root: remove /if/help/

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,20 +1,12 @@
 [bumpversion]
-current_version = 2024.2.3
+current_version = 2023.10.6
 tag = True
 commit = True
-parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?
+parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)
-serialize = 
+serialize = {major}.{minor}.{patch}
-	{major}.{minor}.{patch}-{rc_t}{rc_n}
-	{major}.{minor}.{patch}
 message = release: {new_version}
 tag_name = version/{new_version}
 
-[bumpversion:part:rc_t]
-values = 
-	rc
-	final
-optional_value = final
-
 [bumpversion:file:pyproject.toml]
 
 [bumpversion:file:docker-compose.yml]

.github/actions/comment-pr-instructions/action.yml

@@ -9,6 +9,9 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Generate config
+      id: ev
+      uses: ./.github/actions/docker-push-variables
     - name: Find Comment
       uses: peter-evans/find-comment@v2
       id: fc

.github/actions/docker-push-variables/action.yml

@@ -1,47 +1,64 @@
----
 name: "Prepare docker environment variables"
 description: "Prepare docker environment variables"
 
-inputs:
-  image-name:
-    required: true
-    description: "Docker image prefix"
-  image-arch:
-    required: false
-    description: "Docker image arch"
-
 outputs:
   shouldBuild:
     description: "Whether to build image or not"
     value: ${{ steps.ev.outputs.shouldBuild }}
-
+  branchName:
+    description: "Branch name"
+    value: ${{ steps.ev.outputs.branchName }}
+  branchNameContainer:
+    description: "Branch name (for containers)"
+    value: ${{ steps.ev.outputs.branchNameContainer }}
+  timestamp:
+    description: "Timestamp"
+    value: ${{ steps.ev.outputs.timestamp }}
   sha:
     description: "sha"
     value: ${{ steps.ev.outputs.sha }}
-
+  shortHash:
+    description: "shortHash"
+    value: ${{ steps.ev.outputs.shortHash }}
   version:
-    description: "Version"
+    description: "version"
     value: ${{ steps.ev.outputs.version }}
-  prerelease:
+  versionFamily:
-    description: "Prerelease"
+    description: "versionFamily"
-    value: ${{ steps.ev.outputs.prerelease }}
+    value: ${{ steps.ev.outputs.versionFamily }}
-
-  imageTags:
-    description: "Docker image tags"
-    value: ${{ steps.ev.outputs.imageTags }}
-  imageMainTag:
-    description: "Docker image main tag"
-    value: ${{ steps.ev.outputs.imageMainTag }}
 
 runs:
   using: "composite"
   steps:
     - name: Generate config
       id: ev
-      shell: bash
+      shell: python
-      env:
-        IMAGE_NAME: ${{ inputs.image-name }}
-        IMAGE_ARCH: ${{ inputs.image-arch }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        python3 ${{ github.action_path }}/push_vars.py
+        """Helper script to get the actual branch name, docker safe"""
+        import configparser
+        import os
+        from time import time
+
+        parser = configparser.ConfigParser()
+        parser.read(".bumpversion.cfg")
+
+        branch_name = os.environ["GITHUB_REF"]
+        if os.environ.get("GITHUB_HEAD_REF", "") != "":
+            branch_name = os.environ["GITHUB_HEAD_REF"]
+
+        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
+        version = parser.get("bumpversion", "current_version")
+        version_family = ".".join(version.split(".")[:-1])
+        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+        sha = os.environ["GITHUB_SHA"] if not "${{ github.event.pull_request.head.sha }}" else "${{ github.event.pull_request.head.sha }}"
+
+        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+            print("branchName=%s" % branch_name, file=_output)
+            print("branchNameContainer=%s" % safe_branch_name, file=_output)
+            print("timestamp=%s" % int(time()), file=_output)
+            print("sha=%s" % sha, file=_output)
+            print("shortHash=%s" % sha[:7], file=_output)
+            print("shouldBuild=%s" % should_build, file=_output)
+            print("version=%s" % version, file=_output)
+            print("versionFamily=%s" % version_family, file=_output)

.github/actions/docker-push-variables/push_vars.py

@@ -1,62 +0,0 @@
-"""Helper script to get the actual branch name, docker safe"""
-
-import configparser
-import os
-from time import time
-
-parser = configparser.ConfigParser()
-parser.read(".bumpversion.cfg")
-
-should_build = str(os.environ.get("DOCKER_USERNAME", None) is not None).lower()
-
-branch_name = os.environ["GITHUB_REF"]
-if os.environ.get("GITHUB_HEAD_REF", "") != "":
-    branch_name = os.environ["GITHUB_HEAD_REF"]
-safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
-
-image_names = os.getenv("IMAGE_NAME").split(",")
-image_arch = os.getenv("IMAGE_ARCH") or None
-
-is_pull_request = bool(os.getenv("PR_HEAD_SHA"))
-is_release = "dev" not in image_names[0]
-
-sha = os.environ["GITHUB_SHA"] if not is_pull_request else os.getenv("PR_HEAD_SHA")
-
-# 2042.1.0 or 2042.1.0-rc1
-version = parser.get("bumpversion", "current_version")
-# 2042.1
-version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
-prerelease = "-" in version
-
-image_tags = []
-if is_release:
-    for name in image_names:
-        image_tags += [
-            f"{name}:{version}",
-        ]
-        if not prerelease:
-            image_tags += [
-                f"{name}:latest",
-                f"{name}:{version_family}",
-            ]
-else:
-    suffix = ""
-    if image_arch and image_arch != "amd64":
-        suffix = f"-{image_arch}"
-    for name in image_names:
-        image_tags += [
-            f"{name}:gh-{sha}{suffix}",  # Used for ArgoCD and PR comments
-            f"{name}:gh-{safe_branch_name}{suffix}",  # For convenience
-            f"{name}:gh-{safe_branch_name}-{int(time())}-{sha[:7]}{suffix}",  # Use by FluxCD
-        ]
-
-image_main_tag = image_tags[0]
-image_tags_rendered = ",".join(image_tags)
-
-with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
-    print("shouldBuild=%s" % should_build, file=_output)
-    print("sha=%s" % sha, file=_output)
-    print("version=%s" % version, file=_output)
-    print("prerelease=%s" % prerelease, file=_output)
-    print("imageTags=%s" % image_tags_rendered, file=_output)
-    print("imageMainTag=%s" % image_main_tag, file=_output)

.github/actions/docker-push-variables/test.sh

@@ -1,7 +0,0 @@
-#!/bin/bash -x
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-GITHUB_OUTPUT=/dev/stdout \
-    GITHUB_REF=ref \
-    GITHUB_SHA=sha \
-    IMAGE_NAME=ghcr.io/goauthentik/server,beryju/authentik \
-    python $SCRIPT_DIR/push_vars.py

.github/codespell-words.txt

@@ -3,4 +3,3 @@ keypairs
 hass
 warmup
 ontext
-singed

.github/pull_request_template.md

@@ -27,6 +27,7 @@ If an API change has been made
 If changes to the frontend have been made
 
 -   [ ] The code has been formatted (`make web`)
+-   [ ] The translation files have been updated (`make i18n-extract`)
 
 If applicable
 

.github/workflows/ci-main.yml

@@ -1,4 +1,3 @@
----
 name: authentik-ci-main
 
 on:
@@ -8,7 +7,7 @@ on:
       - next
       - version-*
     paths-ignore:
-      - website/**
+      - website
   pull_request:
     branches:
       - main
@@ -30,7 +29,7 @@ jobs:
           - codespell
           - isort
           - pending-migrations
-          # - pylint
+          - pylint
           - pyright
           - ruff
     runs-on: ubuntu-latest
@@ -70,7 +69,7 @@ jobs:
           cp authentik/lib/default.yml local.env.yml
           cp -R .github ..
           cp -R scripts ..
-          git checkout $(git tag --sort=version:refname | grep '^version/' | grep -vE -- '-rc[0-9]+$' | tail -n1)
+          git checkout version/$(python -c "from authentik import __version__; print(__version__)")
           rm -rf .github/ scripts/
           mv ../.github ../scripts .
       - name: Setup authentik env (stable)
@@ -123,10 +122,9 @@ jobs:
           poetry run make test
           poetry run coverage xml
       - if: ${{ always() }}
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v3
         with:
           flags: unit
-          token: ${{ secrets.CODECOV_TOKEN }}
   test-integration:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -135,16 +133,15 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.9.0
+        uses: helm/kind-action@v1.8.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration
           poetry run coverage xml
       - if: ${{ always() }}
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v3
         with:
           flags: integration
-          token: ${{ secrets.CODECOV_TOKEN }}
   test-e2e:
     name: test-e2e (${{ matrix.job.name }})
     runs-on: ubuntu-latest
@@ -191,10 +188,9 @@ jobs:
           poetry run coverage run manage.py test ${{ matrix.job.glob }}
           poetry run coverage xml
       - if: ${{ always() }}
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v3
         with:
           flags: e2e
-          token: ${{ secrets.CODECOV_TOKEN }}
   ci-core-mark:
     needs:
       - lint
@@ -207,12 +203,6 @@ jobs:
     steps:
       - run: echo mark
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - amd64
-          - arm64
     needs: ci-core-mark
     runs-on: ubuntu-latest
     permissions:
@@ -232,12 +222,9 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-server
-          image-arch: ${{ matrix.arch }}
       - name: Login to Container Registry
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -251,16 +238,69 @@ jobs:
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
-          tags: ${{ steps.ev.outputs.imageTags }}
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.sha }}
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+  build-arm64:
+    needs: ci-core-mark
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
+        id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      - name: Login to Container Registry
+        uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: generate ts client
+        run: make gen-client-ts
+      - name: Build Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          secrets: |
+            GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
+            GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
+          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-arm64
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.sha }}-arm64
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}-arm64
+          build-args: |
+            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
+          platforms: linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          platforms: linux/${{ matrix.arch }}
   pr-comment:
     needs:
       - build
+      - build-arm64
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' }}
     permissions:
@@ -276,9 +316,7 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-server
       - name: Comment on PR
         uses: ./.github/actions/comment-pr-instructions
         with:
-          tag: gh-${{ steps.ev.outputs.imageMainTag }}
+          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}

.github/workflows/ci-outpost.yml

@@ -1,4 +1,3 @@
----
 name: authentik-ci-outpost
 
 on:
@@ -29,7 +28,7 @@ jobs:
       - name: Generate API
         run: make gen-client-go
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v3
         with:
           version: v1.54.2
           args: --timeout 5000s --verbose
@@ -84,11 +83,9 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-${{ matrix.type }}
       - name: Login to Container Registry
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -98,11 +95,15 @@ jobs:
       - name: Build Docker Image
         uses: docker/build-push-action@v5
         with:
-          tags: ${{ steps.ev.outputs.imageTags }}
-          file: ${{ matrix.type }}.Dockerfile
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}
+            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
+          file: ${{ matrix.type }}.Dockerfile
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/amd64,linux/arm64
           context: .
           cache-from: type=gha

.github/workflows/image-compress.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           githubToken: ${{ steps.generate_token.outputs.token }}
           compressOnly: ${{ github.event_name != 'pull_request' }}
-      - uses: peter-evans/create-pull-request@v6
+      - uses: peter-evans/create-pull-request@v5
         if: "${{ github.event_name != 'pull_request' && steps.compress.outputs.markdown != '' }}"
         id: cpr
         with:

