events/batch: add event batching mechanism [AUTH-134]

.bumpversion.cfg

@@ -1,20 +1,12 @@
 [bumpversion]
-current_version = 2024.2.2
+current_version = 2023.10.7
 tag = True
 commit = True
-parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?
-serialize = 
-	{major}.{minor}.{patch}-{rc_t}{rc_n}
-	{major}.{minor}.{patch}
+parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)
+serialize = {major}.{minor}.{patch}
 message = release: {new_version}
 tag_name = version/{new_version}
 
-[bumpversion:part:rc_t]
-values = 
-	rc
-	final
-optional_value = final
-
 [bumpversion:file:pyproject.toml]
 
 [bumpversion:file:docker-compose.yml]

.github/ISSUE_TEMPLATE/question.md

@@ -9,7 +9,7 @@ assignees: ""
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 
-**Relevant info**
+**Relevant infos**
 i.e. Version of other software you're using, specifics of your setup
 
 **Screenshots**

.github/actions/comment-pr-instructions/action.yml

@@ -9,6 +9,9 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Generate config
+      id: ev
+      uses: ./.github/actions/docker-push-variables
     - name: Find Comment
       uses: peter-evans/find-comment@v2
       id: fc

.github/actions/docker-push-variables/action.yml

@@ -1,47 +1,64 @@
----
 name: "Prepare docker environment variables"
 description: "Prepare docker environment variables"
 
-inputs:
-  image-name:
-    required: true
-    description: "Docker image prefix"
-  image-arch:
-    required: false
-    description: "Docker image arch"
-
 outputs:
   shouldBuild:
     description: "Whether to build image or not"
     value: ${{ steps.ev.outputs.shouldBuild }}
-
+  branchName:
+    description: "Branch name"
+    value: ${{ steps.ev.outputs.branchName }}
+  branchNameContainer:
+    description: "Branch name (for containers)"
+    value: ${{ steps.ev.outputs.branchNameContainer }}
+  timestamp:
+    description: "Timestamp"
+    value: ${{ steps.ev.outputs.timestamp }}
   sha:
     description: "sha"
     value: ${{ steps.ev.outputs.sha }}
-
+  shortHash:
+    description: "shortHash"
+    value: ${{ steps.ev.outputs.shortHash }}
   version:
-    description: "Version"
+    description: "version"
     value: ${{ steps.ev.outputs.version }}
-  prerelease:
-    description: "Prerelease"
-    value: ${{ steps.ev.outputs.prerelease }}
-
-  imageTags:
-    description: "Docker image tags"
-    value: ${{ steps.ev.outputs.imageTags }}
-  imageMainTag:
-    description: "Docker image main tag"
-    value: ${{ steps.ev.outputs.imageMainTag }}
+  versionFamily:
+    description: "versionFamily"
+    value: ${{ steps.ev.outputs.versionFamily }}
 
 runs:
   using: "composite"
   steps:
     - name: Generate config
       id: ev
-      shell: bash
-      env:
-        IMAGE_NAME: ${{ inputs.image-name }}
-        IMAGE_ARCH: ${{ inputs.image-arch }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      shell: python
       run: |
-        python3 ${{ github.action_path }}/push_vars.py
+        """Helper script to get the actual branch name, docker safe"""
+        import configparser
+        import os
+        from time import time
+
+        parser = configparser.ConfigParser()
+        parser.read(".bumpversion.cfg")
+
+        branch_name = os.environ["GITHUB_REF"]
+        if os.environ.get("GITHUB_HEAD_REF", "") != "":
+            branch_name = os.environ["GITHUB_HEAD_REF"]
+
+        should_build = str(os.environ.get("DOCKER_USERNAME", "") != "").lower()
+        version = parser.get("bumpversion", "current_version")
+        version_family = ".".join(version.split(".")[:-1])
+        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+        sha = os.environ["GITHUB_SHA"] if not "${{ github.event.pull_request.head.sha }}" else "${{ github.event.pull_request.head.sha }}"
+
+        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+            print("branchName=%s" % branch_name, file=_output)
+            print("branchNameContainer=%s" % safe_branch_name, file=_output)
+            print("timestamp=%s" % int(time()), file=_output)
+            print("sha=%s" % sha, file=_output)
+            print("shortHash=%s" % sha[:7], file=_output)
+            print("shouldBuild=%s" % should_build, file=_output)
+            print("version=%s" % version, file=_output)
+            print("versionFamily=%s" % version_family, file=_output)

.github/actions/docker-push-variables/push_vars.py

@@ -1,62 +0,0 @@
-"""Helper script to get the actual branch name, docker safe"""
-
-import configparser
-import os
-from time import time
-
-parser = configparser.ConfigParser()
-parser.read(".bumpversion.cfg")
-
-should_build = str(os.environ.get("DOCKER_USERNAME", None) is not None).lower()
-
-branch_name = os.environ["GITHUB_REF"]
-if os.environ.get("GITHUB_HEAD_REF", "") != "":
-    branch_name = os.environ["GITHUB_HEAD_REF"]
-safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
-
-image_names = os.getenv("IMAGE_NAME").split(",")
-image_arch = os.getenv("IMAGE_ARCH") or None
-
-is_pull_request = bool(os.getenv("PR_HEAD_SHA"))
-is_release = "dev" not in image_names[0]
-
-sha = os.environ["GITHUB_SHA"] if not is_pull_request else os.getenv("PR_HEAD_SHA")
-
-# 2042.1.0 or 2042.1.0-rc1
-version = parser.get("bumpversion", "current_version")
-# 2042.1
-version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
-prerelease = "-" in version
-
-image_tags = []
-if is_release:
-    for name in image_names:
-        image_tags += [
-            f"{name}:{version}",
-        ]
-        if not prerelease:
-            image_tags += [
-                f"{name}:latest",
-                f"{name}:{version_family}",
-            ]
-else:
-    suffix = ""
-    if image_arch and image_arch != "amd64":
-        suffix = f"-{image_arch}"
-    for name in image_names:
-        image_tags += [
-            f"{name}:gh-{sha}{suffix}",  # Used for ArgoCD and PR comments
-            f"{name}:gh-{safe_branch_name}{suffix}",  # For convenience
-            f"{name}:gh-{safe_branch_name}-{int(time())}-{sha[:7]}{suffix}",  # Use by FluxCD
-        ]
-
-image_main_tag = image_tags[0]
-image_tags_rendered = ",".join(image_tags)
-
-with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
-    print("shouldBuild=%s" % should_build, file=_output)
-    print("sha=%s" % sha, file=_output)
-    print("version=%s" % version, file=_output)
-    print("prerelease=%s" % prerelease, file=_output)
-    print("imageTags=%s" % image_tags_rendered, file=_output)
-    print("imageMainTag=%s" % image_main_tag, file=_output)

.github/actions/docker-push-variables/test.sh

@@ -1,7 +0,0 @@
-#!/bin/bash -x
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-GITHUB_OUTPUT=/dev/stdout \
-    GITHUB_REF=ref \
-    GITHUB_SHA=sha \
-    IMAGE_NAME=ghcr.io/goauthentik/server,beryju/authentik \
-    python $SCRIPT_DIR/push_vars.py

.github/codespell-words.txt

@@ -3,4 +3,3 @@ keypairs
 hass
 warmup
 ontext
-singed

.github/dependabot.yml

@@ -52,10 +52,6 @@ updates:
       esbuild:
         patterns:
           - "@esbuild/*"
-      rollup:
-        patterns:
-          - "@rollup/*"
-          - "rollup-*"
   - package-ecosystem: npm
     directory: "/tests/wdio"
     schedule:

.github/pull_request_template.md

@@ -27,6 +27,7 @@ If an API change has been made
 If changes to the frontend have been made
 
 -   [ ] The code has been formatted (`make web`)
+-   [ ] The translation files have been updated (`make i18n-extract`)
 
 If applicable
 

.github/workflows/ci-main.yml

@@ -1,4 +1,3 @@
----
 name: authentik-ci-main
 
 on:
@@ -8,7 +7,7 @@ on:
       - next
       - version-*
     paths-ignore:
-      - website/**
+      - website
   pull_request:
     branches:
       - main
@@ -28,7 +27,10 @@ jobs:
           - bandit
           - black
           - codespell
+          - isort
           - pending-migrations
+          - pylint
+          - pyright
           - ruff
     runs-on: ubuntu-latest
     steps:
@@ -67,7 +69,7 @@ jobs:
           cp authentik/lib/default.yml local.env.yml
           cp -R .github ..
           cp -R scripts ..
-          git checkout $(git tag --sort=version:refname | grep '^version/' | grep -vE -- '-rc[0-9]+$' | tail -n1)
+          git checkout version/$(python -c "from authentik import __version__; print(__version__)")
           rm -rf .github/ scripts/
           mv ../.github ../scripts .
       - name: Setup authentik env (stable)
@@ -132,7 +134,7 @@ jobs:
       - name: Setup authentik env
         uses: ./.github/actions/setup
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.9.0
+        uses: helm/kind-action@v1.8.0
       - name: run integration
         run: |
           poetry run coverage run manage.py test tests/integration
@@ -204,12 +206,6 @@ jobs:
     steps:
       - run: echo mark
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        arch:
-          - amd64
-          - arm64
     needs: ci-core-mark
     runs-on: ubuntu-latest
     permissions:
@@ -229,12 +225,9 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-server
-          image-arch: ${{ matrix.arch }}
       - name: Login to Container Registry
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -248,16 +241,69 @@ jobs:
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
-          tags: ${{ steps.ev.outputs.imageTags }}
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.sha }}
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+  build-arm64:
+    needs: ci-core-mark
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload contianer images to ghcr.io
+      packages: write
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: prepare variables
+        uses: ./.github/actions/docker-push-variables
+        id: ev
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      - name: Login to Container Registry
+        uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: generate ts client
+        run: make gen-client-ts
+      - name: Build Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          secrets: |
+            GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
+            GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
+          push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-arm64
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.sha }}-arm64
+            ghcr.io/goauthentik/dev-server:gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}-arm64
+          build-args: |
+            GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
+          platforms: linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          platforms: linux/${{ matrix.arch }}
   pr-comment:
     needs:
       - build
+      - build-arm64
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'pull_request' }}
     permissions:
@@ -273,9 +319,7 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-server
       - name: Comment on PR
         uses: ./.github/actions/comment-pr-instructions
         with:
-          tag: gh-${{ steps.ev.outputs.imageMainTag }}
+          tag: gh-${{ steps.ev.outputs.branchNameContainer }}-${{ steps.ev.outputs.timestamp }}-${{ steps.ev.outputs.shortHash }}

.github/workflows/ci-outpost.yml

@@ -1,4 +1,3 @@
----
 name: authentik-ci-outpost
 
 on:
@@ -29,7 +28,7 @@ jobs:
       - name: Generate API
         run: make gen-client-go
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v3
         with:
           version: v1.54.2
           args: --timeout 5000s --verbose
@@ -84,11 +83,9 @@ jobs:
         id: ev
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/dev-${{ matrix.type }}
       - name: Login to Container Registry
-        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         uses: docker/login-action@v3
+        if: ${{ steps.ev.outputs.shouldBuild == 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -98,11 +95,15 @@ jobs:
       - name: Build Docker Image
         uses: docker/build-push-action@v5
         with:
-          tags: ${{ steps.ev.outputs.imageTags }}
-          file: ${{ matrix.type }}.Dockerfile
           push: ${{ steps.ev.outputs.shouldBuild == 'true' }}
+          tags: |
+            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.branchNameContainer }}
+            ghcr.io/goauthentik/dev-${{ matrix.type }}:gh-${{ steps.ev.outputs.sha }}
+          file: ${{ matrix.type }}.Dockerfile
           build-args: |
             GIT_BUILD_HASH=${{ steps.ev.outputs.sha }}
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
           platforms: linux/amd64,linux/arm64
           context: .
           cache-from: type=gha

.github/workflows/ci-website.yml

@@ -48,6 +48,7 @@ jobs:
       matrix:
         job:
           - build
+          - build-docs-only
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.github/workflows/release-publish.yml

@@ -1,4 +1,3 @@
----
 name: authentik-on-release
 
 on:
@@ -20,10 +19,6 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/server,beryju/authentik
       - name: Docker Login Registry
         uses: docker/login-action@v3
         with:
@@ -43,12 +38,21 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
-          push: true
+          push: ${{ github.event_name == 'release' }}
           secrets: |
             GEOIPUPDATE_ACCOUNT_ID=${{ secrets.GEOIPUPDATE_ACCOUNT_ID }}
             GEOIPUPDATE_LICENSE_KEY=${{ secrets.GEOIPUPDATE_LICENSE_KEY }}
-          tags: ${{ steps.ev.outputs.imageTags }}
+          tags: |
+            beryju/authentik:${{ steps.ev.outputs.version }},
+            beryju/authentik:${{ steps.ev.outputs.versionFamily }},
+            beryju/authentik:latest,
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/server:${{ steps.ev.outputs.versionFamily }},
+            ghcr.io/goauthentik/server:latest
           platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost:
     runs-on: ubuntu-latest
     permissions:
@@ -74,10 +78,6 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/${{ matrix.type }},beryju/authentik-${{ matrix.type }}
       - name: make empty clients
         run: |
           mkdir -p ./gen-ts-api
@@ -96,11 +96,20 @@ jobs:
       - name: Build Docker Image
         uses: docker/build-push-action@v5
         with:
-          push: true
-          tags: ${{ steps.ev.outputs.imageTags }}
+          push: ${{ github.event_name == 'release' }}
+          tags: |
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            beryju/authentik-${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
+            beryju/authentik-${{ matrix.type }}:latest,
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.version }},
+            ghcr.io/goauthentik/${{ matrix.type }}:${{ steps.ev.outputs.versionFamily }},
+            ghcr.io/goauthentik/${{ matrix.type }}:latest
           file: ${{ matrix.type }}.Dockerfile
           platforms: linux/amd64,linux/arm64
           context: .
+          build-args: |
+            VERSION=${{ steps.ev.outputs.version }}
+            VERSION_FAMILY=${{ steps.ev.outputs.versionFamily }}
   build-outpost-binary:
     timeout-minutes: 120
     runs-on: ubuntu-latest
@@ -172,18 +181,15 @@ jobs:
       - name: prepare variables
         uses: ./.github/actions/docker-push-variables
         id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        with:
-          image-name: ghcr.io/goauthentik/server
       - name: Get static files from docker image
         run: |
-          docker pull ${{ steps.ev.outputs.imageMainTag }}
-          container=$(docker container create ${{ steps.ev.outputs.imageMainTag }})
+          docker pull ghcr.io/goauthentik/server:latest
+          container=$(docker container create ghcr.io/goauthentik/server:latest)
           docker cp ${container}:web/ .
       - name: Create a Sentry.io release
         uses: getsentry/action-release@v1
         continue-on-error: true
+        if: ${{ github.event_name == 'release' }}
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: authentik-security-inc

.github/workflows/release-tag.yml

@@ -1,4 +1,3 @@
----
 name: authentik-on-tag
 
 on:
@@ -29,13 +28,13 @@ jobs:
         with:
           app_id: ${{ secrets.GH_APP_ID }}
           private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-      - name: prepare variables
-        uses: ./.github/actions/docker-push-variables
-        id: ev
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      - name: Extract version number
+        id: get_version
+        uses: actions/github-script@v7
         with:
-          image-name: ghcr.io/goauthentik/server
+          github-token: ${{ steps.generate_token.outputs.token }}
+          script: |
+            return context.payload.ref.replace(/\/refs\/tags\/version\//, '');
       - name: Create Release
         id: create_release
         uses: actions/create-release@v1.1.4
@@ -43,6 +42,6 @@ jobs:
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
         with:
           tag_name: ${{ github.ref }}
-          release_name: Release ${{ steps.ev.outputs.version }}
+          release_name: Release ${{ steps.get_version.outputs.result }}
           draft: true
-          prerelease: ${{ steps.ev.outputs.prerelease == 'true' }}
+          prerelease: false

.github/workflows/translation-compile.yml

@@ -1,8 +1,9 @@
----
-name: authentik-backend-translate-extract-compile
+name: authentik-backend-translate-compile
 on:
-  schedule:
-    - cron: "0 0 * * *" # every day at midnight
+  push:
+    branches: [main]
+    paths:
+      - "locale/**"
   workflow_dispatch:
 
 env:
@@ -24,20 +25,16 @@ jobs:
           token: ${{ steps.generate_token.outputs.token }}
       - name: Setup authentik env
         uses: ./.github/actions/setup
-      - name: run extract
-        run: |
-          poetry run make i18n-extract
       - name: run compile
-        run: |
-          poetry run ak compilemessages
-          make web-check-compile
+        run: poetry run ak compilemessages
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
+        id: cpr
         with:
           token: ${{ steps.generate_token.outputs.token }}
-          branch: extract-compile-backend-translation
-          commit-message: "core, web: update translations"
-          title: "core, web: update translations"
-          body: "core, web: update translations"
+          branch: compile-backend-translation
+          commit-message: "core: compile backend translations"
+          title: "core: compile backend translations"
+          body: "core: compile backend translations"
           delete-branch: true
           signoff: true

.vscode/extensions.json

@@ -10,7 +10,8 @@
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
         "ms-python.black-formatter",
-        "charliermarsh.ruff",
+        "ms-python.isort",
+        "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
         "ms-python.black-formatter",

Dockerfile

@@ -14,10 +14,9 @@ RUN --mount=type=bind,target=/work/website/package.json,src=./website/package.js
 
 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
-COPY ./schema.yml /work/
 COPY ./SECURITY.md /work/
 
