("authentik_core:if-flow", kwargs={"flow_slug": flow.slug})
             + f"?{querystring}"
@@ -296,6 +335,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 {
                     "username": CharField(required=True),
                     "token": CharField(required=True),
+                    "user_uid": CharField(required=True),
+                    "user_pk": IntegerField(required=True),
+                    "group_pk": CharField(required=False),
                 },
             )
         },
@@ -311,19 +353,27 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                     username=username,
                     name=username,
                     attributes={USER_ATTRIBUTE_SA: True, USER_ATTRIBUTE_TOKEN_EXPIRING: False},
+                    path=USER_PATH_SERVICE_ACCOUNT,
                 )
+                response = {
+                    "username": user.username,
+                    "user_uid": user.uid,
+                    "user_pk": user.pk,
+                }
                 if create_group and self.request.user.has_perm("authentik_core.add_group"):
                     group = Group.objects.create(
                         name=username,
                     )
                     group.users.add(user)
+                    response["group_pk"] = str(group.pk)
                 token = Token.objects.create(
                     identifier=slugify(f"service-account-{username}-password"),
                     intent=TokenIntents.INTENT_APP_PASSWORD,
                     user=user,
                     expires=now() + timedelta(days=360),
                 )
-                return Response({"username": user.username, "token": token.key})
+                response["token"] = token.key
+                return Response(response)
             except (IntegrityError) as exc:
                 return Response(data={"non_field_errors": [str(exc)]}, status=400)
 
@@ -336,11 +386,12 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         serializer = SessionUserSerializer(
             data={"user": UserSelfSerializer(instance=request.user, context=context).data}
         )
-        if SESSION_IMPERSONATE_USER in request._request.session:
+        if SESSION_KEY_IMPERSONATE_USER in request._request.session:
             serializer.initial_data["original"] = UserSelfSerializer(
-                instance=request._request.session[SESSION_IMPERSONATE_ORIGINAL_USER],
+                instance=request._request.session[SESSION_KEY_IMPERSONATE_ORIGINAL_USER],
                 context=context,
             ).data
+        self.request.session.modified = True
         return Response(serializer.initial_data)
 
     @permission_required("authentik_core.reset_user_password")
@@ -367,7 +418,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         except (ValidationError, IntegrityError) as exc:
             LOGGER.debug("Failed to set password", exc=exc)
             return Response(status=400)
-        if user.pk == request.user.pk and SESSION_IMPERSONATE_USER not in self.request.session:
+        if user.pk == request.user.pk and SESSION_KEY_IMPERSONATE_USER not in self.request.session:
             LOGGER.debug("Updating session hash after password change")
             update_session_auth_hash(self.request, user)
         return Response(status=204)
@@ -419,7 +470,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     # pylint: disable=invalid-name, unused-argument
     def recovery_email(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
-        for_user = self.get_object()
+        for_user: User = self.get_object()
         if for_user.email == "":
             LOGGER.debug("User doesn't have an email address")
             return Response(status=404)
@@ -437,8 +488,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),
-            template_name=email_stage.template,
             to=[for_user.email],
+            template_name=email_stage.template,
+            language=for_user.locale(request),
             template_context={
                 "url": link,
                 "user": for_user,
@@ -460,3 +512,32 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         if self.request.user.has_perm("authentik_core.view_user"):
             return self._filter_queryset_for_list(queryset)
         return super().filter_queryset(queryset)
+
+    @extend_schema(
+        responses={
+            200: inline_serializer(
+                "UserPathSerializer", {"paths": ListField(child=CharField(), read_only=True)}
+            )
+        },
+        parameters=[
+            OpenApiParameter(
+                name="search",
+                location=OpenApiParameter.QUERY,
+                type=OpenApiTypes.STR,
+            )
+        ],
+    )
+    @action(detail=False, pagination_class=None)
+    def paths(self, request: Request) -> Response:
+        """Get all user paths"""
+        return Response(
+            data={
+                "paths": list(
+                    self.filter_queryset(self.get_queryset())
+                    .values("path")
+                    .distinct()
+                    .order_by("path")
+                    .values_list("path", flat=True)
+                )
+            }
+        )

authentik/core/apps.py

@@ -1,30 +1,37 @@
 """authentik core app config"""
-from importlib import import_module
+from django.conf import settings
 
-from django.apps import AppConfig
+from authentik.blueprints.apps import ManagedAppConfig
-from django.db import ProgrammingError
-
-from authentik.core.signals import GAUGE_MODELS
-from authentik.lib.utils.reflection import get_apps
 