.github/workflows/release-publish.yml

@@ -1,4 +1,3 @@
----
 name: authentik-on-release
 
 on:
@@ -20,10 +19,6 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/server,beryju/authentik
       - name: Docker Login Registry
         uses: docker/login-action@v3
         with:
@@ -43,12 +38,21 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
-          push: true
+          push: ${{ github.event_name == 'release' }}
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
-          tags: ${{ steps.ev.outputs.imageTags }}
+          tags: |
+            beryju/authentik:${{ steps.ev.outputs.version }},
+            beryju/authentik:${{ steps.ev.outputs.versionFamily }},
+            beryju/authentik:latest,
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.versionFamily }},
+            ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost:
     runs-on: ubuntu-latest
     permissions:
@@ -74,10 +78,6 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/${{ matrix.type }},beryju/authentik-${{ matrix.type }}
       - name: make empty clients
         run: |
           mkdir -p ./gen-ts-api
@@ -96,11 +96,20 @@ jobs:
       - name: Build Docker Image
         uses: docker/build-push-action@v5
         with:
-          push: true
+          push: ${{ github.event_name == 'release' }}
-          tags: ${{ steps.ev.outputs.imageTags }}
+          tags: |
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
+            beryju/authentik-${{ matrix.type }}:latest,
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
+            ghcr.io/goauthentik/${{ matrix.type }}:latest
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
           context: .
+          build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost-binary:
     timeout-minutes: 120
     runs-on: ubuntu-latest
@@ -172,18 +181,15 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/server
       - name: Get static files from docker image
         run: |
-          docker pull ${{ steps.ev.outputs.imageMainTag }}
+          docker pull ghcr.io/goauthentik/server:latest
-          container=$(docker container create ${{ steps.ev.outputs.imageMainTag }})
+          container=$(docker container create ghcr.io/goauthentik/server:latest)
           docker cp ${container}:web/ .
       - name: Create a Sentry.io release
         uses: getsentry/action-release@v1
         continue-on-error: true
+        if: ${{ github.event_name == 'release' }}
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: authentik-security-inc

.github/workflows/release-tag.yml

@@ -1,4 +1,3 @@
----
 name: authentik-on-tag
 
 on:
@@ -29,13 +28,13 @@ jobs:
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - name: prepare variables
+      - name: Extract version number
-        uses: ./.github/actions/docker-push-variables
+        id: get_version
-        id: ev
+        uses: actions/github-script@v7
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         with:
-          image-name: ghcr.io/goauthentik/server
+          github-token: ${{ steps.generate_token.outputs.token }}
+          script: |
+            return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
       - name: Create Release
         id: create_release
         uses: actions/create-release@v1.1.4
@@ -43,6 +42,6 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         with:
           tag_name: ${{ github.ref }}
-          release_name: Release ${{ steps.ev.outputs.version }}
+          release_name: Release ${{ steps.get_version.outputs.result }}
           draft: true
-          prerelease: ${{ steps.ev.outputs.prerelease == 'true' }}
+          prerelease: false

.github/workflows/translation-advice.yml

@@ -19,14 +19,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Find Comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v2
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: "github-actions[bot]"
           body-includes: authentik translations instructions
       - name: Create or update comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v3
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}

.github/workflows/translation-compile.yml

@@ -1,8 +1,9 @@
----
+name: authentik-backend-translate-compile
-name: authentik-backend-translate-extract-compile
 on:
-  schedule:
+  push:
-    - cron: "0 0 * * *" # every day at midnight
+    branches: [main]
+    paths:
+      - "locale/**"
   workflow_dispatch:
 
 env:
@@ -24,20 +25,16 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
       - name: Setup authentik env
         uses: ./.github/actions/setup
-      - name: run extract
-        run: |
-          poetry run make i18n-extract
       - name: run compile
-        run: |
+        run: poetry run ak compilemessages
-          poetry run ak compilemessages
-          make web-check-compile
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v5
+        id: cpr
         with:
           token: ${{ steps.generate_token.outputs.token }}
-          branch: extract-compile-backend-translation
+          branch: compile-backend-translation
-          commit-message: "core, web: update translations"
+          commit-message: "core: compile backend translations"
-          title: "core, web: update translations"
+          title: "core: compile backend translations"
-          body: "core, web: update translations"
+          body: "core: compile backend translations"
           delete-branch: true
           signoff: true

.github/workflows/web-api-publish.yml

@@ -35,7 +35,7 @@ jobs:
         run: |
           export VERSION=`node -e 'console.log(require("../gen-ts-api/package.json").version)'`
           npm i @goauthentik/api@$VERSION
-      - uses: peter-evans/create-pull-request@v6
+      - uses: peter-evans/create-pull-request@v5
         id: cpr
         with:
           token: ${{ steps.generate_token.outputs.token }}

CODEOWNERS

@@ -11,8 +11,6 @@ scripts/                        @goauthentik/backend
 tests/                          @goauthentik/backend
 pyproject.toml                  @goauthentik/backend
 poetry.lock                     @goauthentik/backend
-go.mod                          @goauthentik/backend
-go.sum                          @goauthentik/backend
 # Infrastructure
 .github/                        @goauthentik/infrastructure
 Dockerfile                      @goauthentik/infrastructure

Dockerfile

@@ -1,24 +1,6 @@
 # syntax=docker/dockerfile:1
 
-# Stage 1: Build website
+# Stage 1: Build webui
-FROM --platform=${BUILDPLATFORM} docker.io/node:21 as website-builder
-
-ENV NODE_ENV=production
-
-WORKDIR /work/website
-
-RUN --mount=type=bind,target=/work/website/package.json,src=./website/package.json \
-    --mount=type=bind,target=/work/website/package-lock.json,src=./website/package-lock.json \
-    --mount=type=cache,id=npm-website,sharing=shared,target=/root/.npm \
-    npm ci --include=dev
-
-COPY ./website /work/website/
-COPY ./blueprints /work/blueprints/
-COPY ./SECURITY.md /work/
-
-RUN npm run build-docs-only
-
-# Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
 
 ENV NODE_ENV=production
@@ -36,8 +18,8 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 
 RUN npm run build
 
-# Stage 3: Build go proxy
+# Stage 2: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.0-bookworm AS go-builder
+FROM --platform=${BUILDPLATFORM} docker.io/golang:1.21.6-bookworm AS go-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -68,7 +50,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \
     --mount=type=cache,id=go-build-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/root/.cache/go-build \
     GOARM="${TARGETVARIANT#v}" go build -o /go/authentik ./cmd/server
 
-# Stage 4: MaxMind GeoIP
+# Stage 3: MaxMind GeoIP
 FROM --platform=${BUILDPLATFORM} ghcr.io/maxmind/geoipupdate:v6.1 as geoip
 
 ENV GEOIPUPDATE_EDITION_IDS="GeoLite2-City GeoLite2-ASN"
@@ -82,8 +64,8 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     mkdir -p /usr/share/GeoIP && \
     /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
-# Stage 5: Python dependencies
+# Stage 4: Python dependencies
-FROM docker.io/python:3.12.2-slim-bookworm AS python-deps
+FROM docker.io/python:3.12.1-slim-bookworm AS python-deps
 
 WORKDIR /ak-root/poetry
 
@@ -103,13 +85,12 @@ RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
     --mount=type=cache,target=/root/.cache/pip \
     --mount=type=cache,target=/root/.cache/pypoetry \
     python -m venv /ak-root/venv/ && \
-    bash -c "source ${VENV_PATH}/bin/activate && \
     pip3 install --upgrade pip && \
     pip3 install poetry && \
-        poetry install --only=main --no-ansi --no-interaction --no-root"
+    poetry install --only=main --no-ansi --no-interaction
 
-# Stage 6: Run
+# Stage 5: Run
-FROM docker.io/python:3.12.2-slim-bookworm AS final-image
+FROM docker.io/python:3.12.1-slim-bookworm AS final-image
 
 ARG GIT_BUILD_HASH
 ARG VERSION
@@ -150,7 +131,6 @@ COPY --from=go-builder /go/authentik /bin/authentik
 COPY --from=python-deps /ak-root/venv /ak-root/venv
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/help/ /website/help/
 COPY --from=geoip /usr/share/GeoIP /geoip
 
 USER 1000

Makefile

@@ -5,12 +5,9 @@ PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
-PY_SOURCES = authentik tests scripts lifecycle .github
+PY_SOURCES = authentik tests scripts lifecycle
 DOCKER_IMAGE ?= "authentik:test"
 
-GEN_API_TS = "gen-ts-api"
-GEN_API_GO = "gen-go-api"
-
 pg_user := $(shell python -m authentik.lib.config postgresql.user 2>/dev/null)
 pg_host := $(shell python -m authentik.lib.config postgresql.host 2>/dev/null)
 pg_name := $(shell python -m authentik.lib.config postgresql.name 2>/dev/null)
@@ -70,26 +67,16 @@ lint: ## Lint the python and golang sources
 	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
-core-install:
-	poetry install
-
 migrate: ## Run the Authentik Django server's migrations
 	python -m lifecycle.migrate
 
-i18n-extract: core-i18n-extract web-i18n-extract  ## Extract strings that require translation into files to send to a translation service
+i18n-extract: i18n-extract-core web-i18n-extract  ## Extract strings that require translation into files to send to a translation service
 
-core-i18n-extract:
+i18n-extract-core:
-	ak makemessages \
+	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
-		--add-location file \
-		--no-obsolete \
-		--ignore web \
-		--ignore internal \
-		--ignore ${GEN_API_TS} \
-		--ignore ${GEN_API_GO} \
-		--ignore website \
-		-l en
 
-install: web-install website-install core-install  ## Install all requires dependencies for `web`, `website` and `core`
+install: web-install website-install  ## Install all requires dependencies for `web`, `website` and `core`
+	poetry install
 
 dev-drop-db:
 	dropdb -U ${pg_user} -h ${pg_host} ${pg_name}
@@ -107,14 +94,8 @@ dev-reset: dev-drop-db dev-create-db migrate  ## Drop and restore the Authentik
 #########################
 
 gen-build:  ## Extract the schema from the database
-	AUTHENTIK_DEBUG=true \
+	AUTHENTIK_DEBUG=true ak make_blueprint_schema > blueprints/schema.json
-		AUTHENTIK_TENANTS__ENABLED=true \
+	AUTHENTIK_DEBUG=true ak spectacular --file schema.yml
-		AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true \
-		ak make_blueprint_schema > blueprints/schema.json
-	AUTHENTIK_DEBUG=true \
-		AUTHENTIK_TENANTS__ENABLED=true \
-		AUTHENTIK_OUTPOSTS__DISABLE_EMBEDDED_OUTPOST=true \
-		ak spectacular --file schema.yml
 
 gen-changelog:  ## (Release) generate the changelog based from the commits since the last tag
 	git log --pretty=format:" - %s" $(shell git describe --tags $(shell git rev-list --tags --max-count=1))...$(shell git branch --show-current) | sort > changelog.md
@@ -125,7 +106,7 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		docker.io/openapitools/openapi-diff:2.1.0-beta.8 \
+		docker.io/openapitools/openapi-diff:2.1.0-beta.6 \
 		--markdown /local/diff.md \
 		/local/old_schema.yml /local/schema.yml
 	rm old_schema.yml
@@ -133,52 +114,48 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	sed -i 's/}/}/g' diff.md
 	npx prettier --write diff.md
 
-gen-clean-ts:  ## Remove generated API client for Typescript
+gen-clean:
-	rm -rf ./${GEN_API_TS}/
+	rm -rf gen-go-api/
-	rm -rf ./web/node_modules/@goauthentik/api/
+	rm -rf gen-ts-api/
+	rm -rf web/node_modules/@goauthentik/api/
 
