* packages/fonts: add @goauthentik/fonts package
Extract the bundled web fonts out of web/ into a dedicated
@goauthentik/fonts workspace package: the RedHat variable faces, the
PatternFly pficon icon face, and the FontAwesome Free solid face, each
with its upstream license recorded under licenses/.
web/ now pulls the faces and icons from the package's
@goauthentik/fonts/faces.css and @goauthentik/fonts/icons.css entry
points instead of the old #fonts/* import and the inlined pficon.scss
vendor sheet.
Anchor esbuild's [dir] at the monorepo root via outbase so assets pulled
from the out-of-web package no longer resolve to a "_.._" segment, which
Go's //go:embed silently drops from the embedded outpost build.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* packages/theme: add @goauthentik/theme design-system package
Add @goauthentik/theme, which defines authentik's design tokens (color,
typography, fonts, spacing, shape, shadow, motion, z-index) in TypeScript
and builds them into CSS via styleframe.
Token names carry a distinct separator per category so the token type is
recoverable from the name alone. That is worth the verbosity: it keeps
the DX legible and leaves room for automatic theme management and future
tooling built on top of the token set.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* web/theme: add a demo page for the theme tokens
Add a self-contained demo page, built by build-demo.mjs, that renders
every theme token — colors, typography, spacing, shape, shadow, motion —
so the design system can be eyeballed in isolation while it evolves.
Co-Authored-By: Ken Sternberg <ken@goauthentik.io>
* Heal lockfile.
* Fix spelling.
* Fix grouping.
---------
Co-authored-by: Ken Sternberg <ken@goauthentik.io>
* ci: pin pnpm 11.20.0 everywhere
Every pnpm version reference now agrees on the latest release:
packageManager and the engines floor in all four manifests, and the
ghcr.io/pnpm/pnpm image in both Dockerfiles. Frozen installs for the
root, web, and website workspaces verified clean on 11.20.0.
* Update client-ts.
* root: switch cspell to typo-only reporting
cSpell's default mode reports every word it does not recognize, so each
new integration name or identifier needed a dictionary entry. Switch to
unknownWords: report-common-typos, which matches CodeSpell's behavior:
only known misspellings (reported with a suggested fix) and flagWords
fail the check.
Remove the per-topic dictionaries and word-shape ignore regexes this
makes unnecessary, fix the 18 typos the old allowlists were masking,
and document the new workflow.
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* web/docs: fix style-loader-plugin path and wording in CSS architecture doc
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* website: remove stray blank lines left by ignore-comment removal
Claude-Session: https://claude.ai/code/session_014ZuquWGxU5ReaXR5D3NmwW
* packages/fonts: extract the RedHat variable faces into @goauthentik/fonts
The RedHat typefaces were checked in twice: web/fonts/RedHat held the six
variable faces the app actually loads, and packages/theme carried its own
copy of those plus twenty-four static weights. The variable files were
byte-identical in both places, but the two @font-face sets disagreed on
naming — web bound "RedHatText" to the variable face while the theme
bound it to the static Regular and used "RedHatTextVF" for the variable
one.
Move web's set, which is the canonical one, into a new assets-only
package and drop the theme's copy entirely. The theme now only names the
families; @goauthentik/fonts binds them to files. Nothing about what the
browser loads changes: same bytes, same family names, same vendor layer.
The package has no build step, and only faces.css needs an exports entry
— the url() references beside it resolve relative to that file in both
ESBuild and Vite.
ESBuild's `outbase` is now pinned to the monorepo root. Assets pulled
from a workspace package outside web/ otherwise land under a `..`
segment, which ESBuild sanitizes to `_.._`; Go's `//go:embed dist/*` in
static_outpost.go skips any segment starting with `_`, so the faces would
have gone missing from the embedded outpost build.
* packages/fonts: move the PatternFly icon faces into @goauthentik/fonts
The pficon and Font Awesome faces were declared inside the vendored
PatternFly icon stylesheets, with the font files sitting beside them
under web/src/styles/global/vendor/assets/. That put font bytes in three
places across the repo and tied the faces to stylesheets we re-vendor
whenever PatternFly moves.
Move both families next to the RedHat faces and declare them in a new
icons.css, kept separate from faces.css so a consumer can take the brand
text faces without the icon fonts. The icon classes stay with PatternFly
— only the @font-face rules and the files move. Same bytes: the emitted
assets keep their content hashes.
pficon.scss went too. It was an unreferenced Sass source whose
`$pf-global--fonticon-path` variable had nothing to resolve against.
The copies in shadow/patternfly-base.css are left alone. They come from
the PatternFly package and their font URLs are already stubbed out by the
bundled-text loader, because @font-face has no effect inside a shadow
root — components inherit the faces registered on the document.
* packages/fonts: record the licensing of every bundled font
The package declared MIT and shipped only Red Hat's OFL text, which
described neither what it redistributes nor what redistribution requires.
