release: 2024.2.4

security: fix CVE-2024-37905 (#10230)

Co-authored-by: Jens L <jens@goauthentik.io>

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2024.2.2
+current_version = 2024.2.4
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?

.github/ISSUE_TEMPLATE/question.md

@@ -9,7 +9,7 @@ assignees: ""
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 
-**Relevant info**
+**Relevant infos**
 i.e. Version of other software you're using, specifics of your setup
 
 **Screenshots**

.github/dependabot.yml

@@ -52,10 +52,6 @@ updates:
       esbuild:
         patterns:
           - "@esbuild/*"
-      rollup:
-        patterns:
-          - "@rollup/*"
-          - "rollup-*"
   - package-ecosystem: npm
     directory: "/tests/wdio"
     schedule:

.github/workflows/ci-main.yml

@@ -28,7 +28,10 @@ jobs:
           - bandit
           - black
           - codespell
+          - isort
           - pending-migrations
+          # - pylint
+          - pyright
           - ruff
     runs-on: ubuntu-latest
     steps:

.github/workflows/ci-website.yml

@@ -48,6 +48,7 @@ jobs:
       matrix:
         job:
           - build
+          - build-docs-only
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4

.vscode/extensions.json

@@ -10,7 +10,8 @@
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
         "ms-python.black-formatter",
-        "charliermarsh.ruff",
+        "ms-python.isort",
+        "ms-python.pylint",
         "ms-python.python",
         "ms-python.vscode-pylance",
         "ms-python.black-formatter",

Dockerfile

@@ -14,10 +14,9 @@ RUN --mount=type=bind,target=/work/website/package.json,src=./website/package.js
 
 COPY ./website /work/website/
 COPY ./blueprints /work/blueprints/
-COPY ./schema.yml /work/
 COPY ./SECURITY.md /work/
 
-RUN npm run build-bundled
+RUN npm run build-docs-only
 
 # Stage 2: Build webui
 FROM --platform=${BUILDPLATFORM} docker.io/node:21 as web-builder
@@ -38,7 +37,7 @@ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api
 RUN npm run build
 
 # Stage 3: Build go proxy
-FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.1-bookworm AS go-builder
+FROM --platform=${BUILDPLATFORM} docker.io/golang:1.22.0-bookworm AS go-builder
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -151,7 +150,7 @@ COPY --from=go-builder /go/authentik /bin/authentik
 COPY --from=python-deps /ak-root/venv /ak-root/venv
 COPY --from=web-builder /work/web/dist/ /web/dist/
 COPY --from=web-builder /work/web/authentik/ /web/authentik/
-COPY --from=website-builder /work/website/build/ /website/help/
+COPY --from=website-builder /work/website/help/ /website/help/
 COPY --from=geoip /usr/share/GeoIP /geoip
 
 USER 1000

Makefile

@@ -59,12 +59,15 @@ test: ## Run the server tests and produce a coverage report (locally)
 	coverage report
 
 lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
+	isort $(PY_SOURCES)
 	black $(PY_SOURCES)
-	ruff check --fix $(PY_SOURCES)
+	ruff --fix $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
 lint: ## Lint the python and golang sources
 	bandit -r $(PY_SOURCES) -x node_modules
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
 core-install:
@@ -246,6 +249,9 @@ ci--meta-debug:
 	python -V
 	node --version
 
+ci-pylint: ci--meta-debug
+	pylint $(PY_SOURCES)
+
 ci-black: ci--meta-debug
 	black --check $(PY_SOURCES)
 
@@ -255,8 +261,14 @@ ci-ruff: ci--meta-debug
 ci-codespell: ci--meta-debug
 	codespell $(CODESPELL_ARGS) -s
 
+ci-isort: ci--meta-debug
+	isort --check $(PY_SOURCES)
+
 ci-bandit: ci--meta-debug
 	bandit -r $(PY_SOURCES)
 
+ci-pyright: ci--meta-debug
+	./web/node_modules/.bin/pyright $(PY_SOURCES)
+
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

authentik/__init__.py

@@ -1,12 +1,13 @@
 """authentik root module"""
 
 from os import environ
+from typing import Optional
 
-__version__ = "2024.2.2"
+__version__ = "2024.2.4"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 
-def get_build_hash(fallback: str | None = None) -> str:
+def get_build_hash(fallback: Optional[str] = None) -> str:
     """Get build hash"""
     build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
     return fallback if build_hash == "" and fallback else build_hash

authentik/api/apps.py

@@ -18,7 +18,7 @@ class AuthentikAPIConfig(AppConfig):
 
         # Class is defined here as it needs to be created early enough that drf-spectacular will
         # find it, but also won't cause any import issues
-
+        # pylint: disable=unused-variable
         class TokenSchema(OpenApiAuthenticationExtension):
             """Auth schema"""
 

authentik/api/authentication.py

@@ -1,7 +1,7 @@
 """API Authentication"""
 
 from hmac import compare_digest
-from typing import Any
+from typing import Any, Optional
 
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
@@ -17,7 +17,7 @@ from authentik.providers.oauth2.constants import SCOPE_AUTHENTIK_API
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> str | None:
+def validate_auth(header: bytes) -> Optional[str]:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -32,7 +32,7 @@ def validate_auth(header: bytes) -> str | None:
     return auth_credentials
 
 
-def bearer_auth(raw_header: bytes) -> User | None:
+def bearer_auth(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     user = auth_user_lookup(raw_header)
     if not user:
@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> User | None:
     return user
 
 
-def auth_user_lookup(raw_header: bytes) -> User | None:
+def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     """raw_header in the Format of `Bearer ....`"""
     from authentik.providers.oauth2.models import AccessToken
 
@@ -75,7 +75,7 @@ def auth_user_lookup(raw_header: bytes) -> User | None:
     raise AuthenticationFailed("Token invalid/expired")
 
 
-def token_secret_key(value: str) -> User | None:
+def token_secret_key(value: str) -> Optional[User]:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST

authentik/api/tests/test_auth.py

@@ -25,17 +25,17 @@ class TestAPIAuth(TestCase):
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth(b"foo bar")
+            bearer_auth("foo bar".encode())
 
     def test_invalid_empty(self):
         """Test invalid type"""
-        self.assertIsNone(bearer_auth(b"Bearer "))
+        self.assertIsNone(bearer_auth("Bearer ".encode()))
-        self.assertIsNone(bearer_auth(b""))
+        self.assertIsNone(bearer_auth("".encode()))
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
-            auth = b64encode(b":abc").decode()
+            auth = b64encode(":abc".encode()).decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
     def test_bearer_valid(self):

authentik/api/tests/test_viewsets.py

@@ -1,6 +1,6 @@
 """authentik API Modelviewset tests"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.test import TestCase
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -26,6 +26,6 @@ def viewset_tester_factory(test_viewset: type[ModelViewSet]) -> Callable:
 
 
 for _, viewset, _ in router.registry:
-    if not issubclass(viewset, ModelViewSet | ReadOnlyModelViewSet):
+    if not issubclass(viewset, (ModelViewSet, ReadOnlyModelViewSet)):
         continue
     setattr(TestModelViewSets, f"test_viewset_{viewset.__name__}", viewset_tester_factory(viewset))

authentik/api/v3/urls.py

@@ -33,7 +33,7 @@ for _authentik_app in get_apps():
             app_name=_authentik_app.name,
         )
         continue
-    urls: list = api_urls.api_urlpatterns
+    urls: list = getattr(api_urls, "api_urlpatterns")
     for url in urls:
         if isinstance(url, URLPattern):
             _other_urls.append(url)

authentik/blueprints/api.py

@@ -52,9 +52,7 @@ class BlueprintInstanceSerializer(ModelSerializer):
         valid, logs = Importer.from_string(content, context).validate()
         if not valid:
             text_logs = "\n".join([x["event"] for x in logs])
-            raise ValidationError(
+            raise ValidationError(_("Failed to validate blueprint: %(logs)s" % {"logs": text_logs}))
-                _("Failed to validate blueprint: {logs}".format_map({"logs": text_logs}))
-            )
         return content
 
     def validate(self, attrs: dict) -> dict:

authentik/blueprints/apps.py

@@ -1,6 +1,5 @@
 """authentik Blueprints app"""
 
-from collections.abc import Callable
 from importlib import import_module
 from inspect import ismethod
 
@@ -14,8 +13,8 @@ class ManagedAppConfig(AppConfig):
 
     logger: BoundLogger
 
-    RECONCILE_GLOBAL_CATEGORY: str = "global"
+    RECONCILE_GLOBAL_PREFIX: str = "reconcile_global_"
-    RECONCILE_TENANT_CATEGORY: str = "tenant"
+    RECONCILE_TENANT_PREFIX: str = "reconcile_tenant_"
 
     def __init__(self, app_name: str, *args, **kwargs) -> None:
         super().__init__(app_name, *args, **kwargs)
@@ -23,8 +22,8 @@ class ManagedAppConfig(AppConfig):
 
     def ready(self) -> None:
         self.import_related()
-        self._reconcile_global()
+        self.reconcile_global()
-        self._reconcile_tenant()
+        self.reconcile_tenant()
         return super().ready()
 
     def import_related(self):
@@ -52,8 +51,7 @@ class ManagedAppConfig(AppConfig):
             meth = getattr(self, meth_name)
             if not ismethod(meth):
                 continue
-            category = getattr(meth, "_authentik_managed_reconcile", None)
+            if not meth_name.startswith(prefix):
-            if category != prefix:
                 continue
             name = meth_name.replace(prefix, "")
             try:
@@ -63,19 +61,7 @@ class ManagedAppConfig(AppConfig):
             except (DatabaseError, ProgrammingError, InternalError) as exc:
                 self.logger.warning("Failed to run reconcile", name=name, exc=exc)
 
-    @staticmethod
+    def reconcile_tenant(self) -> None:
-    def reconcile_tenant(func: Callable):
-        """Mark a function to be called on startup (for each tenant)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_TENANT_CATEGORY
-        return func
-
-    @staticmethod
-    def reconcile_global(func: Callable):
-        """Mark a function to be called on startup (globally)"""
-        func._authentik_managed_reconcile = ManagedAppConfig.RECONCILE_GLOBAL_CATEGORY
-        return func
-
-    def _reconcile_tenant(self) -> None:
         """reconcile ourselves for tenanted methods"""
         from authentik.tenants.models import Tenant
 
@@ -86,9 +72,9 @@ class ManagedAppConfig(AppConfig):
             return
         for tenant in tenants:
             with tenant:
-                self._reconcile(self.RECONCILE_TENANT_CATEGORY)
+                self._reconcile(self.RECONCILE_TENANT_PREFIX)
 
-    def _reconcile_global(self) -> None:
+    def reconcile_global(self) -> None:
         """
         reconcile ourselves for global methods.
         Used for signals, tasks, etc. Database queries should not be made in here.
@@ -96,7 +82,7 @@ class ManagedAppConfig(AppConfig):
         from django_tenants.utils import get_public_schema_name, schema_context
 
         with schema_context(get_public_schema_name()):
-            self._reconcile(self.RECONCILE_GLOBAL_CATEGORY)
+            self._reconcile(self.RECONCILE_GLOBAL_PREFIX)
 
 
 class AuthentikBlueprintsConfig(ManagedAppConfig):
@@ -107,13 +93,11 @@ class AuthentikBlueprintsConfig(ManagedAppConfig):
     verbose_name = "authentik Blueprints"
     default = True
 
-    @ManagedAppConfig.reconcile_global
+    def reconcile_global_load_blueprints_v1_tasks(self):
-    def load_blueprints_v1_tasks(self):
         """Load v1 tasks"""
         self.import_module("authentik.blueprints.v1.tasks")
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_blueprints_discovery(self):
-    def blueprints_discovery(self):
         """Run blueprint discovery"""
         from authentik.blueprints.v1.tasks import blueprints_discovery, clear_failed_blueprints
 

authentik/blueprints/models.py

@@ -71,19 +71,6 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
     enabled = models.BooleanField(default=True)
     managed_models = ArrayField(models.TextField(), default=list)
 
-    class Meta:
-        verbose_name = _("Blueprint Instance")
-        verbose_name_plural = _("Blueprint Instances")
-        unique_together = (
-            (
-                "name",
-                "path",
-            ),
-        )
-
-    def __str__(self) -> str:
-        return f"Blueprint Instance {self.name}"
-
     def retrieve_oci(self) -> str:
         """Get blueprint from an OCI registry"""
         client = BlueprintOCIClient(self.path.replace(OCI_PREFIX, "https://"))
@@ -102,7 +89,7 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
                 raise BlueprintRetrievalFailed("Invalid blueprint path")
             with full_path.open("r", encoding="utf-8") as _file:
                 return _file.read()
-        except OSError as exc:
+        except (IOError, OSError) as exc:
             raise BlueprintRetrievalFailed(exc) from exc
 
     def retrieve(self) -> str:
@@ -118,3 +105,16 @@ class BlueprintInstance(SerializerModel, ManagedModel, CreatedUpdatedModel):
         from authentik.blueprints.api import BlueprintInstanceSerializer
 
         return BlueprintInstanceSerializer
+
+    def __str__(self) -> str:
+        return f"Blueprint Instance {self.name}"
+
+    class Meta:
+        verbose_name = _("Blueprint Instance")
+        verbose_name_plural = _("Blueprint Instances")
+        unique_together = (
+            (
+                "name",
+                "path",
+            ),
+        )

authentik/blueprints/tests/__init__.py

@@ -1,7 +1,7 @@
 """Blueprint helpers"""
 
-from collections.abc import Callable
 from functools import wraps
+from typing import Callable
 
 from django.apps import apps
 

authentik/blueprints/tests/test_packaged.py

@@ -1,7 +1,7 @@
 """test packaged blueprints"""
 
-from collections.abc import Callable
 from pathlib import Path
+from typing import Callable
 
 from django.test import TransactionTestCase
 

authentik/blueprints/tests/test_serializer_models.py

@@ -1,6 +1,6 @@
 """authentik managed models tests"""
 
-from collections.abc import Callable
+from typing import Callable, Type
 
 from django.apps import apps
 from django.test import TestCase
@@ -14,7 +14,7 @@ class TestModels(TestCase):
     """Test Models"""
 
 
-def serializer_tester_factory(test_model: type[SerializerModel]) -> Callable:
+def serializer_tester_factory(test_model: Type[SerializerModel]) -> Callable:
     """Test serializer"""
 
     def tester(self: TestModels):

authentik/blueprints/tests/test_v1_tasks.py

@@ -54,7 +54,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
             file.seek(0)
             file_hash = sha512(file.read().encode()).hexdigest()
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             instance = BlueprintInstance.objects.filter(name=blueprint_id).first()
             self.assertEqual(instance.last_applied_hash, file_hash)
             self.assertEqual(
@@ -82,7 +82,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint = BlueprintInstance.objects.filter(name="foo").first()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -107,7 +107,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 )
             )
             file.flush()
-            blueprints_discovery()
+            blueprints_discovery()  # pylint: disable=no-value-for-parameter
             blueprint.refresh_from_db()
             self.assertEqual(
                 blueprint.last_applied_hash,
@@ -149,7 +149,7 @@ class TestBlueprintsV1Tasks(TransactionTestCase):
                 instance.status,
                 BlueprintInstanceStatus.UNKNOWN,
             )
-            apply_blueprint(instance.pk)
+            apply_blueprint(instance.pk)  # pylint: disable=no-value-for-parameter
             instance.refresh_from_db()
             self.assertEqual(instance.last_applied_hash, "")
             self.assertEqual(

authentik/blueprints/v1/common.py

@@ -1,14 +1,13 @@
 """transfer common classes"""
 
 from collections import OrderedDict
-from collections.abc import Iterable, Mapping
 from copy import copy
 from dataclasses import asdict, dataclass, field, is_dataclass
 from enum import Enum
 from functools import reduce
 from operator import ixor
 from os import getenv
-from typing import Any, Literal, Union
+from typing import Any, Iterable, Literal, Mapping, Optional, Union
 from uuid import UUID
 
 from deepmerge import always_merger
@@ -46,7 +45,7 @@ def get_attrs(obj: SerializerModel) -> dict[str, Any]:
 class BlueprintEntryState:
     """State of a single instance"""
 