-gen-clean-go:  ## Remove generated API client for Go
+gen-client-ts:  ## Build and install the authentik API for Typescript into the authentik UI Application
-	rm -rf ./${GEN_API_GO}/
-
-gen-clean: gen-clean-ts gen-clean-go  ## Remove generated API clients
-
-gen-client-ts: gen-clean-ts  ## Build and install the authentik API for Typescript into the authentik UI Application
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
 		docker.io/openapitools/openapi-generator-cli:v6.5.0 generate \
 		-i /local/schema.yml \
 		-g typescript-fetch \
-		-o /local/${GEN_API_TS} \
+		-o /local/gen-ts-api \
 		-c /local/scripts/api-ts-config.yaml \
 		--additional-properties=npmVersion=${NPM_VERSION} \
 		--git-repo-id authentik \
 		--git-user-id goauthentik
 	mkdir -p web/node_modules/@goauthentik/api
-	cd ./${GEN_API_TS} && npm i
+	cd gen-ts-api && npm i
-	\cp -rf ./${GEN_API_TS}/* web/node_modules/@goauthentik/api
+	\cp -rfv gen-ts-api/* web/node_modules/@goauthentik/api
 
-gen-client-go: gen-clean-go  ## Build and install the authentik API for Golang
+gen-client-go:  ## Build and install the authentik API for Golang
-	mkdir -p ./${GEN_API_GO} ./${GEN_API_GO}/templates
+	mkdir -p ./gen-go-api ./gen-go-api/templates
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./${GEN_API_GO}/config.yaml
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./gen-go-api/config.yaml
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O ./${GEN_API_GO}/templates/README.mustache
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O ./gen-go-api/templates/README.mustache
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/go.mod.mustache -O ./${GEN_API_GO}/templates/go.mod.mustache
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/go.mod.mustache -O ./gen-go-api/templates/go.mod.mustache
-	cp schema.yml ./${GEN_API_GO}/
+	cp schema.yml ./gen-go-api/
 	docker run \
-		--rm -v ${PWD}/${GEN_API_GO}:/local \
+		--rm -v ${PWD}/gen-go-api:/local \
 		--user ${UID}:${GID} \
 		docker.io/openapitools/openapi-generator-cli:v6.5.0 generate \
 		-i /local/schema.yml \
 		-g go \
 		-o /local/ \
 		-c /local/config.yaml
-	go mod edit -replace goauthentik.io/api/v3=./${GEN_API_GO}
+	go mod edit -replace goauthentik.io/api/v3=./gen-go-api
-	rm -rf ./${GEN_API_GO}/config.yaml ./${GEN_API_GO}/templates/
+	rm -rf ./gen-go-api/config.yaml ./gen-go-api/templates/
 
 gen-dev-config:  ## Generate a local development config file
 	python -m scripts.generate_config
 
-gen: gen-build gen-client-ts
+gen: gen-build gen-clean gen-client-ts
 
 #########################
 ## Web
@@ -187,7 +164,7 @@ gen: gen-build gen-client-ts
 web-build: web-install  ## Build the Authentik UI
 	cd web && npm run build
 
-web: web-lint-fix web-lint web-check-compile  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it
+web: web-lint-fix web-lint web-check-compile web-i18n-extract  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it
 
 web-install:  ## Install the necessary libraries to build the Authentik UI
 	cd web && npm ci

authentik/__init__.py

@@ -1,9 +1,8 @@
 """authentik root module"""
-
 from os import environ
 from typing import Optional
 
-__version__ = "2024.2.3"
+__version__ = "2023.10.6"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 

authentik/admin/api/meta.py

@@ -1,5 +1,4 @@
 """Meta API"""
-
 from drf_spectacular.utils import extend_schema
 from rest_framework.fields import CharField
 from rest_framework.permissions import IsAuthenticated

authentik/admin/api/metrics.py

@@ -1,5 +1,4 @@
 """authentik administration metrics"""
-
 from datetime import timedelta
 
 from django.db.models.functions import ExtractHour

authentik/admin/api/system.py

@@ -1,5 +1,4 @@
 """authentik administration overview"""
-
 import platform
 from datetime import datetime
 from sys import version as python_version
@@ -14,7 +13,6 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 
 from authentik.core.api.utils import PassiveSerializer
-from authentik.lib.config import CONFIG
 from authentik.lib.utils.reflection import get_env
 from authentik.outposts.apps import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost
@@ -39,9 +37,8 @@ class SystemInfoSerializer(PassiveSerializer):
     http_host = SerializerMethodField()
     http_is_secure = SerializerMethodField()
     runtime = SerializerMethodField()
-    brand = SerializerMethodField()
+    tenant = SerializerMethodField()
     server_time = SerializerMethodField()
-    embedded_outpost_disabled = SerializerMethodField()
     embedded_outpost_host = SerializerMethodField()
 
     def get_http_headers(self, request: Request) -> dict[str, str]:
@@ -72,18 +69,14 @@ class SystemInfoSerializer(PassiveSerializer):
             "uname": " ".join(platform.uname()),
         }
 
-    def get_brand(self, request: Request) -> str:
+    def get_tenant(self, request: Request) -> str:
-        """Currently active brand"""
+        """Currently active tenant"""
-        return str(request._request.brand)
+        return str(request._request.tenant)
 
     def get_server_time(self, request: Request) -> datetime:
         """Current server time"""
         return now()
 
-    def get_embedded_outpost_disabled(self, request: Request) -> bool:
-        """Whether the embedded outpost is disabled"""
-        return CONFIG.get_bool("outposts.disable_embedded_outpost", False)
-
     def get_embedded_outpost_host(self, request: Request) -> str:
         """Get the FQDN configured on the embedded outpost"""
         outposts = Outpost.objects.filter(managed=MANAGED_OUTPOST)

authentik/admin/api/tasks.py

@@ -0,0 +1,134 @@
+"""Tasks API"""
+from importlib import import_module
+
+from django.contrib import messages
+from django.http.response import Http404
+from django.utils.translation import gettext_lazy as _
+from drf_spectacular.types import OpenApiTypes
+from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
+from rest_framework.decorators import action
+from rest_framework.fields import (
+    CharField,
+    ChoiceField,
+    DateTimeField,
+    ListField,
+    SerializerMethodField,
+)
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.viewsets import ViewSet
+from structlog.stdlib import get_logger
+
+from authentik.api.decorators import permission_required
+from authentik.core.api.utils import PassiveSerializer
+from authentik.events.monitored_tasks import TaskInfo, TaskResultStatus
+from authentik.rbac.permissions import HasPermission
+
+LOGGER = get_logger()
+
+
+class TaskSerializer(PassiveSerializer):
+    """Serialize TaskInfo and TaskResult"""
+
+    task_name = CharField()
+    task_description = CharField()
+    task_finish_timestamp = DateTimeField(source="finish_time")
+    task_duration = SerializerMethodField()
+
+    status = ChoiceField(
+        source="result.status.name",
+        choices=[(x.name, x.name) for x in TaskResultStatus],
+    )
+    messages = ListField(source="result.messages")
+
+    def get_task_duration(self, instance: TaskInfo) -> int:
+        """Get the duration a task took to run"""
+        return max(instance.finish_timestamp - instance.start_timestamp, 0)
+
+    def to_representation(self, instance: TaskInfo):
+        """When a new version of authentik adds fields to TaskInfo,
+        the API will fail with an AttributeError, as the classes
+        are pickled in cache. In that case, just delete the info"""
+        try:
+            return super().to_representation(instance)
+        # pylint: disable=broad-except
+        except Exception:  # pragma: no cover
+            if isinstance(self.instance, list):
+                for inst in self.instance:
+                    inst.delete()
+            else:
+                self.instance.delete()
+            return {}
+
+
+class TaskViewSet(ViewSet):
+    """Read-only view set that returns all background tasks"""
+
+    permission_classes = [HasPermission("authentik_rbac.view_system_tasks")]
+    serializer_class = TaskSerializer
+
+    @extend_schema(
+        responses={
+            200: TaskSerializer(many=False),
+            404: OpenApiResponse(description="Task not found"),
+        },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
+    )
+    def retrieve(self, request: Request, pk=None) -> Response:
+        """Get a single system task"""
+        task = TaskInfo.by_name(pk)
+        if not task:
+            raise Http404
+        return Response(TaskSerializer(task, many=False).data)
+
+    @extend_schema(responses={200: TaskSerializer(many=True)})
+    def list(self, request: Request) -> Response:
+        """List system tasks"""
+        tasks = sorted(TaskInfo.all().values(), key=lambda task: task.task_name)
+        return Response(TaskSerializer(tasks, many=True).data)
+
+    @permission_required(None, ["authentik_rbac.run_system_tasks"])
+    @extend_schema(
+        request=OpenApiTypes.NONE,
+        responses={
+            204: OpenApiResponse(description="Task retried successfully"),
+            404: OpenApiResponse(description="Task not found"),
+            500: OpenApiResponse(description="Failed to retry task"),
+        },
+        parameters=[
+            OpenApiParameter(
+                "id",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.PATH,
+                required=True,
+            ),
+        ],
+    )
+    @action(detail=True, methods=["post"])
+    def retry(self, request: Request, pk=None) -> Response:
+        """Retry task"""
+        task = TaskInfo.by_name(pk)
+        if not task:
+            raise Http404
+        try:
+            task_module = import_module(task.task_call_module)
+            task_func = getattr(task_module, task.task_call_func)
+            LOGGER.debug("Running task", task=task_func)
+            task_func.delay(*task.task_call_args, **task.task_call_kwargs)
+            messages.success(
+                self.request,
+                _("Successfully re-scheduled Task %(name)s!" % {"name": task.task_name}),
+            )
+            return Response(status=204)
+        except (ImportError, AttributeError):  # pragma: no cover
+            LOGGER.warning("Failed to run task, remove state", task=task)
+            # if we get an import error, the module path has probably changed
+            task.delete()
+            return Response(status=500)

authentik/admin/api/version.py

@@ -1,5 +1,4 @@
 """authentik administration overview"""
-
 from django.core.cache import cache
 from drf_spectacular.utils import extend_schema
 from packaging.version import parse

authentik/admin/api/workers.py

@@ -1,5 +1,4 @@
 """authentik administration overview"""
-
 from django.conf import settings
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.fields import IntegerField

authentik/admin/apps.py

@@ -1,5 +1,4 @@
 """authentik admin app config"""
-
 from prometheus_client import Gauge, Info
 
 from authentik.blueprints.apps import ManagedAppConfig
@@ -15,3 +14,7 @@ class AuthentikAdminConfig(ManagedAppConfig):
     label = "authentik_admin"
     verbose_name = "authentik Admin"
     default = True
+
+    def reconcile_load_admin_signals(self):
+        """Load admin signals"""
+        self.import_module("authentik.admin.signals")

authentik/admin/settings.py

@@ -1,5 +1,4 @@
 """authentik admin settings"""
-
 from celery.schedules import crontab
 
 from authentik.lib.utils.time import fqdn_rand

authentik/admin/signals.py

@@ -1,7 +1,7 @@
 """admin signals"""
-
 from django.dispatch import receiver
 
+from authentik.admin.api.tasks import TaskInfo
 from authentik.admin.apps import GAUGE_WORKERS
 from authentik.root.celery import CELERY_APP
 from authentik.root.monitoring import monitoring_set
@@ -12,3 +12,10 @@ def monitoring_set_workers(sender, **kwargs):
     """Set worker gauge"""
     count = len(CELERY_APP.control.ping(timeout=0.5))
     GAUGE_WORKERS.set(count)
+
+
+@receiver(monitoring_set)
+def monitoring_set_tasks(sender, **kwargs):
+    """Set task gauges"""
+    for task in TaskInfo.all().values():
+        task.update_metrics()