Three upstreams are bundled, under three different terms:
RedHat text faces OFL-1.1, (c) The Red Hat Project Authors
pficon MIT, (c) Red Hat, Inc., via PatternFly
Font Awesome 5 Free OFL-1.1 for the font files, CC-BY-4.0 for the
icons they encode, (c) Fonticons, Inc.
Declare that as an SPDX expression, add the package's own MIT text, and
ship each upstream's license alongside a NOTICE.md recording provenance
per file. OFL 1.1 requires the copyright notice and license to travel
with any redistributed copy, and CC BY 4.0 requires attribution where the
icons are displayed; `files` now carries all of it into the tarball.
Two things NOTICE.md is explicit about rather than papering over:
@patternfly/patternfly ships no license file, so the MIT text here is Red
Hat's own copied from the sibling @patternfly/icons package; and Font
Awesome's published license carries a copyright line tracking its current
release rather than the 5.x release these files came from.
* server/static: cover range requests for static assets
The Go web server this originally fixed is gone — `ak server` now execs the
Rust binary, and its static handler is a tower-http `ServeDir` behind a
compression layer. Both halves of the old fix are moot there: `ServeDir`
serves ranges itself, tower-http never compresses a response carrying
`Content-Range`, and no ETag middleware survived the rewrite.
Nothing to port, then, but the events map still byte-serves its PMTiles
basemap out of `/static/dist/`, so pin the behavior it depends on: a ranged
request comes back as an uncompressed 206 with an accurate `Content-Length`,
while a full request is still gzipped. The compression layer moves behind a
named constructor so the test exercises the same configuration the router
builds.
refs #21849
* brands: add branding_map_tiles for the events map tile source (#24253)
* brands: add branding_map_tiles for the events map tile source
Brand-level override for where the events map loads its vector tiles:
empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template
points at your own. Includes the migration, schema, and regenerated
clients.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
* packages/geo: add @goauthentik/geo and the hexworld event map (#24255)
A standalone Lit + MapLibre package for the events map: a tilted globe
that bins events into H3 cells and raises them as action-colored pie
columns, over a hex basemap bundled as a PMTiles archive — no tile server
and no external requests, so it works air-gapped. Zoom bands cross-fade
and columns animate between re-bins. Ships the archive, the generator CLI,
and node tests for the geometry, styling, and tiling plan.
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* web: replace the OpenLayers events map with ak-map (#24257)
* brands: add branding_map_tiles for the events map tile source
Brand-level override for where the events map loads its vector tiles:
empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template
points at your own. Includes the migration, schema, and regenerated
clients.
* packages/geo: add @goauthentik/geo and the hexworld event map
A standalone Lit + MapLibre package for the events map: a tilted globe
that bins events into H3 cells and raises them as action-colored pie
columns, over a hex basemap bundled as a PMTiles archive — no tile server
and no external requests, so it works air-gapped. Zoom bands cross-fade
and columns animate between re-bins. Ships the archive, the generator CLI,
and node tests for the geometry, styling, and tiling plan.
* web: replace the OpenLayers events map with ak-map
EventMap now renders @goauthentik/geo's globe: events show as extruded
columns split by action, hovering shows a localized breakdown, and
clicking a column filters the list to that cell's events. The build copies
the bundled archive and glyphs into dist. OpenLayers and the pin-marker
path are removed.
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
* Format.
* brands: note that branding_map_tiles is served unauthenticated
The events map is admin-only, but branding_map_tiles rides along in
CurrentBrandSerializer, which /core/brands/current/ exposes with
AllowAny. Commercial tile providers carry their API key in the URL, and
the help text invites pasting exactly such a URL, so say plainly that
the value is world-readable.
Migration 0016 is edited in place rather than superseded — it has not
shipped, and makemigrations reports no pending changes. Schema and
clients regenerated.
* geo: strip build-machine paths from the shipped basemap archive
The committed hexworld.pmtiles carried the absolute path of the scratch
directory it was built in — including a session uuid — in its metadata
name, description and generator_options, shipped to every install.
tile-join inherits those fields from its first input file, so pass
--name/--description/--attribution explicitly to stop it recurring.
The archive itself is rewritten in place rather than regenerated:
pmtiles v3 lays out header, root directory, metadata, leaf directories
and tile data contiguously, and directory entries address tiles relative
to tileDataOffset, so resizing the metadata only shifts two header
offsets. Verified with the pmtiles reader — header fields match and 634
sampled tiles across z0-7 are byte-identical.
* web: drop the unused OpenLayers map pin
map_pin.svg was the marker icon the OpenLayers events map drew; ak-map
renders extruded columns instead and nothing references the file.
Also correct the preserveSymlinks comment. The flag is load-bearing, but
not for the stated reason: geo resolves its own dependencies fine from
its own node_modules. What it prevents is resolving them by realpath,
which pulls a second copy of the Lit runtime out of .pnpm alongside the
one in web/node_modules — two lit-html/lit-element/@lit-reactive-element
trees and two ReactiveElement hierarchies in one bundle.