-    instance: Model | None = None
+    instance: Optional[Model] = None
 
 
 class BlueprintEntryDesiredState(Enum):
@@ -68,9 +67,9 @@ class BlueprintEntry:
     )
     conditions: list[Any] = field(default_factory=list)
     identifiers: dict[str, Any] = field(default_factory=dict)
-    attrs: dict[str, Any] | None = field(default_factory=dict)
+    attrs: Optional[dict[str, Any]] = field(default_factory=dict)
 
-    id: str | None = None
+    id: Optional[str] = None
 
     _state: BlueprintEntryState = field(default_factory=BlueprintEntryState)
 
@@ -93,10 +92,10 @@ class BlueprintEntry:
             attrs=all_attrs,
         )
 
-    def get_tag_context(
+    def _get_tag_context(
         self,
         depth: int = 0,
-        context_tag_type: type["YAMLTagContext"] | tuple["YAMLTagContext", ...] | None = None,
+        context_tag_type: Optional[type["YAMLTagContext"] | tuple["YAMLTagContext", ...]] = None,
     ) -> "YAMLTagContext":
         """Get a YAMLTagContext object located at a certain depth in the tag tree"""
         if depth < 0:
@@ -109,8 +108,8 @@ class BlueprintEntry:
 
         try:
             return contexts[-(depth + 1)]
-        except IndexError as exc:
+        except IndexError:
-            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}") from exc
+            raise ValueError(f"invalid depth: {depth}. Max depth: {len(contexts) - 1}")
 
     def tag_resolver(self, value: Any, blueprint: "Blueprint") -> Any:
         """Check if we have any special tags that need handling"""
@@ -171,7 +170,7 @@ class Blueprint:
     entries: list[BlueprintEntry] = field(default_factory=list)
     context: dict = field(default_factory=dict)
 
-    metadata: BlueprintMetadata | None = field(default=None)
+    metadata: Optional[BlueprintMetadata] = field(default=None)
 
 
 class YAMLTag:
@@ -219,7 +218,7 @@ class Env(YAMLTag):
     """Lookup environment variable with optional default"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -238,7 +237,7 @@ class Context(YAMLTag):
     """Lookup key from instance context"""
 
     key: str
-    default: Any | None
+    default: Optional[Any]
 
     def __init__(self, loader: "BlueprintLoader", node: ScalarNode | SequenceNode) -> None:
         super().__init__()
@@ -282,7 +281,7 @@ class Format(YAMLTag):
         try:
             return self.format_string % tuple(args)
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Find(YAMLTag):
@@ -367,7 +366,7 @@ class Condition(YAMLTag):
             comparator = self._COMPARATORS[self.mode.upper()]
             return comparator(tuple(bool(x) for x in args))
         except (TypeError, KeyError) as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class If(YAMLTag):
@@ -399,7 +398,7 @@ class If(YAMLTag):
                 blueprint,
             )
         except TypeError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
 
 class Enumerate(YAMLTag, YAMLTagContext):
@@ -413,7 +412,9 @@ class Enumerate(YAMLTag, YAMLTagContext):
         "SEQ": (list, lambda a, b: [*a, b]),
         "MAP": (
             dict,
-            lambda a, b: always_merger.merge(a, {b[0]: b[1]} if isinstance(b, tuple | list) else b),
+            lambda a, b: always_merger.merge(
+                a, {b[0]: b[1]} if isinstance(b, (tuple, list)) else b
+            ),
         ),
     }
 
@@ -455,7 +456,7 @@ class Enumerate(YAMLTag, YAMLTagContext):
         try:
             output_class, add_fn = self._OUTPUT_BODIES[self.output_body.upper()]
         except KeyError as exc:
-            raise EntryInvalidError.from_entry(exc, entry) from exc
+            raise EntryInvalidError.from_entry(exc, entry)
 
         result = output_class()
 
@@ -483,13 +484,13 @@ class EnumeratedItem(YAMLTag):
 
     _SUPPORTED_CONTEXT_TAGS = (Enumerate,)
 
-    def __init__(self, _loader: "BlueprintLoader", node: ScalarNode) -> None:
+    def __init__(self, loader: "BlueprintLoader", node: ScalarNode) -> None:
         super().__init__()
         self.depth = int(node.value)
 
     def resolve(self, entry: BlueprintEntry, blueprint: Blueprint) -> Any:
         try:
-            context_tag: Enumerate = entry.get_tag_context(
+            context_tag: Enumerate = entry._get_tag_context(
                 depth=self.depth,
                 context_tag_type=EnumeratedItem._SUPPORTED_CONTEXT_TAGS,
             )
@@ -499,11 +500,9 @@ class EnumeratedItem(YAMLTag):
                     f"{self.__class__.__name__} tags are only usable "
                     f"inside an {Enumerate.__name__} tag",
                     entry,
-                ) from exc
+                )
 
-            raise EntryInvalidError.from_entry(
+            raise EntryInvalidError.from_entry(f"{self.__class__.__name__} tag: {exc}", entry)
-                f"{self.__class__.__name__} tag: {exc}", entry
-            ) from exc
 
         return context_tag.get_context(entry, blueprint)
 
@@ -516,8 +515,8 @@ class Index(EnumeratedItem):
 
         try:
             return context[0]
-        except IndexError as exc:  # pragma: no cover
+        except IndexError:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class Value(EnumeratedItem):
@@ -528,8 +527,8 @@ class Value(EnumeratedItem):
 
         try:
             return context[1]
-        except IndexError as exc:  # pragma: no cover
+        except IndexError:  # pragma: no cover
-            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry) from exc
+            raise EntryInvalidError.from_entry(f"Empty/invalid context: {context}", entry)
 
 
 class BlueprintDumper(SafeDumper):
@@ -583,13 +582,13 @@ class BlueprintLoader(SafeLoader):
 class EntryInvalidError(SentryIgnoredException):
     """Error raised when an entry is invalid"""
 
-    entry_model: str | None
+    entry_model: Optional[str]
-    entry_id: str | None
+    entry_id: Optional[str]
-    validation_error: ValidationError | None
+    validation_error: Optional[ValidationError]
-    serializer: Serializer | None = None
+    serializer: Optional[Serializer] = None
 
     def __init__(
-        self, *args: object, validation_error: ValidationError | None = None, **kwargs
+        self, *args: object, validation_error: Optional[ValidationError] = None, **kwargs
     ) -> None:
         super().__init__(*args)
         self.entry_model = None

authentik/blueprints/v1/exporter.py

@@ -1,6 +1,6 @@
 """Blueprint exporter"""
 
-from collections.abc import Iterable
+from typing import Iterable
 from uuid import UUID
 
 from django.apps import apps
@@ -59,7 +59,7 @@ class Exporter:
         blueprint = Blueprint()
         self._pre_export(blueprint)
         blueprint.metadata = BlueprintMetadata(
-            name=_("authentik Export - {date}".format_map({"date": str(now())})),
+            name=_("authentik Export - %(date)s" % {"date": str(now())}),
             labels={
                 LABEL_AUTHENTIK_GENERATED: "true",
             },

authentik/blueprints/v1/importer.py

@@ -2,7 +2,7 @@
 
 from contextlib import contextmanager
 from copy import deepcopy
-from typing import Any
+from typing import Any, Optional
 
 from dacite.config import Config
 from dacite.core import from_dict
@@ -62,7 +62,7 @@ SERIALIZER_CONTEXT_BLUEPRINT = "blueprint_entry"
 def excluded_models() -> list[type[Model]]:
     """Return a list of all excluded models that shouldn't be exposed via API
     or other means (internal only, base classes, non-used objects, etc)"""
-
+    # pylint: disable=imported-auth-user
     from django.contrib.auth.models import Group as DjangoGroup
     from django.contrib.auth.models import User as DjangoUser
 
@@ -101,7 +101,7 @@ def excluded_models() -> list[type[Model]]:
 
 def is_model_allowed(model: type[Model]) -> bool:
     """Check if model is allowed"""
-    return model not in excluded_models() and issubclass(model, SerializerModel | BaseMetaModel)
+    return model not in excluded_models() and issubclass(model, (SerializerModel, BaseMetaModel))
 
 
 class DoRollback(SentryIgnoredException):
@@ -125,7 +125,7 @@ class Importer:
     logger: BoundLogger
     _import: Blueprint
 
-    def __init__(self, blueprint: Blueprint, context: dict | None = None):
+    def __init__(self, blueprint: Blueprint, context: Optional[dict] = None):
         self.__pk_map: dict[Any, Model] = {}
         self._import = blueprint
         self.logger = get_logger()
@@ -168,7 +168,7 @@ class Importer:
         for key, value in attrs.items():
             try:
                 if isinstance(value, dict):
-                    for _, _inner_key in enumerate(value):
+                    for idx, _inner_key in enumerate(value):
                         value[_inner_key] = updater(value[_inner_key])
                 elif isinstance(value, list):
                     for idx, _inner_value in enumerate(value):
@@ -197,7 +197,8 @@ class Importer:
 
         return main_query | sub_query
 
-    def _validate_single(self, entry: BlueprintEntry) -> BaseSerializer | None:
+    # pylint: disable-msg=too-many-locals
+    def _validate_single(self, entry: BlueprintEntry) -> Optional[BaseSerializer]:
         """Validate a single entry"""
         if not entry.check_all_conditions_match(self._import):
             self.logger.debug("One or more conditions of this entry are not fulfilled, skipping")
@@ -368,7 +369,7 @@ class Importer:
                     self.__pk_map[entry.identifiers["pk"]] = instance.pk
                 entry._state = BlueprintEntryState(instance)
             elif state == BlueprintEntryDesiredState.ABSENT:
-                instance: Model | None = serializer.instance
+                instance: Optional[Model] = serializer.instance
                 if instance.pk:
                     instance.delete()
                     self.logger.debug("deleted model", mode=instance)

authentik/blueprints/v1/meta/apply_blueprint.py

@@ -43,7 +43,7 @@ class ApplyBlueprintMetaSerializer(PassiveSerializer):
             LOGGER.info("Blueprint does not exist, but not required")
             return MetaResult()
         LOGGER.debug("Applying blueprint from meta model", blueprint=self.blueprint_instance)
-
+        # pylint: disable=no-value-for-parameter
         apply_blueprint(str(self.blueprint_instance.pk))
         return MetaResult()
 

authentik/blueprints/v1/meta/registry.py

@@ -8,15 +8,15 @@ from rest_framework.serializers import Serializer
 class BaseMetaModel(Model):
     """Base models"""
 
-    class Meta:
-        abstract = True
-
     @staticmethod
     def serializer() -> Serializer:
         """Serializer similar to SerializerModel, but as a static method since
         this is an abstract model"""
         raise NotImplementedError
 
+    class Meta:
+        abstract = True
+
 
 class MetaResult:
     """Result returned by Meta Models' serializers. Empty class but we can't return none as

authentik/blueprints/v1/tasks.py

@@ -4,6 +4,7 @@ from dataclasses import asdict, dataclass, field
 from hashlib import sha512
 from pathlib import Path
 from sys import platform
+from typing import Optional
 
 from dacite.core import from_dict
 from django.db import DatabaseError, InternalError, ProgrammingError
@@ -49,14 +50,14 @@ class BlueprintFile:
     version: int
     hash: str
     last_m: int
-    meta: BlueprintMetadata | None = field(default=None)
+    meta: Optional[BlueprintMetadata] = field(default=None)
 
 
 def start_blueprint_watcher():
     """Start blueprint watcher, if it's not running already."""
     # This function might be called twice since it's called on celery startup
-
+    # pylint: disable=global-statement
-    global _file_watcher_started  # noqa: PLW0603
+    global _file_watcher_started
     if _file_watcher_started:
         return
     observer = Observer()
@@ -125,7 +126,7 @@ def blueprints_find() -> list[BlueprintFile]:
         # Check if any part in the path starts with a dot and assume a hidden file
         if any(part for part in path.parts if part.startswith(".")):
             continue
-        with open(path, encoding="utf-8") as blueprint_file:
+        with open(path, "r", encoding="utf-8") as blueprint_file:
             try:
                 raw_blueprint = load(blueprint_file.read(), BlueprintLoader)
             except YAMLError as exc:
@@ -149,7 +150,7 @@ def blueprints_find() -> list[BlueprintFile]:
     throws=(DatabaseError, ProgrammingError, InternalError), base=SystemTask, bind=True
 )
 @prefill_task
-def blueprints_discovery(self: SystemTask, path: str | None = None):
+def blueprints_discovery(self: SystemTask, path: Optional[str] = None):
     """Find blueprints and check if they need to be created in the database"""
     count = 0
     for blueprint in blueprints_find():
@@ -196,7 +197,7 @@ def check_blueprint_v1_file(blueprint: BlueprintFile):
 def apply_blueprint(self: SystemTask, instance_pk: str):
     """Apply single blueprint"""
     self.save_on_success = False
-    instance: BlueprintInstance | None = None
+    instance: Optional[BlueprintInstance] = None
     try:
         instance: BlueprintInstance = BlueprintInstance.objects.filter(pk=instance_pk).first()
         if not instance or not instance.enabled:
@@ -224,10 +225,10 @@ def apply_blueprint(self: SystemTask, instance_pk: str):
         instance.last_applied = now()
         self.set_status(TaskStatus.SUCCESSFUL)
     except (
-        OSError,
         DatabaseError,
         ProgrammingError,
         InternalError,
+        IOError,
         BlueprintRetrievalFailed,
         EntryInvalidError,
     ) as exc:

authentik/brands/middleware.py

@@ -1,6 +1,6 @@
 """Inject brand into current request"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.http.request import HttpRequest
 from django.http.response import HttpResponse
@@ -20,7 +20,7 @@ class BrandMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "brand"):
             brand = get_brand_for_request(request)
-            request.brand = brand
+            setattr(request, "brand", brand)
             locale = brand.default_locale
             if locale != "":
                 activate(locale)

authentik/brands/models.py

@@ -71,7 +71,7 @@ class Brand(SerializerModel):
         """Get default locale"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
             return ""

authentik/core/api/applications.py

@@ -1,8 +1,8 @@
 """Application API Views"""
 
-from collections.abc import Iterator
 from copy import copy
 from datetime import timedelta
+from typing import Iterator, Optional
 
 from django.core.cache import cache
 from django.db.models import QuerySet
@@ -60,7 +60,7 @@ class ApplicationSerializer(ModelSerializer):
 
     meta_icon = ReadOnlyField(source="get_meta_icon")
 
-    def get_launch_url(self, app: Application) -> str | None:
+    def get_launch_url(self, app: Application) -> Optional[str]:
         """Allow formatting of launch URL"""
         user = None
         if "request" in self.context:
@@ -100,6 +100,7 @@ class ApplicationSerializer(ModelSerializer):
 class ApplicationViewSet(UsedByMixin, ModelViewSet):
     """Application Viewset"""
 
+    # pylint: disable=no-member
     queryset = Application.objects.all().prefetch_related("provider")
     serializer_class = ApplicationSerializer
     search_fields = [
@@ -130,7 +131,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
         return queryset
 
     def _get_allowed_applications(
-        self, pagined_apps: Iterator[Application], user: User | None = None
+        self, pagined_apps: Iterator[Application], user: Optional[User] = None
     ) -> list[Application]:
         applications = []
         request = self.request._request
@@ -168,7 +169,7 @@ class ApplicationViewSet(UsedByMixin, ModelViewSet):
             try:
                 for_user = User.objects.filter(pk=request.query_params.get("for_user")).first()
             except ValueError:
-                raise ValidationError({"for_user": "for_user must be numerical"}) from None
+                raise ValidationError({"for_user": "for_user must be numerical"})
             if not for_user:
                 raise ValidationError({"for_user": "User not found"})
         engine = PolicyEngine(application, for_user, request)

authentik/core/api/authenticated_sessions.py

@@ -1,6 +1,6 @@
 """AuthenticatedSessions API Viewset"""
 