-RUN npm run build-bundled
+RUN npm run build-docs-only
 
 # Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
@@ -38,7 +37,7 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 RUN npm run build
 
 # Stage 3: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS go-builder
+FROM --platform=${BUILDPLATFORM} docker.io/golang:1.21.6-bookworm AS go-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -84,7 +83,7 @@ RUN --mount=type=secret,id=GEOIPUPDATE_ACCOUNT_ID \
     /bin/sh -c "/usr/bin/entry.sh || echo 'Failed to get GeoIP database, disabling'; exit 0"
 
 # Stage 5: Python dependencies
-FROM docker.io/python:3.12.2-slim-bookworm AS python-deps
+FROM docker.io/python:3.12.1-slim-bookworm AS python-deps
 
 WORKDIR /ak-root/poetry
 
@@ -104,13 +103,12 @@ RUN --mount=type=bind,target=./pyproject.toml,src=./pyproject.toml \
     --mount=type=cache,target=/root/.cache/pip \
     --mount=type=cache,target=/root/.cache/pypoetry \
     python -m venv /ak-root/venv/ && \
-    bash -c "source ${VENV_PATH}/bin/activate && \
-        pip3 install --upgrade pip && \
-        pip3 install poetry && \
-        poetry install --only=main --no-ansi --no-interaction --no-root"
+    pip3 install --upgrade pip && \
+    pip3 install poetry && \
+    poetry install --only=main --no-ansi --no-interaction
 
 # Stage 6: Run
-FROM docker.io/python:3.12.2-slim-bookworm AS final-image
+FROM docker.io/python:3.12.1-slim-bookworm AS final-image
 
 ARG GIT_BUILD_HASH
 ARG VERSION
@@ -151,7 +149,7 @@ COPY --from=go-builder /go/authentik /bin/authentik
 COPY --from=python-deps /ak-root/venv /ak-root/venv
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/build/ /website/help/
+COPY --from=website-builder /work/website/help/ /website/help/
 COPY --from=geoip /usr/share/GeoIP /geoip
 
 USER 1000

Makefile

@@ -5,12 +5,9 @@ PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
-PY_SOURCES = authentik tests scripts lifecycle .github
+PY_SOURCES = authentik tests scripts lifecycle
 DOCKER_IMAGE ?= "authentik:test"
 
-GEN_API_TS = "gen-ts-api"
-GEN_API_GO = "gen-go-api"
-
 pg_user := $(shell python -m authentik.lib.config postgresql.user 2>/dev/null)
 pg_host := $(shell python -m authentik.lib.config postgresql.host 2>/dev/null)
 pg_name := $(shell python -m authentik.lib.config postgresql.name 2>/dev/null)
@@ -59,12 +56,15 @@ test: ## Run the server tests and produce a coverage report (locally)
 	coverage report
 
 lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
+	isort $(PY_SOURCES)
 	black $(PY_SOURCES)
-	ruff check --fix $(PY_SOURCES)
+	ruff --fix $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
 lint: ## Lint the python and golang sources
 	bandit -r $(PY_SOURCES) -x node_modules
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
 core-install:
@@ -76,15 +76,7 @@ migrate: ## Run the Authentik Django server's migrations
 i18n-extract: core-i18n-extract web-i18n-extract  ## Extract strings that require translation into files to send to a translation service
 
 core-i18n-extract:
-	ak makemessages \
-		--add-location file \
-		--no-obsolete \
-		--ignore web \
-		--ignore internal \
-		--ignore ${GEN_API_TS} \
-		--ignore ${GEN_API_GO} \
-		--ignore website \
-		-l en
+	ak makemessages --ignore web --ignore internal --ignore web --ignore web-api --ignore website -l en
 
 install: web-install website-install core-install  ## Install all requires dependencies for `web`, `website` and `core`
 
@@ -122,7 +114,7 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	docker run \
 		--rm -v ${PWD}:/local \
 		--user ${UID}:${GID} \
-		docker.io/openapitools/openapi-diff:2.1.0-beta.8 \
+		docker.io/openapitools/openapi-diff:2.1.0-beta.6 \
 		--markdown /local/diff.md \
 		/local/old_schema.yml /local/schema.yml
 	rm old_schema.yml
@@ -131,11 +123,11 @@ gen-diff:  ## (Release) generate the changelog diff between the current schema a
 	npx prettier --write diff.md
 
 gen-clean-ts:  ## Remove generated API client for Typescript
-	rm -rf ./${GEN_API_TS}/
-	rm -rf ./web/node_modules/@goauthentik/api/
+	rm -rf gen-ts-api/
+	rm -rf web/node_modules/@goauthentik/api/
 
 gen-clean-go:  ## Remove generated API client for Go
-	rm -rf ./${GEN_API_GO}/
+	rm -rf gen-go-api/
 
 gen-clean: gen-clean-ts gen-clean-go  ## Remove generated API clients
 
@@ -146,31 +138,31 @@ gen-client-ts: gen-clean-ts  ## Build and install the authentik API for Typescri
 		docker.io/openapitools/openapi-generator-cli:v6.5.0 generate \
 		-i /local/schema.yml \
 		-g typescript-fetch \
-		-o /local/${GEN_API_TS} \
+		-o /local/gen-ts-api \
 		-c /local/scripts/api-ts-config.yaml \
 		--additional-properties=npmVersion=${NPM_VERSION} \
 		--git-repo-id authentik \
 		--git-user-id goauthentik
 	mkdir -p web/node_modules/@goauthentik/api
-	cd ./${GEN_API_TS} && npm i
-	\cp -rf ./${GEN_API_TS}/* web/node_modules/@goauthentik/api
+	cd gen-ts-api && npm i
+	\cp -rfv gen-ts-api/* web/node_modules/@goauthentik/api
 
 gen-client-go: gen-clean-go  ## Build and install the authentik API for Golang
-	mkdir -p ./${GEN_API_GO} ./${GEN_API_GO}/templates
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./${GEN_API_GO}/config.yaml
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O ./${GEN_API_GO}/templates/README.mustache
-	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/go.mod.mustache -O ./${GEN_API_GO}/templates/go.mod.mustache
-	cp schema.yml ./${GEN_API_GO}/
+	mkdir -p ./gen-go-api ./gen-go-api/templates
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/config.yaml -O ./gen-go-api/config.yaml
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/README.mustache -O ./gen-go-api/templates/README.mustache
+	wget https://raw.githubusercontent.com/goauthentik/client-go/main/templates/go.mod.mustache -O ./gen-go-api/templates/go.mod.mustache
+	cp schema.yml ./gen-go-api/
 	docker run \
-		--rm -v ${PWD}/${GEN_API_GO}:/local \
+		--rm -v ${PWD}/gen-go-api:/local \
 		--user ${UID}:${GID} \
 		docker.io/openapitools/openapi-generator-cli:v6.5.0 generate \
 		-i /local/schema.yml \
 		-g go \
 		-o /local/ \
 		-c /local/config.yaml
-	go mod edit -replace goauthentik.io/api/v3=./${GEN_API_GO}
-	rm -rf ./${GEN_API_GO}/config.yaml ./${GEN_API_GO}/templates/
+	go mod edit -replace goauthentik.io/api/v3=./gen-go-api
+	rm -rf ./gen-go-api/config.yaml ./gen-go-api/templates/
 
 gen-dev-config:  ## Generate a local development config file
 	python -m scripts.generate_config
@@ -184,7 +176,7 @@ gen: gen-build gen-client-ts
 web-build: web-install  ## Build the Authentik UI
 	cd web && npm run build
 
-web: web-lint-fix web-lint web-check-compile  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it
+web: web-lint-fix web-lint web-check-compile web-i18n-extract  ## Automatically fix formatting issues in the Authentik UI source code, lint the code, and compile it
 
 web-install:  ## Install the necessary libraries to build the Authentik UI
 	cd web && npm ci
@@ -246,6 +238,9 @@ ci--meta-debug:
 	python -V
 	node --version
 
+ci-pylint: ci--meta-debug
+	pylint $(PY_SOURCES)
+
 ci-black: ci--meta-debug
 	black --check $(PY_SOURCES)
 
@@ -255,8 +250,14 @@ ci-ruff: ci--meta-debug
 ci-codespell: ci--meta-debug
 	codespell $(CODESPELL_ARGS) -s
 
+ci-isort: ci--meta-debug
+	isort --check $(PY_SOURCES)
+
 ci-bandit: ci--meta-debug
 	bandit -r $(PY_SOURCES)
 
+ci-pyright: ci--meta-debug
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

authentik/__init__.py

@@ -1,12 +1,13 @@
 """authentik root module"""
 
 from os import environ
+from typing import Optional
 
-__version__ = "2024.2.2"
+__version__ = "2023.10.7"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 
-def get_build_hash(fallback: str | None = None) -> str:
+def get_build_hash(fallback: Optional[str] = None) -> str:
     """Get build hash"""
     build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
     return fallback if build_hash == "" and fallback else build_hash

authentik/admin/apps.py

@@ -15,3 +15,7 @@ class AuthentikAdminConfig(ManagedAppConfig):
     label = "authentik_admin"
     verbose_name = "authentik Admin"
     default = True
+
+    def reconcile_global_load_admin_signals(self):
+        """Load admin signals"""
+        self.import_module("authentik.admin.signals")

authentik/api/apps.py

@@ -18,7 +18,7 @@ class AuthentikAPIConfig(AppConfig):
 
         # Class is defined here as it needs to be created early enough that drf-spectacular will
         # find it, but also won't cause any import issues
-
+        # pylint: disable=unused-variable
         class TokenSchema(OpenApiAuthenticationExtension):
             """Auth schema"""
 

authentik/api/authentication.py

@@ -1,7 +1,7 @@
 """API Authentication"""
 
 from hmac import compare_digest
-from typing import Any
+from typing import Any, Optional
 
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
@@ -17,7 +17,7 @@ from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> str | None:
+def validate_auth(header: bytes) -> Optional[str]:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -32,7 +32,7 @@ def validate_auth(header: bytes) -> str | None:
     return auth_credentials
 
 
-def bearer_auth(raw_header: bytes) -> User | None:
+def bearer_auth(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     user = auth_user_lookup(raw_header)
     if not user:
@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> User | None:
     return user
 
 
-def auth_user_lookup(raw_header: bytes) -> User | None:
+def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     from authentik.providers.oauth2.models import AccessToken
 
@@ -75,7 +75,7 @@ def auth_user_lookup(raw_header: bytes) -> User | None:
     raise AuthenticationFailed("Token invalid/expired")
 
 
-def token_secret_key(value: str) -> User | None:
+def token_secret_key(value: str) -> Optional[User]:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST

authentik/api/decorators.py

@@ -1,7 +1,7 @@
 """API Decorators"""
 
-from collections.abc import Callable
 from functools import wraps
+from typing import Callable, Optional
 
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -11,26 +11,21 @@ from structlog.stdlib import get_logger
 LOGGER = get_logger()
 
 
-def permission_required(obj_perm: str | None = None, global_perms: list[str] | None = None):
+def permission_required(obj_perm: Optional[str] = None, global_perms: Optional[list[str]] = None):
     """Check permissions for a single custom action"""
 
-    def _check_obj_perm(self: ModelViewSet, request: Request):
-        # Check obj_perm both globally and on the specific object
-        # Having the global permission has higher priority
-        if request.user.has_perm(obj_perm):
-            return
-        obj = self.get_object()
-        if not request.user.has_perm(obj_perm, obj):
-            LOGGER.debug("denying access for object", user=request.user, perm=obj_perm, obj=obj)
-            self.permission_denied(request)
-
-    def wrapper_outer(func: Callable):
+    def wrapper_outter(func: Callable):
         """Check permissions for a single custom action"""
 
         @wraps(func)
         def wrapper(self: ModelViewSet, request: Request, *args, **kwargs) -> Response:
             if obj_perm:
-                _check_obj_perm(self, request)
+                obj = self.get_object()
+                if not request.user.has_perm(obj_perm, obj):
+                    LOGGER.debug(
+                        "denying access for object", user=request.user, perm=obj_perm, obj=obj
+                    )
+                    return self.permission_denied(request)
             if global_perms:
                 for other_perm in global_perms:
                     if not request.user.has_perm(other_perm):
@@ -40,4 +35,4 @@ def permission_required(obj_perm: str | None = None, global_perms: list[str] | N
 
         return wrapper
 
-    return wrapper_outer
+    return wrapper_outter

authentik/api/tests/test_auth.py

@@ -25,17 +25,17 @@ class TestAPIAuth(TestCase):
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth(b"foo bar")
+            bearer_auth("foo bar".encode())
 
     def test_invalid_empty(self):
         """Test invalid type"""
-        self.assertIsNone(bearer_auth(b"Bearer "))
-        self.assertIsNone(bearer_auth(b""))
+        self.assertIsNone(bearer_auth("Bearer ".encode()))
+        self.assertIsNone(bearer_auth("".encode()))
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
-            auth = b64encode(b":abc").decode()
+            auth = b64encode(":abc".encode()).decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
     def test_bearer_valid(self):

authentik/api/tests/test_decorators.py

@@ -0,0 +1,35 @@
+"""test decorators api"""
+
+from django.urls import reverse
+from guardian.shortcuts import assign_perm
+from rest_framework.test import APITestCase
+
+from authentik.core.models import Application, User
+from authentik.lib.generators import generate_id
+
+
+class TestAPIDecorators(APITestCase):
+    """test decorators api"""
+
+    def setUp(self) -> None:
+        super().setUp()
+        self.user = User.objects.create(username="test-user")
+
+    def test_obj_perm_denied(self):
+        """Test object perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name=generate_id(), slug=generate_id())
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)
+
+    def test_other_perm_denied(self):
+        """Test other perm denied"""
+        self.client.force_login(self.user)
+        app = Application.objects.create(name=generate_id(), slug=generate_id())
+        assign_perm("authentik_core.view_application", self.user, app)
+        response = self.client.get(
+            reverse("authentik_api:application-metrics", kwargs={"slug": app.slug})
+        )
+        self.assertEqual(response.status_code, 403)

authentik/api/tests/test_viewsets.py

@@ -1,6 +1,6 @@
 """authentik API Modelviewset tests"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.test import TestCase
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -26,6 +26,6 @@ def viewset_tester_factory(test_viewset: type[ModelViewSet]) -> Callable:
 
 
 for _, viewset, _ in router.registry:
-    if not issubclass(viewset, ModelViewSet | ReadOnlyModelViewSet):
+    if not issubclass(viewset, (ModelViewSet, ReadOnlyModelViewSet)):
         continue
     setattr(TestModelViewSets, f"test_viewset_{viewset.__name__}", viewset_tester_factory(viewset))

authentik/api/v3/config.py

@@ -68,11 +68,7 @@ class ConfigView(APIView):
         """Get all capabilities this server instance supports"""
         caps = []
         deb_test = settings.DEBUG or settings.TEST
-        if (
-            CONFIG.get("storage.media.backend", "file") == "s3"
-            or Path(settings.STORAGES["default"]["OPTIONS"]["location"]).is_mount()
-            or deb_test
-        ):
+        if Path(settings.MEDIA_ROOT).is_mount() or deb_test:
             caps.append(Capabilities.CAN_SAVE_MEDIA)
         for processor in get_context_processors():
             if cap := processor.capability():

authentik/api/v3/urls.py

@@ -33,7 +33,7 @@ for _authentik_app in get_apps():
             app_name=_authentik_app.name,
         )
         continue
-    urls: list = api_urls.api_urlpatterns
+    urls: list = getattr(api_urls, "api_urlpatterns")
     for url in urls:
         if isinstance(url, URLPattern):
             _other_urls.append(url)

authentik/blueprints/api.py

@@ -10,13 +10,13 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.blueprints.models import BlueprintInstance
 from authentik.blueprints.v1.importer import Importer
 from authentik.blueprints.v1.oci import OCI_PREFIX
 from authentik.blueprints.v1.tasks import apply_blueprint, blueprints_find_dict
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class ManagedSerializer:
@@ -52,9 +52,7 @@ class BlueprintInstanceSerializer(ModelSerializer):
         valid, logs = Importer.from_string(content, context).validate()
         if not valid:
             text_logs = "\n".join([x["event"] for x in logs])
-            raise ValidationError(
-                _("Failed to validate blueprint: {logs}".format_map({"logs": text_logs}))
-            )
+            raise ValidationError(_("Failed to validate blueprint: %(logs)s" % {"logs": text_logs}))
         return content
 
     def validate(self, attrs: dict) -> dict:

authentik/blueprints/apps.py

@@ -1,6 +1,5 @@
 """authentik Blueprints app"""
 
-from collections.abc import Callable
 from importlib import import_module
 from inspect import ismethod
 
@@ -14,35 +13,18 @@ class ManagedAppConfig(AppConfig):
 
     logger: BoundLogger
 
-    RECONCILE_GLOBAL_CATEGORY: str = "global"
-    RECONCILE_TENANT_CATEGORY: str = "tenant"
+    RECONCILE_GLOBAL_PREFIX: str = "reconcile_global_"
+    RECONCILE_TENANT_PREFIX: str = "reconcile_tenant_"
 
     def __init__(self, app_name: str, *args, **kwargs) -> None:
         super().__init__(app_name, *args, **kwargs)
         self.logger = get_logger().bind(app_name=app_name)
 
     def ready(self) -> None:
-        self.import_related()
-        self._reconcile_global()
-        self._reconcile_tenant()
+        self.reconcile_global()
+        self.reconcile_tenant()
         return super().ready()
 
