Commit Graph

23076 Commits

Author SHA1 Message Date
dependabot[bot]
efdd715b94 core: bump regex from 1.12.4 to 1.13.0 (#24150)
Bumps [regex](https://github.com/rust-lang/regex) from 1.12.4 to 1.13.0.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/regex/compare/1.12.4...1.13.0)

---
updated-dependencies:
- dependency-name: regex
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 12:43:11 +01:00
dependabot[bot]
6ba2c6e20f core: bump rust-toolchain from 1.97.0 to 1.97.1 (#24148)
Bumps [rust-toolchain](https://github.com/rust-lang/rust) from 1.97.0 to 1.97.1.
- [Release notes](https://github.com/rust-lang/rust/releases)
- [Changelog](https://github.com/rust-lang/rust/blob/main/RELEASES.md)
- [Commits](https://github.com/rust-lang/rust/compare/1.97.0...1.97.1)

---
updated-dependencies:
- dependency-name: rust-toolchain
  dependency-version: 1.97.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 12:43:02 +01:00
Dominic Roy
ede8604be4 website/docs: cleanup 07-12: refresh contributor guidance (#23969)
website/docs: refresh contributor guidance
2026-07-17 08:04:44 +00:00
Marc 'risson' Schmitt
efc5f1a36a packages/ak-common/db: ignore empty passwords (#24127)
Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
2026-07-16 19:28:12 +02:00
Jens L.
0c237e8fc2 policies: make policy bindings expire-able (#24116)
* policies: make policy bindings expire-able

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* ensure cache is not poisoned by expired bindings

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix expire task failing

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* apparently needs migrations?

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* format

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix empty result tripping me up

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
2026-07-16 15:30:05 +01:00
Jens L.
e5f84e1ee2 enterprise/endpoints/connectors/fleet: pass populate_policies (#24108)
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
2026-07-16 13:12:18 +01:00
Emil Burzo
1c36f09c66 lifecycle/container: drop curl and runit (#24008) 2026-07-16 15:12:16 +03:00
Jens L.
80972fa692 lib: move ExpiringModel to lib from core (#24109)
lib: move ExpiringModel to lib from common
2026-07-16 13:10:08 +01:00
dependabot[bot]
007d59b5c4 web, docs, packages/*: Fix pnpm Workspace Catalogs (#23944)
* Fix errant lock entries.

* Clean up shared packages. Align workspace catalogs.

* Add pnpm workspace.

---------

Co-authored-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
2026-07-16 14:08:23 +02:00
Ethan Heilman
428bd7d79b providers/oauth2: OpenID key binding support (#22590)
* Adds OpenID key binding and tests

* Ensures dpop_jkt only set for key_bound scope, only JKT covered claims written to cnf

* Checks scope and jkt for device flow, makes library use more consistant, fixes RSA key size computation

* Fixes linter issues

* Addresses linter errors

* Fixes scopes name in device flow

* Increase test coverage

* Simplify jti cache mechanism

* Increased the JTI replay window to 3 minutes

* Refactoring, simplifying code

* Fix wrong JWK library (working with openpubkey again)

* Fix test, refactor errors

* fix authorize error calls

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* remove cnf from introspection

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* remove duplicate code_sha256

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* fix double parsing of key

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

* re-migrate

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

---------

Signed-off-by: Ethan Heilman <ethan.r.heilman@gmail.com>
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
Co-authored-by: Jens Langhammer <jens@goauthentik.io>
2026-07-16 10:48:23 +00:00
dependabot[bot]
cf82d86e8a core: bump github.com/go-ldap/ldap/v3 from 3.4.13 to 3.4.14 (#24088)
Bumps [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) from 3.4.13 to 3.4.14.
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](https://github.com/go-ldap/ldap/compare/v3.4.13...v3.4.14)

---
updated-dependencies:
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:38 +01:00
dependabot[bot]
f5b57408d8 core: bump uvicorn[standard] from 0.50.2 to 0.51.0 (#24089)
Bumps [uvicorn[standard]](https://github.com/Kludex/uvicorn) from 0.50.2 to 0.51.0.
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](https://github.com/Kludex/uvicorn/compare/0.50.2...0.51.0)