-from typing import TypedDict
+from typing import Optional, TypedDict
 
 from django_filters.rest_framework import DjangoFilterBackend
 from guardian.utils import get_anonymous_user
@@ -72,11 +72,11 @@ class AuthenticatedSessionSerializer(ModelSerializer):
         """Get parsed user agent"""
         return user_agent_parser.Parse(instance.last_user_agent)
 
-    def get_geo_ip(self, instance: AuthenticatedSession) -> GeoIPDict | None:  # pragma: no cover
+    def get_geo_ip(self, instance: AuthenticatedSession) -> Optional[GeoIPDict]:  # pragma: no cover
         """Get GeoIP Data"""
         return GEOIP_CONTEXT_PROCESSOR.city_dict(instance.last_ip)
 
-    def get_asn(self, instance: AuthenticatedSession) -> ASNDict | None:  # pragma: no cover
+    def get_asn(self, instance: AuthenticatedSession) -> Optional[ASNDict]:  # pragma: no cover
         """Get ASN Data"""
         return ASN_CONTEXT_PROCESSOR.asn_dict(instance.last_ip)
 

authentik/core/api/groups.py

@@ -1,6 +1,7 @@
 """Groups API Viewset"""
 
 from json import loads
+from typing import Optional
 
 from django.http import Http404
 from django_filters.filters import CharFilter, ModelMultipleChoiceFilter
@@ -58,7 +59,7 @@ class GroupSerializer(ModelSerializer):
 
     num_pk = IntegerField(read_only=True)
 
-    def validate_parent(self, parent: Group | None):
+    def validate_parent(self, parent: Optional[Group]):
         """Validate group parent (if set), ensuring the parent isn't itself"""
         if not self.instance or not parent:
             return parent
@@ -113,7 +114,7 @@ class GroupFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -139,6 +140,7 @@ class UserAccountSerializer(PassiveSerializer):
 class GroupViewSet(UsedByMixin, ModelViewSet):
     """Group Viewset"""
 
+    # pylint: disable=no-member
     queryset = Group.objects.all().select_related("parent").prefetch_related("users")
     serializer_class = GroupSerializer
     search_fields = ["name", "is_superuser"]

authentik/core/api/propertymappings.py

@@ -146,7 +146,7 @@ class PropertyMappingViewSet(
             response_data["result"] = dumps(
                 sanitize_item(result), indent=(4 if format_result else None)
             )
-        except Exception as exc:
+        except Exception as exc:  # pylint: disable=broad-except
             response_data["result"] = str(exc)
             response_data["successful"] = False
         response = PropertyMappingTestResultSerializer(response_data)

authentik/core/api/sources.py

@@ -1,6 +1,6 @@
 """Source API Views"""
 
-from collections.abc import Iterable
+from typing import Iterable
 
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.utils import OpenApiResponse, extend_schema

authentik/core/api/tokens.py

@@ -20,7 +20,7 @@ from authentik.blueprints.v1.importer import SERIALIZER_CONTEXT_BLUEPRINT
 from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.users import UserSerializer
 from authentik.core.api.utils import PassiveSerializer
-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 from authentik.rbac.decorators import permission_required
@@ -36,6 +36,13 @@ class TokenSerializer(ManagedSerializer, ModelSerializer):
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context:
             self.fields["key"] = CharField(required=False)
 
+    def validate_user(self, user: User):
+        """Ensure user of token cannot be changed"""
+        if self.instance and self.instance.user_id:
+            if user.pk != self.instance.user_id:
+                raise ValidationError("User cannot be changed")
+        return user
+
     def validate(self, attrs: dict[Any, str]) -> dict[Any, str]:
         """Ensure only API or App password tokens are created."""
         request: Request = self.context.get("request")

authentik/core/api/transactional_applications.py

@@ -65,7 +65,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 raise ValidationError("Invalid provider model")
             self._provider_model = model
         except LookupError:
-            raise ValidationError("Invalid provider model") from None
+            raise ValidationError("Invalid provider model")
         return fq_model_name
 
     def validate(self, attrs: dict) -> dict:
@@ -106,7 +106,7 @@ class TransactionApplicationSerializer(PassiveSerializer):
                 {
                     exc.entry_id: exc.validation_error.detail,
                 }
-            ) from None
+            )
         return blueprint
 
 

authentik/core/api/used_by.py

@@ -54,6 +54,7 @@ class UsedByMixin:
         responses={200: UsedBySerializer(many=True)},
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
+    # pylint: disable=too-many-locals
     def used_by(self, request: Request, *args, **kwargs) -> Response:
         """Get a list of all objects that use this object"""
         model: Model = self.get_object()

authentik/core/api/users.py

@@ -2,7 +2,7 @@
 
 from datetime import timedelta
 from json import loads
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth import update_session_auth_hash
 from django.contrib.sessions.backends.cache import KEY_PREFIX
@@ -142,7 +142,7 @@ class UserSerializer(ModelSerializer):
         self._set_password(instance, password)
         return instance
 
-    def _set_password(self, instance: User, password: str | None):
+    def _set_password(self, instance: User, password: Optional[str]):
         """Set password of user if we're in a blueprint context, and if it's an empty
         string then use an unusable password"""
         if SERIALIZER_CONTEXT_BLUEPRINT in self.context and password:
@@ -358,7 +358,7 @@ class UsersFilter(FilterSet):
         try:
             value = loads(value)
         except ValueError:
-            raise ValidationError(detail="filter: failed to parse JSON") from None
+            raise ValidationError(detail="filter: failed to parse JSON")
         if not isinstance(value, dict):
             raise ValidationError(detail="filter: value must be key:value mapping")
         qs = {}
@@ -397,14 +397,15 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     def get_queryset(self):  # pragma: no cover
         return User.objects.all().exclude_anonymous().prefetch_related("ak_groups")
 
-    def _create_recovery_link(self) -> tuple[str, Token]:
+    def _create_recovery_link(self) -> tuple[Optional[str], Optional[Token]]:
         """Create a recovery link (when the current brand has a recovery flow set),
         that can either be shown to an admin or sent to the user directly"""
         brand: Brand = self.request._request.brand
         # Check that there is a recovery flow, if not return an error
         flow = brand.flow_recovery
         if not flow:
-            raise ValidationError({"non_field_errors": "No recovery flow set."})
+            LOGGER.debug("No recovery flow set")
+            return None, None
         user: User = self.get_object()
         planner = FlowPlanner(flow)
         planner.allow_empty_flows = True
@@ -416,9 +417,8 @@ class UserViewSet(UsedByMixin, ModelViewSet):
                 },
             )
         except FlowNonApplicableException:
-            raise ValidationError(
+            LOGGER.warning("Recovery flow not applicable to user")
-                {"non_field_errors": "Recovery flow not applicable to user"}
+            return None, None
-            ) from None
         token, __ = FlowToken.objects.update_or_create(
             identifier=f"{user.uid}-password-reset",
             defaults={
@@ -563,13 +563,16 @@ class UserViewSet(UsedByMixin, ModelViewSet):
     @extend_schema(
         responses={
             "200": LinkSerializer(many=False),
+            "404": LinkSerializer(many=False),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         link, _ = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response({"link": ""}, status=404)
         return Response({"link": link})
 
     @permission_required("authentik_core.reset_user_password")
@@ -584,24 +587,27 @@ class UserViewSet(UsedByMixin, ModelViewSet):
         ],
         responses={
             "204": OpenApiResponse(description="Successfully sent recover email"),
+            "404": OpenApiResponse(description="Bad request"),
         },
-        request=None,
     )
-    @action(detail=True, pagination_class=None, filter_backends=[], methods=["POST"])
+    @action(detail=True, pagination_class=None, filter_backends=[])
     def recovery_email(self, request: Request, pk: int) -> Response:
         """Create a temporary link that a user can use to recover their accounts"""
         for_user: User = self.get_object()
         if for_user.email == "":
             LOGGER.debug("User doesn't have an email address")
-            raise ValidationError({"non_field_errors": "User does not have an email address set."})
+            return Response(status=404)
         link, token = self._create_recovery_link()
+        if not link:
+            LOGGER.debug("Couldn't create token")
+            return Response(status=404)
         # Lookup the email stage to assure the current user can access it
         stages = get_objects_for_user(
             request.user, "authentik_stages_email.view_emailstage"
         ).filter(pk=request.query_params.get("email_stage"))
         if not stages.exists():
             LOGGER.debug("Email stage does not exist/user has no permissions")
-            raise ValidationError({"non_field_errors": "Email stage does not exist."})
+            return Response(status=404)
         email_stage: EmailStage = stages.first()
         message = TemplateEmailMessage(
             subject=_(email_stage.subject),

authentik/core/apps.py

@@ -14,16 +14,14 @@ class AuthentikCoreConfig(ManagedAppConfig):
     mountpoint = ""
     default = True
 
-    @ManagedAppConfig.reconcile_global
+    def reconcile_global_debug_worker_hook(self):
-    def debug_worker_hook(self):
         """Dispatch startup tasks inline when debugging"""
         if settings.DEBUG:
             from authentik.root.celery import worker_ready_hook
 
             worker_ready_hook()
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_source_inbuilt(self):
-    def source_inbuilt(self):
         """Reconcile inbuilt source"""
         from authentik.core.models import Source
 

authentik/core/auth.py

@@ -1,6 +1,6 @@
 """Authenticate with tokens"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth.backends import ModelBackend
 from django.http.request import HttpRequest
@@ -16,15 +16,15 @@ class InbuiltBackend(ModelBackend):
     """Inbuilt backend"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> User | None:
+    ) -> Optional[User]:
         user = super().authenticate(request, username=username, password=password, **kwargs)
         if not user:
             return None
         self.set_method("password", request)
         return user
 
-    def set_method(self, method: str, request: HttpRequest | None, **kwargs):
+    def set_method(self, method: str, request: Optional[HttpRequest], **kwargs):
         """Set method data on current flow, if possbiel"""
         if not request:
             return
@@ -40,18 +40,18 @@ class TokenBackend(InbuiltBackend):
     """Authenticate with token"""
 
     def authenticate(
-        self, request: HttpRequest, username: str | None, password: str | None, **kwargs: Any
+        self, request: HttpRequest, username: Optional[str], password: Optional[str], **kwargs: Any
-    ) -> User | None:
+    ) -> Optional[User]:
         try:
-
+            # pylint: disable=no-member
             user = User._default_manager.get_by_natural_key(username)
-
+        # pylint: disable=no-member
         except User.DoesNotExist:
             # Run the default password hasher once to reduce the timing
             # difference between an existing and a nonexistent user (#20760).
             User().set_password(password)
             return None
-
+        # pylint: disable=no-member
         tokens = Token.filter_not_expired(
             user=user, key=password, intent=TokenIntents.INTENT_APP_PASSWORD
         )

authentik/core/channels.py

@@ -38,6 +38,6 @@ class TokenOutpostMiddleware:
                 raise DenyConnection()
         except AuthenticationFailed as exc:
             LOGGER.warning("Failed to authenticate", exc=exc)
-            raise DenyConnection() from None
+            raise DenyConnection()
 
         scope["user"] = user

authentik/core/expression/evaluator.py

@@ -1,6 +1,6 @@
 """Property Mapping Evaluator"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.db.models import Model
 from django.http import HttpRequest
@@ -27,9 +27,9 @@ class PropertyMappingEvaluator(BaseEvaluator):
     def __init__(
         self,
         model: Model,
-        user: User | None = None,
+        user: Optional[User] = None,
-        request: HttpRequest | None = None,
+        request: Optional[HttpRequest] = None,
-        dry_run: bool | None = False,
+        dry_run: Optional[bool] = False,
         **kwargs,
     ):
         if hasattr(model, "name"):

authentik/core/management/commands/shell.py

@@ -16,8 +16,13 @@ from authentik.events.middleware import should_log_model
 from authentik.events.models import Event, EventAction
 from authentik.events.utils import model_to_dict
 
-BANNER_TEXT = f"""### authentik shell ({get_full_version()})
+BANNER_TEXT = """### authentik shell ({authentik})
-### Node {platform.node()} | Arch {platform.machine()} | Python {platform.python_version()} """
+### Node {node} | Arch {arch} | Python {python} """.format(
+    node=platform.node(),
+    python=platform.python_version(),
+    arch=platform.machine(),
+    authentik=get_full_version(),
+)
 
 
 class Command(BaseCommand):
@@ -81,7 +86,7 @@ class Command(BaseCommand):
 
         # If Python code has been passed, execute it and exit.
         if options["command"]:
-
+            # pylint: disable=exec-used
             exec(options["command"], namespace)  # nosec # noqa
             return
 
@@ -94,7 +99,7 @@ class Command(BaseCommand):
         else:
             try:
                 hook()
-            except Exception:
+            except Exception:  # pylint: disable=broad-except
                 # Match the behavior of the cpython shell where an error in
                 # sys.__interactivehook__ prints a warning and the exception
                 # and continues.

authentik/core/middleware.py

@@ -1,7 +1,7 @@
 """authentik admin Middleware to impersonate users"""
 
-from collections.abc import Callable
 from contextvars import ContextVar
+from typing import Callable, Optional
 from uuid import uuid4
 
 from django.http import HttpRequest, HttpResponse
@@ -15,9 +15,9 @@ RESPONSE_HEADER_ID = "X-authentik-id"
 KEY_AUTH_VIA = "auth_via"
 KEY_USER = "user"
 
-CTX_REQUEST_ID = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
+CTX_REQUEST_ID = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "request_id", default=None)
-CTX_HOST = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + "host", default=None)
+CTX_HOST = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + "host", default=None)
-CTX_AUTH_VIA = ContextVar[str | None](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
+CTX_AUTH_VIA = ContextVar[Optional[str]](STRUCTLOG_KEY_PREFIX + KEY_AUTH_VIA, default=None)
 
 
 class ImpersonateMiddleware:
@@ -55,7 +55,7 @@ class RequestIDMiddleware:
     def __call__(self, request: HttpRequest) -> HttpResponse:
         if not hasattr(request, "request_id"):
             request_id = uuid4().hex
-            request.request_id = request_id
+            setattr(request, "request_id", request_id)
             CTX_REQUEST_ID.set(request_id)
             CTX_HOST.set(request.get_host())
             set_tag("authentik.request_id", request_id)
@@ -67,7 +67,7 @@ class RequestIDMiddleware:
         response = self.get_response(request)
 
         response[RESPONSE_HEADER_ID] = request.request_id
-        response.ak_context = {}
+        setattr(response, "ak_context", {})
         response.ak_context["request_id"] = CTX_REQUEST_ID.get()
         response.ak_context["host"] = CTX_HOST.get()
         response.ak_context[KEY_AUTH_VIA] = CTX_AUTH_VIA.get()

authentik/core/models.py

@@ -33,7 +33,7 @@ from authentik.lib.models import (
     SerializerModel,
 )
 from authentik.policies.models import PolicyBindingModel
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 LOGGER = get_logger()
 USER_ATTRIBUTE_DEBUG = "goauthentik.io/user/debug"
@@ -222,7 +222,7 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
         there are at most 3 queries done"""
         return Group.children_recursive(self.ak_groups.all())
 
-    def group_attributes(self, request: HttpRequest | None = None) -> dict[str, Any]:
+    def group_attributes(self, request: Optional[HttpRequest] = None) -> dict[str, Any]:
         """Get a dictionary containing the attributes from all groups the user belongs to,
         including the users attributes"""
         final_attributes = {}
@@ -276,13 +276,13 @@ class User(SerializerModel, GuardianUserMixin, AbstractUser):
     @property
     def uid(self) -> str:
         """Generate a globally unique UID, based on the user ID and the hashed secret key"""
-        return sha256(f"{self.id}-{get_unique_identifier()}".encode("ascii")).hexdigest()
+        return sha256(f"{self.id}-{get_install_id()}".encode("ascii")).hexdigest()
 
-    def locale(self, request: HttpRequest | None = None) -> str:
+    def locale(self, request: Optional[HttpRequest] = None) -> str:
         """Get the locale the user has configured"""
         try:
             return self.attributes.get("settings", {}).get("locale", "")
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to get default locale", exc=exc)
         if request:
@@ -358,7 +358,7 @@ class Provider(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return None
@@ -435,7 +435,7 @@ class Application(SerializerModel, PolicyBindingModel):
         return ApplicationSerializer
 