-    def import_related(self):
-        """Automatically import related modules which rely on just being imported
-        to register themselves (mainly django signals and celery tasks)"""
-
-        def import_relative(rel_module: str):
-            try:
-                module_name = f"{self.name}.{rel_module}"
-                import_module(module_name)
-                self.logger.info("Imported related module", module=module_name)
-            except ModuleNotFoundError:
-                pass
-
-        import_relative("checks")
-        import_relative("tasks")
-        import_relative("signals")
-
     def import_module(self, path: str):
         """Load module"""
         import_module(path)
@@ -52,8 +34,7 @@ class ManagedAppConfig(AppConfig):
             meth = getattr(self, meth_name)
             if not ismethod(meth):
                 continue
-            category = getattr(meth, "_authentik_managed_reconcile", None)
-            if category != prefix:
+            if not meth_name.startswith(prefix):
                 continue
             name = meth_name.replace(prefix, "")
             try:
@@ -63,19 +44,7 @@ class ManagedAppConfig(AppConfig):
             except (DatabaseError, ProgrammingError, InternalError) as exc:
                 self.logger.warning("Failed to run reconcile", name=name, exc=exc)
 
-    @staticmethod
-    def reconcile_tenant(func: Callable):
-        """Mark a function to be called on startup (for each tenant)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_TENANT_CATEGORY
-        return func
-
-    @staticmethod
-    def reconcile_global(func: Callable):
-        """Mark a function to be called on startup (globally)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_GLOBAL_CATEGORY
-        return func
-
-    def _reconcile_tenant(self) -> None:
+    def reconcile_tenant(self) -> None:
         """reconcile ourselves for tenanted methods"""
         from authentik.tenants.models import Tenant
 
@@ -86,9 +55,9 @@ class ManagedAppConfig(AppConfig):
             return
         for tenant in tenants:
             with tenant:
-                self._reconcile(self.RECONCILE_TENANT_CATEGORY)
+                self._reconcile(self.RECONCILE_TENANT_PREFIX)
 
-    def _reconcile_global(self) -> None:
+    def reconcile_global(self) -> None:
         """
         reconcile ourselves for global methods.
         Used for signals, tasks, etc. Database queries should not be made in here.
@@ -96,7 +65,7 @@ class ManagedAppConfig(AppConfig):
         from django_tenants.utils import get_public_schema_name, schema_context
 
         with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
+            self._reconcile(self.RECONCILE_GLOBAL_PREFIX)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -107,13 +76,11 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def load_blueprints_v1_tasks(self):
+    def reconcile_global_load_blueprints_v1_tasks(self):
         """Load v1 tasks"""
         self.import_module("authentik.blueprints.v1.tasks")
 
-    @ManagedAppConfig.reconcile_tenant
-    def blueprints_discovery(self):
+    def reconcile_tenant_blueprints_discovery(self):
         """Run blueprint discovery"""
         from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
 

authentik/blueprints/models.py

@@ -71,19 +71,6 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
-    class Meta:
-        verbose_name = _("Blueprint Instance")
-        verbose_name_plural = _("Blueprint Instances")
-        unique_together = (
-            (
-                "name",
-                "path",
-            ),
-        )
-
-    def __str__(self) -> str:
-        return f"Blueprint Instance {self.name}"
-
     def retrieve_oci(self) -> str:
         """Get blueprint from an OCI registry"""
         client = BlueprintOCIClient(self.path.replace(OCI_PREFIX, "https://"))
@@ -102,7 +89,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")
             with full_path.open("r", encoding="utf-8") as _file:
                 return _file.read()
-        except OSError as exc:
+        except (IOError, OSError) as exc:
             raise BlueprintRetrievalFailed(exc) from exc
 
     def retrieve(self) -> str:
@@ -118,3 +105,16 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
         from authentik.blueprints.api import BlueprintInstanceSerializer
 
         return BlueprintInstanceSerializer
+
+    def __str__(self) -> str:
+        return f"Blueprint Instance {self.name}"
+
+    class Meta:
+        verbose_name = _("Blueprint Instance")
+        verbose_name_plural = _("Blueprint Instances")
+        unique_together = (
+            (
+                "name",
+                "path",
+            ),
+        )

authentik/blueprints/tests/__init__.py

@@ -1,7 +1,7 @@
 """Blueprint helpers"""
 
-from collections.abc import Callable
 from functools import wraps
+from typing import Callable
 
 from django.apps import apps
 

authentik/blueprints/tests/test_packaged.py

@@ -1,7 +1,7 @@
 """test packaged blueprints"""
 
-from collections.abc import Callable
 from pathlib import Path
+from typing import Callable
 
 from django.test import TransactionTestCase
 

authentik/blueprints/tests/test_serializer_models.py

@@ -1,6 +1,6 @@
 """authentik managed models tests"""
 
-from collections.abc import Callable
+from typing import Callable, Type
 
 from django.apps import apps
 from django.test import TestCase
@@ -14,7 +14,7 @@ class TestModels(TestCase):
     """Test Models"""
 
 
-def serializer_tester_factory(test_model: type[SerializerModel]) -> Callable:
+def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
     """Test serializer"""
 
     def tester(self: TestModels):

authentik/blueprints/tests/test_v1_tasks.py

@@ -54,7 +54,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
             file.seek(0)
             file_hash = sha512(file.read().encode()).hexdigest()
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
             self.assertEqual(instance.last_applied_hash, file_hash)
             self.assertEqual(
@@ -82,7 +82,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint = BlueprintInstance.objects.filter(name="foo").first()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -107,7 +107,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint.refresh_from_db()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -149,7 +149,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 instance.status,
                 BlueprintInstanceStatus.UNKNOWN,
             )
-            apply_blueprint(instance.pk)
+            apply_blueprint(instance.pk)  # pylint: disable=no-value-for-parameter
             instance.refresh_from_db()
             self.assertEqual(instance.last_applied_hash, "")
             self.assertEqual(

authentik/blueprints/v1/common.py

@@ -1,14 +1,13 @@
 """transfer common classes"""
 
 from collections import OrderedDict
-from collections.abc import Iterable, Mapping
 from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
 from functools import reduce
 from operator import ixor
 from os import getenv
-from typing import Any, Literal, Union
+from typing import Any, Iterable, Literal, Mapping, Optional, Union
 from uuid import UUID
 
 from deepmerge import always_merger
@@ -46,7 +45,7 @@ def get_attrs(obj: SerializerModel) -> dict[str, Any]:
 class BlueprintEntryState:
     """State of a single instance"""
 
-    instance: Model | None = None
+    instance: Optional[Model] = None
 
 
 class BlueprintEntryDesiredState(Enum):
@@ -68,9 +67,9 @@ class BlueprintEntry:
     )
     conditions: list[Any] = field(default_factory=list)
     identifiers: dict[str, Any] = field(default_factory=dict)
-    attrs: dict[str, Any] | None = field(default_factory=dict)
+    attrs: Optional[dict[str, Any]] = field(default_factory=dict)
 
-    id: str | None = None
+    id: Optional[str] = None
 
     _state: BlueprintEntryState = field(default_factory=BlueprintEntryState)
 
@@ -93,10 +92,10 @@ class BlueprintEntry:
             attrs=all_attrs,
         )
 
-    def get_tag_context(
+    def _get_tag_context(
         self,
         depth: int = 0,
-        context_tag_type: type["YAMLTagContext"] | tuple["YAMLTagContext", ...] | None = None,
+        context_tag_type: Optional[type["YAMLTagContext"] | tuple["YAMLTagContext", ...]] = None,
     ) -> "YAMLTagContext":
         """Get a YAMLTagContext object located at a certain depth in the tag tree"""
         if depth < 0:
@@ -109,8 +108,8 @@ class BlueprintEntry:
 
         try:
             return contexts[-(depth + 1)]
-        except IndexError as exc:
-            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}") from exc
+        except IndexError:
+            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}")
 
     def tag_resolver(self, value: Any, blueprint: "Blueprint") -> Any:
         """Check if we have any special tags that need handling"""
@@ -171,7 +170,7 @@ class Blueprint:
     entries: list[BlueprintEntry] = field(default_factory=list)
     context: dict = field(default_factory=dict)
 
-    metadata: BlueprintMetadata | None = field(default=None)
+    metadata: Optional[BlueprintMetadata] = field(default=None)
 
 
 class YAMLTag:
@@ -219,7 +218,7 @@ class Env(YAMLTag):
     """Lookup environment variable with optional default"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -238,7 +237,7 @@ class Context(YAMLTag):
     """Lookup key from instance context"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -282,7 +281,7 @@ class Format(YAMLTag):
         try:
             return self.format_string % tuple(args)
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Find(YAMLTag):
@@ -367,7 +366,7 @@ class Condition(YAMLTag):
             comparator = self._COMPARATORS[self.mode.upper()]
             return comparator(tuple(bool(x) for x in args))
         except (TypeError, KeyError) as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class If(YAMLTag):
@@ -399,7 +398,7 @@ class If(YAMLTag):
                 blueprint,
             )
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Enumerate(YAMLTag, YAMLTagContext):
@@ -413,7 +412,9 @@ class Enumerate(YAMLTag, YAMLTagContext):
         "SEQ": (list, lambda a, b: [*a, b]),
         "MAP": (
             dict,
-            lambda a, b: always_merger.merge(a, {b[0]: b[1]} if isinstance(b, tuple | list) else b),
+            lambda a, b: always_merger.merge(
+                a, {b[0]: b[1]} if isinstance(b, (tuple, list)) else b
+            ),
         ),
     }
 
@@ -455,7 +456,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         try:
             output_class, add_fn = self._OUTPUT_BODIES[self.output_body.upper()]
         except KeyError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
         result = output_class()
 
@@ -483,13 +484,13 @@ class EnumeratedItem(YAMLTag):
 
     _SUPPORTED_CONTEXT_TAGS = (Enumerate,)
 
-    def __init__(self, _loader: "BlueprintLoader", node: ScalarNode) -> None:
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
         super().__init__()
         self.depth = int(node.value)
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         try:
-            context_tag: Enumerate = entry.get_tag_context(
+            context_tag: Enumerate = entry._get_tag_context(
                 depth=self.depth,
                 context_tag_type=EnumeratedItem._SUPPORTED_CONTEXT_TAGS,
             )
@@ -499,11 +500,9 @@ class EnumeratedItem(YAMLTag):
                     f"{self.__class__.__name__} tags are only usable "
                     f"inside an {Enumerate.__name__} tag",
                     entry,
-                ) from exc
+                )
 
-            raise EntryInvalidError.from_entry(
-                f"{self.__class__.__name__} tag: {exc}", entry
-            ) from exc
+            raise EntryInvalidError.from_entry(f"{self.__class__.__name__} tag: {exc}", entry)
 
         return context_tag.get_context(entry, blueprint)
 
@@ -516,8 +515,8 @@ class Index(EnumeratedItem):
 
         try:
             return context[0]
-        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+        except IndexError:  # pragma: no cover
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class Value(EnumeratedItem):
@@ -528,8 +527,8 @@ class Value(EnumeratedItem):
 
         try:
             return context[1]
-        except IndexError as exc:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+        except IndexError:  # pragma: no cover
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class BlueprintDumper(SafeDumper):
@@ -583,13 +582,13 @@ class BlueprintLoader(SafeLoader):
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
 
-    entry_model: str | None
-    entry_id: str | None
-    validation_error: ValidationError | None
-    serializer: Serializer | None = None
+    entry_model: Optional[str]
+    entry_id: Optional[str]
+    validation_error: Optional[ValidationError]
+    serializer: Optional[Serializer] = None
 
     def __init__(
-        self, *args: object, validation_error: ValidationError | None = None, **kwargs
+        self, *args: object, validation_error: Optional[ValidationError] = None, **kwargs
     ) -> None:
         super().__init__(*args)
         self.entry_model = None

authentik/blueprints/v1/exporter.py

@@ -1,6 +1,6 @@
 """Blueprint exporter"""
 
-from collections.abc import Iterable
+from typing import Iterable
 from uuid import UUID
 
 from django.apps import apps
@@ -59,7 +59,7 @@ class Exporter:
         blueprint = Blueprint()
         self._pre_export(blueprint)
         blueprint.metadata = BlueprintMetadata(
-            name=_("authentik Export - {date}".format_map({"date": str(now())})),
+            name=_("authentik Export - %(date)s" % {"date": str(now())}),
             labels={
                 LABEL_AUTHENTIK_GENERATED: "true",
             },
@@ -74,7 +74,7 @@ class Exporter:
 
 
 class FlowExporter(Exporter):
-    """Exporter customized to only return objects related to `flow`"""
+    """Exporter customised to only return objects related to `flow`"""
 
     flow: Flow
     with_policies: bool

authentik/blueprints/v1/importer.py

@@ -2,7 +2,7 @@
 
 from contextlib import contextmanager
 from copy import deepcopy
-from typing import Any
+from typing import Any, Optional
 
 from dacite.config import Config
 from dacite.core import from_dict
@@ -39,8 +39,7 @@ from authentik.core.models import (
     Source,
     UserSourceConnection,
 )
-from authentik.enterprise.license import LicenseKey
-from authentik.enterprise.models import LicenseUsage
+from authentik.enterprise.models import LicenseKey, LicenseUsage
 from authentik.enterprise.providers.rac.models import ConnectionToken
 from authentik.events.models import SystemTask
 from authentik.events.utils import cleanse_dict
@@ -62,7 +61,7 @@ SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry"
 def excluded_models() -> list[type[Model]]:
     """Return a list of all excluded models that shouldn't be exposed via API
     or other means (internal only, base classes, non-used objects, etc)"""
-
+    # pylint: disable=imported-auth-user
     from django.contrib.auth.models import Group as DjangoGroup
     from django.contrib.auth.models import User as DjangoUser
 
@@ -101,7 +100,7 @@ def excluded_models() -> list[type[Model]]:
 
 def is_model_allowed(model: type[Model]) -> bool:
     """Check if model is allowed"""
-    return model not in excluded_models() and issubclass(model, SerializerModel | BaseMetaModel)
+    return model not in excluded_models() and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 class DoRollback(SentryIgnoredException):
@@ -125,7 +124,7 @@ class Importer:
     logger: BoundLogger
     _import: Blueprint
 
-    def __init__(self, blueprint: Blueprint, context: dict | None = None):
+    def __init__(self, blueprint: Blueprint, context: Optional[dict] = None):
         self.__pk_map: dict[Any, Model] = {}
         self._import = blueprint
         self.logger = get_logger()
@@ -168,7 +167,7 @@ class Importer:
         for key, value in attrs.items():
             try:
                 if isinstance(value, dict):
-                    for _, _inner_key in enumerate(value):
+                    for idx, _inner_key in enumerate(value):
                         value[_inner_key] = updater(value[_inner_key])
                 elif isinstance(value, list):
                     for idx, _inner_value in enumerate(value):
@@ -197,7 +196,8 @@ class Importer:
 
         return main_query | sub_query
 
-    def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer | None:
+    # pylint: disable-msg=too-many-locals
+    def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
         """Validate a single entry"""
         if not entry.check_all_conditions_match(self._import):
             self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
@@ -368,7 +368,7 @@ class Importer:
                     self.__pk_map[entry.identifiers["pk"]] = instance.pk
                 entry._state = BlueprintEntryState(instance)
             elif state == BlueprintEntryDesiredState.ABSENT:
-                instance: Model | None = serializer.instance
+                instance: Optional[Model] = serializer.instance
                 if instance.pk:
                     instance.delete()
                     self.logger.debug("deleted model", mode=instance)

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -43,7 +43,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
             LOGGER.info("Blueprint does not exist, but not required")
             return MetaResult()
         LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
-
+        # pylint: disable=no-value-for-parameter
         apply_blueprint(str(self.blueprint_instance.pk))
         return MetaResult()
 

authentik/blueprints/v1/meta/registry.py

@@ -8,15 +8,15 @@ from rest_framework.serializers import Serializer
 class BaseMetaModel(Model):
     """Base models"""
 
-    class Meta:
-        abstract = True
-
     @staticmethod
     def serializer() -> Serializer:
         """Serializer similar to SerializerModel, but as a static method since
         this is an abstract model"""
         raise NotImplementedError
 
+    class Meta:
+        abstract = True
+
 
 class MetaResult:
     """Result returned by Meta Models' serializers. Empty class but we can't return none as

authentik/blueprints/v1/tasks.py

@@ -3,7 +3,7 @@
 from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
-from sys import platform
+from typing import Optional
 
 from dacite.core import from_dict
 from django.db import DatabaseError, InternalError, ProgrammingError
@@ -49,23 +49,18 @@ class BlueprintFile:
     version: int
     hash: str
     last_m: int
-    meta: BlueprintMetadata | None = field(default=None)
+    meta: Optional[BlueprintMetadata] = field(default=None)
 
 
 def start_blueprint_watcher():
     """Start blueprint watcher, if it's not running already."""
     # This function might be called twice since it's called on celery startup
-
-    global _file_watcher_started  # noqa: PLW0603
+    # pylint: disable=global-statement
+    global _file_watcher_started
     if _file_watcher_started:
         return
     observer = Observer()
-    kwargs = {}
-    if platform.startswith("linux"):
-        kwargs["event_filter"] = (FileCreatedEvent, FileModifiedEvent)
-    observer.schedule(
-        BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True, **kwargs
-    )
+    observer.schedule(BlueprintEventHandler(), CONFIG.get("blueprints_dir"), recursive=True)
     observer.start()
     _file_watcher_started = True
 
@@ -73,36 +68,26 @@ def start_blueprint_watcher():
 class BlueprintEventHandler(FileSystemEventHandler):
     """Event handler for blueprint events"""
 
