* server/static: cover range requests for static assets
The Go web server this originally fixed is gone — `ak server` now execs the
Rust binary, and its static handler is a tower-http `ServeDir` behind a
compression layer. Both halves of the old fix are moot there: `ServeDir`
serves ranges itself, tower-http never compresses a response carrying
`Content-Range`, and no ETag middleware survived the rewrite.
Nothing to port, then, but the events map still byte-serves its PMTiles
basemap out of `/static/dist/`, so pin the behavior it depends on: a ranged
request comes back as an uncompressed 206 with an accurate `Content-Length`,
while a full request is still gzipped. The compression layer moves behind a
named constructor so the test exercises the same configuration the router
builds.
refs #21849
* brands: add branding_map_tiles for the events map tile source (#24253)
* brands: add branding_map_tiles for the events map tile source
Brand-level override for where the events map loads its vector tiles:
empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template
points at your own. Includes the migration, schema, and regenerated
clients.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
* packages/geo: add @goauthentik/geo and the hexworld event map (#24255)
A standalone Lit + MapLibre package for the events map: a tilted globe
that bins events into H3 cells and raises them as action-colored pie
columns, over a hex basemap bundled as a PMTiles archive — no tile server
and no external requests, so it works air-gapped. Zoom bands cross-fade
and columns animate between re-bins. Ships the archive, the generator CLI,
and node tests for the geometry, styling, and tiling plan.
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* web: replace the OpenLayers events map with ak-map (#24257)
* brands: add branding_map_tiles for the events map tile source
Brand-level override for where the events map loads its vector tiles:
empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template
points at your own. Includes the migration, schema, and regenerated
clients.
* packages/geo: add @goauthentik/geo and the hexworld event map
A standalone Lit + MapLibre package for the events map: a tilted globe
that bins events into H3 cells and raises them as action-colored pie
columns, over a hex basemap bundled as a PMTiles archive — no tile server
and no external requests, so it works air-gapped. Zoom bands cross-fade
and columns animate between re-bins. Ships the archive, the generator CLI,
and node tests for the geometry, styling, and tiling plan.
* web: replace the OpenLayers events map with ak-map
EventMap now renders @goauthentik/geo's globe: events show as extruded
columns split by action, hovering shows a localized breakdown, and
clicking a column filters the list to that cell's events. The build copies
the bundled archive and glyphs into dist. OpenLayers and the pin-marker
path are removed.
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
* Format.
* brands: note that branding_map_tiles is served unauthenticated
The events map is admin-only, but branding_map_tiles rides along in
CurrentBrandSerializer, which /core/brands/current/ exposes with
AllowAny. Commercial tile providers carry their API key in the URL, and
the help text invites pasting exactly such a URL, so say plainly that
the value is world-readable.
Migration 0016 is edited in place rather than superseded — it has not
shipped, and makemigrations reports no pending changes. Schema and
clients regenerated.
* geo: strip build-machine paths from the shipped basemap archive
The committed hexworld.pmtiles carried the absolute path of the scratch
directory it was built in — including a session uuid — in its metadata
name, description and generator_options, shipped to every install.
tile-join inherits those fields from its first input file, so pass
--name/--description/--attribution explicitly to stop it recurring.
The archive itself is rewritten in place rather than regenerated:
pmtiles v3 lays out header, root directory, metadata, leaf directories
and tile data contiguously, and directory entries address tiles relative
to tileDataOffset, so resizing the metadata only shifts two header
offsets. Verified with the pmtiles reader — header fields match and 634
sampled tiles across z0-7 are byte-identical.
* web: drop the unused OpenLayers map pin
map_pin.svg was the marker icon the OpenLayers events map drew; ak-map
renders extruded columns instead and nothing references the file.
Also correct the preserveSymlinks comment. The flag is load-bearing, but
not for the stated reason: geo resolves its own dependencies fine from
its own node_modules. What it prevents is resolving them by realpath,
which pulls a second copy of the Lit runtime out of .pnpm alongside the
one in web/node_modules — two lit-html/lit-element/@lit-reactive-element
trees and two ReactiveElement hierarchies in one bundle.
* build: pin playwright through the pnpm catalog in both workspaces
The root and web/ are separate pnpm workspaces with separate lockfiles,
so a caret range let them resolve playwright independently — root landed
on 1.62.0 while web sat at 1.61.1, and `playwright install` downloads a
~95 MB browser build keyed to the exact version. Two versions, two
downloads. Catalog entries plus lint-catalogs turn that drift into a
failing check; the pin is exact because a range is what allowed it.
