mirror of
https://github.com/goauthentik/authentik.git
synced 2026-08-30 18:51:39 -07:00
4e092df177
* server/static: cover range requests for static assets The Go web server this originally fixed is gone — `ak server` now execs the Rust binary, and its static handler is a tower-http `ServeDir` behind a compression layer. Both halves of the old fix are moot there: `ServeDir` serves ranges itself, tower-http never compresses a response carrying `Content-Range`, and no ETag middleware survived the rewrite. Nothing to port, then, but the events map still byte-serves its PMTiles basemap out of `/static/dist/`, so pin the behavior it depends on: a ranged request comes back as an uncompressed 206 with an accurate `Content-Length`, while a full request is still gzipped. The compression layer moves behind a named constructor so the test exercises the same configuration the router builds. refs #21849 * brands: add branding_map_tiles for the events map tile source (#24253) * brands: add branding_map_tiles for the events map tile source Brand-level override for where the events map loads its vector tiles: empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template points at your own. Includes the migration, schema, and regenerated clients. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com> * packages/geo: add @goauthentik/geo and the hexworld event map (#24255) A standalone Lit + MapLibre package for the events map: a tilted globe that bins events into H3 cells and raises them as action-colored pie columns, over a hex basemap bundled as a PMTiles archive — no tile server and no external requests, so it works air-gapped. Zoom bands cross-fade and columns animate between re-bins. Ships the archive, the generator CLI, and node tests for the geometry, styling, and tiling plan. Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local> --------- Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com> Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * web: replace the OpenLayers events map with ak-map (#24257) * brands: add branding_map_tiles for the events map tile source Brand-level override for where the events map loads its vector tiles: empty keeps the bundled basemap, a pmtiles:// archive URL or XYZ template points at your own. Includes the migration, schema, and regenerated clients. * packages/geo: add @goauthentik/geo and the hexworld event map A standalone Lit + MapLibre package for the events map: a tilted globe that bins events into H3 cells and raises them as action-colored pie columns, over a hex basemap bundled as a PMTiles archive — no tile server and no external requests, so it works air-gapped. Zoom bands cross-fade and columns animate between re-bins. Ships the archive, the generator CLI, and node tests for the geometry, styling, and tiling plan. * web: replace the OpenLayers events map with ak-map EventMap now renders @goauthentik/geo's globe: events show as extruded columns split by action, hovering shows a localized breakdown, and clicking a column filters the list to that cell's events. The build copies the bundled archive and glyphs into dist. OpenLayers and the pin-marker path are removed. --------- Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com> Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local> * Format. * brands: note that branding_map_tiles is served unauthenticated The events map is admin-only, but branding_map_tiles rides along in CurrentBrandSerializer, which /core/brands/current/ exposes with AllowAny. Commercial tile providers carry their API key in the URL, and the help text invites pasting exactly such a URL, so say plainly that the value is world-readable. Migration 0016 is edited in place rather than superseded — it has not shipped, and makemigrations reports no pending changes. Schema and clients regenerated. * geo: strip build-machine paths from the shipped basemap archive The committed hexworld.pmtiles carried the absolute path of the scratch directory it was built in — including a session uuid — in its metadata name, description and generator_options, shipped to every install. tile-join inherits those fields from its first input file, so pass --name/--description/--attribution explicitly to stop it recurring. The archive itself is rewritten in place rather than regenerated: pmtiles v3 lays out header, root directory, metadata, leaf directories and tile data contiguously, and directory entries address tiles relative to tileDataOffset, so resizing the metadata only shifts two header offsets. Verified with the pmtiles reader — header fields match and 634 sampled tiles