-    # We only ever get creation and modification events.
-    # See the creation of the Observer instance above for the event filtering.
-
-    # Even though we filter to only get file events, we might still get
-    # directory events as some implementations such as inotify do not support
-    # filtering on file/directory.
-
-    def dispatch(self, event: FileSystemEvent) -> None:
-        """Call specific event handler method. Ignores directory changes."""
+    def on_any_event(self, event: FileSystemEvent):
+        if not isinstance(event, (FileCreatedEvent, FileModifiedEvent)):
+            return
         if event.is_directory:
-            return None
-        return super().dispatch(event)
-
-    def on_created(self, event: FileSystemEvent):
-        """Process file creation"""
-        LOGGER.debug("new blueprint file created, starting discovery")
-        for tenant in Tenant.objects.filter(ready=True):
-            with tenant:
-                blueprints_discovery.delay()
-
-    def on_modified(self, event: FileSystemEvent):
-        """Process file modification"""
-        path = Path(event.src_path)
+            return
         root = Path(CONFIG.get("blueprints_dir")).absolute()
+        path = Path(event.src_path).absolute()
         rel_path = str(path.relative_to(root))
         for tenant in Tenant.objects.filter(ready=True):
             with tenant:
-                for instance in BlueprintInstance.objects.filter(path=rel_path, enabled=True):
-                    LOGGER.debug("modified blueprint file, starting apply", instance=instance)
-                    apply_blueprint.delay(instance.pk.hex)
+                root = Path(CONFIG.get("blueprints_dir")).absolute()
+                path = Path(event.src_path).absolute()
+                rel_path = str(path.relative_to(root))
+                if isinstance(event, FileCreatedEvent):
+                    LOGGER.debug("new blueprint file created, starting discovery", path=rel_path)
+                    blueprints_discovery.delay(rel_path)
+                if isinstance(event, FileModifiedEvent):
+                    for instance in BlueprintInstance.objects.filter(path=rel_path, enabled=True):
+                        LOGGER.debug("modified blueprint file, starting apply", instance=instance)
+                        apply_blueprint.delay(instance.pk.hex)
 
 
 @CELERY_APP.task(
@@ -125,7 +110,7 @@ def blueprints_find() -> list[BlueprintFile]:
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
             continue
-        with open(path, encoding="utf-8") as blueprint_file:
+        with open(path, "r", encoding="utf-8") as blueprint_file:
             try:
                 raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
             except YAMLError as exc:
@@ -149,7 +134,7 @@ def blueprints_find() -> list[BlueprintFile]:
     throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: SystemTask, path: str | None = None):
+def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
@@ -196,7 +181,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 def apply_blueprint(self: SystemTask, instance_pk: str):
     """Apply single blueprint"""
     self.save_on_success = False
-    instance: BlueprintInstance | None = None
+    instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
         if not instance or not instance.enabled:
@@ -224,10 +209,10 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         instance.last_applied = now()
         self.set_status(TaskStatus.SUCCESSFUL)
     except (
-        OSError,
         DatabaseError,
         ProgrammingError,
         InternalError,
+        IOError,
         BlueprintRetrievalFailed,
         EntryInvalidError,
     ) as exc:

authentik/brands/middleware.py

@@ -1,6 +1,6 @@
 """Inject brand into current request"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
@@ -20,7 +20,7 @@ class BrandMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "brand"):
             brand = get_brand_for_request(request)
-            request.brand = brand
+            setattr(request, "brand", brand)
             locale = brand.default_locale
             if locale != "":
                 activate(locale)

authentik/brands/models.py

@@ -71,7 +71,7 @@ class Brand(SerializerModel):
         """Get default locale"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
             return ""

authentik/brands/utils.py

@@ -9,7 +9,6 @@ from sentry_sdk.hub import Hub
 
 from authentik import get_full_version
 from authentik.brands.models import Brand
-from authentik.tenants.models import Tenant
 
 _q_default = Q(default=True)
 DEFAULT_BRAND = Brand(domain="fallback")
@@ -31,14 +30,13 @@ def get_brand_for_request(request: HttpRequest) -> Brand:
 def context_processor(request: HttpRequest) -> dict[str, Any]:
     """Context Processor that injects brand object into every template"""
     brand = getattr(request, "brand", DEFAULT_BRAND)
-    tenant = getattr(request, "tenant", Tenant())
     trace = ""
     span = Hub.current.scope.span
     if span:
         trace = span.to_traceparent()
     return {
         "brand": brand,
-        "footer_links": tenant.footer_links,
+        "footer_links": request.tenant.footer_links,
         "sentry_trace": trace,
         "version": get_full_version(),
     }

authentik/core/api/applications.py

@@ -1,8 +1,8 @@
 """Application API Views"""
 
-from collections.abc import Iterator
 from copy import copy
 from datetime import timedelta
+from typing import Optional
 
 from django.core.cache import cache
 from django.db.models import QuerySet
@@ -23,6 +23,7 @@ from structlog.stdlib import get_logger
 from structlog.testing import capture_logs
 
 from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.providers import ProviderSerializer
 from authentik.core.api.used_by import UsedByMixin
@@ -38,7 +39,6 @@ from authentik.lib.utils.file import (
 from authentik.policies.api.exec import PolicyTestResultSerializer
 from authentik.policies.engine import PolicyEngine
 from authentik.policies.types import PolicyResult
-from authentik.rbac.decorators import permission_required
 from authentik.rbac.filters import ObjectFilter
 
 LOGGER = get_logger()
@@ -60,7 +60,7 @@ class ApplicationSerializer(ModelSerializer):
 
     meta_icon = ReadOnlyField(source="get_meta_icon")
 
-    def get_launch_url(self, app: Application) -> str | None:
+    def get_launch_url(self, app: Application) -> Optional[str]:
         """Allow formatting of launch URL"""
         user = None
         if "request" in self.context:
@@ -100,6 +100,7 @@ class ApplicationSerializer(ModelSerializer):
 class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
+    # pylint: disable=no-member
     queryset = Application.objects.all().prefetch_related("provider")
     serializer_class = ApplicationSerializer
     search_fields = [
@@ -130,14 +131,14 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         return queryset
 
     def _get_allowed_applications(
-        self, pagined_apps: Iterator[Application], user: User | None = None
+        self, queryset: QuerySet, user: Optional[User] = None
     ) -> list[Application]:
         applications = []
         request = self.request._request
         if user:
             request = copy(request)
             request.user = user
-        for application in pagined_apps:
+        for application in queryset:
             engine = PolicyEngine(application, request.user, request)
             engine.build()
             if engine.passing:
@@ -168,7 +169,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             try:
                 for_user = User.objects.filter(pk=request.query_params.get("for_user")).first()
             except ValueError:
-                raise ValidationError({"for_user": "for_user must be numerical"}) from None
+                raise ValidationError({"for_user": "for_user must be numerical"})
             if not for_user:
                 raise ValidationError({"for_user": "User not found"})
         engine = PolicyEngine(application, for_user, request)
@@ -214,7 +215,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             return super().list(request)
 
         queryset = self._filter_queryset_for_list(self.get_queryset())
-        pagined_apps = self.paginate_queryset(queryset)
+        self.paginate_queryset(queryset)
 
         if "for_user" in request.query_params:
             try:
@@ -228,18 +229,18 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
                     raise ValidationError({"for_user": "User not found"})
             except ValueError as exc:
                 raise ValidationError from exc
-            allowed_applications = self._get_allowed_applications(pagined_apps, user=for_user)
+            allowed_applications = self._get_allowed_applications(queryset, user=for_user)
             serializer = self.get_serializer(allowed_applications, many=True)
             return self.get_paginated_response(serializer.data)
 
         allowed_applications = []
         if not should_cache:
-            allowed_applications = self._get_allowed_applications(pagined_apps)
+            allowed_applications = self._get_allowed_applications(queryset)
         if should_cache:
             allowed_applications = cache.get(user_app_cache_key(self.request.user.pk))
             if not allowed_applications:
                 LOGGER.debug("Caching allowed application list")
-                allowed_applications = self._get_allowed_applications(pagined_apps)
+                allowed_applications = self._get_allowed_applications(queryset)
                 cache.set(
                     user_app_cache_key(self.request.user.pk),
                     allowed_applications,

authentik/core/api/authenticated_sessions.py

@@ -1,6 +1,6 @@
 """AuthenticatedSessions API Viewset"""
 
-from typing import TypedDict
+from typing import Optional, TypedDict
 
 from django_filters.rest_framework import DjangoFilterBackend
 from guardian.utils import get_anonymous_user
@@ -72,11 +72,11 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         """Get parsed user agent"""
         return user_agent_parser.Parse(instance.last_user_agent)
 
-    def get_geo_ip(self, instance: AuthenticatedSession) -> GeoIPDict | None:  # pragma: no cover
+    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
         """Get GeoIP Data"""
         return GEOIP_CONTEXT_PROCESSOR.city_dict(instance.last_ip)
 
-    def get_asn(self, instance: AuthenticatedSession) -> ASNDict | None:  # pragma: no cover
+    def get_asn(self, instance: AuthenticatedSession) -> Optional[ASNDict]:  # pragma: no cover
         """Get ASN Data"""
         return ASN_CONTEXT_PROCESSOR.asn_dict(instance.last_ip)
 

authentik/core/api/groups.py

@@ -1,6 +1,7 @@
 """Groups API Viewset"""
 
 from json import loads
+from typing import Optional
 
 from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
@@ -14,11 +15,11 @@ from rest_framework.response import Response
 from rest_framework.serializers import ListSerializer, ModelSerializer, ValidationError
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import JSONDictField, PassiveSerializer
 from authentik.core.models import Group, User
 from authentik.rbac.api.roles import RoleSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class GroupMemberSerializer(ModelSerializer):
@@ -58,7 +59,7 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
-    def validate_parent(self, parent: Group | None):
+    def validate_parent(self, parent: Optional[Group]):
         """Validate group parent (if set), ensuring the parent isn't itself"""
         if not self.instance or not parent:
             return parent
@@ -113,7 +114,7 @@ class GroupFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -139,6 +140,7 @@ class UserAccountSerializer(PassiveSerializer):
 class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
+    # pylint: disable=no-member
     queryset = Group.objects.all().select_related("parent").prefetch_related("users")
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]

authentik/core/api/propertymappings.py

@@ -14,6 +14,7 @@ from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer, SerializerMethodField
 from rest_framework.viewsets import GenericViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, PassiveSerializer, TypeCreateSerializer
@@ -22,7 +23,6 @@ from authentik.core.models import PropertyMapping
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.api.exec import PolicyTestSerializer
-from authentik.rbac.decorators import permission_required
 
 
 class PropertyMappingTestResultSerializer(PassiveSerializer):
@@ -118,11 +118,7 @@ class PropertyMappingViewSet(
     @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
     def test(self, request: Request, pk: str) -> Response:
         """Test Property Mapping"""
-        _mapping: PropertyMapping = self.get_object()
-        # Use `get_subclass` to get correct class and correct `.evaluate` implementation
-        mapping = PropertyMapping.objects.get_subclass(pk=_mapping.pk)
-        # FIXME: when we separate policy mappings between ones for sources
-        # and ones for providers, we need to make the user field optional for the source mapping
+        mapping: PropertyMapping = self.get_object()
         test_params = PolicyTestSerializer(data=request.data)
         if not test_params.is_valid():
             return Response(test_params.errors, status=400)
@@ -146,7 +142,7 @@ class PropertyMappingViewSet(
             response_data["result"] = dumps(
                 sanitize_item(result), indent=(4 if format_result else None)
             )
-        except Exception as exc:
+        except Exception as exc:  # pylint: disable=broad-except
             response_data["result"] = str(exc)
             response_data["successful"] = False
         response = PropertyMappingTestResultSerializer(response_data)

authentik/core/api/sources.py

@@ -1,6 +1,6 @@
 """Source API Views"""
 
-from collections.abc import Iterable
+from typing import Iterable
 
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema
@@ -16,6 +16,7 @@ from rest_framework.viewsets import GenericViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import OwnerFilter, OwnerSuperuserPermissions
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import MetaNameSerializer, TypeCreateSerializer
@@ -29,7 +30,6 @@ from authentik.lib.utils.file import (
 )
 from authentik.lib.utils.reflection import all_subclasses
 from authentik.policies.engine import PolicyEngine
-from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 

authentik/core/api/tokens.py

@@ -15,6 +15,7 @@ from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.api.authorization import OwnerSuperuserPermissions
+from authentik.api.decorators import permission_required
 from authentik.blueprints.api import ManagedSerializer
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
@@ -23,7 +24,6 @@ from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
-from authentik.rbac.decorators import permission_required
 
 
 class TokenSerializer(ManagedSerializer, ModelSerializer):

authentik/core/api/transactional_applications.py

@@ -65,7 +65,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 raise ValidationError("Invalid provider model")
             self._provider_model = model
         except LookupError:
-            raise ValidationError("Invalid provider model") from None
+            raise ValidationError("Invalid provider model")
         return fq_model_name
 
     def validate(self, attrs: dict) -> dict:
@@ -106,7 +106,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 {
                     exc.entry_id: exc.validation_error.detail,
                 }
-            ) from None
+            )
         return blueprint
 
 

authentik/core/api/used_by.py

@@ -54,6 +54,7 @@ class UsedByMixin:
         responses={200: UsedBySerializer(many=True)},
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
+    # pylint: disable=too-many-locals
     def used_by(self, request: Request, *args, **kwargs) -> Response:
         """Get a list of all objects that use this object"""
         model: Model = self.get_object()

authentik/core/api/users.py

@@ -2,7 +2,7 @@
 
 from datetime import timedelta
 from json import loads
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth import update_session_auth_hash
 from django.contrib.sessions.backends.cache import KEY_PREFIX
@@ -49,6 +49,7 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
 from authentik.admin.api.metrics import CoordinateSerializer
+from authentik.api.decorators import permission_required
 from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.brands.models import Brand
 from authentik.core.api.used_by import UsedByMixin
@@ -73,7 +74,6 @@ from authentik.flows.models import FlowToken
 from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER, FlowPlanner
 from authentik.flows.views.executor import QS_KEY_TOKEN
 from authentik.lib.avatars import get_avatar
-from authentik.rbac.decorators import permission_required
 from authentik.stages.email.models import EmailStage
 from authentik.stages.email.tasks import send_mails
 from authentik.stages.email.utils import TemplateEmailMessage
@@ -142,7 +142,7 @@ class UserSerializer(ModelSerializer):
         self._set_password(instance, password)
         return instance
 
-    def _set_password(self, instance: User, password: str | None):
+    def _set_password(self, instance: User, password: Optional[str]):
         """Set password of user if we're in a blueprint context, and if it's an empty
         string then use an unusable password"""
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context and password:
@@ -154,7 +154,7 @@ class UserSerializer(ModelSerializer):
 
     def get_avatar(self, user: User) -> str:
         """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context.get("request"))
+        return get_avatar(user, self.context["request"])
 
     def validate_path(self, path: str) -> str:
         """Validate path"""
@@ -218,7 +218,7 @@ class UserSelfSerializer(ModelSerializer):
 
     def get_avatar(self, user: User) -> str:
         """User's avatar, either a http/https URL or a data URI"""
-        return get_avatar(user, self.context.get("request"))
+        return get_avatar(user, self.context["request"])
 
     @extend_schema_field(
         ListSerializer(
@@ -358,7 +358,7 @@ class UsersFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -397,14 +397,15 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     def get_queryset(self):  # pragma: no cover
         return User.objects.all().exclude_anonymous().prefetch_related("ak_groups")
 
-    def _create_recovery_link(self) -> tuple[str, Token]:
+    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
         """Create a recovery link (when the current brand has a recovery flow set),
         that can either be shown to an admin or sent to the user directly"""
         brand: Brand = self.request._request.brand
         # Check that there is a recovery flow, if not return an error
         flow = brand.flow_recovery
         if not flow:
-            raise ValidationError({"non_field_errors": "No recovery flow set."})
+            LOGGER.debug("No recovery flow set")
+            return None, None
         user: User = self.get_object()
         planner = FlowPlanner(flow)
         planner.allow_empty_flows = True
@@ -416,9 +417,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 },
             )
         except FlowNonApplicableException:
-            raise ValidationError(
-                {"non_field_errors": "Recovery flow not applicable to user"}
-            ) from None
+            LOGGER.warning("Recovery flow not applicable to user")
+            return None, None
         token, __ = FlowToken.objects.update_or_create(
             identifier=f"{user.uid}-password-reset",
             defaults={
@@ -533,7 +533,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             400: OpenApiResponse(description="Bad request"),
         },
     )
-    @action(detail=True, methods=["POST"], permission_classes=[])
+    @action(detail=True, methods=["POST"])
     def set_password(self, request: Request, pk: int) -> Response:
         """Set password for user"""
         user: User = self.get_object()
@@ -563,13 +563,16 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @extend_schema(
         responses={
             "200": LinkSerializer(many=False),
+            "404": LinkSerializer(many=False),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         link, _ = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response({"link": ""}, status=404)
         return Response({"link": link})
 