 
-class AuthentikCoreConfig(AppConfig):
+class AuthentikCoreConfig(ManagedAppConfig):
     """authentik core app config"""
 
     name = "authentik.core"
     label = "authentik_core"
     verbose_name = "authentik Core"
     mountpoint = ""
+    default = True
 
-    def ready(self):
+    def reconcile_load_core_signals(self):
-        import_module("authentik.core.signals")
+        """Load core signals"""
-        import_module("authentik.core.managed")
+        self.import_module("authentik.core.signals")
-        try:
+
-            for app in get_apps():
+    def reconcile_debug_worker_hook(self):
-                for model in app.get_models():
+        """Dispatch startup tasks inline when debugging"""
-                    GAUGE_MODELS.labels(
+        if settings.DEBUG:
-                        model_name=model._meta.model_name,
+            from authentik.root.celery import worker_ready_hook
-                        app=model._meta.app_label,
+
-                    ).set(model.objects.count())
+            worker_ready_hook()
-        except ProgrammingError:
+
-            pass
+    def reconcile_source_inbuilt(self):
+        """Reconcile inbuilt source"""
+        from authentik.core.models import Source
+
+        Source.objects.update_or_create(
+            defaults={
+                "name": "authentik Built-in",
+                "slug": "authentik-built-in",
+            },
+            managed="goauthentik.io/sources/inbuilt",
+        )

authentik/core/expression/evaluator.py

@@ -2,28 +2,32 @@
 from traceback import format_tb
 from typing import Optional
 
+from django.db.models import Model
 from django.http import HttpRequest
-from guardian.utils import get_anonymous_user
 
-from authentik.core.models import PropertyMapping, User
+from authentik.core.models import User
 from authentik.events.models import Event, EventAction
 from authentik.lib.expression.evaluator import BaseEvaluator
 from authentik.policies.types import PolicyRequest
 
 
 class PropertyMappingEvaluator(BaseEvaluator):
-    """Custom Evalautor that adds some different context variables."""
+    """Custom Evaluator that adds some different context variables."""
 
-    def set_context(
+    def __init__(
         self,
-        user: Optional[User],
+        model: Model,
-        request: Optional[HttpRequest],
+        user: Optional[User] = None,
-        mapping: PropertyMapping,
+        request: Optional[HttpRequest] = None,
         **kwargs,
     ):
-        """Update context with context from PropertyMapping's evaluate"""
+        if hasattr(model, "name"):
-        req = PolicyRequest(user=get_anonymous_user())
+            _filename = model.name
-        req.obj = mapping
+        else:
+            _filename = str(model)
+        super().__init__(filename=_filename)
+        req = PolicyRequest(user=User())
+        req.obj = model
         if user:
             req.user = user
             self._context["user"] = user

authentik/core/managed.py

@@ -1,16 +0,0 @@
-"""Core managed objects"""
-from authentik.core.models import Source
-from authentik.managed.manager import EnsureExists, ObjectManager
-
-
-class CoreManager(ObjectManager):
-    """Core managed objects"""
-
-    def reconcile(self):
-        return [
-            EnsureExists(
-                Source,
-                "goauthentik.io/sources/inbuilt",
-                name="authentik Built-in",
-            ),
-        ]

authentik/core/management/commands/bootstrap_tasks.py

@@ -0,0 +1,13 @@
+"""Run bootstrap tasks"""
+from django.core.management.base import BaseCommand
+
+from authentik.root.celery import _get_startup_tasks
+
+
+class Command(BaseCommand):
+    """Run bootstrap tasks to ensure certain objects are created"""
+
+    def handle(self, **options):
+        tasks = _get_startup_tasks()
+        for task in tasks:
+            task()

authentik/core/management/commands/repair_permissions.py

@@ -2,9 +2,10 @@
 from django.apps import apps
 from django.contrib.auth.management import create_permissions
 from django.core.management.base import BaseCommand, no_translations
+from guardian.management import create_anonymous_user
 
 
-class Command(BaseCommand):  # pragma: no cover
+class Command(BaseCommand):
     """Repair missing permissions"""
 
     @no_translations
@@ -13,3 +14,4 @@ class Command(BaseCommand):  # pragma: no cover
         for app in apps.get_app_configs():
             self.stdout.write(f"Checking app {app.name} ({app.label})\n")
             create_permissions(app, verbosity=0)
+        create_anonymous_user(None, using="default")

authentik/core/management/commands/shell.py

@@ -7,9 +7,9 @@ from django.core.management.base import BaseCommand
 from django.db.models import Model
 from django.db.models.signals import post_save, pre_delete
 
