web: revise CSS handling for esbuild

Replace some ad-hoc css mangling with the `unsafeCSS()` function as recommended
by Lit.  This also streamlines a bit of the CSS handling so that it's not calling
`ensure` multiple times.

The worst part of this is understanding just how much of this mangling is really
here to keep Storybook happy.

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2023.10.7
+current_version = 2024.2.2
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?

.github/ISSUE_TEMPLATE/question.md

@@ -9,7 +9,7 @@ assignees: ""
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 
-**Relevant infos**
+**Relevant info**
 i.e. Version of other software you're using, specifics of your setup
 
 **Screenshots**

.github/actions/docker-push-variables/action.yml

@@ -11,6 +11,10 @@ inputs:
     description: "Docker image arch"
 
 outputs:
+  shouldBuild:
+    description: "Whether to build image or not"
+    value: ${{ steps.ev.outputs.shouldBuild }}
+
   sha:
     description: "sha"
     value: ${{ steps.ev.outputs.sha }}
@@ -34,60 +38,10 @@ runs:
   steps:
     - name: Generate config
       id: ev
-      shell: python
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        IMAGE_ARCH: ${{ inputs.image-arch }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        """Helper script to get the actual branch name, docker safe"""
+        python3 ${{ github.action_path }}/push_vars.py
-        import configparser
-        import os
-        from time import time
-
-        parser = configparser.ConfigParser()
-        parser.read(".bumpversion.cfg")
-
-        branch_name = os.environ["GITHUB_REF"]
-        if os.environ.get("GITHUB_HEAD_REF", "") != "":
-            branch_name = os.environ["GITHUB_HEAD_REF"]
-        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
-
-        image_names = "${{ inputs.image-name }}".split(",")
-        image_arch = "${{ inputs.image-arch }}" or None
-
-        is_pull_request = bool("${{ github.event.pull_request.head.sha }}")
-        is_release = "dev" not in image_names[0]
-
-        sha = os.environ["GITHUB_SHA"] if not is_pull_request else "${{ github.event.pull_request.head.sha }}"
-
-        # 2042.1.0 or 2042.1.0-rc1
-        version = parser.get("bumpversion", "current_version")
-        # 2042.1
-        version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
-        prerelease = "-" in version
-
-        image_tags = []
-        if is_release:
-            for name in image_names:
-                image_tags += [
-                    f"{name}:{version}",
-                    f"{name}:{version_family}",
-                ]
-            if not prerelease:
-                image_tags += [f"{name}:latest"]
-        else:
-            suffix = ""
-            if image_arch and image_arch != "amd64":
-                suffix = f"-{image_arch}"
-            for name in image_names:
-                image_tags += [
-                    f"{name}:gh-{sha}{suffix}",
-                    f"{name}:gh-{safe_branch_name}{suffix}",
-                ]
-
-        image_main_tag = image_tags[0]
-        image_tags_rendered = ",".join(image_tags)
-
-        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
-            print("sha=%s" % sha, file=_output)
-            print("version=%s" % version, file=_output)
-            print("prerelease=%s" % prerelease, file=_output)
-            print("imageTags=%s" % image_tags_rendered, file=_output)
-            print("imageMainTag=%s" % image_main_tag, file=_output)

.github/actions/docker-push-variables/push_vars.py

@@ -0,0 +1,62 @@
+"""Helper script to get the actual branch name, docker safe"""
+
+import configparser
+import os
+from time import time
+
+parser = configparser.ConfigParser()
+parser.read(".bumpversion.cfg")
+
+should_build = str(os.environ.get("DOCKER_USERNAME", None) is not None).lower()
+
+branch_name = os.environ["GITHUB_REF"]
+if os.environ.get("GITHUB_HEAD_REF", "") != "":
+    branch_name = os.environ["GITHUB_HEAD_REF"]
+safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+image_names = os.getenv("IMAGE_NAME").split(",")
+image_arch = os.getenv("IMAGE_ARCH") or None
+
+is_pull_request = bool(os.getenv("PR_HEAD_SHA"))
+is_release = "dev" not in image_names[0]
+
+sha = os.environ["GITHUB_SHA"] if not is_pull_request else os.getenv("PR_HEAD_SHA")
+
+# 2042.1.0 or 2042.1.0-rc1
+version = parser.get("bumpversion", "current_version")
+# 2042.1
+version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
+prerelease = "-" in version
+
+image_tags = []
+if is_release:
+    for name in image_names:
+        image_tags += [
+            f"{name}:{version}",
+        ]
+        if not prerelease:
+            image_tags += [
+                f"{name}:latest",
+                f"{name}:{version_family}",
+            ]
+else:
+    suffix = ""
+    if image_arch and image_arch != "amd64":
+        suffix = f"-{image_arch}"
+    for name in image_names:
+        image_tags += [
+            f"{name}:gh-{sha}{suffix}",  # Used for ArgoCD and PR comments
+            f"{name}:gh-{safe_branch_name}{suffix}",  # For convenience
+            f"{name}:gh-{safe_branch_name}-{int(time())}-{sha[:7]}{suffix}",  # Use by FluxCD
+        ]
+
+image_main_tag = image_tags[0]
+image_tags_rendered = ",".join(image_tags)
+
+with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+    print("shouldBuild=%s" % should_build, file=_output)
+    print("sha=%s" % sha, file=_output)
+    print("version=%s" % version, file=_output)
+    print("prerelease=%s" % prerelease, file=_output)
+    print("imageTags=%s" % image_tags_rendered, file=_output)
+    print("imageMainTag=%s" % image_main_tag, file=_output)

.github/actions/docker-push-variables/test.sh

@@ -0,0 +1,7 @@
+#!/bin/bash -x
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+GITHUB_OUTPUT=/dev/stdout \
+    GITHUB_REF=ref \
+    GITHUB_SHA=sha \
+    IMAGE_NAME=ghcr.io/goauthentik/server,beryju/authentik \
+    python $SCRIPT_DIR/push_vars.py

.github/dependabot.yml

@@ -52,6 +52,10 @@ updates:
       esbuild:
         patterns:
           - "@esbuild/*"
+      rollup:
+        patterns:
+          - "@rollup/*"
+          - "rollup-*"
   - package-ecosystem: npm
     directory: "/tests/wdio"
     schedule:

.github/workflows/ci-main.yml

@@ -28,10 +28,7 @@ jobs:
           - bandit
           - black
           - codespell
-          - isort
           - pending-migrations
-          # - pylint
-          - pyright
           - ruff
     runs-on: ubuntu-latest
     steps:
@@ -70,7 +67,7 @@ jobs:
           cp authentik/lib/default.yml local.env.yml
           cp -R .github ..
           cp -R scripts ..
-          git checkout version/$(python -c "from authentik import __version__; print(__version__)")
+          git checkout $(git tag --sort=version:refname | grep '^version/' | grep -vE -- '-rc[0-9]+$' | tail -n1)
           rm -rf .github/ scripts/
           mv ../.github ../scripts .
       - name: Setup authentik env (stable)
@@ -219,7 +216,6 @@ jobs:
       # Needed to upload contianer images to ghcr.io
       packages: write
     timeout-minutes: 120
-    if: "github.repository == 'goauthentik/authentik'"
     steps:
       - uses: actions/checkout@v4
         with:
@@ -231,10 +227,13 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/dev-server
           image-arch: ${{ matrix.arch }}
       - name: Login to Container Registry
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -250,7 +249,7 @@ jobs:
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
           tags: ${{ steps.ev.outputs.imageTags }}
-          push: true
+          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
           cache-from: type=gha
@@ -272,6 +271,8 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/dev-server
       - name: Comment on PR

.github/workflows/ci-outpost.yml

@@ -71,7 +71,6 @@ jobs:
     permissions:
       # Needed to upload contianer images to ghcr.io
       packages: write
-    if: "github.repository == 'goauthentik/authentik'"
     steps:
       - uses: actions/checkout@v4
         with:
@@ -83,9 +82,12 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/dev-${{ matrix.type }}
       - name: Login to Container Registry
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -98,7 +100,7 @@ jobs:
         with:
           tags: ${{ steps.ev.outputs.imageTags }}
           file: ${{ matrix.type }}.Dockerfile
-          push: true
+          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
           platforms: linux/amd64,linux/arm64

.github/workflows/ci-website.yml

@@ -48,7 +48,6 @@ jobs:
       matrix:
         job:
           - build
-          - build-docs-only
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/release-publish.yml

@@ -20,6 +20,8 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/server,beryju/authentik
       - name: Docker Login Registry
@@ -72,6 +74,8 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/${{ matrix.type }},beryju/authentik-${{ matrix.type }}
       - name: make empty clients
@@ -168,12 +172,14 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/server
       - name: Get static files from docker image
         run: |
-          docker pull ghcr.io/goauthentik/server:${{ steps.ev.outputs.imageMainTag }}
+          docker pull ${{ steps.ev.outputs.imageMainTag }}
-          container=$(docker container create ghcr.io/goauthentik/server:${{ steps.ev.outputs.imageMainTag }})
+          container=$(docker container create ${{ steps.ev.outputs.imageMainTag }})
           docker cp ${container}:web/ .
       - name: Create a Sentry.io release
         uses: getsentry/action-release@v1

.github/workflows/release-tag.yml

@@ -32,6 +32,8 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
           image-name: ghcr.io/goauthentik/server
       - name: Create Release

.vscode/extensions.json

@@ -10,8 +10,7 @@
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
         "ms-python.black-formatter",
-        "ms-python.isort",
+        "charliermarsh.ruff",
-        "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
         "ms-python.black-formatter",

Dockerfile

@@ -14,9 +14,10 @@ RUN --mount=type=bind,target=/work/website/package.json,src=./website/package.js
 
 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
+COPY ./schema.yml /work/
 COPY ./SECURITY.md /work/
 
-RUN npm run build-docs-only
+RUN npm run build-bundled
 
 # Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
@@ -37,7 +38,7 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 RUN npm run build
 
 # Stage 3: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.0-bookworm AS go-builder
+FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS go-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -103,9 +104,10 @@ RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
     --mount=type=cache,target=/root/.cache/pip \
     --mount=type=cache,target=/root/.cache/pypoetry \
     python -m venv /ak-root/venv/ && \
+    bash -c "source ${VENV_PATH}/bin/activate && \
         pip3 install --upgrade pip && \
         pip3 install poetry && \
-    poetry install --only=main --no-ansi --no-interaction
+        poetry install --only=main --no-ansi --no-interaction --no-root"
 
 # Stage 6: Run
 FROM docker.io/python:3.12.2-slim-bookworm AS final-image
@@ -149,7 +151,7 @@ COPY --from=go-builder /go/authentik /bin/authentik
 COPY --from=python-deps /ak-root/venv /ak-root/venv
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/help/ /website/help/
+COPY --from=website-builder /work/website/build/ /website/help/
 COPY --from=geoip /usr/share/GeoIP /geoip
 
 USER 1000

Makefile

@@ -5,7 +5,7 @@ PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
-PY_SOURCES = authentik tests scripts lifecycle
+PY_SOURCES = authentik tests scripts lifecycle .github
 DOCKER_IMAGE ?= "authentik:test"
 
 GEN_API_TS = "gen-ts-api"
@@ -59,15 +59,12 @@ test: ## Run the server tests and produce a coverage report (locally)
 	coverage report
 
 lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
-	isort $(PY_SOURCES)
 	black $(PY_SOURCES)
-	ruff --fix $(PY_SOURCES)
+	ruff check --fix $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
 lint: ## Lint the python and golang sources
 	bandit -r $(PY_SOURCES) -x node_modules
-	./web/node_modules/.bin/pyright $(PY_SOURCES)
-	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
 core-install:
@@ -249,9 +246,6 @@ ci--meta-debug:
 	python -V
 	node --version
 
-ci-pylint: ci--meta-debug
-	pylint $(PY_SOURCES)
-
 ci-black: ci--meta-debug
 	black --check $(PY_SOURCES)
 
@@ -261,14 +255,8 @@ ci-ruff: ci--meta-debug
 ci-codespell: ci--meta-debug
 	codespell $(CODESPELL_ARGS) -s
 
-ci-isort: ci--meta-debug
-	isort --check $(PY_SOURCES)
-
 ci-bandit: ci--meta-debug
 	bandit -r $(PY_SOURCES)
 
-ci-pyright: ci--meta-debug
-	./web/node_modules/.bin/pyright $(PY_SOURCES)
-
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

authentik/__init__.py

@@ -1,13 +1,12 @@
 """authentik root module"""
 
 from os import environ
-from typing import Optional
 
-__version__ = "2023.10.7"
+__version__ = "2024.2.2"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 
-def get_build_hash(fallback: Optional[str] = None) -> str:
+def get_build_hash(fallback: str | None = None) -> str:
     """Get build hash"""
     build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
     return fallback if build_hash == "" and fallback else build_hash

authentik/api/apps.py

@@ -18,7 +18,7 @@ class AuthentikAPIConfig(AppConfig):
 
         # Class is defined here as it needs to be created early enough that drf-spectacular will
         # find it, but also won't cause any import issues
-        # pylint: disable=unused-variable
+
         class TokenSchema(OpenApiAuthenticationExtension):
             """Auth schema"""
 

authentik/api/authentication.py

@@ -1,7 +1,7 @@
 """API Authentication"""
 
 from hmac import compare_digest
-from typing import Any, Optional
+from typing import Any
 
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
@@ -17,7 +17,7 @@ from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> Optional[str]:
+def validate_auth(header: bytes) -> str | None:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -32,7 +32,7 @@ def validate_auth(header: bytes) -> Optional[str]:
     return auth_credentials
 
 
-def bearer_auth(raw_header: bytes) -> Optional[User]:
+def bearer_auth(raw_header: bytes) -> User | None:
     """raw_header in the Format of `Bearer ....`"""
     user = auth_user_lookup(raw_header)
     if not user:
@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
     return user
 
 
-def auth_user_lookup(raw_header: bytes) -> Optional[User]:
+def auth_user_lookup(raw_header: bytes) -> User | None:
     """raw_header in the Format of `Bearer ....`"""
     from authentik.providers.oauth2.models import AccessToken
 
@@ -75,7 +75,7 @@ def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     raise AuthenticationFailed("Token invalid/expired")
 