authentik/admin/tasks.py

@@ -1,5 +1,4 @@
 """authentik admin tasks"""
-
 import re
 
 from django.core.cache import cache
@@ -12,7 +11,12 @@ from structlog.stdlib import get_logger
 from authentik import __version__, get_build_hash
 from authentik.admin.apps import PROM_INFO
 from authentik.events.models import Event, EventAction, Notification
-from authentik.events.system_tasks import SystemTask, TaskStatus, prefill_task
+from authentik.events.monitored_tasks import (
+    MonitoredTask,
+    TaskResult,
+    TaskResultStatus,
+    prefill_task,
+)
 from authentik.lib.config import CONFIG
 from authentik.lib.utils.http import get_http_session
 from authentik.root.celery import CELERY_APP
@@ -50,13 +54,13 @@ def clear_update_notifications():
             notification.delete()
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
+@CELERY_APP.task(bind=True, base=MonitoredTask)
 @prefill_task
-def update_latest_version(self: SystemTask):
+def update_latest_version(self: MonitoredTask):
     """Update latest version info"""
     if CONFIG.get_bool("disable_update_check"):
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskStatus.WARNING, "Version check disabled.")
+        self.set_status(TaskResult(TaskResultStatus.WARNING, messages=["Version check disabled."]))
         return
     try:
         response = get_http_session().get(
@@ -66,7 +70,9 @@ def update_latest_version(self: SystemTask):
         data = response.json()
         upstream_version = data.get("stable", {}).get("version")
         cache.set(VERSION_CACHE_KEY, upstream_version, VERSION_CACHE_TIMEOUT)
-        self.set_status(TaskStatus.SUCCESSFUL, "Successfully updated latest Version")
+        self.set_status(
+            TaskResult(TaskResultStatus.SUCCESSFUL, ["Successfully updated latest Version"])
+        )
         _set_prom_info()
         # Check if upstream version is newer than what we're running,
         # and if no event exists yet, create one.
@@ -83,7 +89,7 @@ def update_latest_version(self: SystemTask):
             Event.new(EventAction.UPDATE_AVAILABLE, **event_dict).save()
     except (RequestException, IndexError) as exc:
         cache.set(VERSION_CACHE_KEY, "0.0.0", VERSION_CACHE_TIMEOUT)
-        self.set_error(exc)
+        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
 
 
 _set_prom_info()

authentik/admin/tests/test_api.py

@@ -1,5 +1,4 @@
 """test admin api"""
-
 from json import loads
 
 from django.test import TestCase
@@ -8,6 +7,8 @@ from django.urls import reverse
 from authentik import __version__
 from authentik.blueprints.tests import reconcile_app
 from authentik.core.models import Group, User
+from authentik.core.tasks import clean_expired_models
+from authentik.events.monitored_tasks import TaskResultStatus
 from authentik.lib.generators import generate_id
 
 
@@ -22,6 +23,53 @@ class TestAdminAPI(TestCase):
         self.group.save()
         self.client.force_login(self.user)
 
+    def test_tasks(self):
+        """Test Task API"""
+        clean_expired_models.delay()
+        response = self.client.get(reverse("authentik_api:admin_system_tasks-list"))
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content)
+        self.assertTrue(any(task["task_name"] == "clean_expired_models" for task in body))
+
+    def test_tasks_single(self):
+        """Test Task API (read single)"""
+        clean_expired_models.delay()
+        response = self.client.get(
+            reverse(
+                "authentik_api:admin_system_tasks-detail",
+                kwargs={"pk": "clean_expired_models"},
+            )
+        )
+        self.assertEqual(response.status_code, 200)
+        body = loads(response.content)
+        self.assertEqual(body["status"], TaskResultStatus.SUCCESSFUL.name)
+        self.assertEqual(body["task_name"], "clean_expired_models")
+        response = self.client.get(
+            reverse("authentik_api:admin_system_tasks-detail", kwargs={"pk": "qwerqwer"})
+        )
+        self.assertEqual(response.status_code, 404)
+
+    def test_tasks_retry(self):
+        """Test Task API (retry)"""
+        clean_expired_models.delay()
+        response = self.client.post(
+            reverse(
+                "authentik_api:admin_system_tasks-retry",
+                kwargs={"pk": "clean_expired_models"},
+            )
+        )
+        self.assertEqual(response.status_code, 204)
+
+    def test_tasks_retry_404(self):
+        """Test Task API (retry, 404)"""
+        response = self.client.post(
+            reverse(
+                "authentik_api:admin_system_tasks-retry",
+                kwargs={"pk": "qwerqewrqrqewrqewr"},
+            )
+        )
+        self.assertEqual(response.status_code, 404)
+
     def test_version(self):
         """Test Version API"""
         response = self.client.get(reverse("authentik_api:admin_version"))

authentik/admin/tests/test_tasks.py

@@ -1,5 +1,4 @@
 """test admin tasks"""
-
 from django.core.cache import cache
 from django.test import TestCase
 from requests_mock import Mocker

authentik/admin/urls.py

@@ -1,14 +1,15 @@
 """API URLs"""
-
 from django.urls import path
 
 from authentik.admin.api.meta import AppsViewSet, ModelViewSet
 from authentik.admin.api.metrics import AdministrationMetricsViewSet
 from authentik.admin.api.system import SystemView
+from authentik.admin.api.tasks import TaskViewSet
 from authentik.admin.api.version import VersionView
 from authentik.admin.api.workers import WorkerView
 
 api_urlpatterns = [
+    ("admin/system_tasks", TaskViewSet, "admin_system_tasks"),
     ("admin/apps", AppsViewSet, "apps"),
     ("admin/models", ModelViewSet, "models"),
     path(

authentik/api/authentication.py

@@ -1,5 +1,4 @@
 """API Authentication"""
-
 from hmac import compare_digest
 from typing import Any, Optional
 

authentik/api/authorization.py

@@ -1,5 +1,4 @@
 """API Authorization"""
-
 from django.conf import settings
 from django.db.models import Model
 from django.db.models.query import QuerySet

authentik/api/decorators.py

@@ -1,5 +1,4 @@
 """API Decorators"""
-
 from functools import wraps
 from typing import Callable, Optional
 
@@ -14,23 +13,18 @@ LOGGER = get_logger()
 def permission_required(obj_perm: Optional[str] = None, global_perms: Optional[list[str]] = None):
     """Check permissions for a single custom action"""
 
-    def _check_obj_perm(self: ModelViewSet, request: Request):
+    def wrapper_outter(func: Callable):
-        # Check obj_perm both globally and on the specific object
-        # Having the global permission has higher priority
-        if request.user.has_perm(obj_perm):
-            return
-        obj = self.get_object()
-        if not request.user.has_perm(obj_perm, obj):
-            LOGGER.debug("denying access for object", user=request.user, perm=obj_perm, obj=obj)
-            self.permission_denied(request)
-
-    def wrapper_outer(func: Callable):
         """Check permissions for a single custom action"""
 
         @wraps(func)
         def wrapper(self: ModelViewSet, request: Request, *args, **kwargs) -> Response:
             if obj_perm:
-                _check_obj_perm(self, request)
+                obj = self.get_object()
+                if not request.user.has_perm(obj_perm, obj):
+                    LOGGER.debug(
+                        "denying access for object", user=request.user, perm=obj_perm, obj=obj
+                    )
+                    return self.permission_denied(request)
             if global_perms:
                 for other_perm in global_perms:
                     if not request.user.has_perm(other_perm):
@@ -40,4 +34,4 @@ def permission_required(obj_perm: Optional[str] = None, global_perms: Optional[l
 
         return wrapper
 
-    return wrapper_outer
+    return wrapper_outter

authentik/api/pagination.py

@@ -1,5 +1,4 @@
 """Pagination which includes total pages and current page"""
-
 from rest_framework import pagination
 from rest_framework.response import Response
 

authentik/api/schema.py

@@ -1,5 +1,4 @@
 """Error Response schema, from https://github.com/axnsan12/drf-yasg/issues/224"""
-
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.generators import SchemaGenerator
 from drf_spectacular.plumbing import (

authentik/api/templates/api/browser.html

@@ -3,7 +3,7 @@
 {% load static %}
 
 {% block title %}
-API Browser - {{ brand.branding_title }}
+API Browser - {{ tenant.branding_title }}
 {% endblock %}
 
 {% block head %}

authentik/api/tests/test_auth.py

@@ -1,5 +1,4 @@
 """Test API Authentication"""
-
 import json
 from base64 import b64encode
 

authentik/api/tests/test_config.py

@@ -1,5 +1,4 @@
 """Test config API"""
-
 from json import loads
 
 from django.urls import reverse

authentik/api/tests/test_decorators.py

@@ -0,0 +1,34 @@
+"""test decorators api"""
+from django.urls import reverse
+from guardian.shortcuts import assign_perm
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Application, User
+from authentik.lib.generators import generate_id
+
+
+class TestAPIDecorators(APITestCase):
+    """test decorators api"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.user = User.objects.create(username="test-user")
+
+    def test_obj_perm_denied(self):
+        """Test object perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name=generate_id(), slug=generate_id())
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_other_perm_denied(self):
+        """Test other perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name=generate_id(), slug=generate_id())
+        assign_perm("authentik_core.view_application", self.user, app)
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)

authentik/api/tests/test_schema.py

@@ -1,5 +1,4 @@
 """Schema generation tests"""
-
 from django.urls import reverse
 from rest_framework.test import APITestCase
 from yaml import safe_load

authentik/api/tests/test_viewsets.py

@@ -1,5 +1,4 @@
 """authentik API Modelviewset tests"""
-
 from typing import Callable
 
 from django.test import TestCase

authentik/api/urls.py

@@ -1,5 +1,4 @@
 """authentik api urls"""
-
 from django.urls import include, path
 
 from authentik.api.v3.urls import urlpatterns as v3_urls

authentik/api/v3/config.py

@@ -1,5 +1,4 @@
 """core Configs API"""
-
 from pathlib import Path
 
 from django.conf import settings
@@ -68,16 +67,12 @@ class ConfigView(APIView):
         """Get all capabilities this server instance supports"""
         caps = []
         deb_test = settings.DEBUG or settings.TEST
-        if (
+        if Path(settings.MEDIA_ROOT).is_mount() or deb_test:
-            CONFIG.get("storage.media.backend", "file") == "s3"
-            or Path(settings.STORAGES["default"]["OPTIONS"]["location"]).is_mount()
-            or deb_test
-        ):
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         for processor in get_context_processors():
             if cap := processor.capability():
                 caps.append(cap)
-        if self.request.tenant.impersonation:
+        if CONFIG.get_bool("impersonation"):
             caps.append(Capabilities.CAN_IMPERSONATE)
         if settings.DEBUG:  # pragma: no cover
             caps.append(Capabilities.CAN_DEBUG)

authentik/api/v3/urls.py

@@ -1,5 +1,4 @@
 """api v3 urls"""
-
 from importlib import import_module
 
 from django.urls import path

authentik/api/views.py

@@ -1,5 +1,4 @@
 """General API Views"""
-
 from typing import Any
 
 from django.urls import reverse

authentik/blueprints/api.py

@@ -1,5 +1,4 @@
 """Serializer mixin for managed models"""
-
 from django.utils.translation import gettext_lazy as _
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.decorators import action
@@ -10,13 +9,13 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.oci import OCI_PREFIX
 from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class ManagedSerializer:

authentik/blueprints/apps.py

@@ -11,42 +11,23 @@ from structlog.stdlib import BoundLogger, get_logger
 class ManagedAppConfig(AppConfig):
     """Basic reconciliation logic for apps"""
 