-from authentik import __version__
+from authentik import get_full_version
 from authentik.core.models import User
-from authentik.events.middleware import IGNORED_MODELS
+from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
@@ -18,11 +18,11 @@ BANNER_TEXT = """### authentik shell ({authentik})
     node=platform.node(),
     python=platform.python_version(),
     arch=platform.machine(),
-    authentik=__version__,
+    authentik=get_full_version(),
 )
 
 
-class Command(BaseCommand):  # pragma: no cover
+class Command(BaseCommand):
     """Start the Django shell with all authentik models already imported"""
 
     django_models = {}
@@ -40,9 +40,6 @@ class Command(BaseCommand):  # pragma: no cover
 
         # Gather Django models and constants from each app
         for app in apps.get_app_configs():
-            if not app.name.startswith("authentik"):
-                continue
-
             # Load models from each app
             for model in app.get_models():
                 namespace[model.__name__] = model
@@ -53,7 +50,7 @@ class Command(BaseCommand):  # pragma: no cover
     # pylint: disable=unused-argument
     def post_save_handler(sender, instance: Model, created: bool, **_):
         """Signal handler for all object's post_save"""
-        if isinstance(instance, IGNORED_MODELS):
+        if not should_log_model(instance):
             return
 
         action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
@@ -69,7 +66,7 @@ class Command(BaseCommand):  # pragma: no cover
     # pylint: disable=unused-argument
     def pre_delete_handler(sender, instance: Model, **_):
         """Signal handler for all object's pre_delete"""
-        if isinstance(instance, IGNORED_MODELS):  # pragma: no cover
+        if not should_log_model(instance):  # pragma: no cover
             return
 
         Event.new(EventAction.MODEL_DELETED, model=model_to_dict(instance)).set_user(

authentik/core/middleware.py

@@ -1,19 +1,23 @@
 """authentik admin Middleware to impersonate users"""
-from logging import Logger
+from contextvars import ContextVar
-from threading import local
+from typing import Callable, Optional
-from typing import Callable
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
+from django.utils.translation import activate
 from sentry_sdk.api import set_tag
+from structlog.contextvars import STRUCTLOG_KEY_PREFIX
 
-SESSION_IMPERSONATE_USER = "authentik_impersonate_user"
+SESSION_KEY_IMPERSONATE_USER = "authentik/impersonate/user"
-SESSION_IMPERSONATE_ORIGINAL_USER = "authentik_impersonate_original_user"
+SESSION_KEY_IMPERSONATE_ORIGINAL_USER = "authentik/impersonate/original_user"
-LOCAL = local()
 RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
+CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+
 
 class ImpersonateMiddleware:
     """Middleware to impersonate users"""
@@ -25,10 +29,14 @@ class ImpersonateMiddleware:
 
     def __call__(self, request: HttpRequest) -> HttpResponse:
         # No permission checks are done here, they need to be checked before
-        # SESSION_IMPERSONATE_USER is set.
+        # SESSION_KEY_IMPERSONATE_USER is set.
+        if request.user.is_authenticated:
+            locale = request.user.locale(request)
+            if locale != "":
+                activate(locale)
 
-        if SESSION_IMPERSONATE_USER in request.session:
+        if SESSION_KEY_IMPERSONATE_USER in request.session:
-            request.user = request.session[SESSION_IMPERSONATE_USER]
+            request.user = request.session[SESSION_KEY_IMPERSONATE_USER]
             # Ensure that the user is active, otherwise nothing will work
             request.user.is_active = True
 
@@ -47,26 +55,20 @@ class RequestIDMiddleware:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
             setattr(request, "request_id", request_id)
-            LOCAL.authentik = {
+            CTX_REQUEST_ID.set(request_id)
-                "request_id": request_id,
+            CTX_HOST.set(request.get_host())
-                "host": request.get_host(),
-            }
             set_tag("authentik.request_id", request_id)
+        if hasattr(request, "user") and getattr(request.user, "is_authenticated", False):
+            CTX_AUTH_VIA.set("session")
+        else:
+            CTX_AUTH_VIA.set("unauthenticated")
+
         response = self.get_response(request)
+
         response[RESPONSE_HEADER_ID] = request.request_id
         setattr(response, "ak_context", {})
-        response.ak_context.update(LOCAL.authentik)
+        response.ak_context["request_id"] = CTX_REQUEST_ID.get()
+        response.ak_context["host"] = CTX_HOST.get()
+        response.ak_context[KEY_AUTH_VIA] = CTX_AUTH_VIA.get()
         response.ak_context[KEY_USER] = request.user.username
-        for key in list(LOCAL.authentik.keys()):
-            del LOCAL.authentik[key]
         return response
-
-
-# pylint: disable=unused-argument
-def structlog_add_request_id(logger: Logger, method_name: str, event_dict: dict):
-    """If threadlocal has authentik defined, add request_id to log"""
-    if hasattr(LOCAL, "authentik"):
-        event_dict.update(LOCAL.authentik)
-    if hasattr(LOCAL, "authentik_task"):
-        event_dict.update(LOCAL.authentik_task)
-    return event_dict