 
-def token_secret_key(value: str) -> Optional[User]:
+def token_secret_key(value: str) -> User | None:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST

authentik/api/tests/test_auth.py

@@ -25,17 +25,17 @@ class TestAPIAuth(TestCase):
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth("foo bar".encode())
+            bearer_auth(b"foo bar")
 
     def test_invalid_empty(self):
         """Test invalid type"""
-        self.assertIsNone(bearer_auth("Bearer ".encode()))
+        self.assertIsNone(bearer_auth(b"Bearer "))
-        self.assertIsNone(bearer_auth("".encode()))
+        self.assertIsNone(bearer_auth(b""))
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
-            auth = b64encode(":abc".encode()).decode()
+            auth = b64encode(b":abc").decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
     def test_bearer_valid(self):

authentik/api/tests/test_decorators.py

@@ -1,35 +0,0 @@
-"""test decorators api"""
-
-from django.urls import reverse
-from guardian.shortcuts import assign_perm
-from rest_framework.test import APITestCase
-
-from authentik.core.models import Application, User
-from authentik.lib.generators import generate_id
-
-
-class TestAPIDecorators(APITestCase):
-    """test decorators api"""
-
-    def setUp(self) -> None:
-        super().setUp()
-        self.user = User.objects.create(username="test-user")
-
-    def test_obj_perm_denied(self):
-        """Test object perm denied"""
-        self.client.force_login(self.user)
-        app = Application.objects.create(name=generate_id(), slug=generate_id())
-        response = self.client.get(
-            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
-        )
-        self.assertEqual(response.status_code, 403)
-
-    def test_other_perm_denied(self):
-        """Test other perm denied"""
-        self.client.force_login(self.user)
-        app = Application.objects.create(name=generate_id(), slug=generate_id())
-        assign_perm("authentik_core.view_application", self.user, app)
-        response = self.client.get(
-            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
-        )
-        self.assertEqual(response.status_code, 403)

authentik/api/tests/test_viewsets.py

@@ -1,6 +1,6 @@
 """authentik API Modelviewset tests"""
 
-from typing import Callable
+from collections.abc import Callable
 
 from django.test import TestCase
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -26,6 +26,6 @@ def viewset_tester_factory(test_viewset: type[ModelViewSet]) -> Callable:
 
 
 for _, viewset, _ in router.registry:
-    if not issubclass(viewset, (ModelViewSet, ReadOnlyModelViewSet)):
+    if not issubclass(viewset, ModelViewSet | ReadOnlyModelViewSet):
         continue
     setattr(TestModelViewSets, f"test_viewset_{viewset.__name__}", viewset_tester_factory(viewset))

authentik/api/v3/urls.py

@@ -33,7 +33,7 @@ for _authentik_app in get_apps():
             app_name=_authentik_app.name,
         )
         continue
-    urls: list = getattr(api_urls, "api_urlpatterns")
+    urls: list = api_urls.api_urlpatterns
     for url in urls:
         if isinstance(url, URLPattern):
             _other_urls.append(url)

authentik/blueprints/api.py

@@ -10,13 +10,13 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.decorators import permission_required
 from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.oci import OCI_PREFIX
 from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
+from authentik.rbac.decorators import permission_required
 
 
 class ManagedSerializer:
@@ -52,7 +52,9 @@ class BlueprintInstanceSerializer(ModelSerializer):
         valid, logs = Importer.from_string(content, context).validate()
         if not valid:
             text_logs = "\n".join([x["event"] for x in logs])
-            raise ValidationError(_("Failed to validate blueprint: %(logs)s" % {"logs": text_logs}))
+            raise ValidationError(
+                _("Failed to validate blueprint: {logs}".format_map({"logs": text_logs}))
+            )
         return content
 
     def validate(self, attrs: dict) -> dict:

authentik/blueprints/apps.py

@@ -1,5 +1,6 @@
 """authentik Blueprints app"""
 
+from collections.abc import Callable
 from importlib import import_module
 from inspect import ismethod
 
@@ -13,8 +14,8 @@ class ManagedAppConfig(AppConfig):
 
     logger: BoundLogger
 
-    RECONCILE_GLOBAL_PREFIX: str = "reconcile_global_"
+    RECONCILE_GLOBAL_CATEGORY: str = "global"
-    RECONCILE_TENANT_PREFIX: str = "reconcile_tenant_"
+    RECONCILE_TENANT_CATEGORY: str = "tenant"
 
     def __init__(self, app_name: str, *args, **kwargs) -> None:
         super().__init__(app_name, *args, **kwargs)
@@ -22,8 +23,8 @@ class ManagedAppConfig(AppConfig):
 
     def ready(self) -> None:
         self.import_related()
-        self.reconcile_global()
+        self._reconcile_global()
-        self.reconcile_tenant()
+        self._reconcile_tenant()
         return super().ready()
 
     def import_related(self):
@@ -51,7 +52,8 @@ class ManagedAppConfig(AppConfig):
             meth = getattr(self, meth_name)
             if not ismethod(meth):
                 continue
-            if not meth_name.startswith(prefix):
+            category = getattr(meth, "_authentik_managed_reconcile", None)
+            if category != prefix:
                 continue
             name = meth_name.replace(prefix, "")
             try:
@@ -61,7 +63,19 @@ class ManagedAppConfig(AppConfig):
             except (DatabaseError, ProgrammingError, InternalError) as exc:
                 self.logger.warning("Failed to run reconcile", name=name, exc=exc)
 
-    def reconcile_tenant(self) -> None:
+    @staticmethod
+    def reconcile_tenant(func: Callable):
+        """Mark a function to be called on startup (for each tenant)"""
+        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_TENANT_CATEGORY
+        return func
+
+    @staticmethod
+    def reconcile_global(func: Callable):
+        """Mark a function to be called on startup (globally)"""
+        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_GLOBAL_CATEGORY
+        return func
+
+    def _reconcile_tenant(self) -> None:
         """reconcile ourselves for tenanted methods"""
         from authentik.tenants.models import Tenant
 
@@ -72,9 +86,9 @@ class ManagedAppConfig(AppConfig):
             return
         for tenant in tenants:
             with tenant:
-                self._reconcile(self.RECONCILE_TENANT_PREFIX)
+                self._reconcile(self.RECONCILE_TENANT_CATEGORY)
 
-    def reconcile_global(self) -> None:
+    def _reconcile_global(self) -> None:
         """
         reconcile ourselves for global methods.
         Used for signals, tasks, etc. Database queries should not be made in here.
@@ -82,7 +96,7 @@ class ManagedAppConfig(AppConfig):
         from django_tenants.utils import get_public_schema_name, schema_context
 
         with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_PREFIX)
+            self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -93,11 +107,13 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    def reconcile_global_load_blueprints_v1_tasks(self):
+    @ManagedAppConfig.reconcile_global
+    def load_blueprints_v1_tasks(self):
         """Load v1 tasks"""
         self.import_module("authentik.blueprints.v1.tasks")
 
-    def reconcile_tenant_blueprints_discovery(self):
+    @ManagedAppConfig.reconcile_tenant
+    def blueprints_discovery(self):
         """Run blueprint discovery"""
         from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
 

authentik/blueprints/models.py

@@ -71,6 +71,19 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
+    class Meta:
+        verbose_name = _("Blueprint Instance")
+        verbose_name_plural = _("Blueprint Instances")
+        unique_together = (
+            (
+                "name",
+                "path",
+            ),
+        )
+
+    def __str__(self) -> str:
+        return f"Blueprint Instance {self.name}"
+
     def retrieve_oci(self) -> str:
         """Get blueprint from an OCI registry"""
         client = BlueprintOCIClient(self.path.replace(OCI_PREFIX, "https://"))
@@ -89,7 +102,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")
             with full_path.open("r", encoding="utf-8") as _file:
                 return _file.read()
-        except (IOError, OSError) as exc:
+        except OSError as exc:
             raise BlueprintRetrievalFailed(exc) from exc
 
     def retrieve(self) -> str:
@@ -105,16 +118,3 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
         from authentik.blueprints.api import BlueprintInstanceSerializer
 
         return BlueprintInstanceSerializer
-
-    def __str__(self) -> str:
-        return f"Blueprint Instance {self.name}"
-
-    class Meta:
-        verbose_name = _("Blueprint Instance")
-        verbose_name_plural = _("Blueprint Instances")
-        unique_together = (
-            (
-                "name",
-                "path",
-            ),
-        )

authentik/blueprints/tests/__init__.py

@@ -1,7 +1,7 @@
 """Blueprint helpers"""
 
+from collections.abc import Callable
 from functools import wraps
-from typing import Callable
 
 from django.apps import apps
 

authentik/blueprints/tests/test_packaged.py

@@ -1,7 +1,7 @@
 """test packaged blueprints"""
 
+from collections.abc import Callable
 from pathlib import Path
-from typing import Callable
 
 from django.test import TransactionTestCase
 

authentik/blueprints/tests/test_serializer_models.py

@@ -1,6 +1,6 @@
 """authentik managed models tests"""
 
-from typing import Callable, Type
+from collections.abc import Callable
 
 from django.apps import apps
 from django.test import TestCase
@@ -14,7 +14,7 @@ class TestModels(TestCase):
     """Test Models"""
 
 
-def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
+def serializer_tester_factory(test_model: type[SerializerModel]) -> Callable:
     """Test serializer"""
 
     def tester(self: TestModels):

authentik/blueprints/tests/test_v1_tasks.py

@@ -54,7 +54,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
             file.seek(0)
             file_hash = sha512(file.read().encode()).hexdigest()
             file.flush()
-            blueprints_discovery()  # pylint: disable=no-value-for-parameter
+            blueprints_discovery()
             instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
             self.assertEqual(instance.last_applied_hash, file_hash)
             self.assertEqual(
@@ -82,7 +82,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()  # pylint: disable=no-value-for-parameter
+            blueprints_discovery()
             blueprint = BlueprintInstance.objects.filter(name="foo").first()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -107,7 +107,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()  # pylint: disable=no-value-for-parameter
+            blueprints_discovery()
             blueprint.refresh_from_db()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -149,7 +149,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 instance.status,
                 BlueprintInstanceStatus.UNKNOWN,
             )
-            apply_blueprint(instance.pk)  # pylint: disable=no-value-for-parameter
+            apply_blueprint(instance.pk)
             instance.refresh_from_db()
             self.assertEqual(instance.last_applied_hash, "")
             self.assertEqual(

authentik/blueprints/v1/common.py

@@ -1,13 +1,14 @@
 """transfer common classes"""
 
 from collections import OrderedDict
+from collections.abc import Iterable, Mapping
 from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
 from functools import reduce
 from operator import ixor
 from os import getenv
-from typing import Any, Iterable, Literal, Mapping, Optional, Union
+from typing import Any, Literal, Union
 from uuid import UUID
 
 from deepmerge import always_merger
@@ -45,7 +46,7 @@ def get_attrs(obj: SerializerModel) -> dict[str, Any]:
 class BlueprintEntryState:
     """State of a single instance"""
 
-    instance: Optional[Model] = None
+    instance: Model | None = None
 
 
 class BlueprintEntryDesiredState(Enum):
@@ -67,9 +68,9 @@ class BlueprintEntry:
     )
     conditions: list[Any] = field(default_factory=list)
     identifiers: dict[str, Any] = field(default_factory=dict)
-    attrs: Optional[dict[str, Any]] = field(default_factory=dict)
+    attrs: dict[str, Any] | None = field(default_factory=dict)
 
-    id: Optional[str] = None
+    id: str | None = None
 
     _state: BlueprintEntryState = field(default_factory=BlueprintEntryState)
 
@@ -92,10 +93,10 @@ class BlueprintEntry:
             attrs=all_attrs,
         )
 
-    def _get_tag_context(
+    def get_tag_context(
         self,
         depth: int = 0,
-        context_tag_type: Optional[type["YAMLTagContext"] | tuple["YAMLTagContext", ...]] = None,
+        context_tag_type: type["YAMLTagContext"] | tuple["YAMLTagContext", ...] | None = None,
     ) -> "YAMLTagContext":
         """Get a YAMLTagContext object located at a certain depth in the tag tree"""
         if depth < 0:
@@ -108,8 +109,8 @@ class BlueprintEntry:
 
         try:
             return contexts[-(depth + 1)]
-        except IndexError:
+        except IndexError as exc:
-            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}")
+            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}") from exc
 
     def tag_resolver(self, value: Any, blueprint: "Blueprint") -> Any:
         """Check if we have any special tags that need handling"""
@@ -170,7 +171,7 @@ class Blueprint:
     entries: list[BlueprintEntry] = field(default_factory=list)
     context: dict = field(default_factory=dict)
 
-    metadata: Optional[BlueprintMetadata] = field(default=None)
+    metadata: BlueprintMetadata | None = field(default=None)
 
 
 class YAMLTag:
@@ -218,7 +219,7 @@ class Env(YAMLTag):
     """Lookup environment variable with optional default"""
 
     key: str
-    default: Optional[Any]
+    default: Any | None
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -237,7 +238,7 @@ class Context(YAMLTag):
     """Lookup key from instance context"""
 
     key: str
-    default: Optional[Any]
+    default: Any | None
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -281,7 +282,7 @@ class Format(YAMLTag):
         try:
             return self.format_string % tuple(args)
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError.from_entry(exc, entry) from exc
 
 
 class Find(YAMLTag):
@@ -366,7 +367,7 @@ class Condition(YAMLTag):
             comparator = self._COMPARATORS[self.mode.upper()]
             return comparator(tuple(bool(x) for x in args))
         except (TypeError, KeyError) as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError.from_entry(exc, entry) from exc
 
 
 class If(YAMLTag):
@@ -398,7 +399,7 @@ class If(YAMLTag):
                 blueprint,
             )
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError.from_entry(exc, entry) from exc
 
 
 class Enumerate(YAMLTag, YAMLTagContext):
@@ -412,9 +413,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         "SEQ": (list, lambda a, b: [*a, b]),
         "MAP": (
             dict,
-            lambda a, b: always_merger.merge(
+            lambda a, b: always_merger.merge(a, {b[0]: b[1]} if isinstance(b, tuple | list) else b),
-                a, {b[0]: b[1]} if isinstance(b, (tuple, list)) else b
-            ),
         ),
     }
 