---
updated-dependencies:
- dependency-name: uvicorn[standard]
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:33 +01:00
dependabot[bot]
dcb7f4cbe0 core: bump coverage[toml] from 7.15.0 to 7.15.1 (#24090)
Bumps [coverage[toml]](https://github.com/coveragepy/coveragepy) from 7.15.0 to 7.15.1.
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](https://github.com/coveragepy/coveragepy/compare/7.15.0...7.15.1)

---
updated-dependencies:
- dependency-name: coverage[toml]
  dependency-version: 7.15.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:29 +01:00
dependabot[bot]
9829308c6d core: bump uuid from 1.23.4 to 1.23.5 (#24091)
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.23.4 to 1.23.5.
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.4...v1.23.5)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.23.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:25 +01:00
dependabot[bot]
003cac07fc core: bump json-subscriber from 0.2.8 to 0.3.0 (#24092)
Bumps [json-subscriber](https://github.com/mladedav/json-subscriber) from 0.2.8 to 0.3.0.
- [Release notes](https://github.com/mladedav/json-subscriber/releases)
- [Changelog](https://github.com/mladedav/json-subscriber/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mladedav/json-subscriber/compare/json-subscriber-v0.2.8...json-subscriber-v0.3.0)

---
updated-dependencies:
- dependency-name: json-subscriber
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:21 +01:00
dependabot[bot]
e521de5b0e ci: bump softprops/action-gh-release from 3.0.1 to 3.0.2 (#24093)
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](718ea10b13...3d0d9888cb)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:17 +01:00
dependabot[bot]
b0186ae4c9 ci: bump actions/setup-node from 6.4.0 to 7.0.0 (#24094)
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](48b55a011b...8207627860)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:12 +01:00
dependabot[bot]
14632e87de ci: bump actions/setup-node from 6.4.0 to 7.0.0 in /.github/actions/setup (#24096)
ci: bump actions/setup-node in /.github/actions/setup

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](48b55a011b...8207627860)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-16 11:41:06 +01:00
Dominic Roy
95413c9453 website/integrations: add tooljet (#24083)
Closes: https://github.com/goauthentik/authentik/issues/23085
2026-07-16 11:35:03 +01:00
Dominic Roy
963555dfa8 website/integrations: add discourse (#24084)
Closes: https://github.com/goauthentik/authentik/issues/23083
2026-07-16 11:31:54 +01:00
Dominic Roy
bfcc21fa27 website/integrations: add memos (#24085)
Closes: https://github.com/goauthentik/authentik/issues/23082
2026-07-16 11:18:15 +01:00
Dominic Roy
f339e78091 website/integrations: add directus (#24086)
Closes: https://github.com/goauthentik/authentik/issues/23081
2026-07-16 11:17:32 +01:00
Dominic Roy
13e05e3e9f website/integrations: add sterling pdf (#24087)
Closes: https://github.com/goauthentik/authentik/issues/23078
2026-07-16 11:11:34 +01:00
authentik-automation[bot]
5b468de6b1 core, web: update translations (#24081)
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
2026-07-16 04:04:36 +02:00
Dominic Roy
d705def6c6 website/integrations: Notion: cleanup (#23695)
* website/integrations: Notion: cleanup

Bring the Notion integration guide into the current template structure and refresh its SAML configuration details.

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f33dc-b521-7853-a2ed-eed202651626
Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>

* Update website/integrations/documentation/notion/index.md

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

---------

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
2026-07-15 19:55:33 +00:00
Dominic Roy
356f6b88ca website/integrations: Omni: cleanup (#23720)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34de-12d4-7732-9842-6f4a17367c7f

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
2026-07-15 19:55:17 +00:00
Dominic Roy
43898d2555 website/integrations: Papra: cleanup (#23699)
Clean up the Papra integration guide to match the current integration template and verified OAuth provider configuration.

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f33dd-ab26-7d23-acac-8fb4ad0412bd

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 19:54:12 +00:00
Dominic Roy
8d7f28cedf website/integrations: osTicket: cleanup (#23717)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34de-c26a-7782-8869-0c010d6cef31

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:39:56 +01:00
Dominic Roy
f2bbc730cf website/integrations: Nexterm: cleanup (#23719)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34dd-d9af-72c1-8583-b9f18107f1de

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:39:18 +01:00
Dominic Roy
c8a558332e website/integrations: Harbor: cleanup (#23718)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34dc-1211-73a3-927c-7c1e666e0306

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:39:03 +01:00
Dominic Roy
8ea9d59e57 website/integrations: Atlantis: cleanup (#23710)
Refresh the Atlantis integration guide to document the forward auth setup, webhook bypass, and Atlantis public URL configuration.

