mirror of
https://github.com/goauthentik/authentik.git
synced 2026-08-30 18:51:39 -07:00
root: switch cspell to typo-only reporting (#24701)
* root: switch cspell to typo-only reporting cSpell's default mode reports every word it does not recognize, so each new integration name or identifier needed a dictionary entry. Switch to unknownWords: report-common-typos, which matches CodeSpell's behavior: only known misspellings (reported with a suggested fix) and flagWords fail the check. Remove the per-topic dictionaries and word-shape ignore regexes this makes unnecessary, fix the 18 typos the old allowlists were masking, and document the new workflow. Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW * web/docs: fix style-loader-plugin path and wording in CSS architecture doc Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW * website: remove stray blank lines left by ignore-comment removal Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
This commit is contained in:
Teffen Ellis
@@ -30,7 +30,7 @@ packages/ # Shared workspace packages, polyglot:
|
||||
web/ # TypeScript web UI (own AGENTS.md)
|
||||
website/ # Docs / integrations / API sites (own AGENTS.md)
|
||||
blueprints/ # YAML declarative config (default/ system/ example/) applied at startup
|
||||
locale/ # Backend translations (.po) + shared cspell dictionaries (en/dictionaries/)
|
||||
locale/ # Backend translations (.po) + cspell overrides dictionary (en/dictionaries/)
|
||||
tests/ # Cross-cutting test support: e2e/, integration/, geoip/, openid_conformance/
|
||||
schemas/ # Third-party XSD/JSON schemas (SAML, WS-*, SCIM) used at runtime
|
||||
scripts/ # Repo automation (schema build, compose generation, node setup, semver)
|
||||
@@ -106,7 +106,7 @@ make web-test # Web UI tests (delegates to web/)
|
||||
```bash
|
||||
make lint-fix # Auto-fix: black + ruff (Python) and rustfmt (Rust)
|
||||
make lint # Check: bandit, mypy --strict, golangci-lint, cargo deny/machete
|
||||
make lint-spellcheck # cspell across the repo (shared dictionaries in locale/en/dictionaries/)
|
||||
make lint-spellcheck # cspell across the repo (typo-only mode: reports known misspellings and forbidden British spellings, not unknown words)
|
||||
make lint-catalogs # pnpm catalog pins in sync across the root/web/website workspaces
|
||||
```
|
||||
|
||||
|
||||
@@ -16,7 +16,7 @@ LOGGER = get_logger()
|
||||
|
||||
|
||||
def all_subclasses[T: type](cls: T, sort=True) -> list[T] | set[T]:
|
||||
"""Recursively return all subclassess of cls"""
|
||||
"""Recursively return all subclasses of cls"""
|
||||
classes = set(cls.__subclasses__()).union(
|
||||
[s for c in cls.__subclasses__() for s in all_subclasses(c, sort=sort)]
|
||||
)
|
||||
|
||||
@@ -118,7 +118,7 @@ for subclass in OutpostModel.__subclasses__():
|
||||
|
||||
def outpost_reverse_related_post_save(sender, instance: CertificateKeyPair | Brand, **_):
|
||||
for field in instance._meta.get_fields():
|
||||
# Each field is checked if it has a `related_model` attribute (when ForeginKeys or M2Ms)
|
||||
# Each field is checked if it has a `related_model` attribute (when ForeignKeys or M2Ms)
|
||||
# are used, and if it has a value
|
||||
if not hasattr(field, "related_model"):
|
||||
continue
|
||||
|
||||
@@ -5,6 +5,13 @@
|
||||
"version": "0.2",
|
||||
"readonly": true,
|
||||
"language": "en-US",
|
||||
// Only report words that are known misspellings (with a suggested fix) or
|
||||
// explicitly forbidden via `flagWords`. Unknown-but-plausible words — project
|
||||
// jargon, identifiers, integration names — pass silently, so new terms do not
|
||||
// require dictionary entries. This mirrors CodeSpell's behavior, which checks
|
||||
// against a curated list of common misspellings rather than flagging every
|
||||
// word absent from a dictionary.
|
||||
"unknownWords": "report-common-typos",
|
||||
"cache": {
|
||||
"useCache": true,
|
||||
"cacheLocation": "./.cspellcache",
|
||||
@@ -19,68 +26,18 @@
|
||||
}
|
||||
]
|
||||
],
|
||||
// In typo-only mode, a dictionary entry is needed only when a legitimate term
|
||||
// collides with the common-misspellings list. Record such collisions here
|
||||
// rather than reviving per-topic dictionary files.