@@ -456,7 +455,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         try:
             output_class, add_fn = self._OUTPUT_BODIES[self.output_body.upper()]
         except KeyError as exc:
-            raise EntryInvalidError.from_entry(exc, entry)
+            raise EntryInvalidError.from_entry(exc, entry) from exc
 
         result = output_class()
 
@@ -484,13 +483,13 @@ class EnumeratedItem(YAMLTag):
 
     _SUPPORTED_CONTEXT_TAGS = (Enumerate,)
 
-    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
+    def __init__(self, _loader: "BlueprintLoader", node: ScalarNode) -> None:
         super().__init__()
         self.depth = int(node.value)
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         try:
-            context_tag: Enumerate = entry._get_tag_context(
+            context_tag: Enumerate = entry.get_tag_context(
                 depth=self.depth,
                 context_tag_type=EnumeratedItem._SUPPORTED_CONTEXT_TAGS,
             )
@@ -500,9 +499,11 @@ class EnumeratedItem(YAMLTag):
                     f"{self.__class__.__name__} tags are only usable "
                     f"inside an {Enumerate.__name__} tag",
                     entry,
-                )
+                ) from exc
 
-            raise EntryInvalidError.from_entry(f"{self.__class__.__name__} tag: {exc}", entry)
+            raise EntryInvalidError.from_entry(
+                f"{self.__class__.__name__} tag: {exc}", entry
+            ) from exc
 
         return context_tag.get_context(entry, blueprint)
 
@@ -515,8 +516,8 @@ class Index(EnumeratedItem):
 
         try:
             return context[0]
-        except IndexError:  # pragma: no cover
+        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
 
 
 class Value(EnumeratedItem):
@@ -527,8 +528,8 @@ class Value(EnumeratedItem):
 
         try:
             return context[1]
-        except IndexError:  # pragma: no cover
+        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
 
 
 class BlueprintDumper(SafeDumper):
@@ -582,13 +583,13 @@ class BlueprintLoader(SafeLoader):
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
 
-    entry_model: Optional[str]
+    entry_model: str | None
-    entry_id: Optional[str]
+    entry_id: str | None
-    validation_error: Optional[ValidationError]
+    validation_error: ValidationError | None
-    serializer: Optional[Serializer] = None
+    serializer: Serializer | None = None
 
     def __init__(
-        self, *args: object, validation_error: Optional[ValidationError] = None, **kwargs
+        self, *args: object, validation_error: ValidationError | None = None, **kwargs
     ) -> None:
         super().__init__(*args)
         self.entry_model = None

authentik/blueprints/v1/exporter.py

@@ -1,6 +1,6 @@
 """Blueprint exporter"""
 
-from typing import Iterable
+from collections.abc import Iterable
 from uuid import UUID
 
 from django.apps import apps
@@ -59,7 +59,7 @@ class Exporter:
         blueprint = Blueprint()
         self._pre_export(blueprint)
         blueprint.metadata = BlueprintMetadata(
-            name=_("authentik Export - %(date)s" % {"date": str(now())}),
+            name=_("authentik Export - {date}".format_map({"date": str(now())})),
             labels={
                 LABEL_AUTHENTIK_GENERATED: "true",
             },
@@ -74,7 +74,7 @@ class Exporter:
 
 
 class FlowExporter(Exporter):
-    """Exporter customised to only return objects related to `flow`"""
+    """Exporter customized to only return objects related to `flow`"""
 
     flow: Flow
     with_policies: bool

authentik/blueprints/v1/importer.py

@@ -2,7 +2,7 @@
 
 from contextlib import contextmanager
 from copy import deepcopy
-from typing import Any, Optional
+from typing import Any
 
 from dacite.config import Config
 from dacite.core import from_dict
@@ -62,7 +62,7 @@ SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry"
 def excluded_models() -> list[type[Model]]:
     """Return a list of all excluded models that shouldn't be exposed via API
     or other means (internal only, base classes, non-used objects, etc)"""
-    # pylint: disable=imported-auth-user
+
     from django.contrib.auth.models import Group as DjangoGroup
     from django.contrib.auth.models import User as DjangoUser
 
@@ -101,7 +101,7 @@ def excluded_models() -> list[type[Model]]:
 
 def is_model_allowed(model: type[Model]) -> bool:
     """Check if model is allowed"""
-    return model not in excluded_models() and issubclass(model, (SerializerModel, BaseMetaModel))
+    return model not in excluded_models() and issubclass(model, SerializerModel | BaseMetaModel)
 
 
 class DoRollback(SentryIgnoredException):
@@ -125,7 +125,7 @@ class Importer:
     logger: BoundLogger
     _import: Blueprint
 
-    def __init__(self, blueprint: Blueprint, context: Optional[dict] = None):
+    def __init__(self, blueprint: Blueprint, context: dict | None = None):
         self.__pk_map: dict[Any, Model] = {}
         self._import = blueprint
         self.logger = get_logger()
@@ -168,7 +168,7 @@ class Importer:
         for key, value in attrs.items():
             try:
                 if isinstance(value, dict):
-                    for idx, _inner_key in enumerate(value):
+                    for _, _inner_key in enumerate(value):
                         value[_inner_key] = updater(value[_inner_key])
                 elif isinstance(value, list):
                     for idx, _inner_value in enumerate(value):
@@ -197,8 +197,7 @@ class Importer:
 
         return main_query | sub_query
 
-    # pylint: disable-msg=too-many-locals
+    def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer | None:
-    def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
         """Validate a single entry"""
         if not entry.check_all_conditions_match(self._import):
             self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
@@ -369,7 +368,7 @@ class Importer:
                     self.__pk_map[entry.identifiers["pk"]] = instance.pk
                 entry._state = BlueprintEntryState(instance)
             elif state == BlueprintEntryDesiredState.ABSENT:
-                instance: Optional[Model] = serializer.instance
+                instance: Model | None = serializer.instance
                 if instance.pk:
                     instance.delete()
                     self.logger.debug("deleted model", mode=instance)

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -43,7 +43,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
             LOGGER.info("Blueprint does not exist, but not required")
             return MetaResult()
         LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
-        # pylint: disable=no-value-for-parameter
+
         apply_blueprint(str(self.blueprint_instance.pk))
         return MetaResult()
 

authentik/blueprints/v1/meta/registry.py

@@ -8,15 +8,15 @@ from rest_framework.serializers import Serializer
 class BaseMetaModel(Model):
     """Base models"""
 
+    class Meta:
+        abstract = True
+
     @staticmethod
     def serializer() -> Serializer:
         """Serializer similar to SerializerModel, but as a static method since
         this is an abstract model"""
         raise NotImplementedError
 
-    class Meta:
-        abstract = True
-
 
 class MetaResult:
     """Result returned by Meta Models' serializers. Empty class but we can't return none as

authentik/blueprints/v1/tasks.py

@@ -4,7 +4,6 @@ from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
 from sys import platform
-from typing import Optional
 
 from dacite.core import from_dict
 from django.db import DatabaseError, InternalError, ProgrammingError
@@ -50,14 +49,14 @@ class BlueprintFile:
     version: int
     hash: str
     last_m: int
-    meta: Optional[BlueprintMetadata] = field(default=None)
+    meta: BlueprintMetadata | None = field(default=None)
 
 
 def start_blueprint_watcher():
     """Start blueprint watcher, if it's not running already."""
     # This function might be called twice since it's called on celery startup
-    # pylint: disable=global-statement
+
-    global _file_watcher_started
+    global _file_watcher_started  # noqa: PLW0603
     if _file_watcher_started:
         return
     observer = Observer()
@@ -126,7 +125,7 @@ def blueprints_find() -> list[BlueprintFile]:
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
             continue
-        with open(path, "r", encoding="utf-8") as blueprint_file:
+        with open(path, encoding="utf-8") as blueprint_file:
             try:
                 raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
             except YAMLError as exc:
@@ -150,7 +149,7 @@ def blueprints_find() -> list[BlueprintFile]:
     throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
+def blueprints_discovery(self: SystemTask, path: str | None = None):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
@@ -197,7 +196,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 def apply_blueprint(self: SystemTask, instance_pk: str):
     """Apply single blueprint"""
     self.save_on_success = False
-    instance: Optional[BlueprintInstance] = None
+    instance: BlueprintInstance | None = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
         if not instance or not instance.enabled:
@@ -225,10 +224,10 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         instance.last_applied = now()
         self.set_status(TaskStatus.SUCCESSFUL)
     except (
+        OSError,
         DatabaseError,
         ProgrammingError,
         InternalError,
-        IOError,
         BlueprintRetrievalFailed,
         EntryInvalidError,
     ) as exc:

authentik/brands/middleware.py

@@ -1,6 +1,6 @@
 """Inject brand into current request"""
 
-from typing import Callable
+from collections.abc import Callable
 
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
@@ -20,7 +20,7 @@ class BrandMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "brand"):
             brand = get_brand_for_request(request)
-            setattr(request, "brand", brand)
+            request.brand = brand
             locale = brand.default_locale
             if locale != "":
                 activate(locale)

authentik/brands/models.py

@@ -71,7 +71,7 @@ class Brand(SerializerModel):
         """Get default locale"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-        # pylint: disable=broad-except
+
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
             return ""

authentik/brands/utils.py

@@ -9,6 +9,7 @@ from sentry_sdk.hub import Hub
 
 from authentik import get_full_version
 from authentik.brands.models import Brand
+from authentik.tenants.models import Tenant
 
 _q_default = Q(default=True)
 DEFAULT_BRAND = Brand(domain="fallback")
@@ -30,13 +31,14 @@ def get_brand_for_request(request: HttpRequest) -> Brand:
 def context_processor(request: HttpRequest) -> dict[str, Any]:
     """Context Processor that injects brand object into every template"""
     brand = getattr(request, "brand", DEFAULT_BRAND)
+    tenant = getattr(request, "tenant", Tenant())
     trace = ""
     span = Hub.current.scope.span
     if span:
         trace = span.to_traceparent()
     return {
         "brand": brand,
-        "footer_links": request.tenant.footer_links,
+        "footer_links": tenant.footer_links,
         "sentry_trace": trace,
         "version": get_full_version(),
     }

authentik/core/api/applications.py

@@ -1,8 +1,8 @@
 """Application API Views"""
 
+from collections.abc import Iterator
 from copy import copy
 from datetime import timedelta
-from typing import Iterator, Optional
 
 from django.core.cache import cache
 from django.db.models import QuerySet
@@ -23,7 +23,6 @@ from structlog.stdlib import get_logger
 from structlog.testing import capture_logs
 
 from authentik.admin.api.metrics import CoordinateSerializer
-from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
@@ -39,6 +38,7 @@ from authentik.lib.utils.file import (
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
 from authentik.policies.types import PolicyResult
+from authentik.rbac.decorators import permission_required
 from authentik.rbac.filters import ObjectFilter
 
 LOGGER = get_logger()
@@ -60,7 +60,7 @@ class ApplicationSerializer(ModelSerializer):
 
     meta_icon = ReadOnlyField(source="get_meta_icon")
 
-    def get_launch_url(self, app: Application) -> Optional[str]:
+    def get_launch_url(self, app: Application) -> str | None:
         """Allow formatting of launch URL"""
         user = None
         if "request" in self.context:
@@ -100,7 +100,6 @@ class ApplicationSerializer(ModelSerializer):
 class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
-    # pylint: disable=no-member
     queryset = Application.objects.all().prefetch_related("provider")
     serializer_class = ApplicationSerializer
     search_fields = [
@@ -131,7 +130,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         return queryset
 
     def _get_allowed_applications(
-        self, pagined_apps: Iterator[Application], user: Optional[User] = None
+        self, pagined_apps: Iterator[Application], user: User | None = None
     ) -> list[Application]:
         applications = []
         request = self.request._request
@@ -169,7 +168,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             try:
                 for_user = User.objects.filter(pk=request.query_params.get("for_user")).first()
             except ValueError:
-                raise ValidationError({"for_user": "for_user must be numerical"})
+                raise ValidationError({"for_user": "for_user must be numerical"}) from None
             if not for_user:
                 raise ValidationError({"for_user": "User not found"})
         engine = PolicyEngine(application, for_user, request)

authentik/core/api/authenticated_sessions.py

@@ -1,6 +1,6 @@
 """AuthenticatedSessions API Viewset"""
 
-from typing import Optional, TypedDict
+from typing import TypedDict
 
 from django_filters.rest_framework import DjangoFilterBackend
 from guardian.utils import get_anonymous_user
@@ -72,11 +72,11 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         """Get parsed user agent"""
         return user_agent_parser.Parse(instance.last_user_agent)
 
-    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
+    def get_geo_ip(self, instance: AuthenticatedSession) -> GeoIPDict | None:  # pragma: no cover
         """Get GeoIP Data"""
         return GEOIP_CONTEXT_PROCESSOR.city_dict(instance.last_ip)
 
-    def get_asn(self, instance: AuthenticatedSession) -> Optional[ASNDict]:  # pragma: no cover
+    def get_asn(self, instance: AuthenticatedSession) -> ASNDict | None:  # pragma: no cover
         """Get ASN Data"""
         return ASN_CONTEXT_PROCESSOR.asn_dict(instance.last_ip)
 

authentik/core/api/groups.py

@@ -1,7 +1,6 @@
 """Groups API Viewset"""
 
 from json import loads
-from typing import Optional
 
 from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
@@ -15,11 +14,11 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
 from authentik.core.models import Group, User
 from authentik.rbac.api.roles import RoleSerializer
+from authentik.rbac.decorators import permission_required
 
 
 class GroupMemberSerializer(ModelSerializer):
@@ -59,7 +58,7 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
-    def validate_parent(self, parent: Optional[Group]):
+    def validate_parent(self, parent: Group | None):
         """Validate group parent (if set), ensuring the parent isn't itself"""
         if not self.instance or not parent:
             return parent
@@ -114,7 +113,7 @@ class GroupFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON")
+            raise ValidationError(detail="filter: failed to parse JSON") from None
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -140,7 +139,6 @@ class UserAccountSerializer(PassiveSerializer):
 class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
-    # pylint: disable=no-member
     queryset = Group.objects.all().select_related("parent").prefetch_related("users")
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]

authentik/core/api/propertymappings.py

@@ -14,7 +14,6 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
-from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
@@ -23,6 +22,7 @@ from authentik.core.models import PropertyMapping
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
+from authentik.rbac.decorators import permission_required
 
 
 class PropertyMappingTestResultSerializer(PassiveSerializer):
@@ -146,7 +146,7 @@ class PropertyMappingViewSet(
             response_data["result"] = dumps(
                 sanitize_item(result), indent=(4 if format_result else None)
             )
-        except Exception as exc:  # pylint: disable=broad-except
+        except Exception as exc:
             response_data["result"] = str(exc)
             response_data["successful"] = False
         response = PropertyMappingTestResultSerializer(response_data)

authentik/core/api/sources.py

@@ -1,6 +1,6 @@
 """Source API Views"""
 
