build: add .nvmrc
The setup docs tell contributors to install Node.js with nvm, but there
was nothing in the repo for it to read, so the version had to be passed
by hand on every `nvm install` / `nvm use`. Add an .nvmrc pinning 24,
which is the floor declared in package.json's `engines.node` and the
version the setup guides name.
Running newer than the pin locally is fine: CI resolves `>=24` through
setup-node's `node-version-file: package.json` and so tracks the latest
satisfying release.
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* website/docs: mention pnpm alongside Node.js in developer setup docs
Every JavaScript workspace in the repo is installed with pnpm, but the
setup docs only ever listed Node.js as a prerequisite, leaving new
contributors to infer the package manager from the Makefile. Add pnpm to
the prerequisites of the full, frontend, docs, and translation setup
guides, noting that it can be installed directly or enabled through
corepack using the version pinned in package.json.
The shared install-scripts admonition still described the pre-pnpm
setup: it pointed at .npmrc's ignore-scripts and told contributors to
recover with `npm rebuild --foreground-scripts`. Neither applies
anymore. Rewrite it around pnpm's onlyBuiltDependencies and allowBuilds
lists in each workspace's pnpm-workspace.yaml, and rename the partial to
drop the npm prefix.
Also refresh the translation guide's prerequisites, which still asked
for Node 16.
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* website/docs: prefer nvm for installing Node.js in the setup docs
nvm is one of the version managers recommended on the Node.js download
page, and it scopes the toolchain to the shell instead of installing it
system-wide, so contributors switching between projects don't have to
reinstall. Point the setup guides at it and drop `node@24` from the
macOS Homebrew list.
pnpm now consistently links to its own installation guide rather than
naming a per-platform package, with `corepack enable pnpm` kept as the
alternative that tracks the version pinned in package.json.
In writing-documentation.md this collapses the platform tabs: with nvm
the macOS and Linux steps are identical, so the tabs became two copies
of the same instructions. The Windows note moves into an admonition and
gains a pointer to nvm-windows, which is a separate project rather than
a port.
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
---------
Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com>
Co-authored-by: Playpen Agent <279763771+playpen-agent@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
The user write stage previously saved the pending user on every run that
had prompt data, emitting a model_updated event and triggering downstream
provider/SCIM syncs even when the submitted data matched the existing user.
Snapshot the user's concrete field values before applying prompt data and
only save (and send the user_write signal) when something actually changed.
Newly created users are always written, and group membership is still
reconciled since those operations are idempotent.
Closes#23799
Co-authored-by: tungyhardDevOps <190939682+tungyhardDevOps@users.noreply.github.com>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* add UI, Events > Offboardings to show pending offboardings
* Add docs for user offboarding
* fix linting
* Cleanup.
* Apply suggestions from code review
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
* rename scheduled_at and executed_at fields
* update scheduled_at field
* improve help text to be more accurate
* change button color
* switch boilerplate actions for Cancel offboarding
* remove preview banner
* use task.rel_obj, apply code review suggestions
* implement code review suggestions
* Add docs for user offboarding
* fix linting
* Cleanup.
* Apply suggestions from code review
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
* Regenerate the offboarding client models
* trigger build
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Dominic R <dominic@goauthentik.io>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* add UI, Events > Offboardings to show pending offboardings
* rename scheduled_at and executed_at fields
* update scheduled_at field
* improve help text to be more accurate
* change button color
* switch boilerplate actions for Cancel offboarding
* remove preview banner
* use task.rel_obj, apply code review suggestions
* implement code review suggestions
* Regenerate the offboarding client models
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
* add USER_OFFBOARDED event
* Add UserOffboarding model
* add shared offboard_user service
* add offboarding API and scheduled sweeper
* regenerate schema and TS client
* first pass of offboarding UI
* add initiator for event audit attribution
* refactor ReviewerUser to PartialUser since now that's the way to go
* make it atomic
* prevent 2 workers to offboard an user at the same time
* update migration file
* fix linting
* add missing migration
* add test for prevent self offboard
* Add UserOffboarding.cancel() and log who cancelled
* Add confirmation dialog for cancel offboarding and add IDs to strings
* Reference user_id, not user, to avoid a DB fetch
* update schema and clients
* Add enum overrides for offboarding
* prevent duplicate offboardings and show API errors
* use send_with_options(rel_obj=Schedule…) so executions show under their schedule
* use partial index
* refactor comment
* Add datetime-local fallback
* prevent cancel/excecute race condition, make records inmutable
* add authentik.enterprise.core.revocation for shared functionality
* refactor account lockdown to use shared revocation functionality
* Simplify transaction
* switch to mixin composition for UserOffboardingViewSet
* use new @enterprise_test decorator
* refactor lifecycle app between review and offboarding
* prevent unnecessary redaction of revoke_tokens boolean in the logs
* prevent an user/admin to cancel their own offboarding
* rename scheduled_at and executed_at fields
* improve help text to be more accurate
* change button color
* use task.rel_obj, apply code review suggestions
---------
Signed-off-by: Marcelo Elizeche Landó <marcelo@goauthentik.io>
