Reapply "rework to exception"

This reverts commit 6f6ae67f99.

authentik/core/sources/flow_manager.py

@@ -188,10 +188,10 @@ class SourceFlowManager:
                 if action == Action.ENROLL:
                     self._logger.debug("Handling enrollment of new user")
                     return self.handle_enroll(connection)
-            if action == Action.DENY and self.matcher.failure:
-                response = self.handle_match_failure(self.matcher.failure)
-                if response:
-                    return response
+        except MatchFailure as exc:
+            response = self.handle_match_failure(exc)
+            if response:
+                return response
         except FlowNonApplicableException as exc:
             self._logger.warning("Flow non applicable", exc=exc)
             return self.error_handler(exc)

authentik/core/sources/matcher.py

@@ -35,14 +35,26 @@ class MatchFailureReason(models.TextChoices):
     MISSING_PROPERTY = "missing_property", _("Missing property")
 
 
-@dataclass(frozen=True)
-class MatchFailure:
+class MatchFailure(Exception):
     """Details about a source matching failure."""
 
     reason: MatchFailureReason
     property: str
     source_slug: str
 
+    def __init__(self, reason: MatchFailureReason, property: str, source_slug: str) -> None:
+        self.reason = reason
+        self.property = property
+        self.source_slug = source_slug
+
+    def __str__(self):
+        return (
+            f"Failed to match property {self.property}: {self.reason} (source {self.source_slug})"
+        )
+
+    def __repr__(self):
+        return super().__str__()
+
 
 @dataclass
 class MatchableProperty:
@@ -61,7 +73,6 @@ class SourceMatcher:
         self.source = source
         self.user_connection_type = user_connection_type
         self.group_connection_type = group_connection_type
-        self.failure: MatchFailure | None = None
         self._logger = get_logger().bind(source=self.source)
 
     def get_action(
@@ -103,15 +114,12 @@ class SourceMatcher:
             property = matchable_property.property
             if matching_mode in [matchable_property.link_mode, matchable_property.deny_mode]:
                 if not properties.get(property, None):
-                    self.failure = MatchFailure(
-                        reason=MatchFailureReason.MISSING_PROPERTY,
-                        property=property,
-                        source_slug=self.source.slug,
-                    )
                     self._logger.warning(
                         "Refusing to use none property", identifier=identifier, property=property
                     )
-                    return Action.DENY, None
+                    raise MatchFailure(
+                        MatchFailureReason.MISSING_PROPERTY, property, source_slug=self.source.slug
+                    )
                 query_args = {
                     f"{property}__exact": properties[property],
                 }