* build: pin playwright through the pnpm catalog in both workspaces
The root and web/ are separate pnpm workspaces with separate lockfiles,
so a caret range let them resolve playwright independently — root landed
on 1.62.0 while web sat at 1.61.1, and `playwright install` downloads a
~95 MB browser build keyed to the exact version. Two versions, two
downloads. Catalog entries plus lint-catalogs turn that drift into a
failing check; the pin is exact because a range is what allowed it.
Held at 1.61.1 rather than the newest: 1.62.0 cannot resolve a bare
package name in a tsconfig `extends`, and web/tsconfig.json extends
"@goauthentik/tsconfig", so loading web's playwright.config.js fails and
the e2e suite never runs. `playwright test --list` discovers 25 tests on
1.61.1 and dies before discovery on 1.62.0.
vitest, vite and the @vitest/browser pair join the same catalog since
geo now uses them too and @vitest/browser-playwright drives whichever
playwright it finds.
* geo: rebuild ak-map on re-parent, run tests from source under vitest
disconnectedCallback tore the MapLibre instance down but firstUpdated
only ever fires once, so re-parenting <ak-map> left it permanently
blank. Rebuild from connectedCallback once the element has updated.
The new Chromium test covers exactly that: it fails without the fix and
passes with it, and no other test moves.
Tests move from node:test over compiled out/*.js to vitest over src, so
they exercise the source rather than a stale build and need no build
step. Six of them reached for ../out/*.js through a dynamic import and
would have kept asserting against whatever was last compiled.
Along the way, three things that were already broken:
- `tsc -p scripts` never ran anywhere and does not compile — its
tsconfig omits the DOM lib while its import graph reaches
src/style.ts, which uses `window`. There is now a lint:types script
covering src, scripts and test.
- TippecanoeFeature extended a bare Feature though placeFeature
always emits a Point with fixed properties.
- The README described a previous generation of the generator: wrong
script path, wrong cut names, a zoom band that stops at z7 rather
than z8, a shipped archive listed at 8.8 MB when it is 22 MiB, and
markers painted "via MapLibre feature-state" when they are a
fill-extrusion source.
publishConfig is dropped rather than `private`: geo depends on
@goauthentik/api via link:, which cannot survive publication, so the
package is unpublishable either way and publishConfig was the dead half.
* rust nits
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
* website/docs: document the hexworld event map
* website/docs: drop the OSM tile server from the air-gapped outbound list
The events map no longer reaches tile.openstreetmap.org — the bundled
basemap makes no outbound connections. Note the one way it can reach out
again: a custom basemap configured on a brand.
* Ignore build info.
* Ignore build info.
* Fix pins.
* Fix formatting.
* Fix duplicate package entries.
* Move runtime code to web.
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* add UI, Events > Offboardings to show pending offboardings
* rename scheduled_at and executed_at fields
* update scheduled_at field
* improve help text to be more accurate
* change button color
* switch boilerplate actions for Cancel offboarding
* remove preview banner
* use task.rel_obj, apply code review suggestions
* implement code review suggestions
* Regenerate the offboarding client models
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* rename scheduled_at and executed_at fields
* improve help text to be more accurate
* change button color
* use task.rel_obj, apply code review suggestions
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
* sources/ldap: add sync_group_parentage field
* sources/ldap: regenerate schema after adding field
* sources/ldap: add group parentage synchronizer
* web/admin: add LDAP source toggle for sync_group_parentage
* sources/ldap: rename LDAPSource fields to more accurate names
* web/admin: update admin UI with new field names
Also added better descriptions to all relevant fields, explaining how they interact with each other.
* sources/ldap: add unit tests
* sources/ldap: fix problem discovered by test
* sources/ldap: lint
* web/admin: lint
* website/docs: update LDAP source docs about lookup fields & membership
* sources/ldap: fix renamed attributes
* web/admin: make web
* sources/ldap: update tests and entries.json fixture
* sources/ldap: update migration with current help_text
* sources/ldap: fix lint error
* sources/ldap: restore membership.py to main, with renamed fields
in prep for separating out the synchronizers
* sources/ldap: abstract get_group into BaseMembershipLDAPSynchronizer
* sources/ldap: add separate ParentshipLDAPSynchronizer
* sources/ldap: fix wrong attribute name in extra parents filtering
* remove renames
* rename `sync_group_parents` to `sync_group_hierarchy`
* set `sync_group_hierarchy` default to `False`
This is a breaking change if it's `True`. It should be changed
eventually, but not in this release.
* revert pagination function change
I'm not entirely sure why, but this change hangs the test
`test_membership_sync_special_chars_in_group_dn`.
* add `sync_group_hierarchy` guard to hierarchy sync
* simplify hierarchy sync
* reword group `parentship` to `hierarchy`
* fix lint
* remove dead code
* move `syncGroupHierarchy` toggle next to similar toggles
---------
Co-authored-by: Simonyi Gergő <28359278+gergosimonyi@users.noreply.github.com>
Co-authored-by: Simonyi Gergő <gergo@goauthentik.io>