across z0-7 are byte-identical. * web: drop the unused OpenLayers map pin map_pin.svg was the marker icon the OpenLayers events map drew; ak-map renders extruded columns instead and nothing references the file. Also correct the preserveSymlinks comment. The flag is load-bearing, but not for the stated reason: geo resolves its own dependencies fine from its own node_modules. What it prevents is resolving them by realpath, which pulls a second copy of the Lit runtime out of .pnpm alongside the one in web/node_modules — two lit-html/lit-element/@lit-reactive-element trees and two ReactiveElement hierarchies in one bundle. * build: pin playwright through the pnpm catalog in both workspaces The root and web/ are separate pnpm workspaces with separate lockfiles, so a caret range let them resolve playwright independently — root landed on 1.62.0 while web sat at 1.61.1, and `playwright install` downloads a ~95 MB browser build keyed to the exact version. Two versions, two downloads. Catalog entries plus lint-catalogs turn that drift into a failing check; the pin is exact because a range is what allowed it. Held at 1.61.1 rather than the newest: 1.62.0 cannot resolve a bare package name in a tsconfig `extends`, and web/tsconfig.json extends "@goauthentik/tsconfig", so loading web's playwright.config.js fails and the e2e suite never runs. `playwright test --list` discovers 25 tests on 1.61.1 and dies before discovery on 1.62.0. vitest, vite and the @vitest/browser pair join the same catalog since geo now uses them too and @vitest/browser-playwright drives whichever playwright it finds. * geo: rebuild ak-map on re-parent, run tests from source under vitest disconnectedCallback tore the MapLibre instance down but firstUpdated only ever fires once, so re-parenting <ak-map> left it permanently blank. Rebuild from connectedCallback once the element has updated. The new Chromium test covers exactly that: it fails without the fix and passes with it, and no other test moves. Tests move from node:test over compiled out/*.js to vitest over src, so they exercise the source rather than a stale build and need no build step. Six of them reached for ../out/*.js through a dynamic import and would have kept asserting against whatever was last compiled. Along the way, three things that were already broken: - `tsc -p scripts` never ran anywhere and does not compile — its tsconfig omits the DOM lib while its import graph reaches src/style.ts, which uses `window`. There is now a lint:types script covering src, scripts and test. - TippecanoeFeature extended a bare Feature though placeFeature always emits a Point with fixed properties. - The README described a previous generation of the generator: wrong script path, wrong cut names, a zoom band that stops at z7 rather than z8, a shipped archive listed at 8.8 MB when it is 22 MiB, and markers painted "via MapLibre feature-state" when they are a fill-extrusion source. publishConfig is dropped rather than `private`: geo depends on @goauthentik/api via link:, which cannot survive publication, so the package is unpublishable either way and publishConfig was the dead half. * rust nits Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> * website/docs: document the hexworld event map * website/docs: drop the OSM tile server from the air-gapped outbound list The events map no longer reaches tile.openstreetmap.org — the bundled basemap makes no outbound connections. Note the one way it can reach out again: a custom basemap configured on a brand. * Ignore build info. * Ignore build info. * Fix pins. * Fix formatting. * Fix duplicate package entries. * Move runtime code to web. --------- Signed-off-by: Teffen Ellis <592134+GirlBossRush@users.noreply.github.com> Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Co-authored-by: Teffen Ellis <teffen@Teffens-MacBook-Pro.local> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
94 lines
3.7 KiB
YAML
94 lines
3.7 KiB
YAML
packages:
|
|
- "vendored/*"
|
|
- "docusaurus-theme"
|
|
- "api"
|
|
- "integrations"
|
|
- "docs"
|
|
|
|
# Docusaurus and several first-party plugins rely on phantom deps
|
|
# (notably `@docusaurus/utils`) that npm hoisted. Until each is added as an
|
|
# explicit dependency, fall back to the flat hoisted layout that mirrors
|
|
# npm's behavior.
|
|
nodeLinker: hoisted
|
|
|
|
# Shared version references for the `catalog:` protocol. Workspace members reference
|
|
# these via `catalog:`, and overrides pin transitive deps to the same versions.
|
|
# `scripts/node/lint-catalogs.ts` keeps them in sync with the other workspace roots.
|
|
catalog:
|
|
# The Docusaurus packages ship as one lockstep release and several are declared
|
|
# by three or four workspace members, so a group bump that reaches some
|
|
# manifests and misses others leaves two copies of a package in the tree. When
|
|
# the package owns a React context, as `theme-common` owns ColorModeContext,
|
|
# the second copy is a site-wide runtime crash (#24026). One entry per package
|
|
# here means a bump either lands everywhere or nowhere.
|
|
"@docusaurus/core": "^3.10.2"
|
|
"@docusaurus/faster": "^3.10.2"
|
|
"@docusaurus/module-type-aliases": "^3.10.2"
|
|
"@docusaurus/plugin-client-redirects": "^3.10.2"
|
|
"@docusaurus/plugin-content-docs": "^3.10.2"
|
|
"@docusaurus/preset-classic": "^3.10.2"
|
|
"@docusaurus/theme-common": "^3.10.2"
|
|
"@docusaurus/theme-mermaid": "^3.10.2"
|
|
"@docusaurus/tsconfig": "^3.10.2"
|
|
"@docusaurus/types": "^3.10.2"
|
|
"@docusaurus/utils": "^3.10.2"
|
|
"@eslint/js": "^9.39.5"
|
|
"@typescript-eslint/eslint-plugin": "^8.65.0"
|
|
"@typescript-eslint/parser": "^8.65.0"
|
|
"@typescript-eslint/utils": "^8.65.0"
|
|
"@types/node": "^26.1.2"
|
|
esbuild: "^0.28.1"
|
|
eslint: "^9.39.5"
|
|
prettier: "3.8.3"
|
|
prettier-plugin-packagejson: "^3.0.2"
|
|
typescript: "^6.0.3"
|
|
typescript-eslint: "^8.65.0"
|
|
|
|
overrides:
|
|
"@goauthentik/docusaurus-config>react": "^19.2.6"
|
|
"@goauthentik/docusaurus-config>react-dom": "^19.2.6"
|
|
# theme-common owns ColorModeContext. A second copy anywhere in the tree hands
|
|
# the OpenAPI theme a different context object than the one theme-classic
|
|
# rendered its provider into, and every useColorMode call throws. Unscoped so
|
|
# no workspace member or transitive peer can pull its own copy.
|
|
"@docusaurus/theme-common": "catalog:"
|
|
"@goauthentik/eslint-config>typescript": "catalog:"
|
|
"@goauthentik/prettier-config>prettier-plugin-packagejson": "catalog:"
|
|
"@typescript-eslint/parser>typescript": "catalog:"
|
|
"@typescript-eslint/utils>typescript": "catalog:"
|
|
"docusaurus-theme-openapi-docs>postman-code-generators": "^2.1.1"
|
|
"docusaurus-theme-openapi-docs>detect-package-manager": "workspace:*"
|
|
"docusaurus-theme-openapi-docs>shelljs": "0.10.0"
|
|
"format-imports>eslint": "catalog:"
|
|
"lodash": "^4.18.1"
|
|
"postman-code-generators>detect-package-manager": "workspace:*"
|
|
"postman-code-generators>shelljs": "0.10.0"
|
|
"postman-collection": "^5.3.0"
|
|
"typescript-eslint>typescript": "catalog:"
|
|
"uuid": "^14.0.0"
|
|
|
|
# Allow-list of dependencies whose install/postinstall scripts may run.
|
|
# Everything else is blocked, replacing the prior `ignore-scripts=true` +
|
|
# `npm rebuild --foreground-scripts <pkg>` pattern from #20400. Each entry
|
|
# is audited at review time — adding a package here grants it arbitrary code
|
|
# execution at install.
|
|
onlyBuiltDependencies:
|
|
- "@parcel/watcher"
|
|
- "@swc/core"
|
|
|
|
# Explicit approval map for pnpm 11+. `true` = allowed (mirror
|
|
# onlyBuiltDependencies); `false` = explicitly declined to silence the
|
|
# "pending approval" prompt without running the install script.
|
|
allowBuilds:
|
|
"@parcel/watcher": true
|
|
"@swc/core": true
|
|
core-js: false
|
|
postman-code-generators: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- js-yaml@4.1.1
|
|
- serialize-javascript@7.0.3
|
|
- yaml@1.10.3
|
|
- serialize-javascript@7.0.5
|
|
- '@types/node@26.1.0'
|