     @property
-    def get_meta_icon(self) -> str | None:
+    def get_meta_icon(self) -> Optional[str]:
         """Get the URL to the App Icon image. If the name is /static or starts with http
         it is returned as-is"""
         if not self.meta_icon:
@@ -444,7 +444,7 @@ class Application(SerializerModel, PolicyBindingModel):
             return self.meta_icon.name
         return self.meta_icon.url
 
-    def get_launch_url(self, user: Optional["User"] = None) -> str | None:
+    def get_launch_url(self, user: Optional["User"] = None) -> Optional[str]:
         """Get launch URL if set, otherwise attempt to get launch URL based on provider."""
         url = None
         if self.meta_launch_url:
@@ -457,13 +457,13 @@ class Application(SerializerModel, PolicyBindingModel):
                 user = user._wrapped
             try:
                 return url % user.__dict__
-
+            # pylint: disable=broad-except
             except Exception as exc:
                 LOGGER.warning("Failed to format launch url", exc=exc)
                 return url
         return url
 
-    def get_provider(self) -> Provider | None:
+    def get_provider(self) -> Optional[Provider]:
         """Get casted provider instance"""
         if not self.provider:
             return None
@@ -551,7 +551,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
     objects = InheritanceManager()
 
     @property
-    def icon_url(self) -> str | None:
+    def icon_url(self) -> Optional[str]:
         """Get the URL to the Icon. If the name is /static or
         starts with http it is returned as-is"""
         if not self.icon:
@@ -566,7 +566,7 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
             return self.user_path_template % {
                 "slug": self.slug,
             }
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.warning("Failed to template user path", exc=exc, source=self)
             return User.default_path()
@@ -576,12 +576,12 @@ class Source(ManagedModel, SerializerModel, PolicyBindingModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_login_button(self, request: HttpRequest) -> UILoginButton | None:
+    def ui_login_button(self, request: HttpRequest) -> Optional[UILoginButton]:
         """If source uses a http-based flow, return UI Information about the login
         button. If source doesn't use http-based flow, return None."""
         return None
 
-    def ui_user_settings(self) -> UserSettingSerializer | None:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or UserSettingSerializer."""
         return None
@@ -627,9 +627,6 @@ class ExpiringModel(models.Model):
     expires = models.DateTimeField(default=default_token_duration)
     expiring = models.BooleanField(default=True)
 
-    class Meta:
-        abstract = True
-
     def expire_action(self, *args, **kwargs):
         """Handler which is called when this object is expired. By
         default the object is deleted. This is less efficient compared
@@ -652,6 +649,9 @@ class ExpiringModel(models.Model):
             return False
         return now() > self.expires
 
+    class Meta:
+        abstract = True
+
 
 class TokenIntents(models.TextChoices):
     """Intents a Token can be created for."""
@@ -681,21 +681,6 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
     user = models.ForeignKey("User", on_delete=models.CASCADE, related_name="+")
     description = models.TextField(default="", blank=True)
 
-    class Meta:
-        verbose_name = _("Token")
-        verbose_name_plural = _("Tokens")
-        indexes = [
-            models.Index(fields=["identifier"]),
-            models.Index(fields=["key"]),
-        ]
-        permissions = [("view_token_key", _("View token's key"))]
-
-    def __str__(self):
-        description = f"{self.identifier}"
-        if self.expiring:
-            description += f" (expires={self.expires})"
-        return description
-
     @property
     def serializer(self) -> type[Serializer]:
         from authentik.core.api.tokens import TokenSerializer
@@ -723,6 +708,21 @@ class Token(SerializerModel, ManagedModel, ExpiringModel):
             message=f"Token {self.identifier}'s secret was rotated.",
         ).save()
 
+    def __str__(self):
+        description = f"{self.identifier}"
+        if self.expiring:
+            description += f" (expires={self.expires})"
+        return description
+
+    class Meta:
+        verbose_name = _("Token")
+        verbose_name_plural = _("Tokens")
+        indexes = [
+            models.Index(fields=["identifier"]),
+            models.Index(fields=["key"]),
+        ]
+        permissions = [("view_token_key", _("View token's key"))]
+
 
 class PropertyMapping(SerializerModel, ManagedModel):
     """User-defined key -> x mapping which can be used by providers to expose extra data."""
@@ -743,7 +743,7 @@ class PropertyMapping(SerializerModel, ManagedModel):
         """Get serializer for this model"""
         raise NotImplementedError
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         from authentik.core.expression.evaluator import PropertyMappingEvaluator
 
@@ -779,13 +779,6 @@ class AuthenticatedSession(ExpiringModel):
     last_user_agent = models.TextField(blank=True)
     last_used = models.DateTimeField(auto_now=True)
 
-    class Meta:
-        verbose_name = _("Authenticated Session")
-        verbose_name_plural = _("Authenticated Sessions")
-
-    def __str__(self) -> str:
-        return f"Authenticated Session {self.session_key[:10]}"
-
     @staticmethod
     def from_request(request: HttpRequest, user: User) -> Optional["AuthenticatedSession"]:
         """Create a new session from a http request"""
@@ -800,3 +793,7 @@ class AuthenticatedSession(ExpiringModel):
             last_user_agent=request.META.get("HTTP_USER_AGENT", ""),
             expires=request.session.get_expiry_date(),
         )
+
+    class Meta:
+        verbose_name = _("Authenticated Session")
+        verbose_name_plural = _("Authenticated Sessions")

authentik/core/sources/flow_manager.py

@@ -1,7 +1,7 @@
 """Source decision helper"""
 
 from enum import Enum
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib import messages
 from django.db import IntegrityError
@@ -90,14 +90,15 @@ class SourceFlowManager:
         self._logger = get_logger().bind(source=source, identifier=identifier)
         self.policy_context = {}
 
-    def get_action(self, **kwargs) -> tuple[Action, UserSourceConnection | None]:  # noqa: PLR0911
+    # pylint: disable=too-many-return-statements
+    def get_action(self, **kwargs) -> tuple[Action, Optional[UserSourceConnection]]:
         """decide which action should be taken"""
         new_connection = self.connection_type(source=self.source, identifier=self.identifier)
         # When request is authenticated, always link
         if self.request.user.is_authenticated:
             new_connection.user = self.request.user
             new_connection = self.update_connection(new_connection, **kwargs)
-
+            # pylint: disable=no-member
             new_connection.save()
             return Action.LINK, new_connection
 
@@ -187,10 +188,8 @@ class SourceFlowManager:
         # Default case, assume deny
         error = Exception(
             _(
-                "Request to authenticate with {source} has been denied. Please authenticate "
+                "Request to authenticate with %(source)s has been denied. Please authenticate "
-                "with the source you've previously signed up with.".format_map(
+                "with the source you've previously signed up with." % {"source": self.source.name}
-                    {"source": self.source.name}
-                )
             ),
         )
         return self.error_handler(error)
@@ -218,7 +217,7 @@ class SourceFlowManager:
         self,
         flow: Flow,
         connection: UserSourceConnection,
-        stages: list[StageView] | None = None,
+        stages: Optional[list[StageView]] = None,
         **kwargs,
     ) -> HttpResponse:
         """Prepare Authentication Plan, redirect user FlowExecutor"""
@@ -271,9 +270,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
-                            {"source": self.source.name}
-                        )
                     ),
                 )
             ],
@@ -297,7 +294,7 @@ class SourceFlowManager:
         ).from_http(self.request)
         messages.success(
             self.request,
-            _("Successfully linked {source}!".format_map({"source": self.source.name})),
+            _("Successfully linked %(source)s!" % {"source": self.source.name}),
         )
         return redirect(
             reverse(
@@ -325,9 +322,7 @@ class SourceFlowManager:
                 in_memory_stage(
                     MessageStage,
                     message=_(
-                        "Successfully authenticated with {source}!".format_map(
+                        "Successfully authenticated with %(source)s!" % {"source": self.source.name}
-                            {"source": self.source.name}
-                        )
                     ),
                 )
             ],

authentik/core/tasks.py

@@ -37,20 +37,20 @@ def clean_expired_models(self: SystemTask):
         messages.append(f"Expired {amount} {cls._meta.verbose_name_plural}")
     # Special case
     amount = 0
-
+    # pylint: disable=no-member
     for session in AuthenticatedSession.objects.all():
         cache_key = f"{KEY_PREFIX}{session.session_key}"
         value = None
         try:
             value = cache.get(cache_key)
-
+        # pylint: disable=broad-except
         except Exception as exc:
             LOGGER.debug("Failed to get session from cache", exc=exc)
         if not value:
             session.delete()
             amount += 1
     LOGGER.debug("Expired sessions", model=AuthenticatedSession, amount=amount)
-
+    # pylint: disable=no-member
     messages.append(f"Expired {amount} {AuthenticatedSession._meta.verbose_name_plural}")
     self.set_status(TaskStatus.SUCCESSFUL, *messages)
 

authentik/core/tests/test_models.py

@@ -1,7 +1,7 @@
 """authentik core models tests"""
 
-from collections.abc import Callable
 from time import sleep
+from typing import Callable
 
 from django.test import RequestFactory, TestCase
 from django.utils.timezone import now

authentik/core/tests/test_source_flow_manager.py

@@ -173,5 +173,5 @@ class TestSourceFlowManager(TestCase):
         self.assertEqual(action, Action.ENROLL)
         response = flow_manager.get_flow()
         self.assertIsInstance(response, AccessDeniedResponse)
-
+        # pylint: disable=no-member
         self.assertEqual(response.error_message, "foo")

authentik/core/tests/test_token_api.py

@@ -7,8 +7,8 @@ from guardian.shortcuts import get_anonymous_user
 from rest_framework.test import APITestCase
 
 from authentik.core.api.tokens import TokenSerializer
-from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents, User
+from authentik.core.models import USER_ATTRIBUTE_TOKEN_EXPIRING, Token, TokenIntents
-from authentik.core.tests.utils import create_test_admin_user
+from authentik.core.tests.utils import create_test_admin_user, create_test_user
 from authentik.lib.generators import generate_id
 
 
@@ -17,7 +17,7 @@ class TestTokenAPI(APITestCase):
 
     def setUp(self) -> None:
         super().setUp()
-        self.user = User.objects.create(username="testuser")
+        self.user = create_test_user()
         self.admin = create_test_admin_user()
         self.client.force_login(self.user)
 
@@ -76,6 +76,24 @@ class TestTokenAPI(APITestCase):
         self.assertEqual(token.intent, TokenIntents.INTENT_API)
         self.assertEqual(token.expiring, False)
 
+    def test_token_change_user(self):
+        """Test creating a token and then changing the user"""
+        ident = generate_id()
+        response = self.client.post(reverse("authentik_api:token-list"), {"identifier": ident})
+        self.assertEqual(response.status_code, 201)
+        token = Token.objects.get(identifier=ident)
+        self.assertEqual(token.user, self.user)
+        self.assertEqual(token.intent, TokenIntents.INTENT_API)
+        self.assertEqual(token.expiring, True)
+        self.assertTrue(self.user.has_perm("authentik_core.view_token_key", token))
+        response = self.client.put(
+            reverse("authentik_api:token-detail", kwargs={"identifier": ident}),
+            data={"identifier": "user_token_poc_v3", "intent": "api", "user": self.admin.pk},
+        )
+        self.assertEqual(response.status_code, 400)
+        token.refresh_from_db()
+        self.assertEqual(token.user, self.user)
+
     def test_list(self):
         """Test Token List (Test normal authentication)"""
         Token.objects.all().delete()

authentik/core/tests/test_users_api.py

@@ -60,11 +60,10 @@ class TestUsersAPI(APITestCase):
     def test_recovery_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.status_code, 404)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
 
     def test_set_password(self):
         """Test Direct password set"""
@@ -85,7 +84,7 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery", kwargs={"pk": self.user.pk})
         )
         self.assertEqual(response.status_code, 200)
@@ -93,20 +92,16 @@ class TestUsersAPI(APITestCase):
     def test_recovery_email_no_flow(self):
         """Test user recovery link (no recovery flow set)"""
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.status_code, 404)
-        self.assertJSONEqual(
-            response.content, {"non_field_errors": "User does not have an email address set."}
-        )
         self.user.email = "foo@bar.baz"
         self.user.save()
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.status_code, 404)
-        self.assertJSONEqual(response.content, {"non_field_errors": "No recovery flow set."})
 
     def test_recovery_email_no_stage(self):
         """Test user recovery link (no email stage)"""
@@ -117,11 +112,10 @@ class TestUsersAPI(APITestCase):
         brand.flow_recovery = flow
         brand.save()
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse("authentik_api:user-recovery-email", kwargs={"pk": self.user.pk})
         )
-        self.assertEqual(response.status_code, 400)
+        self.assertEqual(response.status_code, 404)
-        self.assertJSONEqual(response.content, {"non_field_errors": "Email stage does not exist."})
 
     def test_recovery_email(self):
         """Test user recovery link"""
@@ -135,7 +129,7 @@ class TestUsersAPI(APITestCase):
         stage = EmailStage.objects.create(name="email")
 
         self.client.force_login(self.admin)
-        response = self.client.post(
+        response = self.client.get(
             reverse(
                 "authentik_api:user-recovery-email",
                 kwargs={"pk": self.user.pk},

authentik/core/tests/utils.py

@@ -1,5 +1,7 @@
 """Test Utils"""
 
+from typing import Optional
+
 from django.utils.text import slugify
 
 from authentik.brands.models import Brand
@@ -20,7 +22,7 @@ def create_test_flow(
     )
 
 
-def create_test_user(name: str | None = None, **kwargs) -> User:
+def create_test_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test user"""
     uid = generate_id(20) if not name else name
     kwargs.setdefault("email", f"{uid}@goauthentik.io")
@@ -34,7 +36,7 @@ def create_test_user(name: str | None = None, **kwargs) -> User:
     return user
 
 
-def create_test_admin_user(name: str | None = None, **kwargs) -> User:
+def create_test_admin_user(name: Optional[str] = None, **kwargs) -> User:
     """Generate a test-admin user"""
     user = create_test_user(name, **kwargs)
     group = Group.objects.create(name=user.name or name, is_superuser=True)

authentik/core/types.py

@@ -1,6 +1,7 @@
 """authentik core dataclasses"""
 
 from dataclasses import dataclass
+from typing import Optional
 
 from rest_framework.fields import CharField
 
@@ -19,7 +20,7 @@ class UILoginButton:
     challenge: Challenge
 
     # Icon URL, used as-is
-    icon_url: str | None = None
+    icon_url: Optional[str] = None
 
 
 class UserSettingSerializer(PassiveSerializer):

authentik/core/views/apps.py

@@ -57,7 +57,7 @@ class RedirectToAppLaunch(View):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(in_memory_stage(RedirectToAppStage))
         request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs("authentik_core:if-flow", request.GET, flow_slug=flow.slug)

authentik/core/views/error.py

@@ -61,6 +61,7 @@ class ServerErrorView(TemplateView):
     response_class = ServerErrorTemplateResponse
     template_name = "if/error.html"
 
+    # pylint: disable=useless-super-delegation
     def dispatch(self, *args, **kwargs):  # pragma: no cover
         """Little wrapper so django accepts this function"""
         return super().dispatch(*args, **kwargs)

authentik/crypto/api.py

@@ -1,6 +1,7 @@
 """Crypto API Views"""
 
 from datetime import datetime
+from typing import Optional
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
@@ -55,25 +56,25 @@ class CertificateKeyPairSerializer(ModelSerializer):
             return True
         return str(request.query_params.get("include_details", "true")).lower() == "true"
 
-    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha256(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA256)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha256
 
-    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> str | None:
+    def get_fingerprint_sha1(self, instance: CertificateKeyPair) -> Optional[str]:
         "Get certificate Hash (SHA1)"
         if not self._should_include_details:
             return None
         return instance.fingerprint_sha1
 
-    def get_cert_expiry(self, instance: CertificateKeyPair) -> datetime | None:
+    def get_cert_expiry(self, instance: CertificateKeyPair) -> Optional[datetime]:
         "Get certificate expiry"
         if not self._should_include_details:
             return None
-        return DateTimeField().to_representation(instance.certificate.not_valid_after_utc)
+        return DateTimeField().to_representation(instance.certificate.not_valid_after)
 