authentik/core/migrations/0002_auto_20200523_1133.py

@@ -1,55 +0,0 @@
-# Generated by Django 3.0.6 on 2020-05-23 11:33
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_flows", "0003_auto_20200523_1133"),
-        ("authentik_core", "0001_initial"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="application",
-            name="skip_authorization",
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="authentication_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when authenticating existing users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_authentication",
-                to="authentik_flows.Flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="source",
-            name="enrollment_flow",
-            field=models.ForeignKey(
-                blank=True,
-                default=None,
-                help_text="Flow to use when enrolling new users.",
-                null=True,
-                on_delete=django.db.models.deletion.SET_NULL,
-                related_name="source_enrollment",
-                to="authentik_flows.Flow",
-            ),
-        ),
-        migrations.AddField(
-            model_name="provider",
-            name="authorization_flow",
-            field=models.ForeignKey(
-                help_text="Flow used when authorizing this provider.",
-                on_delete=django.db.models.deletion.CASCADE,
-                related_name="provider_authorization",
-                to="authentik_flows.Flow",
-            ),
-        ),
-    ]

authentik/core/migrations/0002_auto_20200523_1133_squashed_0011_provider_name_temp.py

@@ -12,18 +12,25 @@ import authentik.core.models
 
 
 def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
+    from django.contrib.auth.hashers import make_password
-    from authentik.core.models import User
 
+    User = apps.get_model("authentik_core", "User")
     db_alias = schema_editor.connection.alias
 
     akadmin, _ = User.objects.using(db_alias).get_or_create(
         username="akadmin", email="root@localhost", name="authentik Default Admin"
     )
-    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
+    password = None
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
+    if "TF_BUILD" in environ or settings.TEST:
+        password = "akadmin"  # noqa # nosec
+    if "AK_ADMIN_PASS" in environ:
+        password = environ["AK_ADMIN_PASS"]
+    if "AUTHENTIK_BOOTSTRAP_PASSWORD" in environ:
+        password = environ["AUTHENTIK_BOOTSTRAP_PASSWORD"]
+    if password:
+        akadmin.password = make_password(password)
     else:
-        akadmin.set_unusable_password()
+        akadmin.password = make_password(None)
     akadmin.save()
 
 

authentik/core/migrations/0003_default_user.py

@@ -1,50 +0,0 @@
-# Generated by Django 3.0.6 on 2020-05-23 16:40
-from os import environ
-
-from django.apps.registry import Apps
-from django.conf import settings
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-
-def create_default_user(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    # We have to use a direct import here, otherwise we get an object manager error
-    from authentik.core.models import User
-
-    db_alias = schema_editor.connection.alias
-
-    akadmin, _ = User.objects.using(db_alias).get_or_create(
-        username="akadmin", email="root@localhost", name="authentik Default Admin"
-    )
-    if "TF_BUILD" in environ or "AK_ADMIN_PASS" in environ or settings.TEST:
-        akadmin.set_password(environ.get("AK_ADMIN_PASS", "akadmin"), signal=False)  # noqa # nosec
-    else:
-        akadmin.set_unusable_password()
-    akadmin.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0002_auto_20200523_1133"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.RunPython(create_default_user),
-        migrations.AddField(
-            model_name="user",
-            name="is_superuser",
-            field=models.BooleanField(default=False),
-        ),
-        migrations.AddField(
-            model_name="user", name="is_staff", field=models.BooleanField(default=False)
-        ),
-    ]

authentik/core/migrations/0004_auto_20200703_2213.py

@@ -1,28 +0,0 @@
-# Generated by Django 3.0.7 on 2020-07-03 22:13
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0003_default_user"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="application",
-            options={
-                "verbose_name": "Application",
-                "verbose_name_plural": "Applications",
-            },
-        ),
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (("reset_user_password", "Reset Password"),),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-    ]

authentik/core/migrations/0005_token_intent.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.0.7 on 2020-07-05 21:11
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0004_auto_20200703_2213"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                ],
-                default="verification",
-            ),
-        ),
-    ]