-from typing import Iterable
+from collections.abc import Iterable
 
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema
@@ -16,7 +16,6 @@ from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import OwnerFilter, OwnerSuperuserPermissions
-from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
@@ -30,6 +29,7 @@ from authentik.lib.utils.file import (
 )
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.engine import PolicyEngine
+from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 

authentik/core/api/tokens.py

@@ -15,7 +15,6 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.authorization import OwnerSuperuserPermissions
-from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
@@ -24,6 +23,7 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
+from authentik.rbac.decorators import permission_required
 
 
 class TokenSerializer(ManagedSerializer, ModelSerializer):

authentik/core/api/transactional_applications.py

@@ -65,7 +65,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 raise ValidationError("Invalid provider model")
             self._provider_model = model
         except LookupError:
-            raise ValidationError("Invalid provider model")
+            raise ValidationError("Invalid provider model") from None
         return fq_model_name
 
     def validate(self, attrs: dict) -> dict:
@@ -106,7 +106,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 {
                     exc.entry_id: exc.validation_error.detail,
                 }
-            )
+            ) from None
         return blueprint
 
 

authentik/core/api/used_by.py

@@ -54,7 +54,6 @@ class UsedByMixin:
         responses={200: UsedBySerializer(many=True)},
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
-    # pylint: disable=too-many-locals
     def used_by(self, request: Request, *args, **kwargs) -> Response:
         """Get a list of all objects that use this object"""
         model: Model = self.get_object()

authentik/core/api/users.py

@@ -2,7 +2,7 @@
 
 from datetime import timedelta
 from json import loads
-from typing import Any, Optional
+from typing import Any
 
 from django.contrib.auth import update_session_auth_hash
 from django.contrib.sessions.backends.cache import KEY_PREFIX
@@ -49,7 +49,6 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
-from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.brands.models import Brand
 from authentik.core.api.used_by import UsedByMixin
@@ -74,6 +73,7 @@ from authentik.flows.models import FlowToken
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
 from authentik.flows.views.executor import QS_KEY_TOKEN
 from authentik.lib.avatars import get_avatar
+from authentik.rbac.decorators import permission_required
 from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
@@ -142,7 +142,7 @@ class UserSerializer(ModelSerializer):
         self._set_password(instance, password)
         return instance
 
-    def _set_password(self, instance: User, password: Optional[str]):
+    def _set_password(self, instance: User, password: str | None):
         """Set password of user if we're in a blueprint context, and if it's an empty
         string then use an unusable password"""
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context and password:
@@ -154,7 +154,7 @@ class UserSerializer(ModelSerializer):
 
     def get_avatar(self, user: User) -> str:
         """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context["request"])
+        return get_avatar(user, self.context.get("request"))
 
     def validate_path(self, path: str) -> str:
         """Validate path"""
@@ -218,7 +218,7 @@ class UserSelfSerializer(ModelSerializer):
 
     def get_avatar(self, user: User) -> str:
         """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context["request"])
+        return get_avatar(user, self.context.get("request"))
 
     @extend_schema_field(
         ListSerializer(
@@ -358,7 +358,7 @@ class UsersFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON")
+            raise ValidationError(detail="filter: failed to parse JSON") from None
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -397,15 +397,14 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     def get_queryset(self):  # pragma: no cover
         return User.objects.all().exclude_anonymous().prefetch_related("ak_groups")
 
-    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
+    def _create_recovery_link(self) -> tuple[str, Token]:
         """Create a recovery link (when the current brand has a recovery flow set),
         that can either be shown to an admin or sent to the user directly"""
         brand: Brand = self.request._request.brand
         # Check that there is a recovery flow, if not return an error
         flow = brand.flow_recovery
         if not flow:
-            LOGGER.debug("No recovery flow set")
+            raise ValidationError({"non_field_errors": "No recovery flow set."})
-            return None, None
         user: User = self.get_object()
         planner = FlowPlanner(flow)
         planner.allow_empty_flows = True
@@ -417,8 +416,9 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 },
             )
         except FlowNonApplicableException:
-            LOGGER.warning("Recovery flow not applicable to user")
+            raise ValidationError(
-            return None, None
+                {"non_field_errors": "Recovery flow not applicable to user"}
+            ) from None
         token, __ = FlowToken.objects.update_or_create(
             identifier=f"{user.uid}-password-reset",
             defaults={
@@ -533,7 +533,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             400: OpenApiResponse(description="Bad request"),
         },
     )
-    @action(detail=True, methods=["POST"])
+    @action(detail=True, methods=["POST"], permission_classes=[])
     def set_password(self, request: Request, pk: int) -> Response:
         """Set password for user"""
         user: User = self.get_object()
@@ -563,16 +563,13 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @extend_schema(
         responses={
             "200": LinkSerializer(many=False),
-            "404": LinkSerializer(many=False),
         },
+        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[])
+    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         link, _ = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
-            return Response({"link": ""}, status=404)
         return Response({"link": link})
 
     @permission_required("authentik_core.reset_user_password")
@@ -587,31 +584,28 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         ],
         responses={
             "204": OpenApiResponse(description="Successfully sent recover email"),
-            "404": OpenApiResponse(description="Bad request"),
         },
+        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[])
+    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     def recovery_email(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         for_user: User = self.get_object()
         if for_user.email == "":
             LOGGER.debug("User doesn't have an email address")
-            return Response(status=404)
+            raise ValidationError({"non_field_errors": "User does not have an email address set."})
         link, token = self._create_recovery_link()
-        if not link:
-            LOGGER.debug("Couldn't create token")
-            return Response(status=404)
         # Lookup the email stage to assure the current user can access it
         stages = get_objects_for_user(
             request.user, "authentik_stages_email.view_emailstage"
         ).filter(pk=request.query_params.get("email_stage"))
         if not stages.exists():
             LOGGER.debug("Email stage does not exist/user has no permissions")
-            return Response(status=404)
+            raise ValidationError({"non_field_errors": "Email stage does not exist."})
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),
-            to=[for_user.email],
+            to=[(for_user.name, for_user.email)],
             template_name=email_stage.template,
             language=for_user.locale(request),
             template_context={
@@ -631,7 +625,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             "401": OpenApiResponse(description="Access denied"),
         },
     )
-    @action(detail=True, methods=["POST"])
+    @action(detail=True, methods=["POST"], permission_classes=[])
     def impersonate(self, request: Request, pk: int) -> Response:
         """Impersonate a user"""
         if not request.tenant.impersonation:

authentik/core/apps.py

@@ -14,14 +14,16 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    def reconcile_global_debug_worker_hook(self):
+    @ManagedAppConfig.reconcile_global
+    def debug_worker_hook(self):
         """Dispatch startup tasks inline when debugging"""
         if settings.DEBUG:
             from authentik.root.celery import worker_ready_hook
 
             worker_ready_hook()
 
-    def reconcile_tenant_source_inbuilt(self):
+    @ManagedAppConfig.reconcile_tenant
+    def source_inbuilt(self):
         """Reconcile inbuilt source"""
         from authentik.core.models import Source
 

authentik/core/auth.py

@@ -1,6 +1,6 @@
 """Authenticate with tokens"""
 
-from typing import Any, Optional
+from typing import Any
 
 from django.contrib.auth.backends import ModelBackend
 from django.http.request import HttpRequest
@@ -16,15 +16,15 @@ class InbuiltBackend(ModelBackend):
     """Inbuilt backend"""
 
     def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> Optional[User]:
+    ) -> User | None:
         user = super().authenticate(request, username=username, password=password, **kwargs)
         if not user:
             return None
         self.set_method("password", request)
         return user
 
-    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
+    def set_method(self, method: str, request: HttpRequest | None, **kwargs):
         """Set method data on current flow, if possbiel"""
         if not request:
             return
@@ -40,18 +40,18 @@ class TokenBackend(InbuiltBackend):
     """Authenticate with token"""
 
     def authenticate(
-        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> Optional[User]:
+    ) -> User | None:
         try:
-            # pylint: disable=no-member
+
             user = User._default_manager.get_by_natural_key(username)
-        # pylint: disable=no-member
+
         except User.DoesNotExist:
             # Run the default password hasher once to reduce the timing
             # difference between an existing and a nonexistent user (#20760).
             User().set_password(password)
             return None
-        # pylint: disable=no-member
+
         tokens = Token.filter_not_expired(
             user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
         )

authentik/core/channels.py

@@ -38,6 +38,6 @@ class TokenOutpostMiddleware:
                 raise DenyConnection()
         except AuthenticationFailed as exc:
             LOGGER.warning("Failed to authenticate", exc=exc)
-            raise DenyConnection()
+            raise DenyConnection() from None
 
         scope["user"] = user

authentik/core/expression/evaluator.py

@@ -1,6 +1,6 @@
 """Property Mapping Evaluator"""
 
-from typing import Any, Optional
+from typing import Any
 
 from django.db.models import Model
 from django.http import HttpRequest
@@ -27,9 +27,9 @@ class PropertyMappingEvaluator(BaseEvaluator):
     def __init__(
         self,
         model: Model,
-        user: Optional[User] = None,
+        user: User | None = None,
-        request: Optional[HttpRequest] = None,
+        request: HttpRequest | None = None,
-        dry_run: Optional[bool] = False,
+        dry_run: bool | None = False,
         **kwargs,
     ):
         if hasattr(model, "name"):

authentik/core/management/commands/shell.py

@@ -16,13 +16,8 @@ from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
-BANNER_TEXT = """### authentik shell ({authentik})
+BANNER_TEXT = f"""### authentik shell ({get_full_version()})
-### Node {node} | Arch {arch} | Python {python} """.format(
+### Node {platform.node()} | Arch {platform.machine()} | Python {platform.python_version()} """
-    node=platform.node(),
-    python=platform.python_version(),
-    arch=platform.machine(),
-    authentik=get_full_version(),
-)
 
 
 class Command(BaseCommand):
@@ -86,7 +81,7 @@ class Command(BaseCommand):
 
         # If Python code has been passed, execute it and exit.
         if options["command"]:
-            # pylint: disable=exec-used
+
             exec(options["command"], namespace)  # nosec # noqa
             return
 
@@ -99,7 +94,7 @@ class Command(BaseCommand):
         else:
             try:
                 hook()
-            except Exception:  # pylint: disable=broad-except
+            except Exception:
                 # Match the behavior of the cpython shell where an error in
                 # sys.__interactivehook__ prints a warning and the exception
                 # and continues.

authentik/core/middleware.py

@@ -1,7 +1,7 @@
 """authentik admin Middleware to impersonate users"""
 
+from collections.abc import Callable
 from contextvars import ContextVar
-from typing import Callable, Optional
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
@@ -15,9 +15,9 @@ RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
-CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_REQUEST_ID = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
-CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_HOST = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "host", default=None)
-CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+CTX_AUTH_VIA = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
 
 
 class ImpersonateMiddleware:
@@ -55,7 +55,7 @@ class RequestIDMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
-            setattr(request, "request_id", request_id)
+            request.request_id = request_id
             CTX_REQUEST_ID.set(request_id)
             CTX_HOST.set(request.get_host())
             set_tag("authentik.request_id", request_id)
@@ -67,7 +67,7 @@ class RequestIDMiddleware:
         response = self.get_response(request)
 
         response[RESPONSE_HEADER_ID] = request.request_id
-        setattr(response, "ak_context", {})
+        response.ak_context = {}
         response.ak_context["request_id"] = CTX_REQUEST_ID.get()
         response.ak_context["host"] = CTX_HOST.get()
         response.ak_context[KEY_AUTH_VIA] = CTX_AUTH_VIA.get()

authentik/core/models.py

@@ -33,7 +33,7 @@ from authentik.lib.models import (
     SerializerModel,
 )
 from authentik.policies.models import PolicyBindingModel
-from authentik.root.install_id import get_install_id
+from authentik.tenants.utils import get_unique_identifier
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
@@ -222,7 +222,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         there are at most 3 queries done"""
         return Group.children_recursive(self.ak_groups.all())
 
-    def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
+    def group_attributes(self, request: HttpRequest | None = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
@@ -276,13 +276,13 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_unique_identifier()}".encode("ascii")).hexdigest()
 
-    def locale(self, request: Optional[HttpRequest] = None) -> str:
+    def locale(self, request: HttpRequest | None = None) -> str:
         """Get the locale the user has configured"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-        # pylint: disable=broad-except
+
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
         if request:
@@ -358,7 +358,7 @@ class Provider(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def launch_url(self) -> Optional[str]:
+    def launch_url(self) -> str | None:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return None
@@ -435,7 +435,7 @@ class Application(SerializerModel, PolicyBindingModel):
         return ApplicationSerializer
 
     @property
-    def get_meta_icon(self) -> Optional[str]:
+    def get_meta_icon(self) -> str | None:
         """Get the URL to the App Icon image. If the name is /static or starts with http
         it is returned as-is"""
         if not self.meta_icon:
@@ -444,7 +444,7 @@ class Application(SerializerModel, PolicyBindingModel):
             return self.meta_icon.name
         return self.meta_icon.url
 
-    def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
+    def get_launch_url(self, user: Optional["User"] = None) -> str | None:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
         if self.meta_launch_url:
@@ -457,13 +457,13 @@ class Application(SerializerModel, PolicyBindingModel):
                 user = user._wrapped
             try:
                 return url % user.__dict__
-            # pylint: disable=broad-except
+
             except Exception as exc:
                 LOGGER.warning("Failed to format launch url", exc=exc)
                 return url
         return url
 