-    def get_cert_subject(self, instance: CertificateKeyPair) -> str | None:
+    def get_cert_subject(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get certificate subject as full rfc4514"""
         if not self._should_include_details:
             return None
@@ -83,7 +84,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
         """Show if this keypair has a private key configured or not"""
         return instance.key_data != "" and instance.key_data is not None
 
-    def get_private_key_type(self, instance: CertificateKeyPair) -> str | None:
+    def get_private_key_type(self, instance: CertificateKeyPair) -> Optional[str]:
         """Get the private key's type, if set"""
         if not self._should_include_details:
             return None
@@ -120,7 +121,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
             str(load_pem_x509_certificate(value.encode("utf-8"), default_backend()))
         except ValueError as exc:
             LOGGER.warning("Failed to load certificate", exc=exc)
-            raise ValidationError("Unable to load certificate.") from None
+            raise ValidationError("Unable to load certificate.")
         return value
 
     def validate_key_data(self, value: str) -> str:
@@ -139,7 +140,7 @@ class CertificateKeyPairSerializer(ModelSerializer):
                 )
             except (ValueError, TypeError) as exc:
                 LOGGER.warning("Failed to load private key", exc=exc)
-                raise ValidationError("Unable to load private key (possibly encrypted?).") from None
+                raise ValidationError("Unable to load private key (possibly encrypted?).")
         return value
 
     class Meta:

authentik/crypto/apps.py

@@ -1,6 +1,7 @@
 """authentik crypto app config"""
 
-from datetime import UTC, datetime
+from datetime import datetime, timezone
+from typing import Optional
 
 from authentik.blueprints.apps import ManagedAppConfig
 from authentik.lib.generators import generate_id
@@ -35,22 +36,20 @@ class AuthentikCryptoConfig(ManagedAppConfig):
             },
         )
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_managed_jwt_cert(self):
-    def managed_jwt_cert(self):
         """Ensure managed JWT certificate"""
         from authentik.crypto.models import CertificateKeyPair
 
-        cert: CertificateKeyPair | None = CertificateKeyPair.objects.filter(
+        cert: Optional[CertificateKeyPair] = CertificateKeyPair.objects.filter(
             managed=MANAGED_KEY
         ).first()
-        now = datetime.now(tz=UTC)
+        now = datetime.now(tz=timezone.utc)
         if not cert or (
             now < cert.certificate.not_valid_after_utc or now > cert.certificate.not_valid_after_utc
         ):
             self._create_update_cert()
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_self_signed(self):
-    def self_signed(self):
         """Create self-signed keypair"""
         from authentik.crypto.builder import CertificateBuilder
         from authentik.crypto.models import CertificateKeyPair

authentik/crypto/builder.py

@@ -2,6 +2,7 @@
 
 import datetime
 import uuid
+from typing import Optional
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -43,7 +44,7 @@ class CertificateBuilder:
     def generate_private_key(self) -> PrivateKeyTypes:
         """Generate private key"""
         if self._use_ec_private_key:
-            return ec.generate_private_key(curve=ec.SECP256R1())
+            return ec.generate_private_key(curve=ec.SECP256R1)
         return rsa.generate_private_key(
             public_exponent=65537, key_size=4096, backend=default_backend()
         )
@@ -51,7 +52,7 @@ class CertificateBuilder:
     def build(
         self,
         validity_days: int = 365,
-        subject_alt_names: list[str] | None = None,
+        subject_alt_names: Optional[list[str]] = None,
     ):
         """Build self-signed certificate"""
         one_day = datetime.timedelta(1, 0, 0)

authentik/crypto/management/commands/import_certificate.py

@@ -24,13 +24,13 @@ class Command(TenantCommand):
         if not keypair:
             keypair = CertificateKeyPair(name=options["name"])
             dirty = True
-        with open(options["certificate"], encoding="utf-8") as _cert:
+        with open(options["certificate"], mode="r", encoding="utf-8") as _cert:
             cert_data = _cert.read()
             if keypair.certificate_data != cert_data:
                 dirty = True
             keypair.certificate_data = cert_data
         if options["private_key"]:
-            with open(options["private_key"], encoding="utf-8") as _key:
+            with open(options["private_key"], mode="r", encoding="utf-8") as _key:
                 key_data = _key.read()
                 if keypair.key_data != key_data:
                     dirty = True

authentik/crypto/models.py

@@ -2,6 +2,7 @@
 
 from binascii import hexlify
 from hashlib import md5
+from typing import Optional
 from uuid import uuid4
 
 from cryptography.hazmat.backends import default_backend
@@ -36,9 +37,9 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         default="",
     )
 
-    _cert: Certificate | None = None
+    _cert: Optional[Certificate] = None
-    _private_key: PrivateKeyTypes | None = None
+    _private_key: Optional[PrivateKeyTypes] = None
-    _public_key: PublicKeyTypes | None = None
+    _public_key: Optional[PublicKeyTypes] = None
 
     @property
     def serializer(self) -> Serializer:
@@ -56,7 +57,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
         return self._cert
 
     @property
-    def public_key(self) -> PublicKeyTypes | None:
+    def public_key(self) -> Optional[PublicKeyTypes]:
         """Get public key of the private key"""
         if not self._public_key:
             self._public_key = self.private_key.public_key()
@@ -65,7 +66,7 @@ class CertificateKeyPair(SerializerModel, ManagedModel, CreatedUpdatedModel):
     @property
     def private_key(
         self,
-    ) -> PrivateKeyTypes | None:
+    ) -> Optional[PrivateKeyTypes]:
         """Get python cryptography PrivateKey instance"""
         if not self._private_key and self.key_data != "":
             try:

authentik/crypto/tasks.py

@@ -58,7 +58,7 @@ def certificate_discovery(self: SystemTask):
         else:
             cert_name = path.name.replace(path.suffix, "")
         try:
-            with open(path, encoding="utf-8") as _file:
+            with open(path, "r", encoding="utf-8") as _file:
                 body = _file.read()
                 if "PRIVATE KEY" in body:
                     private_keys[cert_name] = ensure_private_key_valid(body)

authentik/crypto/tests.py

@@ -1,5 +1,6 @@
 """Crypto tests"""
 
+import datetime
 from json import loads
 from os import makedirs
 from tempfile import TemporaryDirectory
@@ -7,7 +8,6 @@ from tempfile import TemporaryDirectory
 from cryptography.x509.extensions import SubjectAlternativeName
 from cryptography.x509.general_name import DNSName
 from django.urls import reverse
-from django.utils.timezone import now
 from rest_framework.test import APITestCase
 
 from authentik.core.api.used_by import DeleteAction
@@ -68,9 +68,9 @@ class TestCrypto(APITestCase):
             validity_days=3,
         )
         instance = builder.save()
-        _now = now()
+        now = datetime.datetime.today()
         self.assertEqual(instance.name, name)
-        self.assertEqual((instance.certificate.not_valid_after_utc - _now).days, 2)
+        self.assertEqual((instance.certificate.not_valid_after - now).days, 2)
 
     def test_builder_api(self):
         """Test Builder (via API)"""
@@ -267,7 +267,7 @@ class TestCrypto(APITestCase):
             with open(f"{temp_dir}/foo.bar/privkey.pem", "w+", encoding="utf-8") as _key:
                 _key.write(builder.private_key)
             with CONFIG.patch("cert_discovery_dir", temp_dir):
-                certificate_discovery()
+                certificate_discovery()  # pylint: disable=no-value-for-parameter
         keypair: CertificateKeyPair = CertificateKeyPair.objects.filter(
             managed=MANAGED_DISCOVERED % "foo"
         ).first()

authentik/enterprise/api.py

@@ -22,7 +22,7 @@ from authentik.core.models import User, UserTypes
 from authentik.enterprise.license import LicenseKey, LicenseSummarySerializer
 from authentik.enterprise.models import License
 from authentik.rbac.decorators import permission_required
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 
 class EnterpriseRequiredMixin:
@@ -92,7 +92,7 @@ class LicenseViewSet(UsedByMixin, ModelViewSet):
         """Get install_id"""
         return Response(
             data={
-                "install_id": get_unique_identifier(),
+                "install_id": get_install_id(),
             }
         )
 

authentik/enterprise/audit/apps.py

@@ -13,8 +13,7 @@ class AuthentikEnterpriseAuditConfig(EnterpriseConfig):
     verbose_name = "authentik Enterprise.Audit"
     default = True
 
-    @EnterpriseConfig.reconcile_global
+    def reconcile_global_install_middleware(self):
-    def install_middleware(self):
         """Install enterprise audit middleware"""
         orig_import = "authentik.events.middleware.AuditMiddleware"
         new_import = "authentik.enterprise.audit.middleware.EnterpriseAuditMiddleware"

authentik/enterprise/audit/middleware.py

@@ -11,7 +11,6 @@ from django.db.models.expressions import BaseExpression, Combinable
 from django.db.models.signals import post_init
 from django.http import HttpRequest
 
-from authentik.core.models import User
 from authentik.events.middleware import AuditMiddleware, should_log_model
 from authentik.events.utils import cleanse_dict, sanitize_item
 
@@ -28,13 +27,10 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
         super().connect(request)
         if not self.enabled:
             return
-        user = getattr(request, "user", self.anonymous_user)
-        if not user.is_authenticated:
-            user = self.anonymous_user
         if not hasattr(request, "request_id"):
             return
         post_init.connect(
-            partial(self.post_init_handler, user=user, request=request),
+            partial(self.post_init_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
@@ -62,7 +58,7 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 field_value = value.name
 
             # If current field value is an expression, we are not evaluating it
-            if isinstance(field_value, BaseExpression | Combinable):
+            if isinstance(field_value, (BaseExpression, Combinable)):
                 continue
             field_value = field.to_python(field_value)
             data[field.name] = deepcopy(field_value)
@@ -76,21 +72,21 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 diff[key] = {"previous_value": value, "new_value": after.get(key)}
         return sanitize_item(diff)
 
-    def post_init_handler(self, user: User, request: HttpRequest, sender, instance: Model, **_):
+    def post_init_handler(self, request: HttpRequest, sender, instance: Model, **_):
         """post_init django model handler"""
         if not should_log_model(instance):
             return
         if hasattr(instance, "_previous_state"):
             return
         before = len(connection.queries)
-        instance._previous_state = self.serialize_simple(instance)
+        setattr(instance, "_previous_state", self.serialize_simple(instance))
         after = len(connection.queries)
         if after > before:
             raise AssertionError("More queries generated by serialize_simple")
 
+    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
-        user: User,
         request: HttpRequest,
         sender,
         instance: Model,
@@ -112,6 +108,4 @@ class EnterpriseAuditMiddleware(AuditMiddleware):
                 for field_set in ignored_field_sets:
                     if set(diff.keys()) == set(field_set):
                         return None
-        return super().post_save_handler(
+        return super().post_save_handler(request, sender, instance, created, thread_kwargs, **_)
-            user, request, sender, instance, created, thread_kwargs, **_
-        )

authentik/enterprise/license.py

@@ -21,13 +21,13 @@ from rest_framework.fields import BooleanField, DateTimeField, IntegerField
 from authentik.core.api.utils import PassiveSerializer
 from authentik.core.models import User, UserTypes
 from authentik.enterprise.models import License, LicenseUsage
-from authentik.tenants.utils import get_unique_identifier
+from authentik.root.install_id import get_install_id
 
 CACHE_KEY_ENTERPRISE_LICENSE = "goauthentik.io/enterprise/license"
 CACHE_EXPIRY_ENTERPRISE_LICENSE = 3 * 60 * 60  # 2 Hours
 
 
-@lru_cache
+@lru_cache()
 def get_licensing_key() -> Certificate:
     """Get Root CA PEM"""
     with open("authentik/enterprise/public.pem", "rb") as _key:
@@ -36,7 +36,7 @@ def get_licensing_key() -> Certificate:
 
 def get_license_aud() -> str:
     """Get the JWT audience field"""
-    return f"enterprise.goauthentik.io/license/{get_unique_identifier()}"
+    return f"enterprise.goauthentik.io/license/{get_install_id()}"
 
 
 class LicenseFlags(Enum):
@@ -88,7 +88,7 @@ class LicenseKey:
         try:
             headers = get_unverified_header(jwt)
         except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         x5c: list[str] = headers.get("x5c", [])
         if len(x5c) < 1:
             raise ValidationError("Unable to verify license")
@@ -98,7 +98,7 @@ class LicenseKey:
             our_cert.verify_directly_issued_by(intermediate)
             intermediate.verify_directly_issued_by(get_licensing_key())
         except (InvalidSignature, TypeError, ValueError, Error):
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         try:
             body = from_dict(
                 LicenseKey,
@@ -110,7 +110,7 @@ class LicenseKey:
                 ),
             )
         except PyJWTError:
-            raise ValidationError("Unable to verify license") from None
+            raise ValidationError("Unable to verify license")
         return body
 
     @staticmethod
@@ -142,7 +142,13 @@ class LicenseKey:
     @staticmethod
     def get_external_user_count():
         """Get current external user count"""
-        return LicenseKey.base_user_qs().filter(type=UserTypes.EXTERNAL).count()
+        # Count since start of the month
+        last_month = now().replace(day=1)
+        return (
+            LicenseKey.base_user_qs()
+            .filter(type=UserTypes.EXTERNAL, last_login__gte=last_month)
+            .count()
+        )
 
     def is_valid(self) -> bool:
         """Check if the given license body covers all users

authentik/enterprise/policy.py

@@ -1,5 +1,7 @@
 """Enterprise license policies"""
 
+from typing import Optional
+
 from django.utils.translation import gettext_lazy as _
 
 from authentik.core.models import User, UserTypes
@@ -19,7 +21,7 @@ class EnterprisePolicyAccessView(PolicyAccessView):
             return PolicyResult(False, _("Feature only accessible for internal users."))
         return PolicyResult(True)
 
-    def user_has_access(self, user: User | None = None) -> PolicyResult:
+    def user_has_access(self, user: Optional[User] = None) -> PolicyResult:
         user = user or self.request.user
         request = PolicyRequest(user)
         request.http_request = self.request

authentik/enterprise/providers/rac/api/connection_tokens.py

@@ -6,13 +6,13 @@ from rest_framework.filters import OrderingFilter, SearchFilter
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import GenericViewSet
 
-from authentik.api.authorization import OwnerFilter, OwnerPermissions
+from authentik.api.authorization import OwnerFilter, OwnerSuperuserPermissions
 from authentik.core.api.groups import GroupMemberSerializer
 from authentik.core.api.used_by import UsedByMixin
 from authentik.enterprise.api import EnterpriseRequiredMixin
 from authentik.enterprise.providers.rac.api.endpoints import EndpointSerializer
 from authentik.enterprise.providers.rac.api.providers import RACProviderSerializer
-from authentik.enterprise.providers.rac.models import ConnectionToken, Endpoint
+from authentik.enterprise.providers.rac.models import ConnectionToken
 
 
 class ConnectionTokenSerializer(EnterpriseRequiredMixin, ModelSerializer):
@@ -23,7 +23,7 @@ class ConnectionTokenSerializer(EnterpriseRequiredMixin, ModelSerializer):
     user = GroupMemberSerializer(source="session.user", read_only=True)
 
     class Meta:
-        model = Endpoint
+        model = ConnectionToken
         fields = [
             "pk",
             "provider",
@@ -49,5 +49,5 @@ class ConnectionTokenViewSet(
     filterset_fields = ["endpoint", "session__user", "provider"]
     search_fields = ["endpoint__name", "provider__name"]
     ordering = ["endpoint__name", "provider__name"]
-    permission_classes = [OwnerPermissions]
+    permission_classes = [OwnerSuperuserPermissions]
     filter_backends = [OwnerFilter, DjangoFilterBackend, OrderingFilter, SearchFilter]

authentik/enterprise/providers/rac/api/endpoints.py

@@ -1,5 +1,7 @@
 """RAC Provider API Views"""
 