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f3445-6b6c-7883-96e4-bce69f668ee1

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:38:19 +01:00
Dominic Roy
a7796b040a website/integrations: Portainer: cleanup (#23706)
Refresh the Portainer OAuth integration guide against the current template and remove stale screenshots.


Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f3442-16a1-7612-836f-357f7afb2e3c

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:37:50 +01:00
Dominic Roy
10868f577d website/integrations: RabbitMQ: cleanup (#23745)
* website/integrations: RabbitMQ: cleanup

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f35ce-abd9-7e33-8fdf-96dff93a059e
Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>

* Update website/integrations/infrastructure/rabbitmq/index.mdx

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

---------

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
2026-07-15 19:36:40 +00:00
Dominic Roy
5d19a1b359 website/integrations: Tandoor: cleanup (#23697)
Refresh the Tandoor integration guide to match the current integration template and document the verified allauth OIDC configuration details.

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f33de-1aa2-72e2-a6d8-276c008684ab

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:35:39 +01:00
Dominic Roy
2ca3a4eccc website/integrations: Termix: cleanup (#23750)
* website/integrations: Termix: cleanup

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f35ce-abd9-7e33-8fdf-96dff93a059e
Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>

* Update website/integrations/infrastructure/termix/index.mdx

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

---------

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
2026-07-15 19:32:08 +00:00
Dominic Roy
9f77869c4b website/integrations: Budibase: cleanup (#23069)
* website/integrations: Budibase: cleanup

Agent-thread: https://sdko.org/internal/thr/ak/019ecc99-0219-76a3-a639-22e54e069195
A7k-product: product
A7k-product-repo: 1
Co-authored-by: Agent <gptagent@svc.sdko.net>

* website/integrations: Budibase: address review

Agent-thread: https://koala.sdko.net/th?h=co&d=a7k&t=019f20af-06dd-7950-942c-b5b852f890df
Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>

* website/integrations: Budibase: capitalize Slug label

Agent-thread: https://koala.sdko.net/th?h=co&d=a7k&t=019f20af-06dd-7950-942c-b5b852f890df
Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>

* lint

---------

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 19:31:13 +00:00
Dominic Roy
0fcf46636d website/integrations: Komodo: cleanup (#23714)
Refresh the Komodo integration guide with current OIDC configuration details and template-aligned wording.

Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34dd-8216-70c3-af94-0e74e83c4cf0

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:30:23 +01:00
Dominic Roy
c5edf96127 website/integrations: pgAdmin: cleanup (#23722)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34de-ef6f-7533-ab16-55c061cd23ee

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:29:45 +01:00
Dominic Roy
0289dd92be website/integrations: MinIO: cleanup (#23721)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f34dd-b949-7582-aff6-2578d06565cb

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:29:06 +01:00
Dominic Roy
0762032547 website/integrations: Semaphore: cleanup (#23747)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f35ce-abd9-7e33-8fdf-96dff93a059e

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:14:49 +01:00
Dominic Roy
64b7ae8fa2 website/integrations: sssd: cleanup (#23748)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f35ce-abd9-7e33-8fdf-96dff93a059e

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:13:57 +01:00
Dominic Roy
ea2994d74d website/integrations: Terrakube: cleanup (#23752)
Agent-thread: https://koala.sdko.net/th?h=co&d=sdko&t=019f35ce-abd9-7e33-8fdf-96dff93a059e

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
Co-authored-by: Agent <gptagent@svc.sdko.net>
2026-07-15 20:09:58 +01:00
Dominic Roy
62f0db4cf9 website/integrations: add docker platform (#24075)
* website/integrations: add docker hub

* Rename to Docker.

Seems like the best potential name

* Move to Platforms.