-    def get_provider(self) -> Optional[Provider]:
+    def get_provider(self) -> Provider | None:
         """Get casted provider instance"""
         if not self.provider:
             return None
@@ -551,7 +551,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def icon_url(self) -> Optional[str]:
+    def icon_url(self) -> str | None:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:
@@ -566,7 +566,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
             return self.user_path_template % {
                 "slug": self.slug,
             }
-        # pylint: disable=broad-except
+
         except Exception as exc:
             LOGGER.warning("Failed to template user path", exc=exc, source=self)
             return User.default_path()
@@ -576,12 +576,12 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_login_button(self, request: HttpRequest) -> Optional[UILoginButton]:
+    def ui_login_button(self, request: HttpRequest) -> UILoginButton | None:
         """If source uses a http-based flow, return UI Information about the login
         button. If source doesn't use http-based flow, return None."""
         return None
 
-    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
+    def ui_user_settings(self) -> UserSettingSerializer | None:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or UserSettingSerializer."""
         return None
@@ -627,6 +627,9 @@ class ExpiringModel(models.Model):
     expires = models.DateTimeField(default=default_token_duration)
     expiring = models.BooleanField(default=True)
 
+    class Meta:
+        abstract = True
+
     def expire_action(self, *args, **kwargs):
         """Handler which is called when this object is expired. By
         default the object is deleted. This is less efficient compared
@@ -649,9 +652,6 @@ class ExpiringModel(models.Model):
             return False
         return now() > self.expires
 
-    class Meta:
-        abstract = True
-
 
 class TokenIntents(models.TextChoices):
     """Intents a Token can be created for."""
@@ -681,6 +681,21 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
     user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
     description = models.TextField(default="", blank=True)
 
+    class Meta:
+        verbose_name = _("Token")
+        verbose_name_plural = _("Tokens")
+        indexes = [
+            models.Index(fields=["identifier"]),
+            models.Index(fields=["key"]),
+        ]
+        permissions = [("view_token_key", _("View token's key"))]
+
+    def __str__(self):
+        description = f"{self.identifier}"
+        if self.expiring:
+            description += f" (expires={self.expires})"
+        return description
+
     @property
     def serializer(self) -> type[Serializer]:
         from authentik.core.api.tokens import TokenSerializer
@@ -708,21 +723,6 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
             message=f"Token {self.identifier}'s secret was rotated.",
         ).save()
 
-    def __str__(self):
-        description = f"{self.identifier}"
-        if self.expiring:
-            description += f" (expires={self.expires})"
-        return description
-
-    class Meta:
-        verbose_name = _("Token")
-        verbose_name_plural = _("Tokens")
-        indexes = [
-            models.Index(fields=["identifier"]),
-            models.Index(fields=["key"]),
-        ]
-        permissions = [("view_token_key", _("View token's key"))]
-
 
 class PropertyMapping(SerializerModel, ManagedModel):
     """User-defined key -> x mapping which can be used by providers to expose extra data."""
@@ -743,7 +743,7 @@ class PropertyMapping(SerializerModel, ManagedModel):
         """Get serializer for this model"""
         raise NotImplementedError
 
-    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
+    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         from authentik.core.expression.evaluator import PropertyMappingEvaluator
 
@@ -779,6 +779,13 @@ class AuthenticatedSession(ExpiringModel):
     last_user_agent = models.TextField(blank=True)
     last_used = models.DateTimeField(auto_now=True)
 
+    class Meta:
+        verbose_name = _("Authenticated Session")
+        verbose_name_plural = _("Authenticated Sessions")
+
+    def __str__(self) -> str:
+        return f"Authenticated Session {self.session_key[:10]}"
+
     @staticmethod
     def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
         """Create a new session from a http request"""
@@ -793,7 +800,3 @@ class AuthenticatedSession(ExpiringModel):
             last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
             expires=request.session.get_expiry_date(),
         )
-
-    class Meta:
-        verbose_name = _("Authenticated Session")
-        verbose_name_plural = _("Authenticated Sessions")

authentik/core/sources/flow_manager.py

@@ -1,7 +1,7 @@
 """Source decision helper"""
 
 from enum import Enum
-from typing import Any, Optional
+from typing import Any
 
 from django.contrib import messages
 from django.db import IntegrityError
@@ -90,15 +90,14 @@ class SourceFlowManager:
         self._logger = get_logger().bind(source=source, identifier=identifier)
         self.policy_context = {}
 
-    # pylint: disable=too-many-return-statements
+    def get_action(self, **kwargs) -> tuple[Action, UserSourceConnection | None]:  # noqa: PLR0911
-    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
         """decide which action should be taken"""
         new_connection = self.connection_type(source=self.source, identifier=self.identifier)
         # When request is authenticated, always link
         if self.request.user.is_authenticated:
             new_connection.user = self.request.user
             new_connection = self.update_connection(new_connection, **kwargs)
-            # pylint: disable=no-member
+
             new_connection.save()
             return Action.LINK, new_connection
 
@@ -188,8 +187,10 @@ class SourceFlowManager:
         # Default case, assume deny
         error = Exception(
             _(
-                "Request to authenticate with %(source)s has been denied. Please authenticate "
+                "Request to authenticate with {source} has been denied. Please authenticate "
-                "with the source you've previously signed up with." % {"source": self.source.name}
+                "with the source you've previously signed up with.".format_map(
+                    {"source": self.source.name}
+                )
             ),
         )
         return self.error_handler(error)
@@ -217,7 +218,7 @@ class SourceFlowManager:
         self,
         flow: Flow,
         connection: UserSourceConnection,
-        stages: Optional[list[StageView]] = None,
+        stages: list[StageView] | None = None,
         **kwargs,
     ) -> HttpResponse:
         """Prepare Authentication Plan, redirect user FlowExecutor"""
@@ -270,7 +271,9 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
+                        "Successfully authenticated with {source}!".format_map(
+                            {"source": self.source.name}
+                        )
                     ),
                 )
             ],
@@ -294,7 +297,7 @@ class SourceFlowManager:
         ).from_http(self.request)
         messages.success(
             self.request,
-            _("Successfully linked %(source)s!" % {"source": self.source.name}),
+            _("Successfully linked {source}!".format_map({"source": self.source.name})),
         )
         return redirect(
             reverse(
@@ -322,7 +325,9 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
+                        "Successfully authenticated with {source}!".format_map(
+                            {"source": self.source.name}
+                        )
                     ),
                 )
             ],

authentik/core/tasks.py

@@ -37,20 +37,20 @@ def clean_expired_models(self: SystemTask):
         messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
     # Special case
     amount = 0
-    # pylint: disable=no-member
+
     for session in AuthenticatedSession.objects.all():
         cache_key = f"{KEY_PREFIX}{session.session_key}"
         value = None
         try:
             value = cache.get(cache_key)
-        # pylint: disable=broad-except
+
         except Exception as exc:
             LOGGER.debug("Failed to get session from cache", exc=exc)
         if not value:
             session.delete()
             amount += 1
     LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
-    # pylint: disable=no-member
+
     messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
     self.set_status(TaskStatus.SUCCESSFUL, *messages)
 

authentik/core/tests/test_models.py

@@ -1,7 +1,7 @@
 """authentik core models tests"""
 
+from collections.abc import Callable
 from time import sleep
-from typing import Callable
 
 from django.test import RequestFactory, TestCase
 from django.utils.timezone import now

authentik/core/tests/test_source_flow_manager.py

@@ -173,5 +173,5 @@ class TestSourceFlowManager(TestCase):
         self.assertEqual(action, Action.ENROLL)
         response = flow_manager.get_flow()
         self.assertIsInstance(response, AccessDeniedResponse)
-        # pylint: disable=no-member
+
         self.assertEqual(response.error_message, "foo")

authentik/core/tests/test_users_api.py

@@ -60,10 +60,11 @@ class TestUsersAPI(APITestCase):
     def test_recovery_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.get(
+        response = self.client.post(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
 
     def test_set_password(self):
         """Test Direct password set"""
@@ -84,7 +85,7 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.get(
+        response = self.client.post(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
         self.assertEqual(response.status_code, 200)
@@ -92,16 +93,20 @@ class TestUsersAPI(APITestCase):
     def test_recovery_email_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.get(
+        response = self.client.post(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(
+            response.content, {"non_field_errors": "User does not have an email address set."}
+        )
         self.user.email = "foo@bar.baz"
         self.user.save()
-        response = self.client.get(
+        response = self.client.post(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
 
     def test_recovery_email_no_stage(self):
         """Test user recovery link (no email stage)"""
@@ -112,10 +117,11 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.get(
+        response = self.client.post(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 404)
+        self.assertEqual(response.status_code, 400)
+        self.assertJSONEqual(response.content, {"non_field_errors": "Email stage does not exist."})
 
     def test_recovery_email(self):
         """Test user recovery link"""
@@ -129,7 +135,7 @@ class TestUsersAPI(APITestCase):
         stage = EmailStage.objects.create(name="email")
 
         self.client.force_login(self.admin)
-        response = self.client.get(
+        response = self.client.post(
             reverse(
                 "authentik_api:user-recovery-email",
                 kwargs={"pk": self.user.pk},

authentik/core/tests/utils.py

@@ -1,7 +1,5 @@
 """Test Utils"""
 
-from typing import Optional
-
 from django.utils.text import slugify
 
 from authentik.brands.models import Brand
@@ -22,7 +20,7 @@ def create_test_flow(
     )
 
 
-def create_test_user(name: Optional[str] = None, **kwargs) -> User:
+def create_test_user(name: str | None = None, **kwargs) -> User:
     """Generate a test user"""
     uid = generate_id(20) if not name else name
     kwargs.setdefault("email", f"{uid}@goauthentik.io")
@@ -36,7 +34,7 @@ def create_test_user(name: Optional[str] = None, **kwargs) -> User:
     return user
 
 
-def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
+def create_test_admin_user(name: str | None = None, **kwargs) -> User:
     """Generate a test-admin user"""
     user = create_test_user(name, **kwargs)
     group = Group.objects.create(name=user.name or name, is_superuser=True)

authentik/core/types.py

@@ -1,7 +1,6 @@
 """authentik core dataclasses"""
 
 from dataclasses import dataclass
-from typing import Optional
 
 from rest_framework.fields import CharField
 
@@ -20,7 +19,7 @@ class UILoginButton:
     challenge: Challenge
 
     # Icon URL, used as-is
-    icon_url: Optional[str] = None
+    icon_url: str | None = None
 
 
 class UserSettingSerializer(PassiveSerializer):

authentik/core/views/apps.py

@@ -57,7 +57,7 @@ class RedirectToAppLaunch(View):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404
+            raise Http404 from None
         plan.insert_stage(in_memory_stage(RedirectToAppStage))
         request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs("authentik_core:if-flow", request.GET, flow_slug=flow.slug)

authentik/core/views/error.py

@@ -61,7 +61,6 @@ class ServerErrorView(TemplateView):
     response_class = ServerErrorTemplateResponse
     template_name = "if/error.html"
 
-    # pylint: disable=useless-super-delegation
     def dispatch(self, *args, **kwargs):  # pragma: no cover
         """Little wrapper so django accepts this function"""
         return super().dispatch(*args, **kwargs)

authentik/crypto/api.py

@@ -1,7 +1,6 @@
 """Crypto API Views"""
 
 from datetime import datetime
-from typing import Optional
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
@@ -24,13 +23,13 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import SecretKeyFilter
-from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.crypto.apps import MANAGED_KEY
 from authentik.crypto.builder import CertificateBuilder
 from authentik.crypto.models import CertificateKeyPair
 from authentik.events.models import Event, EventAction
+from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 
@@ -56,25 +55,25 @@ class CertificateKeyPairSerializer(ModelSerializer):
             return True
         return str(request.query_params.get("include_details", "true")).lower() == "true"
 
-    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> Optional[str]:
+    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> str | None:
         "Get certificate Hash (SHA256)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha256
 
-    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> Optional[str]:
+    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> str | None:
         "Get certificate Hash (SHA1)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha1
 
-    def get_cert_expiry(self, instance: CertificateKeyPair) -> Optional[datetime]:
+    def get_cert_expiry(self, instance: CertificateKeyPair) -> datetime | None:
         "Get certificate expiry"
         if not self._should_include_details:
             return None
-        return DateTimeField().to_representation(instance.certificate.not_valid_after)
+        return DateTimeField().to_representation(instance.certificate.not_valid_after_utc)
 
-    def get_cert_subject(self, instance: CertificateKeyPair) -> Optional[str]:
+    def get_cert_subject(self, instance: CertificateKeyPair) -> str | None:
         """Get certificate subject as full rfc4514"""
         if not self._should_include_details:
             return None
@@ -84,7 +83,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
         """Show if this keypair has a private key configured or not"""
         return instance.key_data != "" and instance.key_data is not None
 
-    def get_private_key_type(self, instance: CertificateKeyPair) -> Optional[str]:
+    def get_private_key_type(self, instance: CertificateKeyPair) -> str | None:
         """Get the private key's type, if set"""
         if not self._should_include_details:
             return None
@@ -121,7 +120,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             str(load_pem_x509_certificate(value.encode("utf-8"), default_backend()))
         except ValueError as exc:
             LOGGER.warning("Failed to load certificate", exc=exc)
-            raise ValidationError("Unable to load certificate.")
+            raise ValidationError("Unable to load certificate.") from None
         return value
 
     def validate_key_data(self, value: str) -> str:
@@ -140,7 +139,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
                 )
             except (ValueError, TypeError) as exc:
                 LOGGER.warning("Failed to load private key", exc=exc)
-                raise ValidationError("Unable to load private key (possibly encrypted?).")
+                raise ValidationError("Unable to load private key (possibly encrypted?).") from None
         return value
 
     class Meta:

authentik/crypto/apps.py

@@ -1,7 +1,6 @@
 """authentik crypto app config"""
 
-from datetime import datetime, timezone
+from datetime import UTC, datetime
-from typing import Optional
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
@@ -36,20 +35,22 @@ class AuthentikCryptoConfig(ManagedAppConfig):
             },
         )
 
-    def reconcile_tenant_managed_jwt_cert(self):
+    @ManagedAppConfig.reconcile_tenant
+    def managed_jwt_cert(self):
         """Ensure managed JWT certificate"""
         from authentik.crypto.models import CertificateKeyPair
 
-        cert: Optional[CertificateKeyPair] = CertificateKeyPair.objects.filter(
+        cert: CertificateKeyPair | None = CertificateKeyPair.objects.filter(
             managed=MANAGED_KEY
         ).first()
-        now = datetime.now(tz=timezone.utc)
+        now = datetime.now(tz=UTC)
         if not cert or (
             now < cert.certificate.not_valid_after_utc or now > cert.certificate.not_valid_after_utc
         ):
             self._create_update_cert()
 