+from typing import Optional
+
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.urls import reverse
@@ -34,11 +36,11 @@ class EndpointSerializer(EnterpriseRequiredMixin, ModelSerializer):
     provider_obj = RACProviderSerializer(source="provider", read_only=True)
     launch_url = SerializerMethodField()
 
-    def get_launch_url(self, endpoint: Endpoint) -> str | None:
+    def get_launch_url(self, endpoint: Endpoint) -> Optional[str]:
         """Build actual launch URL (the provider itself does not have one, just
         individual endpoints)"""
         try:
-
+            # pylint: disable=no-member
             return reverse(
                 "authentik_providers_rac:start",
                 kwargs={"app": endpoint.provider.application.slug, "endpoint": endpoint.pk},

authentik/enterprise/providers/rac/models.py

@@ -1,6 +1,6 @@
 """RAC Models"""
 
-from typing import Any
+from typing import Any, Optional
 from uuid import uuid4
 
 from deepmerge import always_merger
@@ -58,7 +58,7 @@ class RACProvider(Provider):
     )
 
     @property
-    def launch_url(self) -> str | None:
+    def launch_url(self) -> Optional[str]:
         """URL to this provider and initiate authorization for the user.
         Can return None for providers that are not URL-based"""
         return "goauthentik.io://providers/rac/launch"
@@ -112,7 +112,7 @@ class RACPropertyMapping(PropertyMapping):
 
     static_settings = models.JSONField(default=dict)
 
-    def evaluate(self, user: User | None, request: HttpRequest | None, **kwargs) -> Any:
+    def evaluate(self, user: Optional[User], request: Optional[HttpRequest], **kwargs) -> Any:
         """Evaluate `self.expression` using `**kwargs` as Context."""
         if len(self.static_settings) > 0:
             return self.static_settings

authentik/enterprise/providers/rac/views.py

@@ -47,7 +47,7 @@ class RACStartView(EnterprisePolicyAccessView):
                 },
             )
         except FlowNonApplicableException:
-            raise Http404 from None
+            raise Http404
         plan.insert_stage(
             in_memory_stage(
                 RACFinalStage,
@@ -132,7 +132,16 @@ class RACFinalStage(RedirectStage):
             flow=self.executor.plan.flow_pk,
             endpoint=self.endpoint.name,
         ).from_http(self.request)
-        self.executor.current_stage.destination = self.request.build_absolute_uri(
+        setattr(
-            reverse("authentik_providers_rac:if-rac", kwargs={"token": str(token.token)})
+            self.executor.current_stage,
+            "destination",
+            self.request.build_absolute_uri(
+                reverse(
+                    "authentik_providers_rac:if-rac",
+                    kwargs={
+                        "token": str(token.token),
+                    },
+                )
+            ),
         )
         return super().get_challenge(*args, **kwargs)

authentik/events/api/tasks.py

@@ -92,7 +92,7 @@ class SystemTaskViewSet(ReadOnlyModelViewSet):
             task_func.delay(*task.task_call_args, **task.task_call_kwargs)
             messages.success(
                 self.request,
-                _("Successfully started task {name}.".format_map({"name": task.name})),
+                _("Successfully started task %(name)s." % {"name": task.name}),
             )
             return Response(status=204)
         except (ImportError, AttributeError) as exc:  # pragma: no cover

authentik/events/apps.py

@@ -35,8 +35,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
     verbose_name = "authentik Events"
     default = True
 
-    @ManagedAppConfig.reconcile_global
+    def reconcile_global_check_deprecations(self):
-    def check_deprecations(self):
         """Check for config deprecations"""
         from authentik.events.models import Event, EventAction
 
@@ -57,8 +56,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
                 message=msg,
             ).save()
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_prefill_tasks(self):
-    def prefill_tasks(self):
         """Prefill tasks"""
         from authentik.events.models import SystemTask
         from authentik.events.system_tasks import _prefill_tasks
@@ -69,8 +67,7 @@ class AuthentikEventsConfig(ManagedAppConfig):
             task.save()
             self.logger.debug("prefilled task", task_name=task.name)
 
-    @ManagedAppConfig.reconcile_tenant
+    def reconcile_tenant_run_scheduled_tasks(self):
-    def run_scheduled_tasks(self):
         """Run schedule tasks which are behind schedule (only applies
         to tasks of which we keep metrics)"""
         from authentik.events.models import TaskStatus

authentik/events/context_processors/asn.py

@@ -46,7 +46,7 @@ class ASNContextProcessor(MMDBContextProcessor):
             "asn": self.asn_dict(ClientIPMiddleware.get_client_ip(request)),
         }
 
-    def asn(self, ip_address: str) -> ASN | None:
+    def asn(self, ip_address: str) -> Optional[ASN]:
         """Wrapper for Reader.asn"""
         with Hub.current.start_span(
             op="authentik.events.asn.asn",
@@ -71,7 +71,7 @@ class ASNContextProcessor(MMDBContextProcessor):
         }
         return asn_dict
 
-    def asn_dict(self, ip_address: str) -> ASNDict | None:
+    def asn_dict(self, ip_address: str) -> Optional[ASNDict]:
         """Wrapper for self.asn that returns a dict"""
         asn = self.asn(ip_address)
         if not asn:

authentik/events/context_processors/geoip.py

@@ -47,7 +47,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
         # Different key `geoip` vs `geo` for legacy reasons
         return {"geoip": self.city(ClientIPMiddleware.get_client_ip(request))}
 
-    def city(self, ip_address: str) -> City | None:
+    def city(self, ip_address: str) -> Optional[City]:
         """Wrapper for Reader.city"""
         with Hub.current.start_span(
             op="authentik.events.geo.city",
@@ -76,7 +76,7 @@ class GeoIPContextProcessor(MMDBContextProcessor):
             city_dict["city"] = city.city.name
         return city_dict
 
-    def city_dict(self, ip_address: str) -> GeoIPDict | None:
+    def city_dict(self, ip_address: str) -> Optional[GeoIPDict]:
         """Wrapper for self.city that returns a dict"""
         city = self.city(ip_address)
         if not city:

authentik/events/context_processors/mmdb.py

@@ -1,6 +1,7 @@
 """Common logic for reading MMDB files"""
 
 from pathlib import Path
+from typing import Optional
 
 from geoip2.database import Reader
 from structlog.stdlib import get_logger
@@ -12,7 +13,7 @@ class MMDBContextProcessor(EventContextProcessor):
     """Common logic for reading MaxMind DB files, including re-loading if the file has changed"""
 
     def __init__(self):
-        self.reader: Reader | None = None
+        self.reader: Optional[Reader] = None
         self._last_mtime: float = 0.0
         self.logger = get_logger()
         self.open()

authentik/events/middleware.py

@@ -1,9 +1,8 @@
 """Events middleware"""
 
-from collections.abc import Callable
 from functools import partial
 from threading import Thread
-from typing import Any
+from typing import Any, Callable, Optional
 
 from django.conf import settings
 from django.contrib.sessions.models import Session
@@ -50,9 +49,9 @@ class EventNewThread(Thread):
     action: str
     request: HttpRequest
     kwargs: dict[str, Any]
-    user: User | None = None
+    user: Optional[User] = None
 
-    def __init__(self, action: str, request: HttpRequest, user: User | None = None, **kwargs):
+    def __init__(self, action: str, request: HttpRequest, user: Optional[User] = None, **kwargs):
         super().__init__()
         self.action = action
         self.request = request
@@ -83,26 +82,29 @@ class AuditMiddleware:
 
         self.anonymous_user = get_anonymous_user()
 
+    def get_user(self, request: HttpRequest) -> User:
+        user = getattr(request, "user", self.anonymous_user)
+        if not user.is_authenticated:
+            return self.anonymous_user
+        return user
+
     def connect(self, request: HttpRequest):
         """Connect signal for automatic logging"""
         self._ensure_fallback_user()
-        user = getattr(request, "user", self.anonymous_user)
-        if not user.is_authenticated:
-            user = self.anonymous_user
         if not hasattr(request, "request_id"):
             return
         post_save.connect(
-            partial(self.post_save_handler, user=user, request=request),
+            partial(self.post_save_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
         pre_delete.connect(
-            partial(self.pre_delete_handler, user=user, request=request),
+            partial(self.pre_delete_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
         m2m_changed.connect(
-            partial(self.m2m_changed_handler, user=user, request=request),
+            partial(self.m2m_changed_handler, request=request),
             dispatch_uid=request.request_id,
             weak=False,
         )
@@ -145,29 +147,31 @@ class AuditMiddleware:
             )
             thread.run()
 
+    # pylint: disable=too-many-arguments
     def post_save_handler(
         self,
-        user: User,
         request: HttpRequest,
         sender,
         instance: Model,
         created: bool,
-        thread_kwargs: dict | None = None,
+        thread_kwargs: Optional[dict] = None,
         **_,
     ):
         """Signal handler for all object's post_save"""
         if not should_log_model(instance):
             return
+        user = self.get_user(request)
 
         action = EventAction.MODEL_CREATED if created else EventAction.MODEL_UPDATED
         thread = EventNewThread(action, request, user=user, model=model_to_dict(instance))
         thread.kwargs.update(thread_kwargs or {})
         thread.run()
 
-    def pre_delete_handler(self, user: User, request: HttpRequest, sender, instance: Model, **_):
+    def pre_delete_handler(self, request: HttpRequest, sender, instance: Model, **_):
         """Signal handler for all object's pre_delete"""
         if not should_log_model(instance):  # pragma: no cover
             return
+        user = self.get_user(request)
 
         EventNewThread(
             EventAction.MODEL_DELETED,
@@ -176,14 +180,13 @@ class AuditMiddleware:
             model=model_to_dict(instance),
         ).run()
 
-    def m2m_changed_handler(
+    def m2m_changed_handler(self, request: HttpRequest, sender, instance: Model, action: str, **_):
-        self, user: User, request: HttpRequest, sender, instance: Model, action: str, **_
-    ):
         """Signal handler for all object's m2m_changed"""
         if action not in ["pre_add", "pre_remove", "post_clear"]:
             return
         if not should_log_m2m(instance):
             return
+        user = self.get_user(request)
 
         EventNewThread(
             EventAction.MODEL_UPDATED,

authentik/events/models.py

@@ -7,6 +7,7 @@ from difflib import get_close_matches
 from functools import lru_cache
 from inspect import currentframe
 from smtplib import SMTPException
+from typing import Optional
 from uuid import uuid4
 
 from django.apps import apps
@@ -51,8 +52,6 @@ from authentik.stages.email.utils import TemplateEmailMessage
 from authentik.tenants.models import Tenant
 
 LOGGER = get_logger()
-DISCORD_FIELD_LIMIT = 25
-NOTIFICATION_SUMMARY_LENGTH = 75
 
 
 def default_event_duration():
@@ -66,7 +65,7 @@ def default_brand():
     return sanitize_dict(model_to_dict(DEFAULT_BRAND))
 
 
-@lru_cache
+@lru_cache()
 def django_app_names() -> list[str]:
     """Get a cached list of all django apps' names (not labels)"""
     return [x.name for x in apps.app_configs.values()]
@@ -199,7 +198,7 @@ class Event(SerializerModel, ExpiringModel):
     @staticmethod
     def new(
         action: str | EventAction,
-        app: str | None = None,
+        app: Optional[str] = None,
         **kwargs,
     ) -> "Event":
         """Create new Event instance from arguments. Instance is NOT saved."""
@@ -225,7 +224,7 @@ class Event(SerializerModel, ExpiringModel):
         self.user = get_user(user)
         return self
 
-    def from_http(self, request: HttpRequest, user: User | None = None) -> "Event":
+    def from_http(self, request: HttpRequest, user: Optional[User] = None) -> "Event":
         """Add data from a Django-HttpRequest, allowing the creation of
         Events independently from requests.
         `user` arguments optionally overrides user from requests."""
@@ -419,7 +418,7 @@ class NotificationTransport(SerializerModel):
                 if not isinstance(value, str):
                     continue
                 # https://birdie0.github.io/discord-webhooks-guide/other/field_limits.html
-                if len(fields) >= DISCORD_FIELD_LIMIT:
+                if len(fields) >= 25:
                     continue
                 fields.append({"title": key[:256], "value": value[:1024]})
         body = {
@@ -452,6 +451,13 @@ class NotificationTransport(SerializerModel):
 
     def send_email(self, notification: "Notification") -> list[str]:
         """Send notification via global email configuration"""
+        if notification.user.email.strip() == "":
+            LOGGER.info(
+                "Discarding notification as user has no email address",
+                user=notification.user,
+                notification=notification,
+            )
+            return None
         subject_prefix = "authentik Notification: "
         context = {
             "key_value": {
@@ -473,7 +479,7 @@ class NotificationTransport(SerializerModel):
                     continue
                 context["key_value"][key] = value
         else:
-            context["title"] += notification.body[:NOTIFICATION_SUMMARY_LENGTH]
+            context["title"] += notification.body[:75]
         # TODO: improve permission check
         if notification.user.is_superuser:
             context["source"] = {
@@ -490,7 +496,7 @@ class NotificationTransport(SerializerModel):
         try:
             from authentik.stages.email.tasks import send_mail
 
-            return send_mail(mail.__dict__)
+            return send_mail(mail.__dict__)  # pylint: disable=no-value-for-parameter
         except (SMTPException, ConnectionError, OSError) as exc:
             raise NotificationTransportError(exc) from exc
 
@@ -534,11 +540,7 @@ class Notification(SerializerModel):
         return NotificationSerializer
 
     def __str__(self) -> str:
-        body_trunc = (
+        body_trunc = (self.body[:75] + "..") if len(self.body) > 75 else self.body
-            (self.body[:NOTIFICATION_SUMMARY_LENGTH] + "..")
-            if len(self.body) > NOTIFICATION_SUMMARY_LENGTH
-            else self.body
-        )
         return f"Notification for user {self.user}: {body_trunc}"
 
     class Meta:

authentik/events/signals.py

@@ -1,6 +1,6 @@
 """authentik events signal listener"""
 
-from typing import Any
+from typing import Any, Optional
 
 from django.contrib.auth.signals import user_logged_in, user_logged_out
 from django.db.models.signals import post_save, pre_delete
@@ -42,7 +42,7 @@ def on_user_logged_in(sender, request: HttpRequest, user: User, **_):
     request.session[SESSION_LOGIN_EVENT] = event
 
 
-def get_login_event(request: HttpRequest) -> Event | None:
+def get_login_event(request: HttpRequest) -> Optional[Event]:
     """Wrapper to get login event that can be mocked in tests"""
     return request.session.get(SESSION_LOGIN_EVENT, None)
 
@@ -71,7 +71,7 @@ def on_login_failed(
     sender,
     credentials: dict[str, str],
     request: HttpRequest,
-    stage: Stage | None = None,
+    stage: Optional[Stage] = None,
     **kwargs,
 ):
     """Failed Login, authentik custom event"""

authentik/events/system_tasks.py

@@ -2,15 +2,16 @@
 
 from datetime import datetime, timedelta
 from time import perf_counter
-from typing import Any
+from typing import Any, Optional
 
 from django.utils.timezone import now
 from django.utils.translation import gettext_lazy as _
 from structlog.stdlib import get_logger
 from tenant_schemas_celery.task import TenantTask
 
-from authentik.events.models import Event, EventAction, TaskStatus
+from authentik.events.models import Event, EventAction
 from authentik.events.models import SystemTask as DBSystemTask
+from authentik.events.models import TaskStatus
 from authentik.events.utils import sanitize_item
 from authentik.lib.utils.errors import exception_to_string
 
@@ -26,10 +27,10 @@ class SystemTask(TenantTask):
     _status: TaskStatus
     _messages: list[str]
 
-    _uid: str | None
+    _uid: Optional[str]
     # Precise start time from perf_counter
-    _start_precise: float | None = None
+    _start_precise: Optional[float] = None
-    _start: datetime | None = None
+    _start: Optional[datetime] = None
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
@@ -59,13 +60,14 @@ class SystemTask(TenantTask):
         self._start = now()
         return super().before_start(task_id, args, kwargs)
 