|
||||
"dictionaryDefinitions": [
|
||||
{
|
||||
"name": "en-x-authentik-software-terms",
|
||||
"path": "./locale/en/dictionaries/software-terms.txt",
|
||||
"description": "English software-related terms",
|
||||
"name": "en-x-authentik-overrides",
|
||||
"path": "./locale/en/dictionaries/overrides.txt",
|
||||
"description": "Legitimate terms that collide with the common-misspellings list",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-idp",
|
||||
"path": "./locale/en/dictionaries/idp.txt",
|
||||
"description": "English IdP words",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-python",
|
||||
"path": "./locale/en/dictionaries/python.txt",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-rust",
|
||||
"path": "./locale/en/dictionaries/rust.txt",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-golang",
|
||||
"path": "./locale/en/dictionaries/golang.txt",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-people",
|
||||
"path": "./locale/en/dictionaries/people.txt",
|
||||
"description": "People names relevant to authentik",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-integrations",
|
||||
"path": "./locale/en/dictionaries/integrations.txt",
|
||||
"description": "English integration names",
|
||||
"addWords": true
|
||||
},
|
||||
{
|
||||
"name": "en-x-authentik-ignore",
|
||||
"path": "./locale/en/dictionaries/ignore.txt",
|
||||
"description": "English ignore list for authentik",
|
||||
"addWords": true,
|
||||
"noSuggest": true
|
||||
}
|
||||
],
|
||||
"dictionaries": [
|
||||
"en-x-authentik-software-terms",
|
||||
"en-x-authentik-idp",
|
||||
"en-x-authentik-ignore",
|
||||
"en-x-authentik-people",
|
||||
"en-x-authentik-integrations",
|
||||
"node",
|
||||
"softwareTerms",
|
||||
"software-tools",
|
||||
"computing-acronyms",
|
||||
"companies",
|
||||
"cpp-compound-words"
|
||||
],
|
||||
"allowCompoundWords": true,
|
||||
"dictionaries": ["en-x-authentik-overrides"],
|
||||
// British spellings to reject in favor of American variants. The `->` form
|
||||
// forbids the left word and offers the right word as the suggested fix.
|
||||
"flagWords": [
|
||||
@@ -162,75 +119,25 @@
|
||||
"name": "EncodedURI",
|
||||
"description": "Encoded URIs, which are common in authentik's codebase and often contain many false positives.",
|
||||
"pattern": "[a-zA-Z]+%3A%2F%2F.+"
|
||||
},
|
||||
{
|
||||
"name": "ConfSuffix",
|
||||
"description": "Variables with `conf` or `config` suffix",
|
||||
"pattern": ["\\w+(conf|config)\\b", "\\b(conf|config)\\w+"]
|
||||
}
|
||||
],
|
||||
// Only content-scoping patterns belong here (encoded blobs, upstream
|
||||
// identifiers spelled the British way) — not word allowlists. Unknown words
|
||||
// are no longer reported, so shape-of-word escapes are unnecessary.
|
||||
"ignoreRegExpList": [
|
||||
// DB Migrations
|
||||
"authentik_c_\\w+_[0-9a-fA-F]+_idx",
|
||||
// Google Analytics
|
||||
"/G-[0-9A-Z]+/",
|
||||
// Github Usernames
|
||||
"@[a-zA-Z0-9_-]+",
|
||||
// GitHub repositories
|
||||
"github\\.com/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+",
|
||||
// Docker images
|
||||
"docker\\.io/[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+",
|
||||
// Suffix "change", which is common in migration files
|
||||
"\\w+change\\b",
|
||||
// Prefix "on", which is common in event handlers
|
||||
"\\bon\\w+\\b",
|
||||
// Prefix "pg", which is common in PostgreSQL-related code
|
||||
"\\bpg\\w+\\b",
|
||||
// Prefix "pf", which is common in PatternFly-related code
|
||||
"\\bpf\\w+\\b",
|
||||
// Prefix "ws", which is common in WebSocket-related code
|
||||
"\\bws\\w+\\b",
|
||||
// Suffix "propertymapping"
|
||||
"\\w+propertymapping\\b",
|
||||
// Words that end with "source", "provider", "user", "group", or "connection",
|
||||
// which are common in authentik's codebase and often contain many false positives.
|
||||
"\\w+(source|provider)(user|group|connection)\\b",
|
||||
"\\w+(source|provider)(user|group|connection)",
|
||||
// Encoded URIs
|
||||
"EncodedURI",
|
||||
// Basic auth header
|
||||
"Basic [a-zA-Z0-9+/=]+",
|
||||
// "ify" suffix, e.g. "stringify", "classify".
|
||||
"\\w+l?ify\\b",
|
||||
// "ified" suffix, e.g. "stringified", "classified".
|
||||
"\\w+l?ified\\b",
|
||||
// "ifying" suffix, e.g. "stringifying", "classifying".
|
||||
"\\w+l?ifying\\b",
|
||||
// PatternFly's grey label modifier is spelled the British way upstream.
|
||||
"pf-m-grey",
|
||||
// Other terms we needed
|
||||
"AKQL",
|
||||
"Base64",
|
||||
"Email",
|
||||
"EncodedURI",
|
||||
"FOUC", // Flash Of Unstyled Content
|
||||
"HashStrings",
|
||||
"PublicKey",
|
||||
"RsaCert",
|
||||
"SpellCheckerIgnoreInDocSetting",
|
||||
"SshRsa",
|
||||
"UnicodeRef",
|
||||
"Urls",
|
||||
"analyse-phase", // UK Spelling
|
||||
"href",
|
||||
"lit-analyse" // UK Spelling
|
||||
// lit-analyzer's CLI and its build phase are spelled the British way upstream.