-    def reconcile_tenant_self_signed(self):
+    @ManagedAppConfig.reconcile_tenant
+    def self_signed(self):
         """Create self-signed keypair"""
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair

authentik/crypto/builder.py

@@ -2,7 +2,6 @@
 
 import datetime
 import uuid
-from typing import Optional
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -44,7 +43,7 @@ class CertificateBuilder:
     def generate_private_key(self) -> PrivateKeyTypes:
         """Generate private key"""
         if self._use_ec_private_key:
-            return ec.generate_private_key(curve=ec.SECP256R1)
+            return ec.generate_private_key(curve=ec.SECP256R1())
         return rsa.generate_private_key(
             public_exponent=65537, key_size=4096, backend=default_backend()
         )
@@ -52,7 +51,7 @@ class CertificateBuilder:
     def build(
         self,
         validity_days: int = 365,
-        subject_alt_names: Optional[list[str]] = None,
+        subject_alt_names: list[str] | None = None,
     ):
         """Build self-signed certificate"""
         one_day = datetime.timedelta(1, 0, 0)

authentik/crypto/management/commands/import_certificate.py

@@ -24,13 +24,13 @@ class Command(TenantCommand):
         if not keypair:
             keypair = CertificateKeyPair(name=options["name"])
             dirty = True
-        with open(options["certificate"], mode="r", encoding="utf-8") as _cert:
+        with open(options["certificate"], encoding="utf-8") as _cert:
             cert_data = _cert.read()
             if keypair.certificate_data != cert_data:
                 dirty = True
             keypair.certificate_data = cert_data
         if options["private_key"]:
-            with open(options["private_key"], mode="r", encoding="utf-8") as _key:
+            with open(options["private_key"], encoding="utf-8") as _key:
                 key_data = _key.read()
                 if keypair.key_data != key_data:
                     dirty = True

authentik/crypto/models.py

@@ -2,7 +2,6 @@
 
 from binascii import hexlify
 from hashlib import md5
-from typing import Optional
 from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
@@ -37,9 +36,9 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         default="",
     )
 
-    _cert: Optional[Certificate] = None
+    _cert: Certificate | None = None
-    _private_key: Optional[PrivateKeyTypes] = None
+    _private_key: PrivateKeyTypes | None = None
-    _public_key: Optional[PublicKeyTypes] = None
+    _public_key: PublicKeyTypes | None = None
 
     @property
     def serializer(self) -> Serializer:
@@ -57,7 +56,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> Optional[PublicKeyTypes]:
+    def public_key(self) -> PublicKeyTypes | None:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -66,7 +65,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> Optional[PrivateKeyTypes]:
+    ) -> PrivateKeyTypes | None:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -58,7 +58,7 @@ def certificate_discovery(self: SystemTask):
         else:
             cert_name = path.name.replace(path.suffix, "")
         try:
-            with open(path, "r", encoding="utf-8") as _file:
+            with open(path, encoding="utf-8") as _file:
                 body = _file.read()
                 if "PRIVATE KEY" in body:
                     private_keys[cert_name] = ensure_private_key_valid(body)

authentik/crypto/tests.py

@@ -1,6 +1,5 @@
 """Crypto tests"""
 
-import datetime
 from json import loads
 from os import makedirs
 from tempfile import TemporaryDirectory
@@ -8,6 +7,7 @@ from tempfile import TemporaryDirectory
 from cryptography.x509.extensions import SubjectAlternativeName
 from cryptography.x509.general_name import DNSName
 from django.urls import reverse
+from django.utils.timezone import now
 from rest_framework.test import APITestCase
 
 from authentik.core.api.used_by import DeleteAction
@@ -68,9 +68,9 @@ class TestCrypto(APITestCase):
             validity_days=3,
         )
         instance = builder.save()
-        now = datetime.datetime.today()
+        _now = now()
         self.assertEqual(instance.name, name)
-        self.assertEqual((instance.certificate.not_valid_after - now).days, 2)
+        self.assertEqual((instance.certificate.not_valid_after_utc - _now).days, 2)
 
     def test_builder_api(self):
         """Test Builder (via API)"""
@@ -267,7 +267,7 @@ class TestCrypto(APITestCase):
             with open(f"{temp_dir}/foo.bar/privkey.pem", "w+", encoding="utf-8") as _key:
                 _key.write(builder.private_key)
             with CONFIG.patch("cert_discovery_dir", temp_dir):
-                certificate_discovery()  # pylint: disable=no-value-for-parameter
+                certificate_discovery()
         keypair: CertificateKeyPair = CertificateKeyPair.objects.filter(
             managed=MANAGED_DISCOVERED % "foo"
         ).first()

authentik/enterprise/api.py

@@ -16,13 +16,13 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import User, UserTypes
 from authentik.enterprise.license import LicenseKey, LicenseSummarySerializer
 from authentik.enterprise.models import License
-from authentik.root.install_id import get_install_id
+from authentik.rbac.decorators import permission_required
+from authentik.tenants.utils import get_unique_identifier
 
 
 class EnterpriseRequiredMixin:
@@ -31,7 +31,7 @@ class EnterpriseRequiredMixin:
 
     def validate(self, attrs: dict) -> dict:
         """Check that a valid license exists"""
-        if not LicenseKey.cached_summary().valid:
+        if not LicenseKey.cached_summary().has_license:
             raise ValidationError(_("Enterprise is required to create/update this object."))
         return super().validate(attrs)
 
@@ -92,7 +92,7 @@ class LicenseViewSet(UsedByMixin, ModelViewSet):
         """Get install_id"""
         return Response(
             data={
-                "install_id": get_install_id(),
+                "install_id": get_unique_identifier(),
             }
         )
 

authentik/enterprise/audit/apps.py

@@ -13,7 +13,8 @@ class AuthentikEnterpriseAuditConfig(EnterpriseConfig):
     verbose_name = "authentik Enterprise.Audit"
     default = True
 
-    def reconcile_global_install_middleware(self):
+    @EnterpriseConfig.reconcile_global
+    def install_middleware(self):
         """Install enterprise audit middleware"""
         orig_import = "authentik.events.middleware.AuditMiddleware"
         new_import = "authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware"

authentik/enterprise/audit/middleware.py

@@ -62,7 +62,7 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 field_value = value.name
 
             # If current field value is an expression, we are not evaluating it
-            if isinstance(field_value, (BaseExpression, Combinable)):
+            if isinstance(field_value, BaseExpression | Combinable):
                 continue
             field_value = field.to_python(field_value)
             data[field.name] = deepcopy(field_value)
@@ -83,12 +83,11 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
         if hasattr(instance, "_previous_state"):
             return
         before = len(connection.queries)
-        setattr(instance, "_previous_state", self.serialize_simple(instance))
+        instance._previous_state = self.serialize_simple(instance)
         after = len(connection.queries)
         if after > before:
             raise AssertionError("More queries generated by serialize_simple")
 
-    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
         user: User,

authentik/enterprise/license.py

@@ -21,13 +21,13 @@ from rest_framework.fields import BooleanField, DateTimeField, IntegerField
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import User, UserTypes
 from authentik.enterprise.models import License, LicenseUsage
-from authentik.root.install_id import get_install_id
+from authentik.tenants.utils import get_unique_identifier
 
 CACHE_KEY_ENTERPRISE_LICENSE = "goauthentik.io/enterprise/license"
 CACHE_EXPIRY_ENTERPRISE_LICENSE = 3 * 60 * 60  # 2 Hours
 
 
-@lru_cache()
+@lru_cache
 def get_licensing_key() -> Certificate:
     """Get Root CA PEM"""
     with open("authentik/enterprise/public.pem", "rb") as _key:
@@ -36,7 +36,7 @@ def get_licensing_key() -> Certificate:
 
 def get_license_aud() -> str:
     """Get the JWT audience field"""
-    return f"enterprise.goauthentik.io/license/{get_install_id()}"
+    return f"enterprise.goauthentik.io/license/{get_unique_identifier()}"
 
 
 class LicenseFlags(Enum):
@@ -88,7 +88,7 @@ class LicenseKey:
         try:
             headers = get_unverified_header(jwt)
         except PyJWTError:
-            raise ValidationError("Unable to verify license")
+            raise ValidationError("Unable to verify license") from None
         x5c: list[str] = headers.get("x5c", [])
         if len(x5c) < 1:
             raise ValidationError("Unable to verify license")
@@ -98,7 +98,7 @@ class LicenseKey:
             our_cert.verify_directly_issued_by(intermediate)
             intermediate.verify_directly_issued_by(get_licensing_key())
         except (InvalidSignature, TypeError, ValueError, Error):
-            raise ValidationError("Unable to verify license")
+            raise ValidationError("Unable to verify license") from None
         try:
             body = from_dict(
                 LicenseKey,
@@ -110,7 +110,7 @@ class LicenseKey:
                 ),
             )
         except PyJWTError:
-            raise ValidationError("Unable to verify license")
+            raise ValidationError("Unable to verify license") from None
         return body
 
     @staticmethod
@@ -142,13 +142,7 @@ class LicenseKey:
     @staticmethod
     def get_external_user_count():
         """Get current external user count"""
-        # Count since start of the month
+        return LicenseKey.base_user_qs().filter(type=UserTypes.EXTERNAL).count()
-        last_month = now().replace(day=1)
-        return (
-            LicenseKey.base_user_qs()
-            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
-            .count()
-        )
 
     def is_valid(self) -> bool:
         """Check if the given license body covers all users
@@ -188,20 +182,21 @@ class LicenseKey:
 
     def summary(self) -> LicenseSummary:
         """Summary of license status"""
+        has_license = License.objects.all().count() > 0
         last_valid = LicenseKey.last_valid_date()
         show_admin_warning = last_valid < now() - timedelta(weeks=2)
         show_user_warning = last_valid < now() - timedelta(weeks=4)
         read_only = last_valid < now() - timedelta(weeks=6)
         latest_valid = datetime.fromtimestamp(self.exp)
         return LicenseSummary(
-            show_admin_warning=show_admin_warning,
+            show_admin_warning=show_admin_warning and has_license,
-            show_user_warning=show_user_warning,
+            show_user_warning=show_user_warning and has_license,
-            read_only=read_only,
+            read_only=read_only and has_license,
             latest_valid=latest_valid,
             internal_users=self.internal_users,
             external_users=self.external_users,
             valid=self.is_valid(),
-            has_license=License.objects.all().count() > 0,
+            has_license=has_license,
         )
 
     @staticmethod

authentik/enterprise/policy.py

@@ -1,7 +1,5 @@
 """Enterprise license policies"""
 
-from typing import Optional
-
 from django.utils.translation import gettext_lazy as _
 
 from authentik.core.models import User, UserTypes
@@ -21,7 +19,7 @@ class EnterprisePolicyAccessView(PolicyAccessView):
             return PolicyResult(False, _("Feature only accessible for internal users."))
         return PolicyResult(True)
 
-    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
+    def user_has_access(self, user: User | None = None) -> PolicyResult:
         user = user or self.request.user
         request = PolicyRequest(user)
         request.http_request = self.request

authentik/enterprise/providers/rac/api/endpoints.py

@@ -1,7 +1,5 @@
 """RAC Provider API Views"""
 
-from typing import Optional
-
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.urls import reverse
@@ -36,11 +34,11 @@ class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
     provider_obj = RACProviderSerializer(source="provider", read_only=True)
     launch_url = SerializerMethodField()
 
-    def get_launch_url(self, endpoint: Endpoint) -> Optional[str]:
+    def get_launch_url(self, endpoint: Endpoint) -> str | None:
         """Build actual launch URL (the provider itself does not have one, just
         individual endpoints)"""
         try:
-            # pylint: disable=no-member
+
             return reverse(
                 "authentik_providers_rac:start",
                 kwargs={"app": endpoint.provider.application.slug, "endpoint": endpoint.pk},

authentik/enterprise/providers/rac/models.py

@@ -1,6 +1,6 @@
 """RAC Models"""
 
-from typing import Any, Optional
+from typing import Any
 from uuid import uuid4
 
 from deepmerge import always_merger
@@ -58,7 +58,7 @@ class RACProvider(Provider):
     )
 
     @property
-    def launch_url(self) -> Optional[str]:
+    def launch_url(self) -> str | None:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return "goauthentik.io://providers/rac/launch"
@@ -112,7 +112,7 @@ class RACPropertyMapping(PropertyMapping):
 
     static_settings = models.JSONField(default=dict)
 
-    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
+    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         if len(self.static_settings) > 0:
             return self.static_settings

authentik/enterprise/providers/rac/views.py

@@ -47,7 +47,7 @@ class RACStartView(EnterprisePolicyAccessView):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404
+            raise Http404 from None
         plan.insert_stage(
             in_memory_stage(
                 RACFinalStage,
@@ -132,16 +132,7 @@ class RACFinalStage(RedirectStage):
             flow=self.executor.plan.flow_pk,
             endpoint=self.endpoint.name,
         ).from_http(self.request)
-        setattr(
+        self.executor.current_stage.destination = self.request.build_absolute_uri(
-            self.executor.current_stage,
+            reverse("authentik_providers_rac:if-rac", kwargs={"token": str(token.token)})
-            "destination",
-            self.request.build_absolute_uri(
-                reverse(
-                    "authentik_providers_rac:if-rac",
-                    kwargs={
-                        "token": str(token.token),
-                    },
-                )
-            ),
         )
         return super().get_challenge(*args, **kwargs)

authentik/enterprise/signals.py

@@ -2,11 +2,14 @@
 
 from datetime import datetime
 
-from django.db.models.signals import pre_save
+from django.core.cache import cache
+from django.db.models.signals import post_save, pre_save
 from django.dispatch import receiver
 from django.utils.timezone import get_current_timezone
 
+from authentik.enterprise.license import CACHE_KEY_ENTERPRISE_LICENSE
 from authentik.enterprise.models import License
+from authentik.enterprise.tasks import enterprise_update_usage
 