-    logger: BoundLogger
+    _logger: BoundLogger
-
-    RECONCILE_GLOBAL_PREFIX: str = "reconcile_global_"
-    RECONCILE_TENANT_PREFIX: str = "reconcile_tenant_"
 
     def __init__(self, app_name: str, *args, **kwargs) -> None:
         super().__init__(app_name, *args, **kwargs)
-        self.logger = get_logger().bind(app_name=app_name)
+        self._logger = get_logger().bind(app_name=app_name)
 
     def ready(self) -> None:
-        self.import_related()
+        self.reconcile()
-        self.reconcile_global()
-        self.reconcile_tenant()
         return super().ready()
 
-    def import_related(self):
-        """Automatically import related modules which rely on just being imported
-        to register themselves (mainly django signals and celery tasks)"""
-
-        def import_relative(rel_module: str):
-            try:
-                module_name = f"{self.name}.{rel_module}"
-                import_module(module_name)
-                self.logger.info("Imported related module", module=module_name)
-            except ModuleNotFoundError:
-                pass
-
-        import_relative("checks")
-        import_relative("tasks")
-        import_relative("signals")
-
     def import_module(self, path: str):
         """Load module"""
         import_module(path)
 
-    def _reconcile(self, prefix: str) -> None:
+    def reconcile(self) -> None:
+        """reconcile ourselves"""
+        prefix = "reconcile_"
         for meth_name in dir(self):
             meth = getattr(self, meth_name)
             if not ismethod(meth):
@@ -55,34 +36,11 @@ class ManagedAppConfig(AppConfig):
                 continue
             name = meth_name.replace(prefix, "")
             try:
-                self.logger.debug("Starting reconciler", name=name)
+                self._logger.debug("Starting reconciler", name=name)
                 meth()
-                self.logger.debug("Successfully reconciled", name=name)
+                self._logger.debug("Successfully reconciled", name=name)
             except (DatabaseError, ProgrammingError, InternalError) as exc:
-                self.logger.warning("Failed to run reconcile", name=name, exc=exc)
+                self._logger.warning("Failed to run reconcile", name=name, exc=exc)
-
-    def reconcile_tenant(self) -> None:
-        """reconcile ourselves for tenanted methods"""
-        from authentik.tenants.models import Tenant
-
-        try:
-            tenants = list(Tenant.objects.filter(ready=True))
-        except (DatabaseError, ProgrammingError, InternalError) as exc:
-            self.logger.debug("Failed to get tenants to run reconcile", exc=exc)
-            return
-        for tenant in tenants:
-            with tenant:
-                self._reconcile(self.RECONCILE_TENANT_PREFIX)
-
-    def reconcile_global(self) -> None:
-        """
-        reconcile ourselves for global methods.
-        Used for signals, tasks, etc. Database queries should not be made in here.
-        """
-        from django_tenants.utils import get_public_schema_name, schema_context
-
-        with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_PREFIX)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -93,11 +51,11 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    def reconcile_global_load_blueprints_v1_tasks(self):
+    def reconcile_load_blueprints_v1_tasks(self):
         """Load v1 tasks"""
         self.import_module("authentik.blueprints.v1.tasks")
 
-    def reconcile_tenant_blueprints_discovery(self):
+    def reconcile_blueprints_discovery(self):
         """Run blueprint discovery"""
         from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
 

authentik/blueprints/management/commands/apply_blueprint.py

@@ -1,5 +1,4 @@
 """Apply blueprint from commandline"""
-
 from sys import exit as sys_exit
 
 from django.core.management.base import BaseCommand, no_translations
@@ -7,7 +6,6 @@ from structlog.stdlib import get_logger
 
 from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.v1.importer import Importer
-from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
 
@@ -18,8 +16,6 @@ class Command(BaseCommand):
     @no_translations
     def handle(self, *args, **options):
         """Apply all blueprints in order, abort when one fails to import"""
-        for tenant in Tenant.objects.filter(ready=True):
-            with tenant:
         for blueprint_path in options.get("blueprints", []):
             content = BlueprintInstance(path=blueprint_path).retrieve()
             importer = Importer.from_string(content)

authentik/blueprints/management/commands/export_blueprint.py

@@ -1,19 +1,17 @@
 """Export blueprint of current authentik install"""
-
+from django.core.management.base import BaseCommand, no_translations
-from django.core.management.base import no_translations
 from structlog.stdlib import get_logger
 
 from authentik.blueprints.v1.exporter import Exporter
-from authentik.tenants.management import TenantCommand
 
 LOGGER = get_logger()
 
 
-class Command(TenantCommand):
+class Command(BaseCommand):
     """Export blueprint of current authentik install"""
 
     @no_translations
-    def handle_per_tenant(self, *args, **options):
+    def handle(self, *args, **options):
         """Export blueprint of current authentik install"""
         exporter = Exporter()
         self.stdout.write(exporter.export_to_string())

authentik/blueprints/management/commands/make_blueprint_schema.py

@@ -1,5 +1,4 @@
 """Generate JSON Schema for blueprints"""
-
 from json import dumps
 from typing import Any
 

authentik/blueprints/migrations/0001_initial.py

@@ -14,7 +14,7 @@ from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_SYSTEM
 from authentik.lib.config import CONFIG
 
 
-def check_blueprint_v1_file(BlueprintInstance: type, db_alias, path: Path):
+def check_blueprint_v1_file(BlueprintInstance: type, path: Path):
     """Check if blueprint should be imported"""
     from authentik.blueprints.models import BlueprintInstanceStatus
     from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata
@@ -29,9 +29,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, db_alias, path: Path):
         if version != 1:
             return
         blueprint_file.seek(0)
-    instance: BlueprintInstance = (
+    instance: BlueprintInstance = BlueprintInstance.objects.filter(path=path).first()
-        BlueprintInstance.objects.using(db_alias).filter(path=path).first()
-    )
     rel_path = path.relative_to(Path(CONFIG.get("blueprints_dir")))
     meta = None
     if metadata:
@@ -39,7 +37,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, db_alias, path: Path):
         if meta.labels.get(LABEL_AUTHENTIK_INSTANTIATE, "").lower() == "false":
             return
     if not instance:
-        BlueprintInstance.objects.using(db_alias).create(
+        instance = BlueprintInstance(
             name=meta.name if meta else str(rel_path),
             path=str(rel_path),
             context={},
@@ -49,6 +47,7 @@ def check_blueprint_v1_file(BlueprintInstance: type, db_alias, path: Path):
             last_applied_hash="",
             metadata=metadata or {},
         )
+        instance.save()
 
 
 def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEditor):
@@ -57,7 +56,7 @@ def migration_blueprint_import(apps: Apps, schema_editor: BaseDatabaseSchemaEdit
 
     db_alias = schema_editor.connection.alias
     for file in glob(f"{CONFIG.get('blueprints_dir')}/**/*.yaml", recursive=True):
-        check_blueprint_v1_file(BlueprintInstance, db_alias, Path(file))
+        check_blueprint_v1_file(BlueprintInstance, Path(file))
 
     for blueprint in BlueprintInstance.objects.using(db_alias).all():
         # If we already have flows (and we should always run before flow migrations)

authentik/blueprints/models.py

@@ -1,5 +1,4 @@
 """blueprint models"""
-
 from pathlib import Path
 from uuid import uuid4
 

authentik/blueprints/settings.py

@@ -1,5 +1,4 @@
 """blueprint Settings"""
-
 from celery.schedules import crontab
 
 from authentik.lib.utils.time import fqdn_rand

authentik/blueprints/tests/__init__.py

@@ -1,5 +1,4 @@
 """Blueprint helpers"""
-
 from functools import wraps
 from typing import Callable
 
@@ -39,7 +38,7 @@ def reconcile_app(app_name: str):
         def wrapper(*args, **kwargs):
             config = apps.get_app_config(app_name)
             if isinstance(config, ManagedAppConfig):
-                config.ready()
+                config.reconcile()
             return func(*args, **kwargs)
 
         return wrapper

authentik/blueprints/tests/test_models.py

@@ -1,5 +1,4 @@
 """authentik managed models tests"""
-
 from django.test import TestCase
 
 from authentik.blueprints.models import BlueprintInstance, BlueprintRetrievalFailed

authentik/blueprints/tests/test_oci.py

@@ -1,5 +1,4 @@
 """Test blueprints OCI"""
-
 from django.test import TransactionTestCase
 from requests_mock import Mocker
 

authentik/blueprints/tests/test_packaged.py

@@ -1,5 +1,4 @@
 """test packaged blueprints"""
-
 from pathlib import Path
 from typing import Callable
 
@@ -8,16 +7,16 @@ from django.test import TransactionTestCase
 from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.tests import apply_blueprint
 from authentik.blueprints.v1.importer import Importer
-from authentik.brands.models import Brand
+from authentik.tenants.models import Tenant
 
 
 class TestPackaged(TransactionTestCase):
     """Empty class, test methods are added dynamically"""
 
-    @apply_blueprint("default/default-brand.yaml")
+    @apply_blueprint("default/default-tenant.yaml")
     def test_decorator_static(self):
         """Test @apply_blueprint decorator"""
-        self.assertTrue(Brand.objects.filter(domain="authentik-default").exists())
+        self.assertTrue(Tenant.objects.filter(domain="authentik-default").exists())
 
 
 def blueprint_tester(file_name: Path) -> Callable:

authentik/blueprints/tests/test_serializer_models.py

@@ -1,5 +1,4 @@
 """authentik managed models tests"""
-
 from typing import Callable, Type
 
 from django.apps import apps

authentik/blueprints/tests/test_v1.py

@@ -1,5 +1,4 @@
 """Test blueprints v1"""
-
 from os import environ
 
 from django.test import TransactionTestCase

authentik/blueprints/tests/test_v1_api.py

@@ -1,5 +1,4 @@
 """Test blueprints v1 api"""
-
 from json import loads
 from tempfile import NamedTemporaryFile, mkdtemp
 

authentik/blueprints/tests/test_v1_conditional_fields.py

@@ -1,5 +1,4 @@
 """Test blueprints v1"""
-
 from django.test import TransactionTestCase
 
 from authentik.blueprints.v1.importer import Importer

authentik/blueprints/tests/test_v1_conditions.py

@@ -1,5 +1,4 @@
 """Test blueprints v1"""
-
 from django.test import TransactionTestCase
 
 from authentik.blueprints.v1.importer import Importer

authentik/blueprints/tests/test_v1_state.py

@@ -1,5 +1,4 @@
 """Test blueprints v1"""
-
 from django.test import TransactionTestCase
 
 from authentik.blueprints.v1.importer import Importer

authentik/blueprints/tests/test_v1_tasks.py

@@ -1,5 +1,4 @@
 """Test blueprints v1 tasks"""
-
 from hashlib import sha512
 from tempfile import NamedTemporaryFile, mkdtemp
 

authentik/blueprints/urls.py

@@ -1,5 +1,4 @@
 """API URLs"""
-
 from authentik.blueprints.api import BlueprintInstanceViewSet
 
 api_urlpatterns = [

authentik/blueprints/v1/common.py

@@ -1,5 +1,4 @@
 """transfer common classes"""
-
 from collections import OrderedDict
 from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass

authentik/blueprints/v1/exporter.py

@@ -1,5 +1,4 @@
 """Blueprint exporter"""
-
 from typing import Iterable
 from uuid import UUID
 