|
||||
"analyse-phase",
|
||||
"lit-analyse"
|
||||
],
|
||||
"languageSettings": [
|
||||
{
|
||||
"languageId": "markdown,mdx",
|
||||
"dictionaries": [
|
||||
"en-x-authentik-python",
|
||||
"en-x-authentik-rust",
|
||||
"en-x-authentik-golang"
|
||||
],
|
||||
"ignoreRegExpList": [
|
||||
// Fenced code blocks
|
||||
"/^\\s*```[\\s\\S]*?^\\s*```/gm",
|
||||
@@ -242,16 +149,6 @@
|
||||
{
|
||||
"languageId": "typescript,javascript,typescriptreact,javascriptreact,mdx,astro",
|
||||
"ignoreRegExpList": [
|
||||
// Event handlers e.g. onClick, onmouseover
|
||||
"\\bon\\w+\\b",
|
||||
// Custom web component tags e.g. <ak-button>, <ak-toggle-group>
|
||||
"</?ak-[a-z0-9-]+",
|
||||
// Scoped import paths, e.g. @webcomponents/webcomponentsjs
|
||||
"@[a-z0-9-]+/[a-z0-9-]+",
|
||||
// Import paths that end with "js", which are often false positives
|
||||
// and not worth the effort of creating a custom dictionary for.
|
||||
"[a-z0-9-]+js",
|
||||
"ConfSuffix",
|
||||
"js-hex-escape",
|
||||
"js-unicode-escape",
|
||||
"js-regexp-flags",
|
||||
@@ -260,25 +157,8 @@
|
||||
},
|
||||
{
|
||||
"languageId": "python",
|
||||
"dictionaries": ["en-x-authentik-python"],
|
||||
"includeRegExpList": ["comments"]
|
||||
},
|
||||
{
|
||||
"languageId": "rust",
|
||||
"dictionaries": ["en-x-authentik-rust"]
|
||||
},
|
||||
{
|
||||
"languageId": "go",
|
||||
"dictionaries": ["en-x-authentik-golang"]
|
||||
},
|
||||
{
|
||||
"languageId": "makefile,toml,yaml",
|
||||
"dictionaries": [
|
||||
"en-x-authentik-python",
|
||||
"en-x-authentik-rust",
|
||||
"en-x-authentik-golang"
|
||||
]
|
||||
},
|
||||
{
|
||||
"languageId": "css,scss",
|
||||
"ignoreRegExpList": [
|
||||
@@ -292,7 +172,6 @@
|
||||
"{cspell.*,cSpell.*,.cspell.*,cspell.config.*}", // CSpell configuration files
|
||||
"cspell-report.{json,html,txt}", // CSpell report files
|
||||
"dictionaries", // Custom dictionary files
|
||||
"ignore.txt", // Custom ignore list files
|
||||
"./locale", // Locale files (Django, CSpell)
|
||||
"web/xliff", // XLIFF translation files
|
||||
"web/src/locales", // Generated TypeScript locale
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
# Golang-specific terms
|
||||
gounicorn
|
||||
pems
|
||||
connm
|
||||
Debugf
|
||||
Infof
|
||||
Warnf
|
||||
layeh
|
||||
Warningf
|
||||
goldap
|
||||
goauthentikio
|
||||
singlevg
|
||||
accsp
|
||||
uapisp
|
||||
GORMDB
|
||||
golangci
|
||||
gorm
|
||||
gorm
|
||||
gorm*
|
||||
logger
|
||||
@@ -1,9 +0,0 @@
|
||||
# IdP-specific terms
|
||||
authentik
|
||||
Yubi
|
||||
Yubikey
|
||||
Yubikeys
|
||||
mycorp
|
||||
mocksaml
|
||||
VSCHAR
|
||||
pbms
|
||||
@@ -1,27 +0,0 @@
|
||||
# Ignored terms that should not be suggested by the spell checker.
|
||||
aaguids
|
||||
ASGI
|
||||
asgi
|
||||
azuread
|
||||
Azuread
|
||||
buildx
|
||||
goauthentik
|
||||
llmstxt
|
||||
lxml
|
||||
pässwörd
|
||||
phlebotinum
|
||||
qewr
|
||||
quox
|
||||
recategorize
|
||||
reinject
|
||||
tmpfs
|
||||
trixie
|
||||
XFCC
|
||||
xghcr
|
||||
xoxb
|
||||
xoxe
|
||||
xoxp
|
||||
foo
|
||||
bar
|
||||
baz
|
||||
qux
|
||||
@@ -1,91 +0,0 @@
|
||||
# Integrations
|
||||
ADOM
|
||||
Apereo
|
||||
appflowy
|
||||
appsmith
|
||||
Ascensio
|
||||
Authy
|
||||
Beszel
|
||||
Bitnami
|
||||
Budibase
|
||||
Chatwoot
|
||||
Coolify
|
||||
Directus
|
||||
Doki
|
||||
Doku
|
||||
dokuwiki
|
||||
Dozzle
|
||||
Engomo
|
||||
Espo
|
||||
espocrm
|
||||
ezBookkeeping
|
||||
fleetdm
|
||||
Flowy
|
||||
Forgejo
|
||||
Forti
|
||||
Fortigate