 
 @receiver(pre_save, sender=License)
@@ -17,3 +20,10 @@ def pre_save_license(sender: type[License], instance: License, **_):
     instance.internal_users = status.internal_users
     instance.external_users = status.external_users
     instance.expiry = datetime.fromtimestamp(status.exp, tz=get_current_timezone())
+
+
+@receiver(post_save, sender=License)
+def post_save_license(sender: type[License], instance: License, **_):
+    """Trigger license usage calculation when license is saved"""
+    cache.delete(CACHE_KEY_ENTERPRISE_LICENSE)
+    enterprise_update_usage.delay()

authentik/events/api/notification_transports.py

@@ -12,7 +12,6 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
-from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.events.models import (
@@ -24,6 +23,7 @@ from authentik.events.models import (
     TransportMode,
 )
 from authentik.events.utils import get_user
+from authentik.rbac.decorators import permission_required
 
 
 class NotificationTransportSerializer(ModelSerializer):

authentik/events/api/tasks.py

@@ -21,8 +21,8 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ReadOnlyModelViewSet
 from structlog.stdlib import get_logger
 
-from authentik.api.decorators import permission_required
 from authentik.events.models import SystemTask, TaskStatus
+from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 
@@ -81,7 +81,7 @@ class SystemTaskViewSet(ReadOnlyModelViewSet):
             500: OpenApiResponse(description="Failed to retry task"),
         },
     )
-    @action(detail=True, methods=["post"])
+    @action(detail=True, methods=["POST"], permission_classes=[])
     def run(self, request: Request, pk=None) -> Response:
         """Run task"""
         task: SystemTask = self.get_object()
@@ -92,7 +92,7 @@ class SystemTaskViewSet(ReadOnlyModelViewSet):
             task_func.delay(*task.task_call_args, **task.task_call_kwargs)
             messages.success(
                 self.request,
-                _("Successfully started task %(name)s." % {"name": task.name}),
+                _("Successfully started task {name}.".format_map({"name": task.name})),
             )
             return Response(status=204)
         except (ImportError, AttributeError) as exc:  # pragma: no cover

authentik/events/apps.py

@@ -35,7 +35,8 @@ class AuthentikEventsConfig(ManagedAppConfig):
     verbose_name = "authentik Events"
     default = True
 
-    def reconcile_global_check_deprecations(self):
+    @ManagedAppConfig.reconcile_global
+    def check_deprecations(self):
         """Check for config deprecations"""
         from authentik.events.models import Event, EventAction
 
@@ -56,7 +57,8 @@ class AuthentikEventsConfig(ManagedAppConfig):
                 message=msg,
             ).save()
 
-    def reconcile_tenant_prefill_tasks(self):
+    @ManagedAppConfig.reconcile_tenant
+    def prefill_tasks(self):
         """Prefill tasks"""
         from authentik.events.models import SystemTask
         from authentik.events.system_tasks import _prefill_tasks
@@ -67,7 +69,8 @@ class AuthentikEventsConfig(ManagedAppConfig):
             task.save()
             self.logger.debug("prefilled task", task_name=task.name)
 
-    def reconcile_tenant_run_scheduled_tasks(self):
+    @ManagedAppConfig.reconcile_tenant
+    def run_scheduled_tasks(self):
         """Run schedule tasks which are behind schedule (only applies
         to tasks of which we keep metrics)"""
         from authentik.events.models import TaskStatus

authentik/events/context_processors/asn.py

@@ -46,7 +46,7 @@ class ASNContextProcessor(MMDBContextProcessor):
             "asn": self.asn_dict(ClientIPMiddleware.get_client_ip(request)),
         }
 
-    def asn(self, ip_address: str) -> Optional[ASN]:
+    def asn(self, ip_address: str) -> ASN | None:
         """Wrapper for Reader.asn"""
         with Hub.current.start_span(
             op="authentik.events.asn.asn",
@@ -71,7 +71,7 @@ class ASNContextProcessor(MMDBContextProcessor):
         }
         return asn_dict
 
-    def asn_dict(self, ip_address: str) -> Optional[ASNDict]:
+    def asn_dict(self, ip_address: str) -> ASNDict | None:
         """Wrapper for self.asn that returns a dict"""
         asn = self.asn(ip_address)
         if not asn:

authentik/events/context_processors/geoip.py

@@ -47,7 +47,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
         # Different key `geoip` vs `geo` for legacy reasons
         return {"geoip": self.city(ClientIPMiddleware.get_client_ip(request))}
 
-    def city(self, ip_address: str) -> Optional[City]:
+    def city(self, ip_address: str) -> City | None:
         """Wrapper for Reader.city"""
         with Hub.current.start_span(
             op="authentik.events.geo.city",
@@ -76,7 +76,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
             city_dict["city"] = city.city.name
         return city_dict
 
-    def city_dict(self, ip_address: str) -> Optional[GeoIPDict]:
+    def city_dict(self, ip_address: str) -> GeoIPDict | None:
         """Wrapper for self.city that returns a dict"""
         city = self.city(ip_address)
         if not city:

authentik/events/context_processors/mmdb.py

@@ -1,7 +1,6 @@
 """Common logic for reading MMDB files"""
 
 from pathlib import Path
-from typing import Optional
 
 from geoip2.database import Reader
 from structlog.stdlib import get_logger
@@ -13,7 +12,7 @@ class MMDBContextProcessor(EventContextProcessor):
     """Common logic for reading MaxMind DB files, including re-loading if the file has changed"""
 
     def __init__(self):
-        self.reader: Optional[Reader] = None
+        self.reader: Reader | None = None
         self._last_mtime: float = 0.0
         self.logger = get_logger()
         self.open()

authentik/events/middleware.py

@@ -1,8 +1,9 @@
 """Events middleware"""
 
+from collections.abc import Callable
 from functools import partial
 from threading import Thread
-from typing import Any, Callable, Optional
+from typing import Any
 
 from django.conf import settings
 from django.contrib.sessions.models import Session
@@ -49,9 +50,9 @@ class EventNewThread(Thread):
     action: str
     request: HttpRequest
     kwargs: dict[str, Any]
-    user: Optional[User] = None
+    user: User | None = None
 
-    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
+    def __init__(self, action: str, request: HttpRequest, user: User | None = None, **kwargs):
         super().__init__()
         self.action = action
         self.request = request
@@ -144,7 +145,6 @@ class AuditMiddleware:
             )
             thread.run()
 
-    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
         user: User,
@@ -152,7 +152,7 @@ class AuditMiddleware:
         sender,
         instance: Model,
         created: bool,
-        thread_kwargs: Optional[dict] = None,
+        thread_kwargs: dict | None = None,
         **_,
     ):
         """Signal handler for all object's post_save"""

authentik/events/models.py

@@ -7,7 +7,6 @@ from difflib import get_close_matches
 from functools import lru_cache
 from inspect import currentframe
 from smtplib import SMTPException
-from typing import Optional
 from uuid import uuid4
 
 from django.apps import apps
@@ -52,6 +51,8 @@ from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
+DISCORD_FIELD_LIMIT = 25
+NOTIFICATION_SUMMARY_LENGTH = 75
 
 
 def default_event_duration():
@@ -65,7 +66,7 @@ def default_brand():
     return sanitize_dict(model_to_dict(DEFAULT_BRAND))
 
 
-@lru_cache()
+@lru_cache
 def django_app_names() -> list[str]:
     """Get a cached list of all django apps' names (not labels)"""
     return [x.name for x in apps.app_configs.values()]
@@ -198,7 +199,7 @@ class Event(SerializerModel, ExpiringModel):
     @staticmethod
     def new(
         action: str | EventAction,
-        app: Optional[str] = None,
+        app: str | None = None,
         **kwargs,
     ) -> "Event":
         """Create new Event instance from arguments. Instance is NOT saved."""
@@ -224,7 +225,7 @@ class Event(SerializerModel, ExpiringModel):
         self.user = get_user(user)
         return self
 
-    def from_http(self, request: HttpRequest, user: Optional[User] = None) -> "Event":
+    def from_http(self, request: HttpRequest, user: User | None = None) -> "Event":
         """Add data from a Django-HttpRequest, allowing the creation of
         Events independently from requests.
         `user` arguments optionally overrides user from requests."""
@@ -418,7 +419,7 @@ class NotificationTransport(SerializerModel):
                 if not isinstance(value, str):
                     continue
                 # https://birdie0.github.io/discord-webhooks-guide/other/field_limits.html
-                if len(fields) >= 25:
+                if len(fields) >= DISCORD_FIELD_LIMIT:
                     continue
                 fields.append({"title": key[:256], "value": value[:1024]})
         body = {
@@ -472,7 +473,7 @@ class NotificationTransport(SerializerModel):
                     continue
                 context["key_value"][key] = value
         else:
-            context["title"] += notification.body[:75]
+            context["title"] += notification.body[:NOTIFICATION_SUMMARY_LENGTH]
         # TODO: improve permission check
         if notification.user.is_superuser:
             context["source"] = {
@@ -480,7 +481,7 @@ class NotificationTransport(SerializerModel):
             }
         mail = TemplateEmailMessage(
             subject=subject_prefix + context["title"],
-            to=[f"{notification.user.name} <{notification.user.email}>"],
+            to=[(notification.user.name, notification.user.email)],
             language=notification.user.locale(),
             template_name="email/event_notification.html",
             template_context=context,
@@ -489,7 +490,7 @@ class NotificationTransport(SerializerModel):
         try:
             from authentik.stages.email.tasks import send_mail
 
-            return send_mail(mail.__dict__)  # pylint: disable=no-value-for-parameter
+            return send_mail(mail.__dict__)
         except (SMTPException, ConnectionError, OSError) as exc:
             raise NotificationTransportError(exc) from exc
 
@@ -533,7 +534,11 @@ class Notification(SerializerModel):
         return NotificationSerializer
 
     def __str__(self) -> str:
-        body_trunc = (self.body[:75] + "..") if len(self.body) > 75 else self.body
+        body_trunc = (
+            (self.body[:NOTIFICATION_SUMMARY_LENGTH] + "..")
+            if len(self.body) > NOTIFICATION_SUMMARY_LENGTH
+            else self.body
+        )
         return f"Notification for user {self.user}: {body_trunc}"
 
     class Meta:

authentik/events/signals.py

@@ -1,6 +1,6 @@
 """authentik events signal listener"""
 
-from typing import Any, Optional
+from typing import Any
 
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.db.models.signals import post_save, pre_delete
@@ -42,7 +42,7 @@ def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
     request.session[SESSION_LOGIN_EVENT] = event
 
 
-def get_login_event(request: HttpRequest) -> Optional[Event]:
+def get_login_event(request: HttpRequest) -> Event | None:
     """Wrapper to get login event that can be mocked in tests"""
     return request.session.get(SESSION_LOGIN_EVENT, None)
 
@@ -71,7 +71,7 @@ def on_login_failed(
     sender,
     credentials: dict[str, str],
     request: HttpRequest,
-    stage: Optional[Stage] = None,
+    stage: Stage | None = None,
     **kwargs,
 ):
     """Failed Login, authentik custom event"""

authentik/events/system_tasks.py

@@ -2,16 +2,15 @@
 
 from datetime import datetime, timedelta
 from time import perf_counter
-from typing import Any, Optional
+from typing import Any
 
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from structlog.stdlib import get_logger
 from tenant_schemas_celery.task import TenantTask
 
-from authentik.events.models import Event, EventAction
+from authentik.events.models import Event, EventAction, TaskStatus
 from authentik.events.models import SystemTask as DBSystemTask
-from authentik.events.models import TaskStatus
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.errors import exception_to_string
 
@@ -27,10 +26,10 @@ class SystemTask(TenantTask):
     _status: TaskStatus
     _messages: list[str]
 
-    _uid: Optional[str]
+    _uid: str | None
     # Precise start time from perf_counter
-    _start_precise: Optional[float] = None
+    _start_precise: float | None = None
-    _start: Optional[datetime] = None
+    _start: datetime | None = None
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
@@ -60,14 +59,13 @@ class SystemTask(TenantTask):
         self._start = now()
         return super().before_start(task_id, args, kwargs)
 
-    def db(self) -> Optional[DBSystemTask]:
+    def db(self) -> DBSystemTask | None:
         """Get DB object for latest task"""
         return DBSystemTask.objects.filter(
             name=self.__name__,
             uid=self._uid,
         ).first()
 
-    # pylint: disable=too-many-arguments
     def after_return(self, status, retval, task_id, args: list[Any], kwargs: dict[str, Any], einfo):
         super().after_return(status, retval, task_id, args, kwargs, einfo=einfo)
         if not self._status:
@@ -88,8 +86,8 @@ class SystemTask(TenantTask):
                 "duration": max(perf_counter() - self._start_precise, 0),
                 "task_call_module": self.__module__,
                 "task_call_func": self.__name__,
-                "task_call_args": args,
+                "task_call_args": sanitize_item(args),
-                "task_call_kwargs": kwargs,
+                "task_call_kwargs": sanitize_item(kwargs),
                 "status": self._status,
                 "messages": sanitize_item(self._messages),
                 "expires": now() + timedelta(hours=self.result_timeout_hours),
@@ -97,7 +95,6 @@ class SystemTask(TenantTask):
             },
         )
 
-    # pylint: disable=too-many-arguments
     def on_failure(self, exc, task_id, args, kwargs, einfo):
         super().on_failure(exc, task_id, args, kwargs, einfo=einfo)
         if not self._status:
@@ -113,8 +110,8 @@ class SystemTask(TenantTask):
                 "duration": max(perf_counter() - self._start_precise, 0),
                 "task_call_module": self.__module__,
                 "task_call_func": self.__name__,
-                "task_call_args": args,
+                "task_call_args": sanitize_item(args),
-                "task_call_kwargs": kwargs,
+                "task_call_kwargs": sanitize_item(kwargs),
                 "status": self._status,
                 "messages": sanitize_item(self._messages),
                 "expires": now() + timedelta(hours=self.result_timeout_hours),

authentik/events/tasks.py

@@ -1,7 +1,5 @@
 """Event notification tasks"""
 