Held at 1.61.1 rather than the newest: 1.62.0 cannot resolve a bare
package name in a tsconfig `extends`, and web/tsconfig.json extends
"@goauthentik/tsconfig", so loading web's playwright.config.js fails and
the e2e suite never runs. `playwright test --list` discovers 25 tests on
1.61.1 and dies before discovery on 1.62.0.
vitest, vite and the @vitest/browser pair join the same catalog since
geo now uses them too and @vitest/browser-playwright drives whichever
playwright it finds.
* geo: rebuild ak-map on re-parent, run tests from source under vitest
disconnectedCallback tore the MapLibre instance down but firstUpdated
only ever fires once, so re-parenting <ak-map> left it permanently
blank. Rebuild from connectedCallback once the element has updated.
The new Chromium test covers exactly that: it fails without the fix and
passes with it, and no other test moves.
Tests move from node:test over compiled out/*.js to vitest over src, so
they exercise the source rather than a stale build and need no build
step. Six of them reached for ../out/*.js through a dynamic import and
would have kept asserting against whatever was last compiled.
Along the way, three things that were already broken:
- `tsc -p scripts` never ran anywhere and does not compile — its
tsconfig omits the DOM lib while its import graph reaches
src/style.ts, which uses `window`. There is now a lint:types script
covering src, scripts and test.
- TippecanoeFeature extended a bare Feature though placeFeature
always emits a Point with fixed properties.
- The README described a previous generation of the generator: wrong
script path, wrong cut names, a zoom band that stops at z7 rather
than z8, a shipped archive listed at 8.8 MB when it is 22 MiB, and
markers painted "via MapLibre feature-state" when they are a
fill-extrusion source.
publishConfig is dropped rather than `private`: geo depends on
@goauthentik/api via link:, which cannot survive publication, so the
package is unpublishable either way and publishConfig was the dead half.
* rust nits
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
* website/docs: document the hexworld event map
* website/docs: drop the OSM tile server from the air-gapped outbound list
The events map no longer reaches tile.openstreetmap.org — the bundled
basemap makes no outbound connections. Note the one way it can reach out
again: a custom basemap configured on a brand.
* Ignore build info.
* Ignore build info.
* Fix pins.
* Fix formatting.
* Fix duplicate package entries.
* Move runtime code to web.
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* rename scheduled_at and executed_at fields
* improve help text to be more accurate
* change button color
* use task.rel_obj, apply code review suggestions
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
* fix race condition and support source stages in auth flow
* fix generated clients
* reduce tab settle time to increase speed with many tabs
* Flesh out clean up.
* web/flows: remove dead multi-tab code
Drop the unused isForeignURL() helper from RedirectStage (its only
caller was replaced by the finalRedirect gate) and the write-only
exitedTabIDs map from Broadcast (exit tracking now flows through
AKMultiTabExitEvent).
* Log unknown messages.
* providers/saml: fix unvalidated serializer in continuous-login redirect
The continuous-login branch of SAMLFlowFinalView built the
RedirectChallenge with data= and handed it straight to
HttpChallengeResponse, which reads .data. DRF raises AssertionError
("must call .is_valid()") when a serializer is given data= without
validation, so SP-initiated SAML Redirect-binding logins 500'd whenever
the flows_continuous_login flag was enabled. Use instance= to serialize
the value directly, matching the other RedirectChallenge call sites.
Add a regression test that drives the SP-initiated Redirect flow through
the executor to SAMLFlowFinalView under continuous login and asserts a
final redirect challenge is returned. Also fix the adjacent
resume-url test, which created a second Application for a provider that
already has one (violating the unique provider constraint).
* Format. Add comments.
* Fix spelling.
* fix tests
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Jens L. <jens@goauthentik.io>
* core, internal, packages: fix British spellings flagged by cspell
Apply American spellings in Python docstrings/comments, Go log messages, a Rust doc comment, and a template comment (behaviour->behavior, initialise->initialize, finalise->finalize, etc.). Part of enabling cspell's British-spelling rule; the rule itself lands in a separate PR once all areas are clean.
Co-Authored-By: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* gen
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---------
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
* oauth2/providers: add post logout redirect uri to providers
* properly handle post_logout_redirect_uri and frontchannel message to rp
* add backchannel support
* move logout url logic
* hanlde forbidden_uri_schemes on post_logout_redirect_uri
* merge post_logout with redirect_uri
---------
Signed-off-by: Connor Peshek <connor@connorpeshek.me>
Co-authored-by: Jens L. <jens@goauthentik.io>