|
||||
Gatus
|
||||
Gestionnaire
|
||||
ghec
|
||||
Gitea
|
||||
Gravitee
|
||||
grommunio
|
||||
HACS
|
||||
Homarr
|
||||
Icinga
|
||||
Informatique
|
||||
Jellyseerr
|
||||
Kavita
|
||||
Kimai
|
||||
Kiota
|
||||
Knoc
|
||||
Knocknoc
|
||||
Komodo
|
||||
Kubeconfig
|
||||
Mautic
|
||||
Mobilizon
|
||||
myabsorb
|
||||
n8n
|
||||
NocoDB
|
||||
Nexterm
|
||||
Observium
|
||||
Ofair
|
||||
Ollama
|
||||
Omada
|
||||
Omnissa
|
||||
omniauth
|
||||
openwebui
|
||||
OPNsense
|
||||
Orchesta
|
||||
Organizr
|
||||
Packagify
|
||||
Palo
|
||||
Papra
|
||||
Personio
|
||||
PhotoPrism
|
||||
pfSense
|
||||
phpipam
|
||||
Planka
|
||||
Plesk
|
||||
PostHog
|
||||
proftpd
|
||||
pveum
|
||||
Qube
|
||||
Relatedly
|
||||
Seerr
|
||||
Sidero
|
||||
snipeit
|
||||
sonarqube
|
||||
Technitium
|
||||
Terrakube
|
||||
Ueberauth
|
||||
Veeam
|
||||
Vikunja
|
||||
Wazuh
|
||||
Wdio
|
||||
Weixin
|
||||
Wekan
|
||||
Xcreds
|
||||
Zammad
|
||||
Zenko
|
||||
Zulip
|
||||
4
locale/en/dictionaries/overrides.txt
Normal file
4
locale/en/dictionaries/overrides.txt
Normal file
@@ -0,0 +1,4 @@
|
||||
# Legitimate terms that the spell checker's common-misspellings list would
|
||||
# otherwise report as typos. Only add a word here when `make lint-spellcheck`
|
||||
# flags it with a suggested "fix" and the original spelling is intentional.
|
||||
ontext
|
||||
@@ -1,16 +0,0 @@
|
||||
# People names.
|
||||
Bery
|
||||
Beryju
|
||||
Teffen
|
||||
GirlBossRush
|
||||
Gergo
|
||||
Marc
|
||||
Dewi
|
||||
Zwanenburg
|
||||
Naur
|
||||
Wärting
|
||||
Aadit
|
||||
Kilby
|
||||
Kahmen
|
||||
Hodgman
|
||||
Sutherland
|
||||
@@ -1,13 +0,0 @@
|
||||
debugpy
|
||||
dramatiq
|
||||
kwargs
|
||||
pgtrigger
|
||||
psycopg
|
||||
pyrad
|
||||
uvicorn
|
||||
pglock
|
||||
dicted
|
||||
mypy
|
||||
klass
|
||||
pgactivity
|
||||
kinit
|
||||
@@ -1,16 +0,0 @@
|
||||
allinone
|
||||
argh
|
||||
clippy
|
||||
impls
|
||||
moka
|
||||
nasm
|
||||
netns
|
||||
pointee
|
||||
rcgen
|
||||
repr
|
||||
serde
|
||||
sqlx
|
||||
tcpv
|
||||
tungstenite
|
||||
unseparated
|
||||
zstd
|
||||
@@ -1,198 +0,0 @@
|
||||
# Software-specific terms
|
||||
*_c_name_*
|
||||
*_c_slug_*
|
||||
*ecdsa*
|
||||
*entra*
|
||||
*id*
|
||||
*identities
|
||||
*identity
|
||||
*ids*
|
||||
*idx*
|
||||
*mapping*
|
||||
*name*
|
||||
*named*
|
||||
*names*
|
||||
*namespace*
|
||||
*namespaces
|
||||
*plex*
|
||||
*provider
|
||||
+Xmldsig+
|
||||
ADFS
|
||||
AKMDX
|
||||
ASVS
|
||||
Algs
|
||||
Backblaze
|
||||
CASB
|
||||
CLDR
|
||||
Cloudflare
|
||||
DOTADIW
|
||||
Docsmg
|
||||
DTCG
|
||||
GDTC
|
||||
GHES
|
||||
GHSA
|
||||
GLPI
|
||||
GitGuardian
|
||||
Guac
|
||||
Guacd
|
||||
Gunicorn
|
||||
HIBP
|
||||
HOTP
|
||||
Hackathon
|
||||
ISPM
|
||||
ITDR
|
||||
Kadmin
|
||||
LDAPCP
|
||||
LSPATH
|
||||
Liskov
|
||||
MDSCIM
|
||||
MYNIS
|
||||
Moreecdsa
|
||||
NGFW
|
||||
OCAK
|
||||
OCNS
|
||||
PEAP
|
||||
PKCE
|
||||
PSSO
|
||||
Pooler
|
||||
Pyroscope
|
||||
QNAP
|
||||
RAC
|
||||
RHAAP
|
||||
SCIM
|
||||
SDKJS
|
||||
SMTPD
|
||||
SNPEGO
|
||||
SPSSO
|
||||
SVGOMG
|
||||
SeaweedFS
|
||||
Sfdc
|
||||
Symfony
|
||||
TOTP
|
||||
Transifex
|
||||
Unenrollment
|
||||
Unmigrate
|
||||
USWDS
|
||||
Wasabi
|
||||
Wsfed
|
||||
Xen
|
||||
Xmldsig
|
||||
XmldsigMore
|
||||
ZTNA
|
||||
aaguid
|
||||
adsi
|
||||
akflow
|
||||
akprox
|
||||
allinone
|
||||
asns
|
||||
backblazeb2
|
||||
cbor
|
||||
cloudflarestorage
|
||||
copylefted
|
||||
cves
|
||||
describedby
|
||||
dialector
|
||||
docsmg
|
||||
doseq
|
||||