     @permission_required("authentik_core.reset_user_password")
@@ -584,28 +587,31 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         ],
         responses={
             "204": OpenApiResponse(description="Successfully sent recover email"),
+            "404": OpenApiResponse(description="Bad request"),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery_email(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         for_user: User = self.get_object()
         if for_user.email == "":
             LOGGER.debug("User doesn't have an email address")
-            raise ValidationError({"non_field_errors": "User does not have an email address set."})
+            return Response(status=404)
         link, token = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response(status=404)
         # Lookup the email stage to assure the current user can access it
         stages = get_objects_for_user(
             request.user, "authentik_stages_email.view_emailstage"
         ).filter(pk=request.query_params.get("email_stage"))
         if not stages.exists():
             LOGGER.debug("Email stage does not exist/user has no permissions")
-            raise ValidationError({"non_field_errors": "Email stage does not exist."})
+            return Response(status=404)
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),
-            to=[(for_user.name, for_user.email)],
+            to=[for_user.email],
             template_name=email_stage.template,
             language=for_user.locale(request),
             template_context={
@@ -625,7 +631,7 @@ class UserViewSet(UsedByMixin, ModelViewSet):
             "401": OpenApiResponse(description="Access denied"),
         },
     )
-    @action(detail=True, methods=["POST"], permission_classes=[])
+    @action(detail=True, methods=["POST"])
     def impersonate(self, request: Request, pk: int) -> Response:
         """Impersonate a user"""
         if not request.tenant.impersonation:

authentik/core/apps.py

@@ -14,16 +14,18 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    @ManagedAppConfig.reconcile_global
-    def debug_worker_hook(self):
+    def reconcile_global_load_core_signals(self):
+        """Load core signals"""
+        self.import_module("authentik.core.signals")
+
+    def reconcile_global_debug_worker_hook(self):
         """Dispatch startup tasks inline when debugging"""
         if settings.DEBUG:
             from authentik.root.celery import worker_ready_hook
 
             worker_ready_hook()
 
-    @ManagedAppConfig.reconcile_tenant
-    def source_inbuilt(self):
+    def reconcile_tenant_source_inbuilt(self):
         """Reconcile inbuilt source"""
         from authentik.core.models import Source
 

authentik/core/auth.py

@@ -1,6 +1,6 @@
 """Authenticate with tokens"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth.backends import ModelBackend
 from django.http.request import HttpRequest
@@ -16,15 +16,15 @@ class InbuiltBackend(ModelBackend):
     """Inbuilt backend"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> User | None:
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+    ) -> Optional[User]:
         user = super().authenticate(request, username=username, password=password, **kwargs)
         if not user:
             return None
         self.set_method("password", request)
         return user
 
-    def set_method(self, method: str, request: HttpRequest | None, **kwargs):
+    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
         """Set method data on current flow, if possbiel"""
         if not request:
             return
@@ -40,18 +40,16 @@ class TokenBackend(InbuiltBackend):
     """Authenticate with token"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
-    ) -> User | None:
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
+    ) -> Optional[User]:
         try:
-
             user = User._default_manager.get_by_natural_key(username)
-
         except User.DoesNotExist:
             # Run the default password hasher once to reduce the timing
             # difference between an existing and a nonexistent user (#20760).
             User().set_password(password)
             return None
-
+        # pylint: disable=no-member
         tokens = Token.filter_not_expired(
             user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
         )

authentik/core/channels.py

@@ -38,6 +38,6 @@ class TokenOutpostMiddleware:
                 raise DenyConnection()
         except AuthenticationFailed as exc:
             LOGGER.warning("Failed to authenticate", exc=exc)
-            raise DenyConnection() from None
+            raise DenyConnection()
 
         scope["user"] = user

authentik/core/expression/evaluator.py

@@ -1,6 +1,6 @@
 """Property Mapping Evaluator"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.db.models import Model
 from django.http import HttpRequest
@@ -27,9 +27,9 @@ class PropertyMappingEvaluator(BaseEvaluator):
     def __init__(
         self,
         model: Model,
-        user: User | None = None,
-        request: HttpRequest | None = None,
-        dry_run: bool | None = False,
+        user: Optional[User] = None,
+        request: Optional[HttpRequest] = None,
+        dry_run: Optional[bool] = False,
         **kwargs,
     ):
         if hasattr(model, "name"):

authentik/core/management/commands/shell.py

@@ -16,8 +16,13 @@ from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
-BANNER_TEXT = f"""### authentik shell ({get_full_version()})
-### Node {platform.node()} | Arch {platform.machine()} | Python {platform.python_version()} """
+BANNER_TEXT = """### authentik shell ({authentik})
+### Node {node} | Arch {arch} | Python {python} """.format(
+    node=platform.node(),
+    python=platform.python_version(),
+    arch=platform.machine(),
+    authentik=get_full_version(),
+)
 
 
 class Command(BaseCommand):
@@ -81,7 +86,7 @@ class Command(BaseCommand):
 
         # If Python code has been passed, execute it and exit.
         if options["command"]:
-
+            # pylint: disable=exec-used
             exec(options["command"], namespace)  # nosec # noqa
             return
 
@@ -94,7 +99,7 @@ class Command(BaseCommand):
         else:
             try:
                 hook()
-            except Exception:
+            except Exception:  # pylint: disable=broad-except
                 # Match the behavior of the cpython shell where an error in
                 # sys.__interactivehook__ prints a warning and the exception
                 # and continues.

authentik/core/middleware.py

@@ -1,7 +1,7 @@
 """authentik admin Middleware to impersonate users"""
 
-from collections.abc import Callable
 from contextvars import ContextVar
+from typing import Callable, Optional
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
@@ -15,9 +15,9 @@ RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
-CTX_REQUEST_ID = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
-CTX_HOST = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "host", default=None)
-CTX_AUTH_VIA = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
 
 
 class ImpersonateMiddleware:
@@ -55,7 +55,7 @@ class RequestIDMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
-            request.request_id = request_id
+            setattr(request, "request_id", request_id)
             CTX_REQUEST_ID.set(request_id)
             CTX_HOST.set(request.get_host())
             set_tag("authentik.request_id", request_id)
@@ -67,7 +67,7 @@ class RequestIDMiddleware:
         response = self.get_response(request)
 
         response[RESPONSE_HEADER_ID] = request.request_id
-        response.ak_context = {}
+        setattr(response, "ak_context", {})
         response.ak_context["request_id"] = CTX_REQUEST_ID.get()
         response.ak_context["host"] = CTX_HOST.get()
         response.ak_context[KEY_AUTH_VIA] = CTX_AUTH_VIA.get()

authentik/core/models.py

@@ -33,7 +33,7 @@ from authentik.lib.models import (
     SerializerModel,
 )
 from authentik.policies.models import PolicyBindingModel
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
@@ -222,7 +222,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         there are at most 3 queries done"""
         return Group.children_recursive(self.ak_groups.all())
 
-    def group_attributes(self, request: HttpRequest | None = None) -> dict[str, Any]:
+    def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
@@ -276,13 +276,13 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{get_unique_identifier()}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
 
-    def locale(self, request: HttpRequest | None = None) -> str:
+    def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
         if request:
@@ -358,7 +358,7 @@ class Provider(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return None
@@ -435,7 +435,7 @@ class Application(SerializerModel, PolicyBindingModel):
         return ApplicationSerializer
 
     @property
-    def get_meta_icon(self) -> str | None:
+    def get_meta_icon(self) -> Optional[str]:
         """Get the URL to the App Icon image. If the name is /static or starts with http
         it is returned as-is"""
         if not self.meta_icon:
@@ -444,7 +444,7 @@ class Application(SerializerModel, PolicyBindingModel):
             return self.meta_icon.name
         return self.meta_icon.url
 
-    def get_launch_url(self, user: Optional["User"] = None) -> str | None:
+    def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
         if self.meta_launch_url:
@@ -457,13 +457,13 @@ class Application(SerializerModel, PolicyBindingModel):
                 user = user._wrapped
             try:
                 return url % user.__dict__
-
+            # pylint: disable=broad-except
             except Exception as exc:
                 LOGGER.warning("Failed to format launch url", exc=exc)
                 return url
         return url
 
-    def get_provider(self) -> Provider | None:
+    def get_provider(self) -> Optional[Provider]:
         """Get casted provider instance"""
         if not self.provider:
             return None
@@ -551,7 +551,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def icon_url(self) -> str | None:
+    def icon_url(self) -> Optional[str]:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:
@@ -566,7 +566,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
             return self.user_path_template % {
                 "slug": self.slug,
             }
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to template user path", exc=exc, source=self)
             return User.default_path()
@@ -576,12 +576,12 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_login_button(self, request: HttpRequest) -> UILoginButton | None:
+    def ui_login_button(self, request: HttpRequest) -> Optional[UILoginButton]:
         """If source uses a http-based flow, return UI Information about the login
         button. If source doesn't use http-based flow, return None."""
         return None
 
-    def ui_user_settings(self) -> UserSettingSerializer | None:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or UserSettingSerializer."""
         return None
@@ -627,9 +627,6 @@ class ExpiringModel(models.Model):
     expires = models.DateTimeField(default=default_token_duration)
     expiring = models.BooleanField(default=True)
 
-    class Meta:
-        abstract = True
-
     def expire_action(self, *args, **kwargs):
         """Handler which is called when this object is expired. By
         default the object is deleted. This is less efficient compared
@@ -652,6 +649,9 @@ class ExpiringModel(models.Model):
             return False
         return now() > self.expires
 
+    class Meta:
+        abstract = True
+
 
 class TokenIntents(models.TextChoices):
     """Intents a Token can be created for."""
@@ -681,21 +681,6 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
     user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
     description = models.TextField(default="", blank=True)
 
-    class Meta:
-        verbose_name = _("Token")
-        verbose_name_plural = _("Tokens")
-        indexes = [
-            models.Index(fields=["identifier"]),
-            models.Index(fields=["key"]),
-        ]
-        permissions = [("view_token_key", _("View token's key"))]
-
-    def __str__(self):
-        description = f"{self.identifier}"
-        if self.expiring:
-            description += f" (expires={self.expires})"
-        return description
-
     @property
     def serializer(self) -> type[Serializer]:
         from authentik.core.api.tokens import TokenSerializer
@@ -723,6 +708,21 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
             message=f"Token {self.identifier}'s secret was rotated.",
         ).save()
 
+    def __str__(self):
+        description = f"{self.identifier}"
+        if self.expiring:
+            description += f" (expires={self.expires})"
+        return description
+
+    class Meta:
+        verbose_name = _("Token")
+        verbose_name_plural = _("Tokens")
+        indexes = [
+            models.Index(fields=["identifier"]),
+            models.Index(fields=["key"]),
+        ]
+        permissions = [("view_token_key", _("View token's key"))]
+
 
 class PropertyMapping(SerializerModel, ManagedModel):
     """User-defined key -> x mapping which can be used by providers to expose extra data."""
@@ -743,7 +743,7 @@ class PropertyMapping(SerializerModel, ManagedModel):
         """Get serializer for this model"""
         raise NotImplementedError
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         from authentik.core.expression.evaluator import PropertyMappingEvaluator
 
@@ -779,13 +779,6 @@ class AuthenticatedSession(ExpiringModel):
     last_user_agent = models.TextField(blank=True)
     last_used = models.DateTimeField(auto_now=True)
 
-    class Meta:
-        verbose_name = _("Authenticated Session")
-        verbose_name_plural = _("Authenticated Sessions")
-
-    def __str__(self) -> str:
-        return f"Authenticated Session {self.session_key[:10]}"
-
     @staticmethod
     def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
         """Create a new session from a http request"""
@@ -800,3 +793,7 @@ class AuthenticatedSession(ExpiringModel):
             last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
             expires=request.session.get_expiry_date(),
         )
+
+    class Meta:
+        verbose_name = _("Authenticated Session")
+        verbose_name_plural = _("Authenticated Sessions")

authentik/core/sources/flow_manager.py

@@ -1,7 +1,7 @@
 """Source decision helper"""
 
 from enum import Enum
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib import messages
 from django.db import IntegrityError
@@ -90,14 +90,15 @@ class SourceFlowManager:
         self._logger = get_logger().bind(source=source, identifier=identifier)
         self.policy_context = {}
 
-    def get_action(self, **kwargs) -> tuple[Action, UserSourceConnection | None]:  # noqa: PLR0911
+    # pylint: disable=too-many-return-statements
+    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
         """decide which action should be taken"""
         new_connection = self.connection_type(source=self.source, identifier=self.identifier)
         # When request is authenticated, always link
         if self.request.user.is_authenticated:
             new_connection.user = self.request.user
             new_connection = self.update_connection(new_connection, **kwargs)
-
+            # pylint: disable=no-member
             new_connection.save()
             return Action.LINK, new_connection
 
@@ -187,10 +188,8 @@ class SourceFlowManager:
         # Default case, assume deny
         error = Exception(
             _(
-                "Request to authenticate with {source} has been denied. Please authenticate "
-                "with the source you've previously signed up with.".format_map(
-                    {"source": self.source.name}
-                )
+                "Request to authenticate with %(source)s has been denied. Please authenticate "
+                "with the source you've previously signed up with." % {"source": self.source.name}
             ),
         )
         return self.error_handler(error)
@@ -218,7 +217,7 @@ class SourceFlowManager:
         self,
         flow: Flow,
         connection: UserSourceConnection,
-        stages: list[StageView] | None = None,
+        stages: Optional[list[StageView]] = None,
         **kwargs,
     ) -> HttpResponse:
         """Prepare Authentication Plan, redirect user FlowExecutor"""
@@ -271,9 +270,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
-                            {"source": self.source.name}
-                        )
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
                     ),
                 )
             ],
@@ -297,7 +294,7 @@ class SourceFlowManager:
         ).from_http(self.request)
         messages.success(
             self.request,
-            _("Successfully linked {source}!".format_map({"source": self.source.name})),
+            _("Successfully linked %(source)s!" % {"source": self.source.name}),
         )
         return redirect(
             reverse(
@@ -325,9 +322,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
-                            {"source": self.source.name}
-                        )
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
                     ),
                 )
             ],

authentik/core/tasks.py

@@ -37,20 +37,18 @@ def clean_expired_models(self: SystemTask):
         messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
     # Special case
     amount = 0
-
     for session in AuthenticatedSession.objects.all():
         cache_key = f"{KEY_PREFIX}{session.session_key}"
         value = None
         try:
             value = cache.get(cache_key)
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.debug("Failed to get session from cache", exc=exc)
         if not value:
             session.delete()
             amount += 1
     LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
-
     messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
     self.set_status(TaskStatus.SUCCESSFUL, *messages)
 

authentik/core/tests/test_models.py

@@ -1,7 +1,7 @@
 """authentik core models tests"""
 
-from collections.abc import Callable
 from time import sleep
+from typing import Callable
 
 from django.test import RequestFactory, TestCase
 from django.utils.timezone import now

authentik/core/tests/test_source_flow_manager.py

@@ -173,5 +173,5 @@ class TestSourceFlowManager(TestCase):
         self.assertEqual(action, Action.ENROLL)
         response = flow_manager.get_flow()
         self.assertIsInstance(response, AccessDeniedResponse)
-
+        # pylint: disable=no-member
         self.assertEqual(response.error_message, "foo")

authentik/core/tests/test_users_api.py

@@ -60,11 +60,10 @@ class TestUsersAPI(APITestCase):
     def test_recovery_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
+        self.assertEqual(response.status_code, 404)
 
     def test_set_password(self):
         """Test Direct password set"""
@@ -85,7 +84,7 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
         self.assertEqual(response.status_code, 200)
@@ -93,20 +92,16 @@ class TestUsersAPI(APITestCase):
     def test_recovery_email_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(
-            response.content, {"non_field_errors": "User does not have an email address set."}
-        )
+        self.assertEqual(response.status_code, 404)
         self.user.email = "foo@bar.baz"
         self.user.save()
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
+        self.assertEqual(response.status_code, 404)
 
     def test_recovery_email_no_stage(self):
         """Test user recovery link (no email stage)"""
@@ -117,11 +112,10 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
-        self.assertJSONEqual(response.content, {"non_field_errors": "Email stage does not exist."})
+        self.assertEqual(response.status_code, 404)
 
     def test_recovery_email(self):
         """Test user recovery link"""
@@ -135,7 +129,7 @@ class TestUsersAPI(APITestCase):
         stage = EmailStage.objects.create(name="email")
 
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse(
                 "authentik_api:user-recovery-email",
                 kwargs={"pk": self.user.pk},

authentik/core/tests/utils.py

@@ -1,5 +1,7 @@
 """Test Utils"""
 
+from typing import Optional
+
 from django.utils.text import slugify
 
 from authentik.brands.models import Brand
@@ -20,7 +22,7 @@ def create_test_flow(
     )
 
 
-def create_test_user(name: str | None = None, **kwargs) -> User:
+def create_test_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test user"""
     uid = generate_id(20) if not name else name
     kwargs.setdefault("email", f"{uid}@goauthentik.io")
@@ -34,7 +36,7 @@ def create_test_user(name: str | None = None, **kwargs) -> User:
     return user
 
 
-def create_test_admin_user(name: str | None = None, **kwargs) -> User:
+def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test-admin user"""
     user = create_test_user(name, **kwargs)
     group = Group.objects.create(name=user.name or name, is_superuser=True)

authentik/core/types.py

@@ -1,6 +1,7 @@
 """authentik core dataclasses"""
 
 from dataclasses import dataclass
+from typing import Optional
 
 from rest_framework.fields import CharField
 
@@ -19,7 +20,7 @@ class UILoginButton:
     challenge: Challenge
 
     # Icon URL, used as-is
-    icon_url: str | None = None
+    icon_url: Optional[str] = None
 
 
 class UserSettingSerializer(PassiveSerializer):

authentik/core/views/apps.py

@@ -57,7 +57,7 @@ class RedirectToAppLaunch(View):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(in_memory_stage(RedirectToAppStage))
         request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs("authentik_core:if-flow", request.GET, flow_slug=flow.slug)

authentik/core/views/error.py

@@ -61,6 +61,7 @@ class ServerErrorView(TemplateView):
     response_class = ServerErrorTemplateResponse
     template_name = "if/error.html"
 