authentik/core/migrations/0006_auto_20200709_1608.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.0.8 on 2020-07-09 16:08
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0005_token_intent"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="source",
-            name="slug",
-            field=models.SlugField(help_text="Internal source name, used in URLs.", unique=True),
-        ),
-    ]

authentik/core/migrations/0007_auto_20200815_1841.py

@@ -1,18 +0,0 @@
-# Generated by Django 3.1 on 2020-08-15 18:41
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0006_auto_20200709_1608"),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name="user",
-            name="first_name",
-            field=models.CharField(blank=True, max_length=150, verbose_name="first name"),
-        ),
-    ]

authentik/core/migrations/0008_auto_20200824_1532.py

@@ -1,36 +0,0 @@
-# Generated by Django 3.1 on 2020-08-24 15:32
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("auth", "0012_alter_user_first_name_max_length"),
-        ("authentik_core", "0007_auto_20200815_1841"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="groups",
-            field=models.ManyToManyField(
-                blank=True,
-                help_text="The groups this user belongs to. A user will get all permissions granted to each of their groups.",
-                related_name="user_set",
-                related_query_name="user",
-                to="auth.Group",
-                verbose_name="groups",
-            ),
-        ),
-        migrations.AddField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(to="authentik_core.Group"),
-        ),
-    ]

authentik/core/migrations/0009_group_is_superuser.py

@@ -1,59 +0,0 @@
-# Generated by Django 3.1.1 on 2020-09-15 19:53
-from django.apps.registry import Apps
-from django.db import migrations, models
-from django.db.backends.base.schema import BaseDatabaseSchemaEditor
-
-import authentik.core.models
-
-
-def create_default_admin_group(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
-    db_alias = schema_editor.connection.alias
-    Group = apps.get_model("authentik_core", "Group")
-    User = apps.get_model("authentik_core", "User")
-
-    # Creates a default admin group
-    group, _ = Group.objects.using(db_alias).get_or_create(
-        is_superuser=True,
-        defaults={
-            "name": "authentik Admins",
-        },
-    )
-    group.users.set(User.objects.filter(username="akadmin"))
-    group.save()
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0008_auto_20200824_1532"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="user",
-            name="is_superuser",
-        ),
-        migrations.RemoveField(
-            model_name="user",
-            name="is_staff",
-        ),
-        migrations.AlterField(
-            model_name="user",
-            name="pb_groups",
-            field=models.ManyToManyField(related_name="users", to="authentik_core.Group"),
-        ),
-        migrations.AddField(
-            model_name="group",
-            name="is_superuser",
-            field=models.BooleanField(
-                default=False, help_text="Users added to this group will be superusers."
-            ),
-        ),
-        migrations.RunPython(create_default_admin_group),
-        migrations.AlterModelManagers(
-            name="user",
-            managers=[
-                ("objects", authentik.core.models.UserManager()),
-            ],
-        ),
-    ]

authentik/core/migrations/0010_auto_20200917_1021.py

@@ -1,24 +0,0 @@
-# Generated by Django 3.1.1 on 2020-09-17 10:21
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0009_group_is_superuser"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="user",
-            options={
-                "permissions": (
-                    ("reset_user_password", "Reset Password"),
-                    ("impersonate", "Can impersonate other users"),
-                ),
-                "verbose_name": "User",
-                "verbose_name_plural": "Users",
-            },
-        ),
-    ]

authentik/core/migrations/0011_provider_name_temp.py

@@ -1,19 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 17:34
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0010_auto_20200917_1021"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="provider",
-            name="name_temp",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-    ]

authentik/core/migrations/0012_auto_20201003_1737.py

@@ -1,20 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 17:37
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0011_provider_name_temp"),
-        ("authentik_providers_oauth2", "0006_remove_oauth2provider_name"),
-        ("authentik_providers_saml", "0006_remove_samlprovider_name"),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="provider",
-            old_name="name_temp",
-            new_name="name",
-        ),
-    ]

authentik/core/migrations/0013_auto_20201003_2132.py

@@ -1,35 +0,0 @@
-# Generated by Django 3.1.2 on 2020-10-03 21:32
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_core", "0012_auto_20201003_1737"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="token",
-            name="identifier",
-            field=models.TextField(default=""),
-            preserve_default=False,
-        ),
-        migrations.AlterField(
-            model_name="token",
-            name="intent",
-            field=models.TextField(
-                choices=[
-                    ("verification", "Intent Verification"),
-                    ("api", "Intent Api"),
-                    ("recovery", "Intent Recovery"),
-                ],
-                default="verification",
-            ),
-        ),
-        migrations.AlterUniqueTogether(
-            name="token",
-            unique_together={("identifier", "user")},
-        ),
-    ]