dsa
|
||||
dsquery
|
||||
ellipsized
|
||||
esbuild
|
||||
falsey
|
||||
frie
|
||||
gcsp
|
||||
geoip
|
||||
geojson
|
||||
geojsonl
|
||||
glpi
|
||||
gosaml
|
||||
grecaptcha
|
||||
hasc
|
||||
hexworld
|
||||
guac
|
||||
guacd
|
||||
gunicorn
|
||||
hackathon
|
||||
haveibeenpwned
|
||||
hcaptcha
|
||||
hibp
|
||||
hotp
|
||||
hres
|
||||
kadmin
|
||||
kiprop
|
||||
kubeadm
|
||||
labelledby
|
||||
wasabisys
|
||||
LLM
|
||||
LLMS
|
||||
mcomplete
|
||||
mermaidjs
|
||||
microsoft
|
||||
mmdb
|
||||
lngs
|
||||
lons
|
||||
maplibre
|
||||
maplibregl
|
||||
noopener
|
||||
noreferrer
|
||||
ocsp
|
||||
oktadev
|
||||
openidc
|
||||
ouia
|
||||
ouid
|
||||
peap
|
||||
pkce
|
||||
pmtiles
|
||||
plex
|
||||
protomaps
|
||||
postgresstore
|
||||
proxyv
|
||||
psso
|
||||
pydantic
|
||||
pyroscope
|
||||
rapi
|
||||
rasterizes
|
||||
rbcervilla
|
||||
recws
|
||||
retag
|
||||
rnds
|
||||
rsa
|
||||
runit
|
||||
RSTR
|
||||
sbdocs
|
||||
schedulable
|
||||
scim
|
||||
scsp
|
||||
sha
|
||||
source
|
||||
stringly
|
||||
sysd
|
||||
tdialector
|
||||
templatize
|
||||
tippecanoe
|
||||
tgcsp
|
||||
tguacd
|
||||
tgunicorn
|
||||
totp
|
||||
tscsp
|
||||
ttotp
|
||||
tuisp
|
||||
uisp
|
||||
unenrollment
|
||||
unhashed
|
||||
unmigrate
|
||||
unscalable
|
||||
unskippable
|
||||
unsynchronized
|
||||
uperm
|
||||
uwsgi
|
||||
wireit
|
||||
wsfed
|
||||
wtrealm
|
||||
xen+
|
||||
xenc
|
||||
yamltags
|
||||
zxcvbn
|
||||
~uuid
|
||||
~uuids
|
||||
wreply
|
||||
@@ -103,7 +103,7 @@ pub enum Tlv<'a> {
|
||||
/// Contains the host name value passed by the client, as an UTF-8 encoded string. In case of
|
||||
/// TLS being used on the client connection, this is the exact copy of the `server_name`
|
||||
/// extension as defined by RFC3546, section 3.1, often referred to as SNI. There are probably
|
||||
/// other situations where an authority can be mentionned on a connection without TLS being
|
||||
/// other situations where an authority can be mentioned on a connection without TLS being
|
||||
/// involved at all.
|
||||
Authority(Cow<'a, str>),
|
||||
|
||||
|
||||
@@ -37,7 +37,6 @@ test("normalizePlace accepts legacy pmap:-prefixed names", () => {
|
||||
});
|
||||
|
||||
test("normalizePlace rejects unwanted kinds and nameless places", () => {
|
||||
// spellchecker:disable-next-line
|
||||
expect(normalizePlace({ kind: "neighbourhood", name: "Mitte" }, 0, 0)).toBe(null);
|
||||
expect(normalizePlace({ kind: "locality" }, 0, 0)).toBe(null);
|
||||
});
|
||||
@@ -99,7 +98,6 @@ test("country reveal zoom is tiered by population, not the dump's min_zoom", ()
|
||||
normalizePlace(
|
||||
{
|
||||
"kind": "country",
|
||||
// spellchecker:disable-next-line
|
||||
"name": "Österreich",
|
||||
"name:en": "Austria",
|
||||
"min_zoom": 4,
|
||||
|
||||
@@ -67,7 +67,7 @@ export function loadJSON(jsonPath) {
|
||||
});
|
||||
}
|
||||
|
||||
const PackageJSONComparisionFields = /** @type {const} */ ([
|
||||
const PackageJSONComparisonFields = /** @type {const} */ ([
|
||||
"name",
|
||||
"dependencies",
|
||||
"devDependencies",
|
||||
@@ -77,14 +77,14 @@ const PackageJSONComparisionFields = /** @type {const} */ ([
|
||||
]);
|
||||
|
||||
/**
|
||||
* @typedef {typeof PackageJSONComparisionFields[number]} PackageJSONComparisionField
|
||||
* @typedef {typeof PackageJSONComparisonFields[number]} PackageJSONComparisonField
|
||||
*/
|
||||
|
||||
/**
|
||||
* Extracts only the dependency fields from a package.json object for comparison purposes.