@@ -8,6 +7,7 @@ from django.contrib.auth import get_user_model
 from django.db.models import Model, Q, QuerySet
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
+from guardian.shortcuts import get_anonymous_user
 from yaml import dump
 
 from authentik.blueprints.v1.common import (
@@ -48,7 +48,7 @@ class Exporter:
         """Return a queryset for `model`. Can be used to filter some
         objects on some models"""
         if model == get_user_model():
-            return model.objects.exclude_anonymous()
+            return model.objects.exclude(pk=get_anonymous_user().pk)
         return model.objects.all()
 
     def _pre_export(self, blueprint: Blueprint):
@@ -74,7 +74,7 @@ class Exporter:
 
 
 class FlowExporter(Exporter):
-    """Exporter customized to only return objects related to `flow`"""
+    """Exporter customised to only return objects related to `flow`"""
 
     flow: Flow
     with_policies: bool

authentik/blueprints/v1/importer.py

@@ -1,5 +1,4 @@
 """Blueprint importer"""
-
 from contextlib import contextmanager
 from copy import deepcopy
 from typing import Any, Optional
@@ -8,14 +7,11 @@ from dacite.config import Config
 from dacite.core import from_dict
 from dacite.exceptions import DaciteError
 from deepmerge import always_merger
-from django.contrib.auth.models import Permission
-from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import FieldError
 from django.db.models import Model
 from django.db.models.query_utils import Q
 from django.db.transaction import atomic
 from django.db.utils import IntegrityError
-from guardian.models import UserObjectPermission
 from rest_framework.exceptions import ValidationError
 from rest_framework.serializers import BaseSerializer, Serializer
 from structlog.stdlib import BoundLogger, get_logger
@@ -39,20 +35,14 @@ from authentik.core.models import (
     Source,
     UserSourceConnection,
 )
-from authentik.enterprise.license import LicenseKey
+from authentik.enterprise.models import LicenseKey, LicenseUsage
-from authentik.enterprise.models import LicenseUsage
-from authentik.enterprise.providers.rac.models import ConnectionToken
-from authentik.events.models import SystemTask
 from authentik.events.utils import cleanse_dict
 from authentik.flows.models import FlowToken, Stage
 from authentik.lib.models import SerializerModel
 from authentik.lib.sentry import SentryIgnoredException
 from authentik.outposts.models import OutpostServiceConnection
 from authentik.policies.models import Policy, PolicyBindingModel
-from authentik.policies.reputation.models import Reputation
-from authentik.providers.oauth2.models import AccessToken, AuthorizationCode, RefreshToken
 from authentik.providers.scim.models import SCIMGroup, SCIMUser
-from authentik.tenants.models import Tenant
 
 # Context set when the serializer is created in a blueprint context
 # Update website/developer-docs/blueprints/v1/models.md when used
@@ -67,12 +57,8 @@ def excluded_models() -> list[type[Model]]:
     from django.contrib.auth.models import User as DjangoUser
 
     return (
-        # Django only classes
         DjangoUser,
         DjangoGroup,
-        ContentType,
-        Permission,
-        UserObjectPermission,
         # Base classes
         Provider,
         Source,
@@ -89,13 +75,6 @@ def excluded_models() -> list[type[Model]]:
         LicenseUsage,
         SCIMGroup,
         SCIMUser,
-        Tenant,
-        SystemTask,
-        ConnectionToken,
-        AuthorizationCode,
-        AccessToken,
-        RefreshToken,
-        Reputation,
     )
 
 

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -1,5 +1,4 @@
 """Apply Blueprint meta model"""
-
 from typing import TYPE_CHECKING
 
 from rest_framework.exceptions import ValidationError

authentik/blueprints/v1/meta/registry.py

@@ -1,5 +1,4 @@
 """Base models"""
-
 from django.apps import apps
 from django.db.models import Model
 from rest_framework.serializers import Serializer

authentik/blueprints/v1/oci.py

@@ -1,5 +1,4 @@
 """OCI Client"""
-
 from typing import Any
 from urllib.parse import ParseResult, urlparse
 

authentik/blueprints/v1/tasks.py

@@ -1,9 +1,7 @@
 """v1 blueprints tasks"""
-
 from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
-from sys import platform
 from typing import Optional
 
 from dacite.core import from_dict
@@ -31,12 +29,15 @@ from authentik.blueprints.v1.common import BlueprintLoader, BlueprintMetadata, E
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.labels import LABEL_AUTHENTIK_INSTANTIATE
 from authentik.blueprints.v1.oci import OCI_PREFIX
-from authentik.events.models import TaskStatus
+from authentik.events.monitored_tasks import (
-from authentik.events.system_tasks import SystemTask, prefill_task
+    MonitoredTask,
+    TaskResult,
+    TaskResultStatus,
+    prefill_task,
+)
 from authentik.events.utils import sanitize_dict
 from authentik.lib.config import CONFIG
 from authentik.root.celery import CELERY_APP
-from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
 _file_watcher_started = False
@@ -61,12 +62,7 @@ def start_blueprint_watcher():
     if _file_watcher_started:
         return
     observer = Observer()
-    kwargs = {}
+    observer.schedule(BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True)
-    if platform.startswith("linux"):
-        kwargs["event_filter"] = (FileCreatedEvent, FileModifiedEvent)
-    observer.schedule(
-        BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True, **kwargs
-    )
     observer.start()
     _file_watcher_started = True
 
@@ -74,33 +70,18 @@ def start_blueprint_watcher():
 class BlueprintEventHandler(FileSystemEventHandler):
     """Event handler for blueprint events"""
 
-    # We only ever get creation and modification events.
+    def on_any_event(self, event: FileSystemEvent):
-    # See the creation of the Observer instance above for the event filtering.
+        if not isinstance(event, (FileCreatedEvent, FileModifiedEvent)):
-
+            return
-    # Even though we filter to only get file events, we might still get
-    # directory events as some implementations such as inotify do not support
-    # filtering on file/directory.
-
-    def dispatch(self, event: FileSystemEvent) -> None:
-        """Call specific event handler method. Ignores directory changes."""
         if event.is_directory:
-            return None
+            return
-        return super().dispatch(event)
-
-    def on_created(self, event: FileSystemEvent):
-        """Process file creation"""
-        LOGGER.debug("new blueprint file created, starting discovery")
-        for tenant in Tenant.objects.filter(ready=True):
-            with tenant:
-                blueprints_discovery.delay()
-
-    def on_modified(self, event: FileSystemEvent):
-        """Process file modification"""
-        path = Path(event.src_path)
         root = Path(CONFIG.get("blueprints_dir")).absolute()
+        path = Path(event.src_path).absolute()
         rel_path = str(path.relative_to(root))
-        for tenant in Tenant.objects.filter(ready=True):
+        if isinstance(event, FileCreatedEvent):
-            with tenant:
+            LOGGER.debug("new blueprint file created, starting discovery", path=rel_path)
+            blueprints_discovery.delay(rel_path)
+        if isinstance(event, FileModifiedEvent):
             for instance in BlueprintInstance.objects.filter(path=rel_path, enabled=True):
                 LOGGER.debug("modified blueprint file, starting apply", instance=instance)
                 apply_blueprint.delay(instance.pk.hex)
@@ -147,10 +128,10 @@ def blueprints_find() -> list[BlueprintFile]:
 
 
 @CELERY_APP.task(
-    throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
+    throws=(DatabaseError, ProgrammingError, InternalError), base=MonitoredTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
+def blueprints_discovery(self: MonitoredTask, path: Optional[str] = None):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
@@ -159,7 +140,10 @@ def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
         check_blueprint_v1_file(blueprint)
         count += 1
     self.set_status(
-        TaskStatus.SUCCESSFUL, _("Successfully imported %(count)d files." % {"count": count})
+        TaskResult(
+            TaskResultStatus.SUCCESSFUL,
+            messages=[_("Successfully imported %(count)d files." % {"count": count})],
+        )
     )
 
 
@@ -192,9 +176,9 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 
 @CELERY_APP.task(
     bind=True,
-    base=SystemTask,
+    base=MonitoredTask,
 )
-def apply_blueprint(self: SystemTask, instance_pk: str):
+def apply_blueprint(self: MonitoredTask, instance_pk: str):
     """Apply single blueprint"""
     self.save_on_success = False
     instance: Optional[BlueprintInstance] = None
@@ -212,18 +196,18 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         if not valid:
             instance.status = BlueprintInstanceStatus.ERROR
             instance.save()
-            self.set_status(TaskStatus.ERROR, *[x["event"] for x in logs])
+            self.set_status(TaskResult(TaskResultStatus.ERROR, [x["event"] for x in logs]))
             return
         applied = importer.apply()
         if not applied:
             instance.status = BlueprintInstanceStatus.ERROR
             instance.save()
-            self.set_status(TaskStatus.ERROR, "Failed to apply")
+            self.set_status(TaskResult(TaskResultStatus.ERROR, "Failed to apply"))
             return
         instance.status = BlueprintInstanceStatus.SUCCESSFUL
         instance.last_applied_hash = file_hash
         instance.last_applied = now()
-        self.set_status(TaskStatus.SUCCESSFUL)
+        self.set_status(TaskResult(TaskResultStatus.SUCCESSFUL))
     except (
         DatabaseError,
         ProgrammingError,
@@ -234,7 +218,7 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
     ) as exc:
         if instance:
             instance.status = BlueprintInstanceStatus.ERROR
-        self.set_error(exc)
+        self.set_status(TaskResult(TaskResultStatus.ERROR).with_error(exc))
     finally:
         if instance:
             instance.save()

authentik/brands/apps.py

@@ -1,11 +0,0 @@
-"""authentik brands app"""
-
-from django.apps import AppConfig
-
-
-class AuthentikBrandsConfig(AppConfig):
-    """authentik Brand app"""
-
-    name = "authentik.brands"
-    label = "authentik_brands"
-    verbose_name = "authentik Brands"

authentik/brands/middleware.py

@@ -1,27 +0,0 @@
-"""Inject brand into current request"""
-
-from typing import Callable
-
-from django.http.request import HttpRequest
-from django.http.response import HttpResponse
-from django.utils.translation import activate
-
-from authentik.brands.utils import get_brand_for_request
-
-
-class BrandMiddleware:
-    """Add current brand to http request"""
-
-    get_response: Callable[[HttpRequest], HttpResponse]
-
-    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
-        self.get_response = get_response
-
-    def __call__(self, request: HttpRequest) -> HttpResponse:
-        if not hasattr(request, "brand"):
-            brand = get_brand_for_request(request)
-            setattr(request, "brand", brand)
-            locale = brand.default_locale
-            if locale != "":
-                activate(locale)
-        return self.get_response(request)

authentik/brands/migrations/0005_tenantuuid_to_branduuid.py

@@ -1,21 +0,0 @@
-# Generated by Django 4.2.7 on 2023-12-12 06:41
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("authentik_brands", "0004_tenant_flow_device_code"),
-    ]
-
-    operations = [
-        migrations.RenameField(
-            model_name="brand",
-            old_name="tenant_uuid",
-            new_name="brand_uuid",
-        ),
-        migrations.RemoveField(
-            model_name="brand",
-            name="event_retention",
-        ),
-    ]