* Remove Useless Line

* Rename

* Rename it to something else again

* Apply suggestion from @dominic-r

Signed-off-by: Dominic Roy <dominic@goauthentik.io>

* TRIGGER CI

* Trigger Build

* idek

---------

Signed-off-by: Dominic Roy <dominic@goauthentik.io>
2026-07-15 19:03:13 +00:00
Emil Burzo
0f8ba42bd7 website/docs: release notes for 2026.5.5 (#24070) 2026-07-15 15:55:23 +00:00
Emil Burzo
dd710b1e2d website/docs: release notes for 2026.2.6 (#24069) 2026-07-15 15:53:06 +00:00
Teffen Ellis
1dc509dcac web, locale: Normalize legacy locale file names (#24024)
* web/xliff: remove legacy Transifex-named locale files

The old Transifex config named locale files with underscores
(cs_CZ.xlf, pt_BR.xlf, ...) alongside the hyphenated BCP-47 form the
current lit-localize pipeline actually reads. That config was fixed
months ago, so the underscore files are either stale duplicates of a
current kebab-case sibling or orphaned contributions for locales the
project never enabled.

Deleted 11 legacy files that already have a kebab-case equivalent in
web/xliff/. Kebab wins even where the two diverged, so 2,220 legacy-only
<trans-unit> targets get dropped along the way (fr_FR carried the bulk
at 954; the rest of the languages contribute the remaining 1,266).

Renamed 3 legacy files with no kebab counterpart and added their locale
codes to web/lit-localize.json targetLocales:

- ar_AA.xlf -> ar.xlf (AA was a bogus private-use region; landed on
  the plain language code).
- bg_BG.xlf -> bg-BG.xlf.
- no_NO.xlf -> nb-NO.xlf (no is the Norwegian macrolanguage; the
  translation is Bokmal, so nb is the correct language subtag).

Each renamed file also has its internal target-language attribute
updated to match its new locale code, so lit-localize keeps
recognising the existing translations instead of treating everything
as absent.

Wired the new locales into LocaleLoaderRecord in
web/src/common/ui/locale/definitions.ts so the runtime can import the
emitted modules; lit-localize regenerates web/src/locale-codes.ts to
match. locale/ (Django gettext) stays exactly as it was.

Verified with: cd web && npm run build-locales && npm run precommit.

Co-Authored-By: Agent (authentik-m-remove-legacy-intended-nominal-mahogany) <279763771+playpen-agent@users.noreply.github.com>

* locale: sync Django language codes to lit-localize (ar_AA to ar, no_NO to nb_NO)

Mirror the two locale-code changes just landed on the web/xliff side
into the Django gettext tree, in Django's ll_CC underscore form:

- locale/ar_AA -> locale/ar (drop the bogus AA private-use region;
  matches web ar).
- locale/no_NO -> locale/nb_NO (Norwegian macrolanguage to Bokmal,
  which is the writing system the contributed translation uses;
  matches web nb-NO).

bg_BG is left alone (already equals the underscore form of the web
bg-BG), and every other Django locale directory - including zh-Hans
and zh-Hant - stays exactly as it was.

Both catalogs also had their in-file Language header updated to match
the new directory (Language: ar_AA -> ar, Language: no_NO -> nb_NO)
and the .mo binaries were recompiled via manage.py compilemessages so
runtime lookups get the correct language metadata.

No functional LANGUAGES / LANGUAGE_CODE settings referenced the old
codes: only historical Transifex team URLs in the .po Language-Team
headers and past release-notes lines mention them, and those are
metadata / audit trail rather than config.

Verified: to_locale('nb-no') -> 'nb_NO', to_locale('ar') -> 'ar', and
gettext.translation loads locale/ar/LC_MESSAGES/django.mo (1,122
entries, language=ar) and locale/nb_NO/LC_MESSAGES/django.mo (1,116
entries, language=nb_NO).

Co-Authored-By: Agent (authentik-m-remove-legacy-intended-nominal-mahogany) <279763771+playpen-agent@users.noreply.github.com>

---------

Co-authored-by: Agent (authentik-m-remove-legacy-intended-nominal-mahogany) <279763771+playpen-agent@users.noreply.github.com>
2026-07-15 17:42:27 +02:00
Ken Sternberg
ffa7c77f62 web/bug: harmonize and make routine the display of tasks (part 4: schedule-list cards) (#23855)
* ## What

         window.authentik.flow = {
             "layout": "{{ flow.layout }}",
    +        "background": "{{ flow.background }}",
    +        "title": "{{ flow.title }}",
         };

Amends the `flow.html` template and `GlobalAuthentik` parser to include new parameters, `background` and `title`, in the flow-specific part of the configuration written to the HTML `<head>` object, and to provide those parameters to client code.