|
||||
*
|
||||
* @param {PackageJSON} data
|
||||
* @returns {Pick<PackageJSON, PackageJSONComparisionField>}
|
||||
* @returns {Pick<PackageJSON, PackageJSONComparisonField>}
|
||||
*/
|
||||
export function pluckDependencyFields(data) {
|
||||
/**
|
||||
@@ -92,13 +92,13 @@ export function pluckDependencyFields(data) {
|
||||
*/
|
||||
const result = {};
|
||||
|
||||
for (const field of PackageJSONComparisionFields) {
|
||||
for (const field of PackageJSONComparisonFields) {
|
||||
if (data[field]) {
|
||||
result[field] = data[field];
|
||||
}
|
||||
}
|
||||
|
||||
return /** @type {Pick<PackageJSON, PackageJSONComparisionField>} */ (result);
|
||||
return /** @type {Pick<PackageJSON, PackageJSONComparisonField>} */ (result);
|
||||
}
|
||||
|
||||
//#region Versioning
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
This document describes how the CSS is built in our current system, and what we can do to make that
|
||||
process less challenging and fraught with difficulties:
|
||||
|
||||
## styleLoaderPlugin (./bundler/style-loader-pluging/node.js)
|
||||
## styleLoaderPlugin (./bundler/style-loader-plugin/node.js)
|
||||
|
||||
All of our CSS is complied together by this ESBuild plug.
|
||||
All of our CSS is compiled together by this ESBuild plugin.
|
||||
|
||||
## ./scripts/build-web.mjs
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ const mfaSupportHelp = msg(
|
||||
);
|
||||
|
||||
const clientNetworksHelp = msg(
|
||||
"List of CIDRs (comma-seperated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.",
|
||||
"List of CIDRs (comma-separated) that clients can connect from. A more specific CIDR will match before a looser one. Clients connecting from a non-specified CIDR will be dropped.",
|
||||
);
|
||||
|
||||
export interface RADIUSProviderFormProps {
|
||||
|
||||
@@ -204,7 +204,7 @@ export class UserListPage extends WithLicenseSummary(
|
||||
[msg("Actions"), null, msg("Row Actions")],
|
||||
];
|
||||
|
||||
//#region Renderering
|
||||
//#region Rendering
|
||||
|
||||
protected override renderToolbarSelected(): TemplateResult {
|
||||
const disabled = this.selectedElements.length < 1;
|
||||
|
||||
@@ -9,7 +9,7 @@ import { css, html, nothing } from "lit";
|
||||
import { customElement, property } from "lit/decorators.js";
|
||||
|
||||
@customElement("ak-license-notice")
|
||||
export class AKLicenceNotice extends WithLicenseSummary(AKElement) {
|
||||
export class AKLicenseNotice extends WithLicenseSummary(AKElement) {
|
||||
public static styles = [
|
||||
css`
|
||||
::part(container) {
|
||||
@@ -44,6 +44,6 @@ export class AKLicenceNotice extends WithLicenseSummary(AKElement) {
|
||||
|
||||
declare global {
|
||||
interface HTMLElementTagNameMap {
|
||||
"ak-license-notice": AKLicenceNotice;
|
||||
"ak-license-notice": AKLicenseNotice;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -4,16 +4,12 @@
|
||||
|
||||
html[lang="ja"],
|
||||
html[lang^="ja-"] {
|
||||
/* spellchecker:disable */
|
||||
|
||||
--ak-font-family-sans-serif:
|
||||
"M PLUS 2", "Noto Sans JP", "Hiragino Kaku Gothic Pro", "ヒラギノ角ゴ Pro W3", メイリオ,
|
||||
Meiryo, "ＭＳ Ｐゴシック", var(--ak-generic-sans-serif);
|
||||
|
||||
--ak-font-family-serif: "Noto Serif JP", var(--ak-generic-serif);
|
||||
|
||||
/* spellchecker:enable */
|
||||
|
||||
--ak-font-family-heading: var(--ak-font-family-sans-serif);
|
||||
|
||||
--pf-c-content--h1--FontWeight: 500;
|
||||
|
||||
@@ -3,8 +3,6 @@
|
||||
*/
|
||||
|
||||
html[lang^="zh"] {
|
||||
/* spellchecker:disable */
|
||||
|
||||
--ak-font-family-sans-serif:
|
||||
"Noto Sans SC", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei",
|
||||
sans-serif, var(--ak-generic-sans-serif);
|
||||
@@ -15,8 +13,6 @@ html[lang^="zh"] {
|
||||
"Noto Sans SC", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei",
|
||||
sans-serif;
|
||||
|
||||
/* spellchecker:enable */
|
||||
|
||||
--pf-c-content--h1--FontWeight: 500;
|
||||
|
||||
body {
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
// cspell:ignore bearbeiten Versuche Beispielsweise nichts sehen Avaa
|
||||
import { sanitizeLocaleModule } from "../../scripts/unescape-locale-entities.mjs";
|
||||
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
2
web/types/dom.d.ts
vendored
2
web/types/dom.d.ts
vendored
@@ -2,8 +2,6 @@
|
||||
* @file Global DOM-related types.