authentik/brands/models.py

@@ -1,86 +0,0 @@
-"""brand models"""
-
-from uuid import uuid4
-
-from django.db import models
-from django.utils.translation import gettext_lazy as _
-from rest_framework.serializers import Serializer
-from structlog.stdlib import get_logger
-
-from authentik.crypto.models import CertificateKeyPair
-from authentik.flows.models import Flow
-from authentik.lib.models import SerializerModel
-
-LOGGER = get_logger()
-
-
-class Brand(SerializerModel):
-    """Single brand"""
-
-    brand_uuid = models.UUIDField(primary_key=True, editable=False, default=uuid4)
-    domain = models.TextField(
-        help_text=_(
-            "Domain that activates this brand. Can be a superset, i.e. `a.b` for `aa.b` and `ba.b`"
-        )
-    )
-    default = models.BooleanField(
-        default=False,
-    )
-
-    branding_title = models.TextField(default="authentik")
-
-    branding_logo = models.TextField(default="/static/dist/assets/icons/icon_left_brand.svg")
-    branding_favicon = models.TextField(default="/static/dist/assets/icons/icon.png")
-
-    flow_authentication = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_authentication"
-    )
-    flow_invalidation = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_invalidation"
-    )
-    flow_recovery = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_recovery"
-    )
-    flow_unenrollment = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_unenrollment"
-    )
-    flow_user_settings = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_user_settings"
-    )
-    flow_device_code = models.ForeignKey(
-        Flow, null=True, on_delete=models.SET_NULL, related_name="brand_device_code"
-    )
-
-    web_certificate = models.ForeignKey(
-        CertificateKeyPair,
-        null=True,
-        default=None,
-        on_delete=models.SET_DEFAULT,
-        help_text=_("Web Certificate used by the authentik Core webserver."),
-    )
-    attributes = models.JSONField(default=dict, blank=True)
-
-    @property
-    def serializer(self) -> Serializer:
-        from authentik.brands.api import BrandSerializer
-
-        return BrandSerializer
-
-    @property
-    def default_locale(self) -> str:
-        """Get default locale"""
-        try:
-            return self.attributes.get("settings", {}).get("locale", "")
-        # pylint: disable=broad-except
-        except Exception as exc:
-            LOGGER.warning("Failed to get default locale", exc=exc)
-            return ""
-
-    def __str__(self) -> str:
-        if self.default:
-            return "Default brand"
-        return f"Brand {self.domain}"
-
-    class Meta:
-        verbose_name = _("Brand")
-        verbose_name_plural = _("Brands")

authentik/brands/tests.py

@@ -1,77 +0,0 @@
-"""Test brands"""
-
-from django.urls import reverse
-from rest_framework.test import APITestCase
-
-from authentik.brands.api import Themes
-from authentik.brands.models import Brand
-from authentik.core.tests.utils import create_test_admin_user, create_test_brand
-
-
-class TestBrands(APITestCase):
-    """Test brands"""
-
-    def test_current_brand(self):
-        """Test Current brand API"""
-        brand = create_test_brand()
-        self.assertJSONEqual(
-            self.client.get(reverse("authentik_api:brand-current")).content.decode(),
-            {
-                "branding_logo": "/static/dist/assets/icons/icon_left_brand.svg",
-                "branding_favicon": "/static/dist/assets/icons/icon.png",
-                "branding_title": "authentik",
-                "matched_domain": brand.domain,
-                "ui_footer_links": [],
-                "ui_theme": Themes.AUTOMATIC,
-                "default_locale": "",
-            },
-        )
-
-    def test_brand_subdomain(self):
-        """Test Current brand API"""
-        Brand.objects.all().delete()
-        Brand.objects.create(domain="bar.baz", branding_title="custom")
-        self.assertJSONEqual(
-            self.client.get(
-                reverse("authentik_api:brand-current"), HTTP_HOST="foo.bar.baz"
-            ).content.decode(),
-            {
-                "branding_logo": "/static/dist/assets/icons/icon_left_brand.svg",
-                "branding_favicon": "/static/dist/assets/icons/icon.png",
-                "branding_title": "custom",
-                "matched_domain": "bar.baz",
-                "ui_footer_links": [],
-                "ui_theme": Themes.AUTOMATIC,
-                "default_locale": "",
-            },
-        )
-
-    def test_fallback(self):
-        """Test fallback brand"""
-        Brand.objects.all().delete()
-        self.assertJSONEqual(
-            self.client.get(reverse("authentik_api:brand-current")).content.decode(),
-            {
-                "branding_logo": "/static/dist/assets/icons/icon_left_brand.svg",
-                "branding_favicon": "/static/dist/assets/icons/icon.png",
-                "branding_title": "authentik",
-                "matched_domain": "fallback",
-                "ui_footer_links": [],
-                "ui_theme": Themes.AUTOMATIC,
-                "default_locale": "",
-            },
-        )
-
-    def test_create_default_multiple(self):
-        """Test attempted creation of multiple default brands"""
-        Brand.objects.create(
-            domain="foo",
-            default=True,
-            branding_title="custom",
-        )
-        user = create_test_admin_user()
-        self.client.force_login(user)
-        response = self.client.post(
-            reverse("authentik_api:brand-list"), data={"domain": "bar", "default": True}
-        )
-        self.assertEqual(response.status_code, 400)

authentik/brands/urls.py

@@ -1,7 +0,0 @@
-"""API URLs"""
-
-from authentik.brands.api import BrandViewSet
-
-api_urlpatterns = [
-    ("core/brands", BrandViewSet),
-]

authentik/brands/utils.py

@@ -1,44 +0,0 @@
-"""Brand utilities"""
-
-from typing import Any
-
-from django.db.models import F, Q
-from django.db.models import Value as V
-from django.http.request import HttpRequest
-from sentry_sdk.hub import Hub
-
-from authentik import get_full_version
-from authentik.brands.models import Brand
-from authentik.tenants.models import Tenant
-
-_q_default = Q(default=True)
-DEFAULT_BRAND = Brand(domain="fallback")
-
-
-def get_brand_for_request(request: HttpRequest) -> Brand:
-    """Get brand object for current request"""
-    db_brands = (
-        Brand.objects.annotate(host_domain=V(request.get_host()))
-        .filter(Q(host_domain__iendswith=F("domain")) | _q_default)
-        .order_by("default")
-    )
-    brands = list(db_brands.all())
-    if len(brands) < 1:
-        return DEFAULT_BRAND
-    return brands[0]
-
-
-def context_processor(request: HttpRequest) -> dict[str, Any]:
-    """Context Processor that injects brand object into every template"""
-    brand = getattr(request, "brand", DEFAULT_BRAND)
-    tenant = getattr(request, "tenant", Tenant())
-    trace = ""
-    span = Hub.current.scope.span
-    if span:
-        trace = span.to_traceparent()
-    return {
-        "brand": brand,
-        "footer_links": tenant.footer_links,
-        "sentry_trace": trace,
-        "version": get_full_version(),
-    }

authentik/core/api/applications.py

@@ -1,18 +1,16 @@
 """Application API Views"""
-
-from copy import copy
 from datetime import timedelta
-from typing import Iterator, Optional
+from typing import Optional
 
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.db.models.functions import ExtractHour
+from django.http.response import HttpResponseBadRequest
 from django.shortcuts import get_object_or_404
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
 from guardian.shortcuts import get_objects_for_user
 from rest_framework.decorators import action
-from rest_framework.exceptions import ValidationError
 from rest_framework.fields import CharField, ReadOnlyField, SerializerMethodField
 from rest_framework.parsers import MultiPartParser
 from rest_framework.request import Request
@@ -23,6 +21,7 @@ from structlog.stdlib import get_logger
 from structlog.testing import capture_logs
 
 from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
@@ -38,7 +37,6 @@ from authentik.lib.utils.file import (
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
 from authentik.policies.types import PolicyResult
-from authentik.rbac.decorators import permission_required
 from authentik.rbac.filters import ObjectFilter
 
 LOGGER = get_logger()
@@ -130,16 +128,10 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             queryset = backend().filter_queryset(self.request, queryset, self)
         return queryset
 
-    def _get_allowed_applications(
+    def _get_allowed_applications(self, queryset: QuerySet) -> list[Application]:
-        self, pagined_apps: Iterator[Application], user: Optional[User] = None
-    ) -> list[Application]:
         applications = []
-        request = self.request._request
+        for application in queryset:
-        if user:
+            engine = PolicyEngine(application, self.request.user, self.request)
-            request = copy(request)
-            request.user = user
-        for application in pagined_apps:
-            engine = PolicyEngine(application, request.user, request)
             engine.build()
             if engine.passing:
                 applications.append(application)
@@ -155,6 +147,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         ],
         responses={
             200: PolicyTestResultSerializer(),
+            404: OpenApiResponse(description="for_user user not found"),
         },
     )
     @action(detail=True, methods=["GET"])
@@ -167,11 +160,9 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         for_user = request.user
         if request.user.is_superuser and "for_user" in request.query_params:
             try:
-                for_user = User.objects.filter(pk=request.query_params.get("for_user")).first()
+                for_user = get_object_or_404(User, pk=request.query_params.get("for_user"))
             except ValueError:
-                raise ValidationError({"for_user": "for_user must be numerical"})
+                return HttpResponseBadRequest("for_user must be numerical")
-            if not for_user:
-                raise ValidationError({"for_user": "User not found"})
         engine = PolicyEngine(application, for_user, request)
         engine.use_cache = False
         with capture_logs() as logs:
@@ -196,51 +187,28 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
                 name="superuser_full_list",
                 location=OpenApiParameter.QUERY,
                 type=OpenApiTypes.BOOL,
-            ),
+            )
-            OpenApiParameter(
-                name="for_user",
-                location=OpenApiParameter.QUERY,
-                type=OpenApiTypes.INT,
-            ),
         ]
     )
     def list(self, request: Request) -> Response:
         """Custom list method that checks Policy based access instead of guardian"""
-        should_cache = request.query_params.get("search", "") == ""
+        should_cache = request.GET.get("search", "") == ""
 
-        superuser_full_list = (
+        superuser_full_list = str(request.GET.get("superuser_full_list", "false")).lower() == "true"
-            str(request.query_params.get("superuser_full_list", "false")).lower() == "true"
-        )
         if superuser_full_list and request.user.is_superuser:
             return super().list(request)
 
         queryset = self._filter_queryset_for_list(self.get_queryset())
-        pagined_apps = self.paginate_queryset(queryset)
+        self.paginate_queryset(queryset)
-
-        if "for_user" in request.query_params:
-            try:
-                for_user: int = int(request.query_params.get("for_user", 0))
-                for_user = (
-                    get_objects_for_user(request.user, "authentik_core.view_user_applications")
-                    .filter(pk=for_user)
-                    .first()
-                )
-                if not for_user:
-                    raise ValidationError({"for_user": "User not found"})
-            except ValueError as exc:
-                raise ValidationError from exc
-            allowed_applications = self._get_allowed_applications(pagined_apps, user=for_user)
-            serializer = self.get_serializer(allowed_applications, many=True)
-            return self.get_paginated_response(serializer.data)
 
         allowed_applications = []
         if not should_cache:
-            allowed_applications = self._get_allowed_applications(pagined_apps)
+            allowed_applications = self._get_allowed_applications(queryset)
         if should_cache:
             allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
             if not allowed_applications:
                 LOGGER.debug("Caching allowed application list")
-                allowed_applications = self._get_allowed_applications(pagined_apps)
+                allowed_applications = self._get_allowed_applications(queryset)
                 cache.set(
                     user_app_cache_key(self.request.user.pk),
                     allowed_applications,

authentik/core/api/authenticated_sessions.py

@@ -1,5 +1,4 @@
 """AuthenticatedSessions API Viewset"""
-
 from typing import Optional, TypedDict
 
 from django_filters.rest_framework import DjangoFilterBackend

authentik/core/api/devices.py

@@ -1,5 +1,4 @@
 """Authenticator Devices API Views"""
-
 from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import OpenApiParameter, extend_schema
 from rest_framework.fields import BooleanField, CharField, IntegerField, SerializerMethodField

authentik/core/api/groups.py

@@ -1,5 +1,4 @@
 """Groups API Viewset"""
-
 from json import loads
 from typing import Optional
 