-from typing import Optional
-
 from django.db.models.query_utils import Q
 from guardian.shortcuts import get_anonymous_user
 from structlog.stdlib import get_logger
@@ -38,7 +36,7 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):
     if not event:
         LOGGER.warning("event doesn't exist yet or anymore", event_uuid=event_uuid)
         return
-    trigger: Optional[NotificationRule] = NotificationRule.objects.filter(name=trigger_name).first()
+    trigger: NotificationRule | None = NotificationRule.objects.filter(name=trigger_name).first()
     if not trigger:
         return
 

authentik/events/tests/test_event.py

@@ -105,7 +105,7 @@ class TestEvents(TestCase):
         # Test brand
         request = self.factory.get("/")
         brand = Brand(domain="test-brand")
-        setattr(request, "brand", brand)
+        request.brand = brand
         event = Event.new("unittest").from_http(request)
         self.assertEqual(
             event.brand,

authentik/events/utils.py

@@ -7,7 +7,7 @@ from datetime import date, datetime, time, timedelta
 from enum import Enum
 from pathlib import Path
 from types import GeneratorType, NoneType
-from typing import Any, Optional
+from typing import Any
 from uuid import UUID
 
 from django.contrib.auth.models import AnonymousUser
@@ -37,7 +37,7 @@ def cleanse_item(key: str, value: Any) -> Any:
     """Cleanse a single item"""
     if isinstance(value, dict):
         return cleanse_dict(value)
-    if isinstance(value, (list, tuple, set)):
+    if isinstance(value, list | tuple | set):
         for idx, item in enumerate(value):
             value[idx] = cleanse_item(key, item)
         return value
@@ -74,7 +74,7 @@ def model_to_dict(model: Model) -> dict[str, Any]:
     }
 
 
-def get_user(user: User | AnonymousUser, original_user: Optional[User] = None) -> dict[str, Any]:
+def get_user(user: User | AnonymousUser, original_user: User | None = None) -> dict[str, Any]:
     """Convert user object to dictionary, optionally including the original user"""
     if isinstance(user, AnonymousUser):
         try:
@@ -95,8 +95,7 @@ def get_user(user: User | AnonymousUser, original_user: Optional[User] = None) -
     return user_data
 
 
-# pylint: disable=too-many-return-statements,too-many-branches
+def sanitize_item(value: Any) -> Any:  # noqa: PLR0911, PLR0912
-def sanitize_item(value: Any) -> Any:
     """Sanitize a single item, ensure it is JSON parsable"""
     if is_dataclass(value):
         # Because asdict calls `copy.deepcopy(obj)` on everything that's not tuple/dict,
@@ -115,20 +114,20 @@ def sanitize_item(value: Any) -> Any:
         return sanitize_dict(value)
     if isinstance(value, GeneratorType):
         return sanitize_item(list(value))
-    if isinstance(value, (list, tuple, set)):
+    if isinstance(value, list | tuple | set):
         new_values = []
         for item in value:
             new_value = sanitize_item(item)
             if new_value:
                 new_values.append(new_value)
         return new_values
-    if isinstance(value, (User, AnonymousUser)):
+    if isinstance(value, User | AnonymousUser):
         return sanitize_dict(get_user(value))
     if isinstance(value, models.Model):
         return sanitize_dict(model_to_dict(value))
     if isinstance(value, UUID):
         return value.hex
-    if isinstance(value, (HttpRequest, WSGIRequest)):
+    if isinstance(value, HttpRequest | WSGIRequest):
         return ...
     if isinstance(value, City):
         return GEOIP_CONTEXT_PROCESSOR.city_to_dict(value)
@@ -171,7 +170,7 @@ def sanitize_item(value: Any) -> Any:
             "module": value.__module__,
         }
     # List taken from the stdlib's JSON encoder (_make_iterencode, encoder.py:415)
-    if isinstance(value, (bool, int, float, NoneType, list, tuple, dict)):
+    if isinstance(value, bool | int | float | NoneType | list | tuple | dict):
         return value
     try:
         return DjangoJSONEncoder().default(value)

authentik/flows/api/flows.py

@@ -15,7 +15,6 @@ from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
-from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.exporter import FlowExporter
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT, Importer
 from authentik.core.api.used_by import UsedByMixin
@@ -33,6 +32,7 @@ from authentik.lib.utils.file import (
     set_file_url,
 )
 from authentik.lib.views import bad_request_message
+from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 
@@ -114,7 +114,6 @@ class FlowImportResultSerializer(PassiveSerializer):
 class FlowViewSet(UsedByMixin, ModelViewSet):
     """Flow Viewset"""
 
-    # pylint: disable=no-member
     queryset = Flow.objects.all().prefetch_related("stages", "policies")
     serializer_class = FlowSerializer
     lookup_field = "slug"
@@ -279,7 +278,7 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
         },
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
-    def execute(self, request: Request, slug: str):
+    def execute(self, request: Request, _slug: str):
         """Execute flow for current user"""
         # Because we pre-plan the flow here, and not in the planner, we need to manually clear
         # the history of the inspector
@@ -294,8 +293,9 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
             return bad_request_message(
                 request,
                 _(
-                    "Flow not applicable to current user/request: %(messages)s"
+                    "Flow not applicable to current user/request: {messages}".format_map(
-                    % {"messages": exc.messages}
+                        {"messages": exc.messages}
+                    )
                 ),
             )
         return Response(

authentik/flows/api/flows_diagram.py

@@ -1,7 +1,6 @@
 """Flows Diagram API"""
 
 from dataclasses import dataclass, field
-from typing import Optional
 
 from django.utils.translation import gettext as _
 from guardian.shortcuts import get_objects_for_user
@@ -18,8 +17,8 @@ class DiagramElement:
 
     identifier: str
     description: str
-    action: Optional[str] = None
+    action: str | None = None
-    source: Optional[list["DiagramElement"]] = None
+    source: list["DiagramElement"] | None = None
 
     style: list[str] = field(default_factory=lambda: ["[", "]"])
 
@@ -66,10 +65,10 @@ class FlowDiagram:
         ):
             element = DiagramElement(
                 f"flow_policy_{p_index}",
-                _("Policy (%(type)s)" % {"type": policy_binding.policy._meta.verbose_name})
+                _("Policy ({type})".format_map({"type": policy_binding.policy._meta.verbose_name}))
                 + "\n"
                 + policy_binding.policy.name,
-                _("Binding %(order)d" % {"order": policy_binding.order}),
+                _("Binding {order}".format_map({"order": policy_binding.order})),
                 parent_elements,
                 style=["{{", "}}"],
             )
@@ -92,7 +91,7 @@ class FlowDiagram:
         ):
             element = DiagramElement(
                 f"stage_{stage_index}_policy_{p_index}",
-                _("Policy (%(type)s)" % {"type": policy_binding.policy._meta.verbose_name})
+                _("Policy ({type})".format_map({"type": policy_binding.policy._meta.verbose_name}))
                 + "\n"
                 + policy_binding.policy.name,
                 "",
@@ -120,7 +119,7 @@ class FlowDiagram:
 
             element = DiagramElement(
                 f"stage_{s_index}",
-                _("Stage (%(type)s)" % {"type": stage_binding.stage._meta.verbose_name})
+                _("Stage ({type})".format_map({"type": stage_binding.stage._meta.verbose_name}))
                 + "\n"
                 + stage_binding.stage.name,
                 action,

authentik/flows/apps.py

@@ -31,9 +31,10 @@ class AuthentikFlowsConfig(ManagedAppConfig):
     verbose_name = "authentik Flows"
     default = True
 
-    def reconcile_global_load_stages(self):
+    @ManagedAppConfig.reconcile_global
+    def load_stages(self):
         """Ensure all stages are loaded"""
         from authentik.flows.models import Stage
 
         for stage in all_subclasses(Stage):
-            _ = stage().type
+            _ = stage().view

authentik/flows/challenge.py

@@ -104,7 +104,7 @@ class FlowErrorChallenge(Challenge):
     error = CharField(required=False)
     traceback = CharField(required=False)
 
-    def __init__(self, request: Optional[Request] = None, error: Optional[Exception] = None):
+    def __init__(self, request: Request | None = None, error: Exception | None = None):
         super().__init__(data={})
         if not request or not error:
             return

authentik/flows/exceptions.py

@@ -1,7 +1,5 @@
 """flow exceptions"""
 
-from typing import Optional
-
 from django.utils.translation import gettext_lazy as _
 
 from authentik.lib.sentry import SentryIgnoredException
@@ -11,7 +9,7 @@ from authentik.policies.types import PolicyResult
 class FlowNonApplicableException(SentryIgnoredException):
     """Flow does not apply to current user (denied by policy, or otherwise)."""
 
-    policy_result: Optional[PolicyResult] = None
+    policy_result: PolicyResult | None = None
 
     @property
     def messages(self) -> str:

authentik/flows/markers.py

@@ -1,7 +1,7 @@
 """Stage Markers"""
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 
 from django.http.request import HttpRequest
 from structlog.stdlib import get_logger
@@ -25,7 +25,7 @@ class StageMarker:
         plan: "FlowPlan",
         binding: FlowStageBinding,
         http_request: HttpRequest,
-    ) -> Optional[FlowStageBinding]:
+    ) -> FlowStageBinding | None:
         """Process callback for this marker. This should be overridden by sub-classes.
         If a stage should be removed, return None."""
         return binding
@@ -42,7 +42,7 @@ class ReevaluateMarker(StageMarker):
         plan: "FlowPlan",
         binding: FlowStageBinding,
         http_request: HttpRequest,
-    ) -> Optional[FlowStageBinding]:
+    ) -> FlowStageBinding | None:
         """Re-evaluate policies bound to stage, and if they fail, remove from plan"""
         from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
 

authentik/flows/migrations/0027_auto_20231028_1424.py

@@ -16,7 +16,7 @@ def set_oobe_flow_authentication(apps: Apps, schema_editor: BaseDatabaseSchemaEd
     users = User.objects.using(db_alias).exclude(username="akadmin")
     try:
         users = users.exclude(pk=get_anonymous_user().pk)
-    # pylint: disable=broad-except
+
     except Exception:  # nosec
         pass
 

authentik/flows/models.py

@@ -2,7 +2,7 @@
 
 from base64 import b64decode, b64encode
 from pickle import dumps, loads  # nosec
-from typing import TYPE_CHECKING, Optional
+from typing import TYPE_CHECKING
 from uuid import uuid4
 
 from django.db import models
@@ -83,7 +83,7 @@ class Stage(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def type(self) -> type["StageView"]:
+    def view(self) -> type["StageView"]:
         """Return StageView class that implements logic for this stage"""
         # This is a bit of a workaround, since we can't set class methods with setattr
         if hasattr(self, "__in_memory_type"):
@@ -95,7 +95,7 @@ class Stage(SerializerModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
+    def ui_user_settings(self) -> UserSettingSerializer | None:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or a challenge."""
         return None
@@ -113,8 +113,8 @@ def in_memory_stage(view: type["StageView"], **kwargs) -> Stage:
     # we set the view as a separate property and reference a generic function
     # that returns that member
     setattr(stage, "__in_memory_type", view)
-    setattr(stage, "name", _("Dynamic In-memory stage: %(doc)s" % {"doc": view.__doc__}))
+    stage.name = _("Dynamic In-memory stage: {doc}".format_map({"doc": view.__doc__}))
-    setattr(stage._meta, "verbose_name", class_to_path(view))
+    stage._meta.verbose_name = class_to_path(view)
     for key, value in kwargs.items():
         setattr(stage, key, value)
     return stage

authentik/flows/planner.py

@@ -1,7 +1,7 @@
 """Flows Planner"""
 
 from dataclasses import dataclass, field
-from typing import Any, Optional
+from typing import Any
 
 from django.core.cache import cache
 from django.http import HttpRequest
@@ -39,7 +39,7 @@ CACHE_TIMEOUT = CONFIG.get_int("cache.timeout_flows")
 CACHE_PREFIX = "goauthentik.io/flows/planner/"
 
 
-def cache_key(flow: Flow, user: Optional[User] = None) -> str:
+def cache_key(flow: Flow, user: User | None = None) -> str:
     """Generate Cache key for flow"""
     prefix = CACHE_PREFIX + str(flow.pk)
     if user:
@@ -58,16 +58,16 @@ class FlowPlan:
     context: dict[str, Any] = field(default_factory=dict)
     markers: list[StageMarker] = field(default_factory=list)
 
-    def append_stage(self, stage: Stage, marker: Optional[StageMarker] = None):
+    def append_stage(self, stage: Stage, marker: StageMarker | None = None):
         """Append `stage` to all stages, optionally with stage marker"""
         return self.append(FlowStageBinding(stage=stage), marker)
 
-    def append(self, binding: FlowStageBinding, marker: Optional[StageMarker] = None):
+    def append(self, binding: FlowStageBinding, marker: StageMarker | None = None):
         """Append `stage` to all stages, optionally with stage marker"""
         self.bindings.append(binding)
         self.markers.append(marker or StageMarker())
 
-    def insert_stage(self, stage: Stage, marker: Optional[StageMarker] = None):
+    def insert_stage(self, stage: Stage, marker: StageMarker | None = None):
         """Insert stage into plan, as immediate next stage"""
         self.bindings.insert(1, FlowStageBinding(stage=stage, order=0))
         self.markers.insert(1, marker or StageMarker())
@@ -78,7 +78,7 @@ class FlowPlan:
 
         self.insert_stage(in_memory_stage(RedirectStage, destination=destination))
 
-    def next(self, http_request: Optional[HttpRequest]) -> Optional[FlowStageBinding]:
+    def next(self, http_request: HttpRequest | None) -> FlowStageBinding | None:
         """Return next pending stage from the bottom of the list"""
         if not self.has_stages:
             return None
@@ -94,7 +94,7 @@ class FlowPlan:
             self.markers.remove(marker)
             if not self.has_stages:
                 return None
-            # pylint: disable=not-callable
+
             return self.next(http_request)
         return marked_stage
 
@@ -148,9 +148,7 @@ class FlowPlanner:
             if not outpost_user:
                 raise FlowNonApplicableException()
 
-    def plan(
+    def plan(self, request: HttpRequest, default_context: dict[str, Any] | None = None) -> FlowPlan:
-        self, request: HttpRequest, default_context: Optional[dict[str, Any]] = None
-    ) -> FlowPlan:
         """Check each of the flows' policies, check policies for each stage with PolicyBinding
         and return ordered list"""
         with Hub.current.start_span(
@@ -214,7 +212,7 @@ class FlowPlanner:
         self,
         user: User,
         request: HttpRequest,
-        default_context: Optional[dict[str, Any]],
+        default_context: dict[str, Any] | None,
     ) -> FlowPlan:
         """Build flow plan by checking each stage in their respective
         order and checking the applied policies"""