|
||||
*/
|
||||
|
||||
/* spellchecker:ignore closedBy */
|
||||
|
||||
export {};
|
||||
|
||||
declare global {
|
||||
|
||||
2
web/types/rapi-doc/index.d.ts
vendored
2
web/types/rapi-doc/index.d.ts
vendored
@@ -2,7 +2,6 @@ declare module "rapidoc" {
|
||||
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
||||
type Booleanish = "true" | "false";
|
||||
|
||||
// spellchecker:disable
|
||||
/**
|
||||
* Web Component based Swagger & OpenAPI Spec Viewer
|
||||
*
|
||||
@@ -73,7 +72,6 @@ declare module "rapidoc" {
|
||||
* @attr {string} api-key-value - Value of the API key (can be overwritten from UI).
|
||||
* @attr {"omit" | "same-origin" | "include"} fetch-credentials - Credentials mode for cross-domain calls.
|
||||
*/
|
||||
// spellchecker:enable
|
||||
class RapiDoc extends HTMLElement {
|
||||
/**
|
||||
* Programmatically load a spec.
|
||||
|
||||
@@ -128,15 +128,14 @@ Avoid renaming/moving pages unless necessary; better organization rarely justifi
|
||||
|
||||
## Spell checking
|
||||
|
||||
Spell checking uses **cspell** (`make lint-spellcheck`, config `../cspell.config.jsonc`). Custom dictionaries live in `../locale/en/dictionaries/` (`software-terms.txt`, `integrations.txt`, `idp.txt`, language-specific lists, `people.txt`, `ignore.txt`). Add genuinely new product/service/technology terms to the appropriate dictionary rather than rewording correct prose; never disable the checker for a whole page.
|
||||
Spell checking uses **cspell** (`make lint-spellcheck`, config `../cspell.config.jsonc`) in typo-only mode (`unknownWords: "report-common-typos"`): it reports only words on the common-misspellings list (always with a suggested fix) and forbidden British spellings. Unknown words — product names, jargon, identifiers — pass silently, so a new integration or technology term needs **no** dictionary entry.
|
||||
|
||||
For a genuine one-off that does not belong in a dictionary (a deliberate misspelling in an example, an opaque token), use an inline cspell comment scoped as tightly as possible:
|
||||
If the checker flags a word whose spelling is intentional (a third-party API member, a deliberate misspelling in an example), either:
|
||||
|
||||
- `<!-- spellchecker:ignore someword anotherword -->` in Markdown/MDX, or `// spellchecker:ignore ...` in code — allow specific words for the rest of the file.
|
||||
- `<!-- spellchecker:disable-next-line -->` / `// spellchecker:disable-next-line` — skip just the following line.
|
||||
- `<!-- spellchecker:disable -->` … `<!-- spellchecker:enable -->` — skip a bounded region (avoid; prefer the narrower forms).
|
||||
- add it to `../locale/en/dictionaries/overrides.txt` if it may recur across files, or
|
||||
- use an inline comment scoped as tightly as possible for a true one-off: `<!-- spellchecker:ignore someword -->` in Markdown/MDX (`// spellchecker:ignore ...` in code), or `<!-- spellchecker:disable-next-line -->` for a single line.
|
||||
|
||||
Reach for a dictionary entry first — inline ignores are for the rare case the term is truly local to one page.
|
||||
Never disable the checker for a whole page.
|
||||
|
||||
## Deployment
|
||||
|
||||
@@ -161,6 +160,6 @@ Every PR gets a Netlify Deploy Preview — use it to verify rendering, links, an
|
||||
| Build runtime | Node ≥ 24, npm ≥ 11 (run via `corepack`) |
|
||||
| Package layout | NPM Workspaces (`docs`, `integrations`, `api`, `docusaurus-theme`) |
|
||||
| Lint / format | ESLint 9 (`@goauthentik/eslint-config`) + Prettier (`@goauthentik/prettier-config`) |
|
||||
| Spell check | cspell + shared dictionaries |
|
||||
| Spell check | cspell (typo-only mode) |
|
||||
| Types | TypeScript (`tsc -b`) |
|
||||
| Hosting | Netlify + GitHub Actions |
|
||||
|
||||
@@ -4,8 +4,6 @@ sidebar_label: Cascade layers
|
||||
description: How authentik's web UI orders its CSS with @layer, and where each kind of rule belongs.
|
||||
---
|
||||
|
||||
<!-- cspell:words unlayered -->
|
||||
|
||||
authentik's document CSS is ordered with [cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer). Layers make the ordering explicit, so a rule's precedence comes from the layer it is assigned to rather than from where it happens to be imported or how specific its selector is.
|
||||
|
||||
## The layer order
|
||||
|
||||
@@ -4,8 +4,6 @@ sidebar_label: CSS architecture
|
||||
description: How authentik's runtime CSS and design tokens fit together across the theme package, the document cascade, and Lit components.
|
||||
---
|
||||
|
||||
<!-- cspell:words DTCG Styleframe -->
|
||||
|
||||
authentik's UI is a customized PatternFly 4 system wrapped in Lit web components. Treat PatternFly as a compatibility layer, not the public API to build on: the stable surface is the `--ak-*` token set.