@@ -15,11 +14,11 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
 from authentik.core.models import Group, User
 from authentik.rbac.api.roles import RoleSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class GroupMemberSerializer(ModelSerializer):

authentik/core/api/propertymappings.py

@@ -1,5 +1,4 @@
 """PropertyMapping API Views"""
-
 from json import dumps
 
 from drf_spectacular.types import OpenApiTypes
@@ -14,15 +13,16 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
 from authentik.core.expression.evaluator import PropertyMappingEvaluator
 from authentik.core.models import PropertyMapping
+from authentik.enterprise.apps import EnterpriseConfig
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class PropertyMappingTestResultSerializer(PassiveSerializer):
@@ -96,6 +96,7 @@ class PropertyMappingViewSet(
                     "description": subclass.__doc__,
                     "component": subclass().component,
                     "model_name": subclass._meta.model_name,
+                    "requires_enterprise": isinstance(subclass._meta.app_config, EnterpriseConfig),
                 }
             )
         return Response(TypeCreateSerializer(data, many=True).data)
@@ -118,11 +119,7 @@ class PropertyMappingViewSet(
     @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     def test(self, request: Request, pk: str) -> Response:
         """Test Property Mapping"""
-        _mapping: PropertyMapping = self.get_object()
+        mapping: PropertyMapping = self.get_object()
-        # Use `get_subclass` to get correct class and correct `.evaluate` implementation
-        mapping = PropertyMapping.objects.get_subclass(pk=_mapping.pk)
-        # FIXME: when we separate policy mappings between ones for sources
-        # and ones for providers, we need to make the user field optional for the source mapping
         test_params = PolicyTestSerializer(data=request.data)
         if not test_params.is_valid():
             return Response(test_params.errors, status=400)

authentik/core/api/providers.py

@@ -1,5 +1,4 @@
 """Provider API Views"""
-
 from django.db.models import QuerySet
 from django.db.models.query import Q
 from django.utils.translation import gettext_lazy as _

authentik/core/api/sources.py

@@ -1,5 +1,4 @@
 """Source API Views"""
-
 from typing import Iterable
 
 from django_filters.rest_framework import DjangoFilterBackend
@@ -16,6 +15,7 @@ from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import OwnerFilter, OwnerSuperuserPermissions
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
@@ -29,7 +29,6 @@ from authentik.lib.utils.file import (
 )
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.engine import PolicyEngine
-from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 

authentik/core/api/tokens.py

@@ -1,5 +1,4 @@
 """Tokens API Viewset"""
-
 from typing import Any
 
 from django_filters.rest_framework import DjangoFilterBackend
@@ -15,6 +14,7 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.authorization import OwnerSuperuserPermissions
+from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
@@ -23,7 +23,6 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
-from authentik.rbac.decorators import permission_required
 
 
 class TokenSerializer(ManagedSerializer, ModelSerializer):

authentik/core/api/transactional_applications.py

@@ -1,5 +1,4 @@
 """transactional application and provider creation"""
-
 from django.apps import apps
 from drf_spectacular.utils import PolymorphicProxySerializer, extend_schema, extend_schema_field
 from rest_framework.exceptions import ValidationError

authentik/core/api/used_by.py

@@ -1,5 +1,4 @@
 """used_by mixin"""
-
 from enum import Enum
 from inspect import getmembers
 
@@ -32,7 +31,7 @@ class UsedBySerializer(PassiveSerializer):
     model_name = CharField()
     pk = CharField()
     name = CharField()
-    action = ChoiceField(choices=[(x.value, x.name) for x in DeleteAction])
+    action = ChoiceField(choices=[(x.name, x.name) for x in DeleteAction])
 
 
 def get_delete_action(manager: Manager) -> str:

authentik/core/api/users.py

@@ -1,5 +1,4 @@
 """User API Views"""
-
 from datetime import timedelta
 from json import loads
 from typing import Any, Optional
@@ -31,7 +30,7 @@ from drf_spectacular.utils import (
     extend_schema_field,
     inline_serializer,
 )
-from guardian.shortcuts import get_objects_for_user
+from guardian.shortcuts import get_anonymous_user, get_objects_for_user
 from rest_framework.decorators import action
 from rest_framework.fields import CharField, IntegerField, ListField, SerializerMethodField
 from rest_framework.request import Request
@@ -49,8 +48,8 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
-from authentik.brands.models import Brand
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, LinkSerializer, PassiveSerializer
 from authentik.core.middleware import (
@@ -72,11 +71,11 @@ from authentik.flows.exceptions import FlowNonApplicableException
 from authentik.flows.models import FlowToken
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
 from authentik.flows.views.executor import QS_KEY_TOKEN
-from authentik.lib.avatars import get_avatar
+from authentik.lib.config import CONFIG
-from authentik.rbac.decorators import permission_required
 from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
+from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
 
@@ -104,21 +103,14 @@ class UserSerializer(ModelSerializer):
     """User Serializer"""
 
     is_superuser = BooleanField(read_only=True)
-    avatar = SerializerMethodField()
+    avatar = CharField(read_only=True)
     attributes = JSONDictField(required=False)
     groups = PrimaryKeyRelatedField(
-        allow_empty=True,
+        allow_empty=True, many=True, source="ak_groups", queryset=Group.objects.all(), default=list
-        many=True,
-        source="ak_groups",
-        queryset=Group.objects.all().order_by("name"),
-        default=list,
     )
     groups_obj = ListSerializer(child=UserGroupSerializer(), read_only=True, source="ak_groups")
     uid = CharField(read_only=True)
-    username = CharField(
+    username = CharField(max_length=150, validators=[UniqueValidator(queryset=User.objects.all())])
-        max_length=150,
-        validators=[UniqueValidator(queryset=User.objects.all().order_by("username"))],
-    )
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -152,10 +144,6 @@ class UserSerializer(ModelSerializer):
             instance.set_unusable_password()
             instance.save()
 
-    def get_avatar(self, user: User) -> str:
-        """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context.get("request"))
-
     def validate_path(self, path: str) -> str:
         """Validate path"""
         if path[:1] == "/" or path[-1] == "/":
@@ -210,16 +198,12 @@ class UserSelfSerializer(ModelSerializer):
     """User Serializer for information a user can retrieve about themselves"""
 
     is_superuser = BooleanField(read_only=True)
-    avatar = SerializerMethodField()
+    avatar = CharField(read_only=True)
     groups = SerializerMethodField()
     uid = CharField(read_only=True)
     settings = SerializerMethodField()
     system_permissions = SerializerMethodField()
 
-    def get_avatar(self, user: User) -> str:
-        """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context.get("request"))
-
     @extend_schema_field(
         ListSerializer(
             child=inline_serializer(
@@ -237,15 +221,15 @@ class UserSelfSerializer(ModelSerializer):
             }
 
     def get_settings(self, user: User) -> dict[str, Any]:
-        """Get user settings with brand and group settings applied"""
+        """Get user settings with tenant and group settings applied"""
         return user.group_attributes(self._context["request"]).get("settings", {})
 
     def get_system_permissions(self, user: User) -> list[str]:
         """Get all system permissions assigned to the user"""
         return list(
-            x.split(".", maxsplit=1)[1]
+            user.user_permissions.filter(
-            for x in user.get_all_permissions()
+                content_type__app_label="authentik_rbac", content_type__model="systempermission"
-            if x.startswith("authentik_rbac")
+            ).values_list("codename", flat=True)
         )
 
     class Meta:
@@ -346,11 +330,11 @@ class UsersFilter(FilterSet):
     groups_by_name = ModelMultipleChoiceFilter(
         field_name="ak_groups__name",
         to_field_name="name",
-        queryset=Group.objects.all().order_by("name"),
+        queryset=Group.objects.all(),
     )
     groups_by_pk = ModelMultipleChoiceFilter(
         field_name="ak_groups",
-        queryset=Group.objects.all().order_by("name"),
+        queryset=Group.objects.all(),
     )
 
     def filter_attributes(self, queryset, name, value):
@@ -395,14 +379,14 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     filterset_class = UsersFilter
 
     def get_queryset(self):  # pragma: no cover
-        return User.objects.all().exclude_anonymous().prefetch_related("ak_groups")
+        return User.objects.all().exclude(pk=get_anonymous_user().pk)
 
     def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
-        """Create a recovery link (when the current brand has a recovery flow set),
+        """Create a recovery link (when the current tenant has a recovery flow set),
         that can either be shown to an admin or sent to the user directly"""
-        brand: Brand = self.request._request.brand
+        tenant: Tenant = self.request._request.tenant
         # Check that there is a recovery flow, if not return an error
-        flow = brand.flow_recovery
+        flow = tenant.flow_recovery
         if not flow:
             LOGGER.debug("No recovery flow set")
             return None, None
@@ -533,7 +517,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             400: OpenApiResponse(description="Bad request"),
         },
     )
-    @action(detail=True, methods=["POST"], permission_classes=[])
+    @action(detail=True, methods=["POST"])
     def set_password(self, request: Request, pk: int) -> Response:
         """Set password for user"""
         user: User = self.get_object()
@@ -611,7 +595,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),
-            to=[(for_user.name, for_user.email)],
+            to=[for_user.email],
             template_name=email_stage.template,
             language=for_user.locale(request),
             template_context={
@@ -631,10 +615,10 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             "401": OpenApiResponse(description="Access denied"),
         },
     )
-    @action(detail=True, methods=["POST"], permission_classes=[])
+    @action(detail=True, methods=["POST"])
     def impersonate(self, request: Request, pk: int) -> Response:
         """Impersonate a user"""
-        if not request.tenant.impersonation:
+        if not CONFIG.get_bool("impersonation"):
             LOGGER.debug("User attempted to impersonate", user=request.user)
             return Response(status=401)
         if not request.user.has_perm("impersonate"):

authentik/core/api/utils.py

@@ -1,5 +1,4 @@
 """API Utilities"""
-
 from typing import Any
 
 from django.db.models import Model

authentik/core/apps.py

@@ -1,5 +1,4 @@
 """authentik core app config"""
-
 from django.conf import settings
 
 from authentik.blueprints.apps import ManagedAppConfig
@@ -14,14 +13,18 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    def reconcile_global_debug_worker_hook(self):
+    def reconcile_load_core_signals(self):
+        """Load core signals"""
+        self.import_module("authentik.core.signals")
+
+    def reconcile_debug_worker_hook(self):
         """Dispatch startup tasks inline when debugging"""
         if settings.DEBUG:
             from authentik.root.celery import worker_ready_hook
 
             worker_ready_hook()
 
-    def reconcile_tenant_source_inbuilt(self):
+    def reconcile_source_inbuilt(self):
         """Reconcile inbuilt source"""
         from authentik.core.models import Source
 

authentik/core/auth.py

@@ -43,9 +43,7 @@ class TokenBackend(InbuiltBackend):
         self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
     ) -> Optional[User]:
         try:
-            # pylint: disable=no-member
             user = User._default_manager.get_by_natural_key(username)
-        # pylint: disable=no-member
         except User.DoesNotExist:
             # Run the default password hasher once to reduce the timing
             # difference between an existing and a nonexistent user (#20760).

authentik/core/channels.py

@@ -1,5 +1,4 @@
 """Channels base classes"""
-
 from channels.db import database_sync_to_async
 from channels.exceptions import DenyConnection
 from rest_framework.exceptions import AuthenticationFailed

authentik/core/exceptions.py

@@ -1,5 +1,4 @@
 """authentik core exceptions"""
-
 from authentik.lib.sentry import SentryIgnoredException
 
 

authentik/core/expression/evaluator.py

@@ -1,5 +1,4 @@
 """Property Mapping Evaluator"""
-
 from typing import Any, Optional
 
 from django.db.models import Model