-    def db(self) -> DBSystemTask | None:
+    def db(self) -> Optional[DBSystemTask]:
         """Get DB object for latest task"""
         return DBSystemTask.objects.filter(
             name=self.__name__,
             uid=self._uid,
         ).first()
 
+    # pylint: disable=too-many-arguments
     def after_return(self, status, retval, task_id, args: list[Any], kwargs: dict[str, Any], einfo):
         super().after_return(status, retval, task_id, args, kwargs, einfo=einfo)
         if not self._status:
@@ -95,6 +97,7 @@ class SystemTask(TenantTask):
             },
         )
 
+    # pylint: disable=too-many-arguments
     def on_failure(self, exc, task_id, args, kwargs, einfo):
         super().on_failure(exc, task_id, args, kwargs, einfo=einfo)
         if not self._status:

authentik/events/tasks.py

@@ -1,5 +1,7 @@
 """Event notification tasks"""
 
+from typing import Optional
+
 from django.db.models.query_utils import Q
 from guardian.shortcuts import get_anonymous_user
 from structlog.stdlib import get_logger
@@ -36,7 +38,7 @@ def event_trigger_handler(event_uuid: str, trigger_name: str):
     if not event:
         LOGGER.warning("event doesn't exist yet or anymore", event_uuid=event_uuid)
         return
-    trigger: NotificationRule | None = NotificationRule.objects.filter(name=trigger_name).first()
+    trigger: Optional[NotificationRule] = NotificationRule.objects.filter(name=trigger_name).first()
     if not trigger:
         return
 

authentik/events/tests/test_event.py

@@ -105,7 +105,7 @@ class TestEvents(TestCase):
         # Test brand
         request = self.factory.get("/")
         brand = Brand(domain="test-brand")
-        request.brand = brand
+        setattr(request, "brand", brand)
         event = Event.new("unittest").from_http(request)
         self.assertEqual(
             event.brand,

authentik/events/tests/test_middleware.py

@@ -3,9 +3,10 @@
 from django.urls import reverse
 from rest_framework.test import APITestCase
 
-from authentik.core.models import Application
+from authentik.core.models import Application, Token, TokenIntents
 from authentik.core.tests.utils import create_test_admin_user
 from authentik.events.models import Event, EventAction
+from authentik.lib.generators import generate_id
 
 
 class TestEventsMiddleware(APITestCase):
@@ -47,3 +48,30 @@ class TestEventsMiddleware(APITestCase):
                 context__model__name="test-delete",
             ).exists()
         )
+
+    def test_create_with_api(self):
+        """Test model creation event (with API token auth)"""
+        self.client.logout()
+        token = Token.objects.create(user=self.user, intent=TokenIntents.INTENT_API, expiring=False)
+        uid = generate_id()
+        self.client.post(
+            reverse("authentik_api:application-list"),
+            data={"name": uid, "slug": uid},
+            HTTP_AUTHORIZATION=f"Bearer {token.key}",
+        )
+        self.assertTrue(Application.objects.filter(name=uid).exists())
+        event = Event.objects.filter(
+            action=EventAction.MODEL_CREATED,
+            context__model__model_name="application",
+            context__model__app="authentik_core",
+            context__model__name=uid,
+        ).first()
+        self.assertIsNotNone(event)
+        self.assertEqual(
+            event.user,
+            {
+                "pk": self.user.pk,
+                "email": self.user.email,
+                "username": self.user.username,
+            },
+        )

authentik/events/utils.py

@@ -7,7 +7,7 @@ from datetime import date, datetime, time, timedelta
 from enum import Enum
 from pathlib import Path
 from types import GeneratorType, NoneType
-from typing import Any
+from typing import Any, Optional
 from uuid import UUID
 
 from django.contrib.auth.models import AnonymousUser
@@ -37,7 +37,7 @@ def cleanse_item(key: str, value: Any) -> Any:
     """Cleanse a single item"""
     if isinstance(value, dict):
         return cleanse_dict(value)
-    if isinstance(value, list | tuple | set):
+    if isinstance(value, (list, tuple, set)):
         for idx, item in enumerate(value):
             value[idx] = cleanse_item(key, item)
         return value
@@ -74,7 +74,7 @@ def model_to_dict(model: Model) -> dict[str, Any]:
     }
 
 
-def get_user(user: User | AnonymousUser, original_user: User | None = None) -> dict[str, Any]:
+def get_user(user: User | AnonymousUser, original_user: Optional[User] = None) -> dict[str, Any]:
     """Convert user object to dictionary, optionally including the original user"""
     if isinstance(user, AnonymousUser):
         try:
@@ -95,7 +95,8 @@ def get_user(user: User | AnonymousUser, original_user: User | None = None) -> d
     return user_data
 
 
-def sanitize_item(value: Any) -> Any:  # noqa: PLR0911, PLR0912
+# pylint: disable=too-many-return-statements,too-many-branches
+def sanitize_item(value: Any) -> Any:
     """Sanitize a single item, ensure it is JSON parsable"""
     if is_dataclass(value):
         # Because asdict calls `copy.deepcopy(obj)` on everything that's not tuple/dict,
@@ -114,20 +115,20 @@ def sanitize_item(value: Any) -> Any:  # noqa: PLR0911, PLR0912
         return sanitize_dict(value)
     if isinstance(value, GeneratorType):
         return sanitize_item(list(value))
-    if isinstance(value, list | tuple | set):
+    if isinstance(value, (list, tuple, set)):
         new_values = []
         for item in value:
             new_value = sanitize_item(item)
             if new_value:
                 new_values.append(new_value)
         return new_values
-    if isinstance(value, User | AnonymousUser):
+    if isinstance(value, (User, AnonymousUser)):
         return sanitize_dict(get_user(value))
     if isinstance(value, models.Model):
         return sanitize_dict(model_to_dict(value))
     if isinstance(value, UUID):
         return value.hex
-    if isinstance(value, HttpRequest | WSGIRequest):
+    if isinstance(value, (HttpRequest, WSGIRequest)):
         return ...
     if isinstance(value, City):
         return GEOIP_CONTEXT_PROCESSOR.city_to_dict(value)
@@ -170,7 +171,7 @@ def sanitize_item(value: Any) -> Any:  # noqa: PLR0911, PLR0912
             "module": value.__module__,
         }
     # List taken from the stdlib's JSON encoder (_make_iterencode, encoder.py:415)
-    if isinstance(value, bool | int | float | NoneType | list | tuple | dict):
+    if isinstance(value, (bool, int, float, NoneType, list, tuple, dict)):
         return value
     try:
         return DjangoJSONEncoder().default(value)

authentik/flows/api/flows.py

@@ -114,6 +114,7 @@ class FlowImportResultSerializer(PassiveSerializer):
 class FlowViewSet(UsedByMixin, ModelViewSet):
     """Flow Viewset"""
 
+    # pylint: disable=no-member
     queryset = Flow.objects.all().prefetch_related("stages", "policies")
     serializer_class = FlowSerializer
     lookup_field = "slug"
@@ -278,7 +279,7 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
         },
     )
     @action(detail=True, pagination_class=None, filter_backends=[])
-    def execute(self, request: Request, _slug: str):
+    def execute(self, request: Request, slug: str):
         """Execute flow for current user"""
         # Because we pre-plan the flow here, and not in the planner, we need to manually clear
         # the history of the inspector
@@ -293,9 +294,8 @@ class FlowViewSet(UsedByMixin, ModelViewSet):
             return bad_request_message(
                 request,
                 _(
-                    "Flow not applicable to current user/request: {messages}".format_map(
+                    "Flow not applicable to current user/request: %(messages)s"
-                        {"messages": exc.messages}
+                    % {"messages": exc.messages}
-                    )
                 ),
             )
         return Response(

authentik/flows/api/flows_diagram.py

@@ -1,6 +1,7 @@
 """Flows Diagram API"""
 
 from dataclasses import dataclass, field
+from typing import Optional
 
 from django.utils.translation import gettext as _
 from guardian.shortcuts import get_objects_for_user
@@ -17,8 +18,8 @@ class DiagramElement:
 
     identifier: str
     description: str
-    action: str | None = None
+    action: Optional[str] = None
-    source: list["DiagramElement"] | None = None
+    source: Optional[list["DiagramElement"]] = None
 
     style: list[str] = field(default_factory=lambda: ["[", "]"])
 
@@ -65,10 +66,10 @@ class FlowDiagram:
         ):
             element = DiagramElement(
                 f"flow_policy_{p_index}",
-                _("Policy ({type})".format_map({"type": policy_binding.policy._meta.verbose_name}))
+                _("Policy (%(type)s)" % {"type": policy_binding.policy._meta.verbose_name})
                 + "\n"
                 + policy_binding.policy.name,
-                _("Binding {order}".format_map({"order": policy_binding.order})),
+                _("Binding %(order)d" % {"order": policy_binding.order}),
                 parent_elements,
                 style=["{{", "}}"],
             )
@@ -91,7 +92,7 @@ class FlowDiagram:
         ):
             element = DiagramElement(
                 f"stage_{stage_index}_policy_{p_index}",
-                _("Policy ({type})".format_map({"type": policy_binding.policy._meta.verbose_name}))
+                _("Policy (%(type)s)" % {"type": policy_binding.policy._meta.verbose_name})
                 + "\n"
                 + policy_binding.policy.name,
                 "",
@@ -119,7 +120,7 @@ class FlowDiagram:
 
             element = DiagramElement(
                 f"stage_{s_index}",
-                _("Stage ({type})".format_map({"type": stage_binding.stage._meta.verbose_name}))
+                _("Stage (%(type)s)" % {"type": stage_binding.stage._meta.verbose_name})
                 + "\n"
                 + stage_binding.stage.name,
                 action,

authentik/flows/apps.py

@@ -31,10 +31,9 @@ class AuthentikFlowsConfig(ManagedAppConfig):
     verbose_name = "authentik Flows"
     default = True
 
-    @ManagedAppConfig.reconcile_global
+    def reconcile_global_load_stages(self):
-    def load_stages(self):
         """Ensure all stages are loaded"""
         from authentik.flows.models import Stage
 
         for stage in all_subclasses(Stage):
-            _ = stage().view
+            _ = stage().type

authentik/flows/challenge.py

@@ -104,7 +104,7 @@ class FlowErrorChallenge(Challenge):
     error = CharField(required=False)
     traceback = CharField(required=False)
 
-    def __init__(self, request: Request | None = None, error: Exception | None = None):
+    def __init__(self, request: Optional[Request] = None, error: Optional[Exception] = None):
         super().__init__(data={})
         if not request or not error:
             return

authentik/flows/exceptions.py

@@ -1,5 +1,7 @@
 """flow exceptions"""
 
+from typing import Optional
+
 from django.utils.translation import gettext_lazy as _
 
 from authentik.lib.sentry import SentryIgnoredException
@@ -9,7 +11,7 @@ from authentik.policies.types import PolicyResult
 class FlowNonApplicableException(SentryIgnoredException):
     """Flow does not apply to current user (denied by policy, or otherwise)."""
 
-    policy_result: PolicyResult | None = None
+    policy_result: Optional[PolicyResult] = None
 
     @property
     def messages(self) -> str:

authentik/flows/markers.py

@@ -1,7 +1,7 @@
 """Stage Markers"""
 
 from dataclasses import dataclass
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Optional
 
 from django.http.request import HttpRequest
 from structlog.stdlib import get_logger
@@ -25,7 +25,7 @@ class StageMarker:
         plan: "FlowPlan",
         binding: FlowStageBinding,
         http_request: HttpRequest,
-    ) -> FlowStageBinding | None:
+    ) -> Optional[FlowStageBinding]:
         """Process callback for this marker. This should be overridden by sub-classes.
         If a stage should be removed, return None."""
         return binding
@@ -42,7 +42,7 @@ class ReevaluateMarker(StageMarker):
         plan: "FlowPlan",
         binding: FlowStageBinding,
         http_request: HttpRequest,
-    ) -> FlowStageBinding | None:
+    ) -> Optional[FlowStageBinding]:
         """Re-evaluate policies bound to stage, and if they fail, remove from plan"""
         from authentik.flows.planner import PLAN_CONTEXT_PENDING_USER
 

authentik/flows/migrations/0027_auto_20231028_1424.py

@@ -16,7 +16,7 @@ def set_oobe_flow_authentication(apps: Apps, schema_editor: BaseDatabaseSchemaEd
     users = User.objects.using(db_alias).exclude(username="akadmin")
     try:
         users = users.exclude(pk=get_anonymous_user().pk)
-
+    # pylint: disable=broad-except
     except Exception:  # nosec
         pass
 

authentik/flows/models.py

@@ -2,7 +2,7 @@
 
 from base64 import b64decode, b64encode
 from pickle import dumps, loads  # nosec
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Optional
 from uuid import uuid4
 
 from django.db import models
@@ -83,7 +83,7 @@ class Stage(SerializerModel):
     objects = InheritanceManager()
 
     @property
-    def view(self) -> type["StageView"]:
+    def type(self) -> type["StageView"]:
         """Return StageView class that implements logic for this stage"""
         # This is a bit of a workaround, since we can't set class methods with setattr
         if hasattr(self, "__in_memory_type"):
@@ -95,7 +95,7 @@ class Stage(SerializerModel):
         """Return component used to edit this object"""
         raise NotImplementedError
 
-    def ui_user_settings(self) -> UserSettingSerializer | None:
+    def ui_user_settings(self) -> Optional[UserSettingSerializer]:
         """Entrypoint to integrate with User settings. Can either return None if no
         user settings are available, or a challenge."""
         return None
@@ -113,8 +113,8 @@ def in_memory_stage(view: type["StageView"], **kwargs) -> Stage:
     # we set the view as a separate property and reference a generic function
     # that returns that member
     setattr(stage, "__in_memory_type", view)
-    stage.name = _("Dynamic In-memory stage: {doc}".format_map({"doc": view.__doc__}))
+    setattr(stage, "name", _("Dynamic In-memory stage: %(doc)s" % {"doc": view.__doc__}))
-    stage._meta.verbose_name = class_to_path(view)
+    setattr(stage._meta, "verbose_name", class_to_path(view))
     for key, value in kwargs.items():
         setattr(stage, key, value)
     return stage

authentik/flows/planner.py

@@ -1,7 +1,7 @@
 """Flows Planner"""
 
 from dataclasses import dataclass, field
-from typing import Any
+from typing import Any, Optional
 
 from django.core.cache import cache
 from django.http import HttpRequest
@@ -39,7 +39,7 @@ CACHE_TIMEOUT = CONFIG.get_int("cache.timeout_flows")
 CACHE_PREFIX = "goauthentik.io/flows/planner/"
 
 
-def cache_key(flow: Flow, user: User | None = None) -> str:
+def cache_key(flow: Flow, user: Optional[User] = None) -> str:
     """Generate Cache key for flow"""
     prefix = CACHE_PREFIX + str(flow.pk)
     if user:
@@ -58,16 +58,16 @@ class FlowPlan:
     context: dict[str, Any] = field(default_factory=dict)
     markers: list[StageMarker] = field(default_factory=list)
 
-    def append_stage(self, stage: Stage, marker: StageMarker | None = None):
+    def append_stage(self, stage: Stage, marker: Optional[StageMarker] = None):
         """Append `stage` to all stages, optionally with stage marker"""
         return self.append(FlowStageBinding(stage=stage), marker)
 
-    def append(self, binding: FlowStageBinding, marker: StageMarker | None = None):
+    def append(self, binding: FlowStageBinding, marker: Optional[StageMarker] = None):
         """Append `stage` to all stages, optionally with stage marker"""
         self.bindings.append(binding)
         self.markers.append(marker or StageMarker())
 
-    def insert_stage(self, stage: Stage, marker: StageMarker | None = None):
+    def insert_stage(self, stage: Stage, marker: Optional[StageMarker] = None):
         """Insert stage into plan, as immediate next stage"""
         self.bindings.insert(1, FlowStageBinding(stage=stage, order=0))
         self.markers.insert(1, marker or StageMarker())
@@ -78,7 +78,7 @@ class FlowPlan:
 
         self.insert_stage(in_memory_stage(RedirectStage, destination=destination))
 