+    # pylint: disable=useless-super-delegation
     def dispatch(self, *args, **kwargs):  # pragma: no cover
         """Little wrapper so django accepts this function"""
         return super().dispatch(*args, **kwargs)

authentik/crypto/api.py

@@ -1,6 +1,7 @@
 """Crypto API Views"""
 
 from datetime import datetime
+from typing import Optional
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
@@ -23,13 +24,13 @@ from rest_framework.viewsets import ModelViewSet
 from structlog.stdlib import get_logger
 
 from authentik.api.authorization import SecretKeyFilter
+from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.crypto.apps import MANAGED_KEY
 from authentik.crypto.builder import CertificateBuilder
 from authentik.crypto.models import CertificateKeyPair
 from authentik.events.models import Event, EventAction
-from authentik.rbac.decorators import permission_required
 
 LOGGER = get_logger()
 
@@ -55,25 +56,25 @@ class CertificateKeyPairSerializer(ModelSerializer):
             return True
         return str(request.query_params.get("include_details", "true")).lower() == "true"
 
-    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA256)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha256
 
-    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA1)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha1
 
-    def get_cert_expiry(self, instance: CertificateKeyPair) -> datetime | None:
+    def get_cert_expiry(self, instance: CertificateKeyPair) -> Optional[datetime]:
         "Get certificate expiry"
         if not self._should_include_details:
             return None
-        return DateTimeField().to_representation(instance.certificate.not_valid_after_utc)
+        return DateTimeField().to_representation(instance.certificate.not_valid_after)
 
-    def get_cert_subject(self, instance: CertificateKeyPair) -> str | None:
+    def get_cert_subject(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get certificate subject as full rfc4514"""
         if not self._should_include_details:
             return None
@@ -83,7 +84,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
         """Show if this keypair has a private key configured or not"""
         return instance.key_data != "" and instance.key_data is not None
 
-    def get_private_key_type(self, instance: CertificateKeyPair) -> str | None:
+    def get_private_key_type(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get the private key's type, if set"""
         if not self._should_include_details:
             return None
@@ -120,7 +121,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             str(load_pem_x509_certificate(value.encode("utf-8"), default_backend()))
         except ValueError as exc:
             LOGGER.warning("Failed to load certificate", exc=exc)
-            raise ValidationError("Unable to load certificate.") from None
+            raise ValidationError("Unable to load certificate.")
         return value
 
     def validate_key_data(self, value: str) -> str:
@@ -139,7 +140,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
                 )
             except (ValueError, TypeError) as exc:
                 LOGGER.warning("Failed to load private key", exc=exc)
-                raise ValidationError("Unable to load private key (possibly encrypted?).") from None
+                raise ValidationError("Unable to load private key (possibly encrypted?).")
         return value
 
     class Meta:

authentik/crypto/apps.py

@@ -1,6 +1,7 @@
 """authentik crypto app config"""
 
-from datetime import UTC, datetime
+from datetime import datetime
+from typing import Optional
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
@@ -16,6 +17,10 @@ class AuthentikCryptoConfig(ManagedAppConfig):
     verbose_name = "authentik Crypto"
     default = True
 
+    def reconcile_global_load_crypto_tasks(self):
+        """Load crypto tasks"""
+        self.import_module("authentik.crypto.tasks")
+
     def _create_update_cert(self):
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair
@@ -35,22 +40,20 @@ class AuthentikCryptoConfig(ManagedAppConfig):
             },
         )
 
-    @ManagedAppConfig.reconcile_tenant
-    def managed_jwt_cert(self):
+    def reconcile_tenant_managed_jwt_cert(self):
         """Ensure managed JWT certificate"""
         from authentik.crypto.models import CertificateKeyPair
 
-        cert: CertificateKeyPair | None = CertificateKeyPair.objects.filter(
+        cert: Optional[CertificateKeyPair] = CertificateKeyPair.objects.filter(
             managed=MANAGED_KEY
         ).first()
-        now = datetime.now(tz=UTC)
+        now = datetime.now()
         if not cert or (
-            now < cert.certificate.not_valid_after_utc or now > cert.certificate.not_valid_after_utc
+            now < cert.certificate.not_valid_before or now > cert.certificate.not_valid_after
         ):
             self._create_update_cert()
 
-    @ManagedAppConfig.reconcile_tenant
-    def self_signed(self):
+    def reconcile_tenant_self_signed(self):
         """Create self-signed keypair"""
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair

authentik/crypto/builder.py

@@ -2,6 +2,7 @@
 
 import datetime
 import uuid
+from typing import Optional
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -43,7 +44,7 @@ class CertificateBuilder:
     def generate_private_key(self) -> PrivateKeyTypes:
         """Generate private key"""
         if self._use_ec_private_key:
-            return ec.generate_private_key(curve=ec.SECP256R1())
+            return ec.generate_private_key(curve=ec.SECP256R1)
         return rsa.generate_private_key(
             public_exponent=65537, key_size=4096, backend=default_backend()
         )
@@ -51,7 +52,7 @@ class CertificateBuilder:
     def build(
         self,
         validity_days: int = 365,
-        subject_alt_names: list[str] | None = None,
+        subject_alt_names: Optional[list[str]] = None,
     ):
         """Build self-signed certificate"""
         one_day = datetime.timedelta(1, 0, 0)

authentik/crypto/management/commands/import_certificate.py

@@ -24,13 +24,13 @@ class Command(TenantCommand):
         if not keypair:
             keypair = CertificateKeyPair(name=options["name"])
             dirty = True
-        with open(options["certificate"], encoding="utf-8") as _cert:
+        with open(options["certificate"], mode="r", encoding="utf-8") as _cert:
             cert_data = _cert.read()
             if keypair.certificate_data != cert_data:
                 dirty = True
             keypair.certificate_data = cert_data
         if options["private_key"]:
-            with open(options["private_key"], encoding="utf-8") as _key:
+            with open(options["private_key"], mode="r", encoding="utf-8") as _key:
                 key_data = _key.read()
                 if keypair.key_data != key_data:
                     dirty = True

authentik/crypto/models.py

@@ -2,6 +2,7 @@
 
 from binascii import hexlify
 from hashlib import md5
+from typing import Optional
 from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
@@ -36,9 +37,9 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         default="",
     )
 
-    _cert: Certificate | None = None
-    _private_key: PrivateKeyTypes | None = None
-    _public_key: PublicKeyTypes | None = None
+    _cert: Optional[Certificate] = None
+    _private_key: Optional[PrivateKeyTypes] = None
+    _public_key: Optional[PublicKeyTypes] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -56,7 +57,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> PublicKeyTypes | None:
+    def public_key(self) -> Optional[PublicKeyTypes]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -65,7 +66,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> PrivateKeyTypes | None:
+    ) -> Optional[PrivateKeyTypes]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -58,7 +58,7 @@ def certificate_discovery(self: SystemTask):
         else:
             cert_name = path.name.replace(path.suffix, "")
         try:
-            with open(path, encoding="utf-8") as _file:
+            with open(path, "r", encoding="utf-8") as _file:
                 body = _file.read()
                 if "PRIVATE KEY" in body:
                     private_keys[cert_name] = ensure_private_key_valid(body)

authentik/crypto/tests.py

@@ -1,5 +1,6 @@
 """Crypto tests"""
 
+import datetime
 from json import loads
 from os import makedirs
 from tempfile import TemporaryDirectory
@@ -7,7 +8,6 @@ from tempfile import TemporaryDirectory
 from cryptography.x509.extensions import SubjectAlternativeName
 from cryptography.x509.general_name import DNSName
 from django.urls import reverse
-from django.utils.timezone import now
 from rest_framework.test import APITestCase
 
 from authentik.core.api.used_by import DeleteAction
@@ -68,9 +68,9 @@ class TestCrypto(APITestCase):
             validity_days=3,
         )
         instance = builder.save()
-        _now = now()
+        now = datetime.datetime.today()
         self.assertEqual(instance.name, name)
-        self.assertEqual((instance.certificate.not_valid_after_utc - _now).days, 2)
+        self.assertEqual((instance.certificate.not_valid_after - now).days, 2)
 
     def test_builder_api(self):
         """Test Builder (via API)"""
@@ -267,7 +267,7 @@ class TestCrypto(APITestCase):
             with open(f"{temp_dir}/foo.bar/privkey.pem", "w+", encoding="utf-8") as _key:
                 _key.write(builder.private_key)
             with CONFIG.patch("cert_discovery_dir", temp_dir):
-                certificate_discovery()
+                certificate_discovery()  # pylint: disable=no-value-for-parameter
         keypair: CertificateKeyPair = CertificateKeyPair.objects.filter(
             managed=MANAGED_DISCOVERED % "foo"
         ).first()

authentik/enterprise/api.py

@@ -1,7 +1,6 @@
 """Enterprise API Views"""
 
-from dataclasses import asdict
-from datetime import timedelta
+from datetime import datetime, timedelta
 
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
@@ -9,29 +8,29 @@ from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import extend_schema, inline_serializer
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
-from rest_framework.fields import CharField, IntegerField
+from rest_framework.fields import BooleanField, CharField, DateTimeField, IntegerField
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet
 
+from authentik.api.decorators import permission_required
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import User, UserTypes
-from authentik.enterprise.license import LicenseKey, LicenseSummarySerializer
-from authentik.enterprise.models import License
-from authentik.rbac.decorators import permission_required
-from authentik.tenants.utils import get_unique_identifier
+from authentik.enterprise.models import License, LicenseKey
+from authentik.root.install_id import get_install_id
 
 
 class EnterpriseRequiredMixin:
     """Mixin to validate that a valid enterprise license
-    exists before allowing to save the object"""
+    exists before allowing to safe the object"""
 
     def validate(self, attrs: dict) -> dict:
         """Check that a valid license exists"""
-        if not LicenseKey.cached_summary().has_license:
+        total = LicenseKey.get_total()
+        if not total.is_valid():
             raise ValidationError(_("Enterprise is required to create/update this object."))
         return super().validate(attrs)
 
@@ -62,6 +61,19 @@ class LicenseSerializer(ModelSerializer):
         }
 
 
+class LicenseSummary(PassiveSerializer):
+    """Serializer for license status"""
+
+    internal_users = IntegerField(required=True)
+    external_users = IntegerField(required=True)
+    valid = BooleanField()
+    show_admin_warning = BooleanField()
+    show_user_warning = BooleanField()
+    read_only = BooleanField()
+    latest_valid = DateTimeField()
+    has_license = BooleanField()
+
+
 class LicenseForecastSerializer(PassiveSerializer):
     """Serializer for license forecast"""
 
@@ -92,20 +104,38 @@ class LicenseViewSet(UsedByMixin, ModelViewSet):
         """Get install_id"""
         return Response(
             data={
-                "install_id": get_unique_identifier(),
+                "install_id": get_install_id(),
             }
         )
 
     @extend_schema(
         request=OpenApiTypes.NONE,
         responses={
-            200: LicenseSummarySerializer(),
+            200: LicenseSummary(),
         },
     )
     @action(detail=False, methods=["GET"], permission_classes=[IsAuthenticated])
     def summary(self, request: Request) -> Response:
         """Get the total license status"""
-        response = LicenseSummarySerializer(data=asdict(LicenseKey.cached_summary()))
+        total = LicenseKey.get_total()
+        last_valid = LicenseKey.last_valid_date()
+        # TODO: move this to a different place?
+        show_admin_warning = last_valid < now() - timedelta(weeks=2)
+        show_user_warning = last_valid < now() - timedelta(weeks=4)
+        read_only = last_valid < now() - timedelta(weeks=6)
+        latest_valid = datetime.fromtimestamp(total.exp)
+        response = LicenseSummary(
+            data={
+                "internal_users": total.internal_users,
+                "external_users": total.external_users,
+                "valid": total.is_valid(),
+                "show_admin_warning": show_admin_warning,
+                "show_user_warning": show_user_warning,
+                "read_only": read_only,
+                "latest_valid": latest_valid,
+                "has_license": License.objects.all().count() > 0,
+            }
+        )
         response.is_valid(raise_exception=True)
         return Response(response.data)
 

authentik/enterprise/apps.py

@@ -17,12 +17,16 @@ class AuthentikEnterpriseConfig(EnterpriseConfig):
     verbose_name = "authentik Enterprise"
     default = True
 
+    def reconcile_global_load_enterprise_signals(self):
+        """Load enterprise signals"""
+        self.import_module("authentik.enterprise.signals")
+
     def enabled(self):
         """Return true if enterprise is enabled and valid"""
         return self.check_enabled() or settings.TEST
 
     def check_enabled(self):
         """Actual enterprise check, cached"""
-        from authentik.enterprise.license import LicenseKey
+        from authentik.enterprise.models import LicenseKey
 
-        return LicenseKey.cached_summary().valid
+        return LicenseKey.get_total().is_valid()

authentik/enterprise/audit/apps.py

@@ -13,8 +13,7 @@ class AuthentikEnterpriseAuditConfig(EnterpriseConfig):
     verbose_name = "authentik Enterprise.Audit"
     default = True
 
-    @EnterpriseConfig.reconcile_global
-    def install_middleware(self):
+    def reconcile_global_install_middleware(self):
         """Install enterprise audit middleware"""
         orig_import = "authentik.events.middleware.AuditMiddleware"
         new_import = "authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware"

authentik/enterprise/audit/middleware.py

@@ -19,10 +19,14 @@ from authentik.events.utils import cleanse_dict, sanitize_item
 class EnterpriseAuditMiddleware(AuditMiddleware):
     """Enterprise audit middleware"""
 
+    _enabled = None
+
     @property
     def enabled(self):
-        """Check if audit logging is enabled"""
-        return apps.get_app_config("authentik_enterprise").enabled()
+        """Lazy check if audit logging is enabled"""
+        if self._enabled is None:
+            self._enabled = apps.get_app_config("authentik_enterprise").enabled()
+        return self._enabled
 
     def connect(self, request: HttpRequest):
         super().connect(request)
@@ -62,7 +66,7 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 field_value = value.name
 
             # If current field value is an expression, we are not evaluating it
-            if isinstance(field_value, BaseExpression | Combinable):
+            if isinstance(field_value, (BaseExpression, Combinable)):
                 continue
             field_value = field.to_python(field_value)
             data[field.name] = deepcopy(field_value)
@@ -83,11 +87,12 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
         if hasattr(instance, "_previous_state"):
             return
         before = len(connection.queries)
-        instance._previous_state = self.serialize_simple(instance)
+        setattr(instance, "_previous_state", self.serialize_simple(instance))
         after = len(connection.queries)
         if after > before:
             raise AssertionError("More queries generated by serialize_simple")
 