|
||||
|
||||
## The pieces
|
||||
|
||||
@@ -137,7 +137,7 @@ image:
|
||||
- web/admin: rework outpost health
|
||||
- web/elements: add grouping and descriptions to search select
|
||||
- web/elements: make ak-search-select limited in height and scroll
|
||||
- web/elements: render ak-seach-select dropdown correctly in modals
|
||||
- web/elements: render ak-search-select dropdown correctly in modals
|
||||
- web/user: fix user settings stuck loading
|
||||
|
||||
## Fixed in 2022.12.2
|
||||
|
||||
@@ -213,7 +213,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.2
|
||||
- enterprise: add full audit log (#8177)
|
||||
- enterprise: fix system task missing set_status (#8455)
|
||||
- enterprise: rework license summary caching (#8501)
|
||||
- enterrpise: exclude inactive users from license (#8294)
|
||||
- enterprise: exclude inactive users from license (#8294)
|
||||
- events: add ASN Database reader (#7793)
|
||||
- events: add better fallback for sanitize_item to ensure everything can be saved as JSON (#7694)
|
||||
- events: add graph for event volume (#7639)
|
||||
|
||||
@@ -3,8 +3,6 @@ title: Release 2024.4
|
||||
slug: /releases/2024.4
|
||||
---
|
||||
|
||||
<!-- cSpell:ignore moar -->
|
||||
|
||||
## Highlights
|
||||
|
||||
- **OAuth/SAML as authentication factor** :ak-enterprise Use an external provider as part of an MFA authentication flow, including custom implementations
|
||||
|
||||
@@ -3,8 +3,6 @@ title: Release 2025.12
|
||||
slug: "/releases/2025.12"
|
||||
---
|
||||
|
||||
<!-- spellchecker:ignore fqxr xjjx -->
|
||||
|
||||
## Highlights
|
||||
|
||||
- **Endpoint Devices**: :ak-enterprise :ak-preview Endpoint Devices is a new feature set for Windows, macOS, and Linux devices that enables SSH authentication, local device login, and more, all with authentik credentials. See the [Endpoint Devices docs](../../endpoint-devices/index.mdx) for more details.
|
||||
@@ -459,7 +457,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2025.12
|
||||
- providers/proxy: move search path to query instead of runtime parameter (cherry-pick #20662 to version-2025.12) (#20692)
|
||||
- providers/radius: fix message authenticator validation (cherry-pick #21824 to version-2025.12) (#21827)
|
||||
- providers/saml: Fix redirect for saml slo (cherry-pick #21258 to version-2025.12) (#21283)
|
||||
- proviers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) (#21227)
|
||||
- providers/ldap: avoid concurrent header writes in API Client (cherry-pick #21223 to version-2025.12) (#21227)
|
||||
- root: do not rely on npm cli for version bump (cherry-pick #20276 to version-2025.12) (#20320)
|
||||
- root: fix compose generation for patch releases release candidates (cherry-pick #21353 to version-2025.12) (#21354)
|
||||
- root: update django to 5.2.14 (cherry-pick #22064 to version-2025.12) (#22065)
|
||||
|
||||
@@ -3,8 +3,6 @@ title: Release 2026.2
|
||||
slug: "/releases/2026.2"
|
||||
---
|
||||
|
||||
<!-- spellchecker:ignore fqxr xjjx πthon -->
|
||||
|
||||
## Highlights
|
||||
|
||||
- **Object Lifecycle Management**: :ak-enterprise :ak-preview Admins can now automatically schedule periodic reviews of authentik objects (applications, groups, roles) for compliance and auditing purposes.
|
||||
|
||||
@@ -3,8 +3,6 @@ title: Release 2026.5
|
||||
slug: "/releases/2026.5"
|
||||
---
|
||||
|
||||
<!-- spellchecker:ignore fqxr xjjx -->
|
||||
|
||||
## Highlights
|
||||
|
||||
- **Account Lockdown**: :ak-enterprise A new panic button for compromised accounts that can immediately cut off access, revoke tokens, end sessions, and leave an audit trail.
|
||||
@@ -400,7 +398,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2026.5
|
||||
- tasks: threads instead of forks (#19476)
|
||||
- tenants: add option to mark flag as deprecated (#22063)
|
||||
- tenants: fix default schema in initial migration (#21114)
|
||||
- tenants: fix system flags removeable (cherry-pick #22163 to version-2026.5) (#22182)
|
||||
- tenants: fix system flags removable (cherry-pick #22163 to version-2026.5) (#22182)
|
||||
- tests: add mixin to launch traefik for tests requiring SSL (#22011)
|
||||
- tests: refactor test harness to split apart a single file (#21391)
|
||||
- translate: Updates for project authentik and language bg_BG (#22112)
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
<!-- spellchecker:ignore GHSA-xp7f-xjjx-gwm8 -->
|
||||
|
||||
# CVE-2026-49443 / GHSA-xp7f-xjjx-gwm8
|
||||
|
||||
## SourceStage bypass via empty POST
|
||||
|
||||
@@ -6,8 +6,6 @@ support_level: community
|
||||
|
||||
import RedirectURI20265Note from "../../\_redirect-uri-2026-5-note.mdx";
|
||||
|
||||
<!-- spellchecker:ignore gromox -->
|
||||
|
||||
## What is grommunio?
|
||||
|
||||
> grommunio is an open-source groupware server and collaboration platform offering email, calendar, contacts, tasks, video conferencing, and file sync. It is fully compatible with Microsoft Outlook via MAPI/RPC, EWS, and ActiveSync.
|
||||
|
||||
Reference in New Issue
Block a user