-    def next(self, http_request: HttpRequest | None) -> FlowStageBinding | None:
+    def next(self, http_request: Optional[HttpRequest]) -> Optional[FlowStageBinding]:
         """Return next pending stage from the bottom of the list"""
         if not self.has_stages:
             return None
@@ -94,7 +94,7 @@ class FlowPlan:
             self.markers.remove(marker)
             if not self.has_stages:
                 return None
-
+            # pylint: disable=not-callable
             return self.next(http_request)
         return marked_stage
 
@@ -148,7 +148,9 @@ class FlowPlanner:
             if not outpost_user:
                 raise FlowNonApplicableException()
 
-    def plan(self, request: HttpRequest, default_context: dict[str, Any] | None = None) -> FlowPlan:
+    def plan(
+        self, request: HttpRequest, default_context: Optional[dict[str, Any]] = None
+    ) -> FlowPlan:
         """Check each of the flows' policies, check policies for each stage with PolicyBinding
         and return ordered list"""
         with Hub.current.start_span(
@@ -212,7 +214,7 @@ class FlowPlanner:
         self,
         user: User,
         request: HttpRequest,
-        default_context: dict[str, Any] | None,
+        default_context: Optional[dict[str, Any]],
     ) -> FlowPlan:
         """Build flow plan by checking each stage in their respective
         order and checking the applied policies"""

authentik/flows/stage.py

@@ -1,6 +1,6 @@
 """authentik stage Base view"""
 
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Optional
 
 from django.contrib.auth.models import AnonymousUser
 from django.http import HttpRequest
@@ -153,7 +153,7 @@ class ChallengeStageView(StageView):
                 "app": self.executor.plan.context.get(PLAN_CONTEXT_APPLICATION, ""),
                 "user": self.get_pending_user(for_display=True),
             }
-
+        # pylint: disable=broad-except
         except Exception as exc:
             self.logger.warning("failed to template title", exc=exc)
             return self.executor.flow.title
@@ -234,9 +234,9 @@ class ChallengeStageView(StageView):
 class AccessDeniedChallengeView(ChallengeStageView):
     """Used internally by FlowExecutor's stage_invalid()"""
 
-    error_message: str | None
+    error_message: Optional[str]
 
-    def __init__(self, executor: "FlowExecutorView", error_message: str | None = None, **kwargs):
+    def __init__(self, executor: "FlowExecutorView", error_message: Optional[str] = None, **kwargs):
         super().__init__(executor, **kwargs)
         self.error_message = error_message
 

authentik/flows/tests/__init__.py

@@ -1,7 +1,7 @@
 """Test helpers"""
 
 from json import loads
-from typing import Any
+from typing import Any, Optional
 
 from django.http.response import HttpResponse
 from django.urls.base import reverse
@@ -15,11 +15,12 @@ from authentik.flows.models import Flow
 class FlowTestCase(APITestCase):
     """Helpers for testing flows and stages."""
 
+    # pylint: disable=invalid-name
     def assertStageResponse(
         self,
         response: HttpResponse,
-        flow: Flow | None = None,
+        flow: Optional[Flow] = None,
-        user: User | None = None,
+        user: Optional[User] = None,
         **kwargs,
     ) -> dict[str, Any]:
         """Assert various attributes of a stage response"""
@@ -44,6 +45,7 @@ class FlowTestCase(APITestCase):
             self.assertEqual(raw_response[key], expected)
         return raw_response
 
+    # pylint: disable=invalid-name
     def assertStageRedirects(self, response: HttpResponse, to: str) -> dict[str, Any]:
         """Wrapper around assertStageResponse that checks for a redirect"""
         return self.assertStageResponse(

authentik/flows/tests/test_stage_model.py

@@ -1,6 +1,6 @@
 """base model tests"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.test import TestCase
 
@@ -22,7 +22,7 @@ def model_tester_factory(test_model: type[Stage]) -> Callable:
             model_class = test_model.__bases__[0]()
         else:
             model_class = test_model()
-        self.assertTrue(issubclass(model_class.view, StageView))
+        self.assertTrue(issubclass(model_class.type, StageView))
         self.assertIsNotNone(test_model.component)
         _ = model_class.ui_user_settings()
 

authentik/flows/tests/test_stage_views.py

@@ -1,6 +1,6 @@
 """stage view tests"""
 
-from collections.abc import Callable
+from typing import Callable
 
 from django.test import RequestFactory, TestCase
 

authentik/flows/views/executor.py

@@ -1,6 +1,7 @@
 """authentik multi-stage authentication engine"""
 
 from copy import deepcopy
+from typing import Optional
 
 from django.conf import settings
 from django.contrib.auth.mixins import LoginRequiredMixin
@@ -107,8 +108,8 @@ class FlowExecutorView(APIView):
 
     flow: Flow
 
-    plan: FlowPlan | None = None
+    plan: Optional[FlowPlan] = None
-    current_binding: FlowStageBinding | None = None
+    current_binding: Optional[FlowStageBinding] = None
     current_stage: Stage
     current_stage_view: View
 
@@ -136,9 +137,9 @@ class FlowExecutorView(APIView):
             )
         return to_stage_response(self.request, self.stage_invalid(error_message=exc.messages))
 
-    def _check_flow_token(self, key: str) -> FlowPlan | None:
+    def _check_flow_token(self, key: str) -> Optional[FlowPlan]:
         """Check if the user is using a flow token to restore a plan"""
-        token: FlowToken | None = FlowToken.filter_not_expired(key=key).first()
+        token: Optional[FlowToken] = FlowToken.filter_not_expired(key=key).first()
         if not token:
             return None
         plan = None
@@ -154,6 +155,7 @@ class FlowExecutorView(APIView):
         self._logger.debug("f(exec): restored flow plan from token", plan=plan)
         return plan
 
+    # pylint: disable=too-many-return-statements
     def dispatch(self, request: HttpRequest, flow_slug: str) -> HttpResponse:
         with Hub.current.start_span(
             op="authentik.flow.executor.dispatch", description=self.flow.slug
@@ -200,7 +202,7 @@ class FlowExecutorView(APIView):
                 # if the cached plan is from an older version, it might have different attributes
                 # in which case we just delete the plan and invalidate everything
                 next_binding = self.plan.next(self.request)
-            except Exception as exc:
+            except Exception as exc:  # pylint: disable=broad-except
                 self._logger.warning(
                     "f(exec): found incompatible flow plan, invalidating run", exc=exc
                 )
@@ -218,7 +220,7 @@ class FlowExecutorView(APIView):
                 flow_slug=self.flow.slug,
             )
             try:
-                stage_cls = self.current_stage.view
+                stage_cls = self.current_stage.type
             except NotImplementedError as exc:
                 self._logger.debug("Error getting stage type", exc=exc)
                 return self.stage_invalid()
@@ -289,7 +291,7 @@ class FlowExecutorView(APIView):
                 span.set_data("authentik Flow", self.flow.slug)
                 stage_response = self.current_stage_view.dispatch(request)
                 return to_stage_response(request, stage_response)
-        except Exception as exc:
+        except Exception as exc:  # pylint: disable=broad-except
             return self.handle_exception(exc)
 
     @extend_schema(
@@ -340,7 +342,7 @@ class FlowExecutorView(APIView):
                 span.set_data("authentik Flow", self.flow.slug)
                 stage_response = self.current_stage_view.dispatch(request)
                 return to_stage_response(request, stage_response)
-        except Exception as exc:
+        except Exception as exc:  # pylint: disable=broad-except
             return self.handle_exception(exc)
 
     def _initiate_plan(self) -> FlowPlan:
@@ -352,7 +354,7 @@ class FlowExecutorView(APIView):
             # there are no issues with the class we might've gotten
             # from the cache. If there are errors, just delete all cached flows
             _ = plan.has_stages
-        except Exception:
+        except Exception:  # pylint: disable=broad-except
             keys = cache.keys(f"{CACHE_PREFIX}*")
             cache.delete_many(keys)
             return self._initiate_plan()
@@ -424,7 +426,7 @@ class FlowExecutorView(APIView):
         )
         return self._flow_done()
 
-    def stage_invalid(self, error_message: str | None = None) -> HttpResponse:
+    def stage_invalid(self, error_message: Optional[str] = None) -> HttpResponse:
         """Callback used stage when data is correct but a policy denies access
         or the user account is disabled.
 
@@ -482,9 +484,9 @@ class CancelView(View):
 class ToDefaultFlow(View):
     """Redirect to default flow matching by designation"""
 
-    designation: FlowDesignation | None = None
+    designation: Optional[FlowDesignation] = None
 
-    def flow_by_policy(self, request: HttpRequest, **flow_filter) -> Flow | None:
+    def flow_by_policy(self, request: HttpRequest, **flow_filter) -> Optional[Flow]:
         """Get a Flow by `**flow_filter` and check if the request from `request` can access it."""
         flows = Flow.objects.filter(**flow_filter).order_by("slug")
         for flow in flows:
@@ -506,7 +508,9 @@ class ToDefaultFlow(View):
         if self.designation == FlowDesignation.AUTHENTICATION:
             flow = brand.flow_authentication
             # Check if we have a default flow from application
-            application: Application | None = self.request.session.get(SESSION_KEY_APPLICATION_PRE)
+            application: Optional[Application] = self.request.session.get(
+                SESSION_KEY_APPLICATION_PRE
+            )
             if application and application.provider and application.provider.authentication_flow:
                 flow = application.provider.authentication_flow
         elif self.designation == FlowDesignation.INVALIDATION:
@@ -536,10 +540,7 @@ class ToDefaultFlow(View):
 
 def to_stage_response(request: HttpRequest, source: HttpResponse) -> HttpResponse:
     """Convert normal HttpResponse into JSON Response"""
-    if (
+    if isinstance(source, HttpResponseRedirect) or source.status_code == 302:
-        isinstance(source, HttpResponseRedirect)
-        or source.status_code == HttpResponseRedirect.status_code
-    ):
         redirect_url = source["Location"]
         # Redirects to the same URL usually indicate an Error within a form
         if request.get_full_path() == redirect_url:
@@ -603,7 +604,7 @@ class ConfigureFlowInitView(LoginRequiredMixin, View):
             )
         except FlowNonApplicableException:
             LOGGER.warning("Flow not applicable to user")
-            raise Http404 from None
+            raise Http404
         request.session[SESSION_KEY_PLAN] = plan
         return redirect_with_qs(
             "authentik_core:if-flow",

authentik/flows/views/inspector.py

@@ -24,8 +24,7 @@ from authentik.flows.api.bindings import FlowStageBindingSerializer
 from authentik.flows.models import Flow
 from authentik.flows.planner import FlowPlan
 from authentik.flows.views.executor import SESSION_KEY_HISTORY, SESSION_KEY_PLAN
-
+from authentik.root.install_id import get_install_id
-MIN_FLOW_LENGTH = 2
 
 
 class FlowInspectorPlanSerializer(PassiveSerializer):
@@ -42,7 +41,7 @@ class FlowInspectorPlanSerializer(PassiveSerializer):
 
     def get_next_planned_stage(self, plan: FlowPlan) -> FlowStageBindingSerializer:
         """Get the next planned stage"""
-        if len(plan.bindings) < MIN_FLOW_LENGTH:
+        if len(plan.bindings) < 2:
             return FlowStageBindingSerializer().data
         return FlowStageBindingSerializer(instance=plan.bindings[1]).data
 
@@ -50,10 +49,12 @@ class FlowInspectorPlanSerializer(PassiveSerializer):
         """Get the plan's context, sanitized"""
         return sanitize_dict(plan.context)
 
-    def get_session_id(self, _plan: FlowPlan) -> str:
+    def get_session_id(self, plan: FlowPlan) -> str:
         """Get a unique session ID"""
         request: Request = self.context["request"]
-        return sha256(request._request.session.session_key.encode("ascii")).hexdigest()
+        return sha256(
+            f"{request._request.session.session_key}-{get_install_id()}".encode("ascii")
+        ).hexdigest()
 
 
 class FlowInspectionSerializer(PassiveSerializer):

authentik/lib/avatars.py

@@ -3,11 +3,11 @@
 from base64 import b64encode
 from functools import cache as funccache
 from hashlib import md5
-from typing import TYPE_CHECKING
+from typing import TYPE_CHECKING, Optional
 from urllib.parse import urlencode
 
 from django.core.cache import cache
-from django.http import HttpRequest, HttpResponseNotFound
+from django.http import HttpRequest
 from django.templatetags.static import static
 from lxml import etree  # nosec
 from lxml.etree import Element, SubElement  # nosec
@@ -37,18 +37,18 @@ SVG_FONTS = [
 ]
 
 
-def avatar_mode_none(user: "User", mode: str) -> str | None:
+def avatar_mode_none(user: "User", mode: str) -> Optional[str]:
     """No avatar"""
     return DEFAULT_AVATAR
 
 
-def avatar_mode_attribute(user: "User", mode: str) -> str | None:
+def avatar_mode_attribute(user: "User", mode: str) -> Optional[str]:
     """Avatars based on a user attribute"""
     avatar = get_path_from_dict(user.attributes, mode[11:], default=None)
     return avatar
 
 
-def avatar_mode_gravatar(user: "User", mode: str) -> str | None:
+def avatar_mode_gravatar(user: "User", mode: str) -> Optional[str]:
     """Gravatar avatars"""
     # gravatar uses md5 for their URLs, so md5 can't be avoided
     mail_hash = md5(user.email.lower().encode("utf-8")).hexdigest()  # nosec
@@ -65,7 +65,7 @@ def avatar_mode_gravatar(user: "User", mode: str) -> str | None:
         # (HEAD since we don't need the body)
         # so if that returns a 404, move onto the next mode
         res = get_http_session().head(gravatar_url, timeout=5)
-        if res.status_code == HttpResponseNotFound.status_code:
+        if res.status_code == 404:
             cache.set(full_key, None)
             return None
         res.raise_for_status()
@@ -86,13 +86,12 @@ def generate_colors(text: str) -> tuple[str, str]:
     red = min(max((color >> 16) & 0xFF, 55), 200)
     bg_hex = f"{red:02x}{green:02x}{blue:02x}"
     # Contrasting text color (https://stackoverflow.com/a/3943023)
-    text_hex = (
+    text_hex = "000" if (red * 0.299 + green * 0.587 + blue * 0.114) > 186 else "fff"
-        "000" if (red * 0.299 + green * 0.587 + blue * 0.114) > 186 else "fff"  # noqa: PLR2004
-    )
     return bg_hex, text_hex
 
 
 @funccache
+# pylint: disable=too-many-arguments,too-many-locals
 def generate_avatar_from_name(
     name: str,
     length: int = 2,
@@ -108,7 +107,7 @@ def generate_avatar_from_name(
     """
     name_parts = name.split()
     # Only abbreviate first and last name
-    if len(name_parts) > 2:  # noqa: PLR2004
+    if len(name_parts) > 2:
         name_parts = [name_parts[0], name_parts[-1]]
 
     if len(name_parts) == 1:
@@ -156,7 +155,7 @@ def generate_avatar_from_name(
     return etree.tostring(root_element).decode()
 
 
-def avatar_mode_generated(user: "User", mode: str) -> str | None:
+def avatar_mode_generated(user: "User", mode: str) -> Optional[str]:
     """Wrapper that converts generated avatar to base64 svg"""
     # By default generate based off of user's display name
     name = user.name.strip()
@@ -170,7 +169,7 @@ def avatar_mode_generated(user: "User", mode: str) -> str | None:
     return f"data:image/svg+xml;base64,{b64encode(svg.encode('utf-8')).decode('utf-8')}"
 
 
-def avatar_mode_url(user: "User", mode: str) -> str | None:
+def avatar_mode_url(user: "User", mode: str) -> Optional[str]:
     """Format url"""
     mail_hash = md5(user.email.lower().encode("utf-8")).hexdigest()  # nosec
     return mode % {
@@ -180,7 +179,7 @@ def avatar_mode_url(user: "User", mode: str) -> str | None:
     }
 
 
-def get_avatar(user: "User", request: HttpRequest | None = None) -> str:
+def get_avatar(user: "User", request: Optional[HttpRequest] = None) -> str:
     """Get avatar with configured mode"""
     mode_map = {
         "none": avatar_mode_none,