+    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
         user: User,

authentik/enterprise/license.py

@@ -1,208 +0,0 @@
-"""Enterprise license"""
-
-from base64 import b64decode
-from binascii import Error
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timedelta
-from enum import Enum
-from functools import lru_cache
-from time import mktime
-
-from cryptography.exceptions import InvalidSignature
-from cryptography.x509 import Certificate, load_der_x509_certificate, load_pem_x509_certificate
-from dacite import from_dict
-from django.core.cache import cache
-from django.db.models.query import QuerySet
-from django.utils.timezone import now
-from jwt import PyJWTError, decode, get_unverified_header
-from rest_framework.exceptions import ValidationError
-from rest_framework.fields import BooleanField, DateTimeField, IntegerField
-
-from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import User, UserTypes
-from authentik.enterprise.models import License, LicenseUsage
-from authentik.tenants.utils import get_unique_identifier
-
-CACHE_KEY_ENTERPRISE_LICENSE = "goauthentik.io/enterprise/license"
-CACHE_EXPIRY_ENTERPRISE_LICENSE = 3 * 60 * 60  # 2 Hours
-
-
-@lru_cache
-def get_licensing_key() -> Certificate:
-    """Get Root CA PEM"""
-    with open("authentik/enterprise/public.pem", "rb") as _key:
-        return load_pem_x509_certificate(_key.read())
-
-
-def get_license_aud() -> str:
-    """Get the JWT audience field"""
-    return f"enterprise.goauthentik.io/license/{get_unique_identifier()}"
-
-
-class LicenseFlags(Enum):
-    """License flags"""
-
-
-@dataclass
-class LicenseSummary:
-    """Internal representation of a license summary"""
-
-    internal_users: int
-    external_users: int
-    valid: bool
-    show_admin_warning: bool
-    show_user_warning: bool
-    read_only: bool
-    latest_valid: datetime
-    has_license: bool
-
-
-class LicenseSummarySerializer(PassiveSerializer):
-    """Serializer for license status"""
-
-    internal_users = IntegerField(required=True)
-    external_users = IntegerField(required=True)
-    valid = BooleanField()
-    show_admin_warning = BooleanField()
-    show_user_warning = BooleanField()
-    read_only = BooleanField()
-    latest_valid = DateTimeField()
-    has_license = BooleanField()
-
-
-@dataclass
-class LicenseKey:
-    """License JWT claims"""
-
-    aud: str
-    exp: int
-
-    name: str
-    internal_users: int = 0
-    external_users: int = 0
-    flags: list[LicenseFlags] = field(default_factory=list)
-
-    @staticmethod
-    def validate(jwt: str) -> "LicenseKey":
-        """Validate the license from a given JWT"""
-        try:
-            headers = get_unverified_header(jwt)
-        except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
-        x5c: list[str] = headers.get("x5c", [])
-        if len(x5c) < 1:
-            raise ValidationError("Unable to verify license")
-        try:
-            our_cert = load_der_x509_certificate(b64decode(x5c[0]))
-            intermediate = load_der_x509_certificate(b64decode(x5c[1]))
-            our_cert.verify_directly_issued_by(intermediate)
-            intermediate.verify_directly_issued_by(get_licensing_key())
-        except (InvalidSignature, TypeError, ValueError, Error):
-            raise ValidationError("Unable to verify license") from None
-        try:
-            body = from_dict(
-                LicenseKey,
-                decode(
-                    jwt,
-                    our_cert.public_key(),
-                    algorithms=["ES512"],
-                    audience=get_license_aud(),
-                ),
-            )
-        except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
-        return body
-
-    @staticmethod
-    def get_total() -> "LicenseKey":
-        """Get a summarized version of all (not expired) licenses"""
-        active_licenses = License.objects.filter(expiry__gte=now())
-        total = LicenseKey(get_license_aud(), 0, "Summarized license", 0, 0)
-        for lic in active_licenses:
-            total.internal_users += lic.internal_users
-            total.external_users += lic.external_users
-            exp_ts = int(mktime(lic.expiry.timetuple()))
-            if total.exp == 0:
-                total.exp = exp_ts
-            if exp_ts <= total.exp:
-                total.exp = exp_ts
-            total.flags.extend(lic.status.flags)
-        return total
-
-    @staticmethod
-    def base_user_qs() -> QuerySet:
-        """Base query set for all users"""
-        return User.objects.all().exclude_anonymous().exclude(is_active=False)
-
-    @staticmethod
-    def get_default_user_count():
-        """Get current default user count"""
-        return LicenseKey.base_user_qs().filter(type=UserTypes.INTERNAL).count()
-
-    @staticmethod
-    def get_external_user_count():
-        """Get current external user count"""
-        return LicenseKey.base_user_qs().filter(type=UserTypes.EXTERNAL).count()
-
-    def is_valid(self) -> bool:
-        """Check if the given license body covers all users
-
-        Only checks the current count, no historical data is checked"""
-        default_users = self.get_default_user_count()
-        if default_users > self.internal_users:
-            return False
-        active_users = self.get_external_user_count()
-        if active_users > self.external_users:
-            return False
-        return True
-
-    def record_usage(self):
-        """Capture the current validity status and metrics and save them"""
-        threshold = now() - timedelta(hours=8)
-        if not LicenseUsage.objects.filter(record_date__gte=threshold).exists():
-            LicenseUsage.objects.create(
-                user_count=self.get_default_user_count(),
-                external_user_count=self.get_external_user_count(),
-                within_limits=self.is_valid(),
-            )
-        summary = asdict(self.summary())
-        # Also cache the latest summary for the middleware
-        cache.set(CACHE_KEY_ENTERPRISE_LICENSE, summary, timeout=CACHE_EXPIRY_ENTERPRISE_LICENSE)
-        return summary
-
-    @staticmethod
-    def last_valid_date() -> datetime:
-        """Get the last date the license was valid"""
-        usage: LicenseUsage = (
-            LicenseUsage.filter_not_expired(within_limits=True).order_by("-record_date").first()
-        )
-        if not usage:
-            return now()
-        return usage.record_date
-
-    def summary(self) -> LicenseSummary:
-        """Summary of license status"""
-        has_license = License.objects.all().count() > 0
-        last_valid = LicenseKey.last_valid_date()
-        show_admin_warning = last_valid < now() - timedelta(weeks=2)
-        show_user_warning = last_valid < now() - timedelta(weeks=4)
-        read_only = last_valid < now() - timedelta(weeks=6)
-        latest_valid = datetime.fromtimestamp(self.exp)
-        return LicenseSummary(
-            show_admin_warning=show_admin_warning and has_license,
-            show_user_warning=show_user_warning and has_license,
-            read_only=read_only and has_license,
-            latest_valid=latest_valid,
-            internal_users=self.internal_users,
-            external_users=self.external_users,
-            valid=self.is_valid(),
-            has_license=has_license,
-        )
-
-    @staticmethod
-    def cached_summary() -> LicenseSummary:
-        """Helper method which looks up the last summary"""
-        summary = cache.get(CACHE_KEY_ENTERPRISE_LICENSE)
-        if not summary:
-            return LicenseKey.get_total().summary()
-        return from_dict(LicenseSummary, summary)

authentik/enterprise/middleware.py

@@ -1,64 +0,0 @@
-"""Enterprise middleware"""
-
-from collections.abc import Callable
-
-from django.http import HttpRequest, HttpResponse, JsonResponse
-from django.urls import resolve
-from structlog.stdlib import BoundLogger, get_logger
-
-from authentik.enterprise.api import LicenseViewSet
-from authentik.enterprise.license import LicenseKey
-from authentik.flows.views.executor import FlowExecutorView
-from authentik.lib.utils.reflection import class_to_path
-
-
-class EnterpriseMiddleware:
-    """Enterprise middleware"""
-
-    get_response: Callable[[HttpRequest], HttpResponse]
-    logger: BoundLogger
-
-    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]):
-        self.get_response = get_response
-        self.logger = get_logger().bind()
-
-    def __call__(self, request: HttpRequest) -> HttpResponse:
-        resolver_match = resolve(request.path_info)
-        request.resolver_match = resolver_match
-        if not self.is_request_allowed(request):
-            self.logger.warning("Refusing request due to expired/invalid license")
-            return JsonResponse(
-                {
-                    "detail": "Request denied due to expired/invalid license.",
-                    "code": "denied_license",
-                },
-                status=400,
-            )
-        return self.get_response(request)
-
-    def is_request_allowed(self, request: HttpRequest) -> bool:
-        """Check if a specific request is allowed"""
-        if self.is_request_always_allowed(request):
-            return True
-        cached_status = LicenseKey.cached_summary()
-        if not cached_status:
-            return True
-        if cached_status.read_only:
-            return False
-        return True
-
-    def is_request_always_allowed(self, request: HttpRequest):
-        """Check if a request is always allowed"""
-        # Always allow "safe" methods
-        if request.method.lower() in ["get", "head", "options", "trace"]:
-            return True
-        # Always allow requests to manage licenses
-        if class_to_path(request.resolver_match.func) == class_to_path(LicenseViewSet):
-            return True
-        # Flow executor is mounted as an API path but explicitly allowed
-        if class_to_path(request.resolver_match.func) == class_to_path(FlowExecutorView):
-            return True
-        # Only apply these restrictions to the API
-        if "authentik_api" not in request.resolver_match.app_names:
-            return True
-        return False

authentik/enterprise/models.py

@@ -1,20 +1,159 @@
 """Enterprise models"""
 
-from datetime import timedelta
-from typing import TYPE_CHECKING
+from base64 import b64decode
+from binascii import Error
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta
+from enum import Enum
+from functools import lru_cache
+from time import mktime
 from uuid import uuid4
 
+from cryptography.exceptions import InvalidSignature
+from cryptography.x509 import Certificate, load_der_x509_certificate, load_pem_x509_certificate
+from dacite import from_dict
 from django.contrib.postgres.indexes import HashIndex
 from django.db import models
+from django.db.models.query import QuerySet
 from django.utils.timezone import now
 from django.utils.translation import gettext as _
+from jwt import PyJWTError, decode, get_unverified_header
+from rest_framework.exceptions import ValidationError
 from rest_framework.serializers import BaseSerializer
 
-from authentik.core.models import ExpiringModel
+from authentik.core.models import ExpiringModel, User, UserTypes
 from authentik.lib.models import SerializerModel
+from authentik.root.install_id import get_install_id
 
-if TYPE_CHECKING:
-    from authentik.enterprise.license import LicenseKey
+
+@lru_cache()
+def get_licensing_key() -> Certificate:
+    """Get Root CA PEM"""
+    with open("authentik/enterprise/public.pem", "rb") as _key:
+        return load_pem_x509_certificate(_key.read())
+
+
+def get_license_aud() -> str:
+    """Get the JWT audience field"""
+    return f"enterprise.goauthentik.io/license/{get_install_id()}"
+
+
+class LicenseFlags(Enum):
+    """License flags"""
+
+
+@dataclass
+class LicenseKey:
+    """License JWT claims"""
+
+    aud: str
+    exp: int
+
+    name: str
+    internal_users: int = 0
+    external_users: int = 0
+    flags: list[LicenseFlags] = field(default_factory=list)
+
+    @staticmethod
+    def validate(jwt: str) -> "LicenseKey":
+        """Validate the license from a given JWT"""
+        try:
+            headers = get_unverified_header(jwt)
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        x5c: list[str] = headers.get("x5c", [])
+        if len(x5c) < 1:
+            raise ValidationError("Unable to verify license")
+        try:
+            our_cert = load_der_x509_certificate(b64decode(x5c[0]))
+            intermediate = load_der_x509_certificate(b64decode(x5c[1]))
+            our_cert.verify_directly_issued_by(intermediate)
+            intermediate.verify_directly_issued_by(get_licensing_key())
+        except (InvalidSignature, TypeError, ValueError, Error):
+            raise ValidationError("Unable to verify license")
+        try:
+            body = from_dict(
+                LicenseKey,
+                decode(
+                    jwt,
+                    our_cert.public_key(),
+                    algorithms=["ES512"],
+                    audience=get_license_aud(),
+                ),
+            )
+        except PyJWTError:
+            raise ValidationError("Unable to verify license")
+        return body
+
+    @staticmethod
+    def get_total() -> "LicenseKey":
+        """Get a summarized version of all (not expired) licenses"""
+        active_licenses = License.objects.filter(expiry__gte=now())
+        total = LicenseKey(get_license_aud(), 0, "Summarized license", 0, 0)
+        for lic in active_licenses:
+            total.internal_users += lic.internal_users
+            total.external_users += lic.external_users
+            exp_ts = int(mktime(lic.expiry.timetuple()))
+            if total.exp == 0:
+                total.exp = exp_ts
+            if exp_ts <= total.exp:
+                total.exp = exp_ts
+            total.flags.extend(lic.status.flags)
+        return total
+
+    @staticmethod
+    def base_user_qs() -> QuerySet:
+        """Base query set for all users"""
+        return User.objects.all().exclude_anonymous().exclude(is_active=False)
+
+    @staticmethod
+    def get_default_user_count():
+        """Get current default user count"""
+        return LicenseKey.base_user_qs().filter(type=UserTypes.INTERNAL).count()
+
+    @staticmethod
+    def get_external_user_count():
+        """Get current external user count"""
+        # Count since start of the month
+        last_month = now().replace(day=1)
+        return (
+            LicenseKey.base_user_qs()
+            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
+            .count()
+        )
+
+    def is_valid(self) -> bool:
+        """Check if the given license body covers all users
+
+        Only checks the current count, no historical data is checked"""
+        default_users = self.get_default_user_count()
+        if default_users > self.internal_users:
+            return False
+        active_users = self.get_external_user_count()
+        if active_users > self.external_users:
+            return False
+        return True
+
+    def record_usage(self):
+        """Capture the current validity status and metrics and save them"""
+        threshold = now() - timedelta(hours=8)
+        if LicenseUsage.objects.filter(record_date__gte=threshold).exists():
+            return
+        LicenseUsage.objects.create(
+            user_count=self.get_default_user_count(),
+            external_user_count=self.get_external_user_count(),
+            within_limits=self.is_valid(),
+        )
+
+    @staticmethod
+    def last_valid_date() -> datetime:
+        """Get the last date the license was valid"""
+        usage: LicenseUsage = (
+            LicenseUsage.filter_not_expired(within_limits=True).order_by("-record_date").first()
+        )
+        if not usage:
+            return now()
+        return usage.record_date
 
 
 class License(SerializerModel):
@@ -35,10 +174,8 @@ class License(SerializerModel):
         return LicenseSerializer
 
     @property
-    def status(self) -> "LicenseKey":
+    def status(self) -> LicenseKey:
         """Get parsed license status"""
-        from authentik.enterprise.license import LicenseKey
-
         return LicenseKey.validate(self.key)
 
     class Meta:

authentik/enterprise/policy.py

@@ -1,9 +1,11 @@
 """Enterprise license policies"""
 
+from typing import Optional
+
 from django.utils.translation import gettext_lazy as _
 
 from authentik.core.models import User, UserTypes
-from authentik.enterprise.license import LicenseKey
+from authentik.enterprise.models import LicenseKey
 from authentik.policies.types import PolicyRequest, PolicyResult
 from authentik.policies.views import PolicyAccessView
 
@@ -19,7 +21,7 @@ class EnterprisePolicyAccessView(PolicyAccessView):
             return PolicyResult(False, _("Feature only accessible for internal users."))
         return PolicyResult(True)
 
-    def user_has_access(self, user: User | None = None) -> PolicyResult:
+    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
         user = user or self.request.user
         request = PolicyRequest(user)
         request.http_request = self.request

authentik/enterprise/providers/rac/api/connection_tokens.py

@@ -1,53 +0,0 @@
-"""RAC Provider API Views"""
-
-from django_filters.rest_framework.backends import DjangoFilterBackend
-from rest_framework import mixins
-from rest_framework.filters import OrderingFilter, SearchFilter
-from rest_framework.serializers import ModelSerializer
-from rest_framework.viewsets import GenericViewSet
-
-from authentik.api.authorization import OwnerFilter, OwnerPermissions
-from authentik.core.api.groups import GroupMemberSerializer
-from authentik.core.api.used_by import UsedByMixin
-from authentik.enterprise.api import EnterpriseRequiredMixin
-from authentik.enterprise.providers.rac.api.endpoints import EndpointSerializer
-from authentik.enterprise.providers.rac.api.providers import RACProviderSerializer
-from authentik.enterprise.providers.rac.models import ConnectionToken, Endpoint
-
-
-class ConnectionTokenSerializer(EnterpriseRequiredMixin, ModelSerializer):
-    """ConnectionToken Serializer"""
-
-    provider_obj = RACProviderSerializer(source="provider", read_only=True)
-    endpoint_obj = EndpointSerializer(source="endpoint", read_only=True)
-    user = GroupMemberSerializer(source="session.user", read_only=True)
-
-    class Meta:
-        model = Endpoint
-        fields = [
-            "pk",
-            "provider",
-            "provider_obj",
-            "endpoint",
-            "endpoint_obj",
-            "user",
-        ]
-
-
-class ConnectionTokenViewSet(
-    mixins.RetrieveModelMixin,
-    mixins.UpdateModelMixin,
-    mixins.DestroyModelMixin,
-    UsedByMixin,
-    mixins.ListModelMixin,
-    GenericViewSet,
-):
-    """ConnectionToken Viewset"""
-
-    queryset = ConnectionToken.objects.all().select_related("session", "endpoint")
-    serializer_class = ConnectionTokenSerializer
-    filterset_fields = ["endpoint", "session__user", "provider"]
-    search_fields = ["endpoint__name", "provider__name"]
-    ordering = ["endpoint__name", "provider__name"]
-    permission_classes = [OwnerPermissions]
-    filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]

authentik/enterprise/providers/rac/api/endpoints.py

@@ -1,5 +1,7 @@
 """RAC Provider API Views"""
 
+from typing import Optional
+
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.urls import reverse
@@ -34,11 +36,11 @@ class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
     provider_obj = RACProviderSerializer(source="provider", read_only=True)
     launch_url = SerializerMethodField()
 
-    def get_launch_url(self, endpoint: Endpoint) -> str | None:
+    def get_launch_url(self, endpoint: Endpoint) -> Optional[str]:
         """Build actual launch URL (the provider itself does not have one, just
         individual endpoints)"""
         try:
-
+            # pylint: disable=no-member
             return reverse(
                 "authentik_providers_rac:start",
                 kwargs={"app": endpoint.provider.application.slug, "endpoint": endpoint.pk},

authentik/enterprise/providers/rac/api/providers.py

@@ -16,12 +16,7 @@ class RACProviderSerializer(EnterpriseRequiredMixin, ProviderSerializer):
 
     class Meta:
         model = RACProvider
-        fields = ProviderSerializer.Meta.fields + [
-            "settings",
-            "outpost_set",
-            "connection_expiry",
-            "delete_token_on_disconnect",
-        ]
+        fields = ProviderSerializer.Meta.fields + ["settings", "outpost_set", "connection_expiry"]
         extra_kwargs = ProviderSerializer.Meta.extra_kwargs
 
 

authentik/enterprise/providers/rac/apps.py

@@ -12,3 +12,7 @@ class AuthentikEnterpriseProviderRAC(EnterpriseConfig):
     default = True
     mountpoint = ""
     ws_mountpoint = "authentik.enterprise.providers.rac.urls"
+
+    def reconcile_global_load_rac_signals(self):
+        """Load rac signals"""
+        self.import_module("authentik.enterprise.providers.rac.signals")

authentik/enterprise/providers/rac/consumer_client.py

@@ -43,7 +43,6 @@ class RACClientConsumer(AsyncWebsocketConsumer):
     logger: BoundLogger
 
     async def connect(self):
-        self.logger = get_logger()
         await self.accept("guacamole")
         await self.channel_layer.group_add(RAC_CLIENT_GROUP, self.channel_name)
         await self.channel_layer.group_add(
@@ -65,11 +64,9 @@ class RACClientConsumer(AsyncWebsocketConsumer):
     @database_sync_to_async
     def init_outpost_connection(self):
         """Initialize guac connection settings"""
-        self.token = (
-            ConnectionToken.filter_not_expired(token=self.scope["url_route"]["kwargs"]["token"])
-            .select_related("endpoint", "provider", "session", "session__user")
-            .first()
-        )
+        self.token = ConnectionToken.filter_not_expired(
+            token=self.scope["url_route"]["kwargs"]["token"]
+        ).first()
         if not self.token:
             raise DenyConnection()
         self.provider = self.token.provider
@@ -110,9 +107,6 @@ class RACClientConsumer(AsyncWebsocketConsumer):
                 OUTPOST_GROUP_INSTANCE % {"outpost_pk": str(outpost.pk), "instance": states[0].uid},
                 msg,
             )
-        if self.provider and self.provider.delete_token_on_disconnect:
-            self.logger.info("Deleting connection token to prevent reconnect", token=self.token)
-            self.token.delete()
 
     async def receive(self, text_data=None, bytes_data=None):
         """Mirror data received from client to the dest_channel_id

authentik/enterprise/providers/rac/migrations/0001_squashed_0003_alter_connectiontoken_options_and_more.py