## Why

The `layout` is start-up critical: it tells the Flow interface how the admin wants the Flow page to look, and allows the HTML and CSS to be pre-aligned to that condition. `layout` is determined on a per-Flow bases, not a per-Stage basis; Flows are derived from a tuple of `(Brand, Application?)`, where the opening policy *may* direct a user to a different flow if the user reached authentik via a redirect from a specific application, but will otherwise fall back to the default Flow for the Brand.

The `background` is a field that is required if the `Flow`’s layout is of type `frame_background`; in this case, the part of the viewport not dedicated to the FlowExecutor is reserved for an `<iframe>` that will be filled in with whatever the administrator specifies. Although this gives it the same priority as `layout` (whether it’s provided or undefined) for describing the [chrome](https://developer.mozilla.org/en-US/docs/Glossary/Chrome) around a challenge, it is currently not provided to the application in the start-up config; it is provided in the `challenge` and renders the IFrame as part of the initial challenge.

This patch fixes that; if `layout` is provided, `background` ought to be as well, even if it’s empty. The execution of a Challenge ought not have any influence over the look and feel of the Flow-defined appearance *around* that Challenge.

I have added `title` as well; with that, all of the current theme-and-appearance related configuration details are placed into `<head>` and can be removed from the FlowExecutor.

Server-side, `background` is currently specified: `background = FileField(blank=True, default="")` which is … interesting since we also appear to store URLs in it. I don’t see anything in the FlowSerializer that would change that from a client’s point of view.

This patch furthers the effort to separate flow execution from flow presentation.

- \[🐰\] The code has been formatted (`make web`)

* web/bug: harmonize and make routine the display of tasks (part 1: cards)

## What

This commit:

- replaces the cut-and-paste “card” version of `ak-task-list` with a function call, `taskCard()`, that fully implements the card as a drop-in replacement.

- removes the requirement that the `ModelEnum` entry be parsed for `ak-task-list`

- moves the parse and definition of the `ModelEnum` to a const outside the object.

- In some cases, the container function was updated to take the task-related object when it was known to never be `undefined`. This removes the `?` operator from a number of places.

## Why

- While working on the details list feature, I noticed that `ak-task-list` is both implemented and used with little to no consistency. This is the first of a series of PRs to improve the consistency of `ak-task-list`. This commit isolates one of three common idioms around `ak-task-list`, the “card in an overview” idiom.

- The `ModelEnum` never changes during the lifecycle of a session, and does not need to be re-allocated with every instance. Extracting it makes sense.

  - In most cases, the parse is left in-place in the existing files because `ak-schedule-list` also uses them. This has been scheduled to a future task.

- *Every* instance of `ak-task-list` (and `ak-schedule-list`) starts with the parse; this sort of repetition is a common source of bugs. Moving it to the function eliminates this source of bugs.

- Where the containing function takes a related object, these were cases where the object was known not to be `undefined`. The `?` in these functions is unnecessary, and may give future maintainers pause to wonder why it’s even there when there’s no doubt the object *is* defined.

## How to test

In every case, this is a 1:1 substitution of a large block of HTML with, well, a function that produces the same large block of HTML. The test is that there’s no visual change between implementations. Because this replaces a Lit de-reference with actual function calls, the compiler and linter will correctly identify if there has been a mis-type, unwanted substitution, or last-line effect.

* Forgot to remove the per-instance parse.

* web/bug: harmonize and make routine the display of tasks (part 2: description-list abuse)

## What

This commit:

- replaces the cut-and-paste “description list” version of `ak-task-list` with a function call, `taskCard()`, that fully implements the task list as a drop-in replacement.

- removes the requirement that the `ModelEnum` entry be parsed for `ak-task-list`

- moves the parse and definition of the `ModelEnum` to a const outside the object.

- Fixes the issue that the “Tasks” title line wasn’t the correct font weight

- Replaces a “switch/case” expression with a, you know, an actual *expression* expression

## Why

This is the same work as [harmonize display of tasks, part 1: cards](https://github.com/goauthentik/authentik/pull/23837), only for the four places where we used a description list instead of a card.

In every case, making the substitution *did not change* the visual presentation.

- I’m embarassed that I missed that: the “Task” label should be bold.

- Using `tspattern` because using statements as expressions annoys me.

## How to test

See [prior branch](https://github.com/goauthentik/authentik/pull/23837) for the same test routine.

## Example: No change in presentation

* web/bug: harmonize and make routine the display of tasks (part 3: problem children)

## What

This commit:

- replaces two more instances of `ak-task-list` with a function call, `taskCard()`, that fully implements the task list as a drop-in replacement.

- removes the requirement that the `ModelEnum` entry be parsed for `ak-task-list`

- moves the parse and definition of the `ModelEnum` to a const outside the object.

- Replaces two more “switch/case” expression with a, you know, an actual *expression* expression

## Why

This is the same work as [harmonize display of tasks, part 1: cards](https://github.com/goauthentik/authentik/pull/23837). In this case, these two looked like cut-and-paste errors (a grid of one cell nested inside a grid? Really?) and I decided to keep them separate to ensure that they got closer attention.

In both cases, making the substitution *did not change* the visual presentation.

- Using `tspattern` because using statements as expressions annoys me.

## How to test

See [prior branch](https://github.com/goauthentik/authentik/pull/23837) for the same test routine.

* Don't need to nest the card class there.

* Serious typo.

* It was wrong of me to delay this; it should have been fixed in this branch first.

* web/bug: harmonize and make routine the display of tasks (part 4: schedule-list cards)

## What

This commit:

- creates a variant of `taskCard()` for `ak-schedule-list`, calling it (predictably) `scheduleCard()`.

- replaces instances of `ak-schedule-list` with a function call, `scheduleCard()`, that fully implements the schedule list as a drop-in replacement.

- removes the requirement that the `ModelEnum` entry be parsed for `ak-schedule-list`. This will also fully remove the requirement that the parsing be done *at all* anywhere but inside these function calls. Since in all cases the `ModelEnum` declaration has already been moved to a constant, there was no need to reproduce that work.

## Why

This is the same work as [harmonize display of tasks, part 1: cards](https://github.com/goauthentik/authentik/pull/23837), only applied to its sibling, `ak-schedule-list`. In all cases, making the substitution *did not change* the visual presentation.

## How to test

See [prior branch](https://github.com/goauthentik/authentik/pull/23837) for the same test routine.

* These are imported by the template function; they aren't needed in individual files anymore.

* 'Consistency is the hobgoblin of small minds.' - Ralph Waldo Emerson

* Just trying to make life a little better.

* Just trying to make life a little better.

* web/bug: harmonize and make routine the display of tasks (part 3: problem children)

## What

This commit:

- replaces two more instances of `ak-task-list` with a function call, `taskCard()`, that fully implements the task list as a drop-in replacement.

- removes the requirement that the `ModelEnum` entry be parsed for `ak-task-list`

- moves the parse and definition of the `ModelEnum` to a const outside the object.

- Replaces two more “switch/case” expression with a, you know, an actual *expression* expression

## Why

This is the same work as [harmonize display of tasks, part 1: cards](https://github.com/goauthentik/authentik/pull/23837). In this case, these two looked like cut-and-paste errors (a grid of one cell nested inside a grid? Really?) and I decided to keep them separate to ensure that they got closer attention.

In both cases, making the substitution *did not change* the visual presentation.

- Using `tspattern` because using statements as expressions annoys me.

## How to test

See [prior branch](https://github.com/goauthentik/authentik/pull/23837) for the same test routine.

* Just trying to make life a little better.
2026-07-15 08:03:24 -07:00
authentik-automation[bot]
4f192b71d1 security: automated internal backport of patch 1822.sec.patch to authentik-main (#24064)
Automated internal backport of patch 1822.sec.patch to authentik-main

Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
2026-07-15 14:55:36 +00:00
authentik-automation[bot]
2a324e9d43 security: automated internal backport of patch 1934.sec.patch to authentik-main (#24067)
Automated internal backport of patch 1934.sec.patch to authentik-main

Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
2026-07-15 17:41:06 +03:00
authentik-automation[bot]
b7eedb095e security: automated internal backport of patch 1887.sec.patch to authentik-main (#24065)
Automated internal backport of patch 1887.sec.patch to authentik-main

Co-authored-by: authentik-automation[bot] <135050075+authentik-automation[bot]@users.noreply.github.com>
2026-07-15 14:33:56 +00:00