@@ -1,181 +0,0 @@
-# Generated by Django 5.0.1 on 2024-02-11 19:04
-
-import uuid
-
-import django.db.models.deletion
-from django.db import migrations, models
-
-import authentik.core.models
-import authentik.lib.utils.time
-
-
-class Migration(migrations.Migration):
-
-    replaces = [
-        ("authentik_providers_rac", "0001_initial"),
-        ("authentik_providers_rac", "0002_endpoint_maximum_connections"),
-        ("authentik_providers_rac", "0003_alter_connectiontoken_options_and_more"),
-    ]
-
-    initial = True
-
-    dependencies = [
-        ("authentik_core", "0032_group_roles"),
-        ("authentik_policies", "0011_policybinding_failure_result_and_more"),
-    ]
-
-    operations = [
-        migrations.CreateModel(
-            name="RACPropertyMapping",
-            fields=[
-                (
-                    "propertymapping_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_core.propertymapping",
-                    ),
-                ),
-                ("static_settings", models.JSONField(default=dict)),
-            ],
-            options={
-                "verbose_name": "RAC Property Mapping",
-                "verbose_name_plural": "RAC Property Mappings",
-            },
-            bases=("authentik_core.propertymapping",),
-        ),
-        migrations.CreateModel(
-            name="RACProvider",
-            fields=[
-                (
-                    "provider_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_core.provider",
-                    ),
-                ),
-                ("settings", models.JSONField(default=dict)),
-                (
-                    "auth_mode",
-                    models.TextField(
-                        choices=[("static", "Static"), ("prompt", "Prompt")], default="prompt"
-                    ),
-                ),
-                (
-                    "connection_expiry",
-                    models.TextField(
-                        default="hours=8",
-                        help_text="Determines how long a session lasts. Default of 0 means that the sessions lasts until the browser is closed. (Format: hours=-1;minutes=-2;seconds=-3)",
-                        validators=[authentik.lib.utils.time.timedelta_string_validator],
-                    ),
-                ),
-                (
-                    "delete_token_on_disconnect",
-                    models.BooleanField(
-                        default=False,
-                        help_text="When set to true, connection tokens will be deleted upon disconnect.",
-                    ),
-                ),
-            ],
-            options={
-                "verbose_name": "RAC Provider",
-                "verbose_name_plural": "RAC Providers",
-            },
-            bases=("authentik_core.provider",),
-        ),
-        migrations.CreateModel(
-            name="Endpoint",
-            fields=[
-                (
-                    "policybindingmodel_ptr",
-                    models.OneToOneField(
-                        auto_created=True,
-                        on_delete=django.db.models.deletion.CASCADE,
-                        parent_link=True,
-                        primary_key=True,
-                        serialize=False,
-                        to="authentik_policies.policybindingmodel",
-                    ),
-                ),
-                ("name", models.TextField()),
-                ("host", models.TextField()),
-                (
-                    "protocol",
-                    models.TextField(choices=[("rdp", "Rdp"), ("vnc", "Vnc"), ("ssh", "Ssh")]),
-                ),
-                ("settings", models.JSONField(default=dict)),
-                (
-                    "auth_mode",
-                    models.TextField(choices=[("static", "Static"), ("prompt", "Prompt")]),
-                ),
-                (
-                    "property_mappings",
-                    models.ManyToManyField(
-                        blank=True, default=None, to="authentik_core.propertymapping"
-                    ),
-                ),
-                (
-                    "provider",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_providers_rac.racprovider",
-                    ),
-                ),
-                ("maximum_connections", models.IntegerField(default=1)),
-            ],
-            options={
-                "verbose_name": "RAC Endpoint",
-                "verbose_name_plural": "RAC Endpoints",
-            },
-            bases=("authentik_policies.policybindingmodel", models.Model),
-        ),
-        migrations.CreateModel(
-            name="ConnectionToken",
-            fields=[
-                (
-                    "expires",
-                    models.DateTimeField(default=authentik.core.models.default_token_duration),
-                ),
-                ("expiring", models.BooleanField(default=True)),
-                (
-                    "connection_token_uuid",
-                    models.UUIDField(default=uuid.uuid4, primary_key=True, serialize=False),
-                ),
-                ("token", models.TextField(default=authentik.core.models.default_token_key)),
-                ("settings", models.JSONField(default=dict)),
-                (
-                    "endpoint",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_providers_rac.endpoint",
-                    ),
-                ),
-                (
-                    "provider",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_providers_rac.racprovider",
-                    ),
-                ),
-                (
-                    "session",
-                    models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE,
-                        to="authentik_core.authenticatedsession",
-                    ),
-                ),
-            ],
-            options={
-                "abstract": False,
-                "verbose_name": "RAC Connection token",
-                "verbose_name_plural": "RAC Connection tokens",
-            },
-        ),
-    ]

authentik/enterprise/providers/rac/migrations/0003_alter_connectiontoken_options_and_more.py

@@ -1,28 +0,0 @@
-# Generated by Django 5.0.1 on 2024-02-11 19:04
-
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ("authentik_providers_rac", "0002_endpoint_maximum_connections"),
-    ]
-
-    operations = [
-        migrations.AlterModelOptions(
-            name="connectiontoken",
-            options={
-                "verbose_name": "RAC Connection token",
-                "verbose_name_plural": "RAC Connection tokens",
-            },
-        ),
-        migrations.AddField(
-            model_name="racprovider",
-            name="delete_token_on_disconnect",
-            field=models.BooleanField(
-                default=False,
-                help_text="When set to true, connection tokens will be deleted upon disconnect.",
-            ),
-        ),
-    ]

authentik/enterprise/providers/rac/models.py

@@ -1,18 +1,17 @@
 """RAC Models"""
 
-from typing import Any
+from typing import Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
 from django.db import models
 from django.db.models import QuerySet
-from django.http import HttpRequest
 from django.utils.translation import gettext as _
 from rest_framework.serializers import Serializer
 from structlog.stdlib import get_logger
 
 from authentik.core.exceptions import PropertyMappingExpressionException
-from authentik.core.models import ExpiringModel, PropertyMapping, Provider, User, default_token_key
+from authentik.core.models import ExpiringModel, PropertyMapping, Provider, default_token_key
 from authentik.events.models import Event, EventAction
 from authentik.lib.models import SerializerModel
 from authentik.lib.utils.time import timedelta_string_validator
@@ -52,13 +51,9 @@ class RACProvider(Provider):
             "(Format: hours=-1;minutes=-2;seconds=-3)"
         ),
     )
-    delete_token_on_disconnect = models.BooleanField(
-        default=False,
-        help_text=_("When set to true, connection tokens will be deleted upon disconnect."),
-    )
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return "goauthentik.io://providers/rac/launch"
@@ -112,12 +107,6 @@ class RACPropertyMapping(PropertyMapping):
 
     static_settings = models.JSONField(default=dict)
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
-        """Evaluate `self.expression` using `**kwargs` as Context."""
-        if len(self.static_settings) > 0:
-            return self.static_settings
-        return super().evaluate(user, request, **kwargs)
-
     @property
     def component(self) -> str:
         return "ak-property-mapping-rac-form"
@@ -166,6 +155,9 @@ class ConnectionToken(ExpiringModel):
         def mapping_evaluator(mappings: QuerySet):
             for mapping in mappings:
                 mapping: RACPropertyMapping
+                if len(mapping.static_settings) > 0:
+                    always_merger.merge(settings, mapping.static_settings)
+                    continue
                 try:
                     mapping_settings = mapping.evaluate(
                         self.session.user, None, endpoint=self.endpoint, provider=self.provider
@@ -199,13 +191,3 @@ class ConnectionToken(ExpiringModel):
                 continue
             settings[key] = str(value)
         return settings
-
-    def __str__(self):
-        return (
-            f"RAC Connection token {self.session.user} to "
-            f"{self.endpoint.provider.name}/{self.endpoint.name}"
-        )
-
-    class Meta:
-        verbose_name = _("RAC Connection token")
-        verbose_name_plural = _("RAC Connection tokens")

authentik/enterprise/providers/rac/signals.py

@@ -45,8 +45,8 @@ def pre_delete_connection_token_disconnect(sender, instance: ConnectionToken, **
 
 
 @receiver(post_save, sender=Endpoint)
-def post_save_endpoint(sender: type[Model], instance, created: bool, **_):
-    """Clear user's endpoint cache upon endpoint creation"""
+def post_save_application(sender: type[Model], instance, created: bool, **_):
+    """Clear user's application cache upon application creation"""
     if not created:  # pragma: no cover
         return
 

authentik/enterprise/providers/rac/tests/test_endpoints_api.py

@@ -70,7 +70,6 @@ class TestEndpointsAPI(APITestCase):
                             "authorization_flow": None,
                             "property_mappings": [],
                             "connection_expiry": "hours=8",
-                            "delete_token_on_disconnect": False,
                             "component": "ak-provider-rac-form",
                             "assigned_application_slug": self.app.slug,
                             "assigned_application_name": self.app.name,
@@ -125,7 +124,6 @@ class TestEndpointsAPI(APITestCase):
                             "assigned_application_slug": self.app.slug,
                             "assigned_application_name": self.app.name,
                             "connection_expiry": "hours=8",
-                            "delete_token_on_disconnect": False,
                             "verbose_name": "RAC Provider",
                             "verbose_name_plural": "RAC Providers",
                             "meta_model_name": "authentik_providers_rac.racprovider",
@@ -154,7 +152,6 @@ class TestEndpointsAPI(APITestCase):
                             "assigned_application_slug": self.app.slug,
                             "assigned_application_name": self.app.name,
                             "connection_expiry": "hours=8",
-                            "delete_token_on_disconnect": False,
                             "verbose_name": "RAC Provider",
                             "verbose_name_plural": "RAC Providers",
                             "meta_model_name": "authentik_providers_rac.racprovider",

authentik/enterprise/providers/rac/tests/test_views.py

@@ -11,8 +11,7 @@ from rest_framework.test import APITestCase
 
 from authentik.core.models import Application
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
-from authentik.enterprise.license import LicenseKey
-from authentik.enterprise.models import License
+from authentik.enterprise.models import License, LicenseKey
 from authentik.enterprise.providers.rac.models import Endpoint, Protocols, RACProvider
 from authentik.lib.generators import generate_id
 from authentik.policies.denied import AccessDeniedResponse
@@ -40,7 +39,7 @@ class TestRACViews(APITestCase):
         )
 
     @patch(
-        "authentik.enterprise.license.LicenseKey.validate",
+        "authentik.enterprise.models.LicenseKey.validate",
         MagicMock(
             return_value=LicenseKey(
                 aud="",
@@ -71,7 +70,7 @@ class TestRACViews(APITestCase):
         self.assertEqual(final_response.status_code, 200)
 
     @patch(
-        "authentik.enterprise.license.LicenseKey.validate",
+        "authentik.enterprise.models.LicenseKey.validate",
         MagicMock(
             return_value=LicenseKey(
                 aud="",
@@ -100,7 +99,7 @@ class TestRACViews(APITestCase):
         self.assertIsInstance(response, AccessDeniedResponse)
 
     @patch(
-        "authentik.enterprise.license.LicenseKey.validate",
+        "authentik.enterprise.models.LicenseKey.validate",
         MagicMock(
             return_value=LicenseKey(
                 aud="",

authentik/enterprise/providers/rac/urls.py

@@ -6,7 +6,6 @@ from django.urls import path
 from django.views.decorators.csrf import ensure_csrf_cookie
 
 from authentik.core.channels import TokenOutpostMiddleware
-from authentik.enterprise.providers.rac.api.connection_tokens import ConnectionTokenViewSet
 from authentik.enterprise.providers.rac.api.endpoints import EndpointViewSet
 from authentik.enterprise.providers.rac.api.property_mappings import RACPropertyMappingViewSet
 from authentik.enterprise.providers.rac.api.providers import RACProviderViewSet
@@ -46,5 +45,4 @@ api_urlpatterns = [
     ("providers/rac", RACProviderViewSet),
     ("propertymappings/rac", RACPropertyMappingViewSet),
     ("rac/endpoints", EndpointViewSet),
-    ("rac/connection_tokens", ConnectionTokenViewSet),
 ]

authentik/enterprise/providers/rac/views.py

@@ -47,7 +47,7 @@ class RACStartView(EnterprisePolicyAccessView):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(
             in_memory_stage(
                 RACFinalStage,
@@ -104,15 +104,14 @@ class RACFinalStage(RedirectStage):
         # Check if we're already at the maximum connection limit
         all_tokens = ConnectionToken.filter_not_expired(
             endpoint=self.endpoint,
-        )
-        if self.endpoint.maximum_connections > -1:
-            if all_tokens.count() >= self.endpoint.maximum_connections:
-                msg = [_("Maximum connection limit reached.")]
-                # Check if any other tokens exist for the current user, and inform them
-                # they are already connected
-                if all_tokens.filter(session__user=self.request.user).exists():
-                    msg.append(_("(You are already connected in another tab/window)"))
-                return self.executor.stage_invalid(" ".join(msg))
+        ).exclude(endpoint__maximum_connections__lte=-1)
+        if all_tokens.count() >= self.endpoint.maximum_connections:
+            msg = [_("Maximum connection limit reached.")]
+            # Check if any other tokens exist for the current user, and inform them
+            # they are already connected
+            if all_tokens.filter(session__user=self.request.user).exists():
+                msg.append(_("(You are already connected in another tab/window)"))
+            return self.executor.stage_invalid(" ".join(msg))
         return super().dispatch(request, *args, **kwargs)
 
     def get_challenge(self, *args, **kwargs) -> RedirectChallenge:
@@ -132,7 +131,16 @@ class RACFinalStage(RedirectStage):
             flow=self.executor.plan.flow_pk,
             endpoint=self.endpoint.name,
         ).from_http(self.request)
-        self.executor.current_stage.destination = self.request.build_absolute_uri(
-            reverse("authentik_providers_rac:if-rac", kwargs={"token": str(token.token)})
+        setattr(
+            self.executor.current_stage,
+            "destination",
+            self.request.build_absolute_uri(
+                reverse(
+                    "authentik_providers_rac:if-rac",
+                    kwargs={
+                        "token": str(token.token),
+                    },
+                )
+            ),
         )
         return super().get_challenge(*args, **kwargs)

authentik/enterprise/settings.py

@@ -5,9 +5,9 @@ from celery.schedules import crontab
 from authentik.lib.utils.time import fqdn_rand
 
 CELERY_BEAT_SCHEDULE = {
-    "enterprise_update_usage": {
-        "task": "authentik.enterprise.tasks.enterprise_update_usage",
-        "schedule": crontab(minute=fqdn_rand("enterprise_update_usage"), hour="*/2"),
+    "enterprise_calculate_license": {
+        "task": "authentik.enterprise.tasks.calculate_license",
+        "schedule": crontab(minute=fqdn_rand("calculate_license"), hour="*/2"),
         "options": {"queue": "authentik_scheduled"},
     }
 }
@@ -16,5 +16,3 @@ TENANT_APPS = [
     "authentik.enterprise.audit",
     "authentik.enterprise.providers.rac",
 ]
-
-MIDDLEWARE = ["authentik.enterprise.middleware.EnterpriseMiddleware"]

authentik/enterprise/signals.py

@@ -2,14 +2,11 @@
 
 from datetime import datetime
 
-from django.core.cache import cache
-from django.db.models.signals import post_save, pre_save
+from django.db.models.signals import pre_save
 from django.dispatch import receiver
 from django.utils.timezone import get_current_timezone
 
-from authentik.enterprise.license import CACHE_KEY_ENTERPRISE_LICENSE
 from authentik.enterprise.models import License
-from authentik.enterprise.tasks import enterprise_update_usage
 
 
 @receiver(pre_save, sender=License)
@@ -20,10 +17,3 @@ def pre_save_license(sender: type[License], instance: License, **_):
     instance.internal_users = status.internal_users
     instance.external_users = status.external_users
     instance.expiry = datetime.fromtimestamp(status.exp, tz=get_current_timezone())
-
-
-@receiver(post_save, sender=License)
-def post_save_license(sender: type[License], instance: License, **_):
-    """Trigger license usage calculation when license is saved"""
-    cache.delete(CACHE_KEY_ENTERPRISE_LICENSE)
-    enterprise_update_usage.delay()

authentik/enterprise/tasks.py

@@ -1,14 +1,10 @@
 """Enterprise tasks"""
 
-from authentik.enterprise.license import LicenseKey
-from authentik.events.models import TaskStatus
-from authentik.events.system_tasks import SystemTask, prefill_task
+from authentik.enterprise.models import LicenseKey
 from authentik.root.celery import CELERY_APP
 
 
-@CELERY_APP.task(bind=True, base=SystemTask)
-@prefill_task
-def enterprise_update_usage(self: SystemTask):
-    """Update enterprise license status"""
+@CELERY_APP.task()
+def calculate_license():
+    """Calculate licensing status"""
     LicenseKey.get_total().record_usage()
-    self.set_status(TaskStatus.SUCCESSFUL)