Merge branch 'main' into web/replace-rollup-with-esbuild

* main: (75 commits)
  Add missing commas, correction of spelling errors (#8680)
  website/docs: Add documentation for Glitchtip (#8182)
  website: add solve gitea group does not take effect (#8413)
  enterprise: fix read_only activating when no license is installed (#8697)
  core: fix blueprint export (#8695)
  web: bump the sentry group in /web with 1 update (#8687)
  web: bump yaml from 2.3.4 to 2.4.0 in /web (#8689)
  web: bump the eslint group in /web with 1 update (#8688)
  core: bump pytest from 8.0.1 to 8.0.2 (#8693)
  website: bump @types/react from 18.2.57 to 18.2.58 in /website (#8690)
  web: bump the eslint group in /tests/wdio with 1 update (#8691)
  core: bump sentry-sdk from 1.40.4 to 1.40.5 (#8692)
  core: bump coverage from 7.4.1 to 7.4.3 (#8694)
  providers/oauth2: fix inconsistent `sub` value when setting via mapping (#8677)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh_CN (#8678)
  translate: Updates for file locale/en/LC_MESSAGES/django.po in zh-Hans (#8679)
  core, web: update translations (#8672)
  root: fix config loading after refactor during ruff migration (#8674)
  root: early spring clean for linting (#8498)
  website/integrations: multiple integration edits (#7923)
  ...

.bumpversion.cfg

@@ -1,16 +1,16 @@
 [bumpversion]
-current_version = 2023.10.7
+current_version = 2024.2.1
 tag = True
 commit = True
 parse = (?P<major>\d+)\.(?P<minor>\d+)\.(?P<patch>\d+)(?:-(?P<rc_t>[a-zA-Z-]+)(?P<rc_n>[1-9]\\d*))?
-serialize =
+serialize = 
 	{major}.{minor}.{patch}-{rc_t}{rc_n}
 	{major}.{minor}.{patch}
 message = release: {new_version}
 tag_name = version/{new_version}
 
 [bumpversion:part:rc_t]
-values =
+values = 
 	rc
 	final
 optional_value = final

.github/ISSUE_TEMPLATE/question.md

@@ -9,7 +9,7 @@ assignees: ""
 **Describe your question/**
 A clear and concise description of what you're trying to do.
 
-**Relevant infos**
+**Relevant info**
 i.e. Version of other software you're using, specifics of your setup
 
 **Screenshots**

.github/actions/docker-push-variables/action.yml

@@ -34,63 +34,10 @@ runs:
   steps:
     - name: Generate config
       id: ev
-      shell: python
+      shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        IMAGE_ARCH: ${{ inputs.image-arch }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        """Helper script to get the actual branch name, docker safe"""
-        import configparser
-        import os
-        from time import time
-
-        parser = configparser.ConfigParser()
-        parser.read(".bumpversion.cfg")
-
-        branch_name = os.environ["GITHUB_REF"]
-        if os.environ.get("GITHUB_HEAD_REF", "") != "":
-            branch_name = os.environ["GITHUB_HEAD_REF"]
-        safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
-
-        image_names = "${{ inputs.image-name }}".split(",")
-        image_arch = "${{ inputs.image-arch }}" or None
-
-        is_pull_request = bool("${{ github.event.pull_request.head.sha }}")
-        is_release = "dev" not in image_names[0]
-
-        sha = os.environ["GITHUB_SHA"] if not is_pull_request else "${{ github.event.pull_request.head.sha }}"
-
-        # 2042.1.0 or 2042.1.0-rc1
-        version = parser.get("bumpversion", "current_version")
-        # 2042.1
-        version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
-        prerelease = "-" in version
-
-        image_tags = []
-        if is_release:
-            for name in image_names:
-                image_tags += [
-                    f"{name}:{version}",
-                ]
-            if not prerelease:
-                image_tags += [
-                    f"{name}:latest",
-                    f"{name}:{version_family}",
-                ]
-        else:
-            suffix = ""
-            if image_arch and image_arch != "amd64":
-                suffix = f"-{image_arch}"
-            for name in image_names:
-                image_tags += [
-                    f"{name}:gh-{sha}{suffix}",  # Used for ArgoCD and PR comments
-                    f"{name}:gh-{safe_branch_name}{suffix}",  # For convenience
-                    f"{name}:gh-{safe_branch_name}-{int(time())}-{sha[:7]}{suffix}",  # Use by FluxCD
-                ]
-
-        image_main_tag = image_tags[0]
-        image_tags_rendered = ",".join(image_tags)
-
-        with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
-            print("sha=%s" % sha, file=_output)
-            print("version=%s" % version, file=_output)
-            print("prerelease=%s" % prerelease, file=_output)
-            print("imageTags=%s" % image_tags_rendered, file=_output)
-            print("imageMainTag=%s" % image_main_tag, file=_output)
+        python3 ${{ github.action_path }}/push_vars.py

.github/actions/docker-push-variables/push_vars.py

@@ -0,0 +1,59 @@
+"""Helper script to get the actual branch name, docker safe"""
+
+import configparser
+import os
+from time import time
+
+parser = configparser.ConfigParser()
+parser.read(".bumpversion.cfg")
+
+branch_name = os.environ["GITHUB_REF"]
+if os.environ.get("GITHUB_HEAD_REF", "") != "":
+    branch_name = os.environ["GITHUB_HEAD_REF"]
+safe_branch_name = branch_name.replace("refs/heads/", "").replace("/", "-")
+
+image_names = os.getenv("IMAGE_NAME").split(",")
+image_arch = os.getenv("IMAGE_ARCH") or None
+
+is_pull_request = bool(os.getenv("PR_HEAD_SHA"))
+is_release = "dev" not in image_names[0]
+
+sha = os.environ["GITHUB_SHA"] if not is_pull_request else os.getenv("PR_HEAD_SHA")
+
+# 2042.1.0 or 2042.1.0-rc1
+version = parser.get("bumpversion", "current_version")
+# 2042.1
+version_family = ".".join(version.split("-", 1)[0].split(".")[:-1])
+prerelease = "-" in version
+
+image_tags = []
+if is_release:
+    for name in image_names:
+        image_tags += [
+            f"{name}:{version}",
+        ]
+        if not prerelease:
+            image_tags += [
+                f"{name}:latest",
+                f"{name}:{version_family}",
+            ]
+else:
+    suffix = ""
+    if image_arch and image_arch != "amd64":
+        suffix = f"-{image_arch}"
+    for name in image_names:
+        image_tags += [
+            f"{name}:gh-{sha}{suffix}",  # Used for ArgoCD and PR comments
+            f"{name}:gh-{safe_branch_name}{suffix}",  # For convenience
+            f"{name}:gh-{safe_branch_name}-{int(time())}-{sha[:7]}{suffix}",  # Use by FluxCD
+        ]
+
+image_main_tag = image_tags[0]
+image_tags_rendered = ",".join(image_tags)
+
+with open(os.environ["GITHUB_OUTPUT"], "a+", encoding="utf-8") as _output:
+    print("sha=%s" % sha, file=_output)
+    print("version=%s" % version, file=_output)
+    print("prerelease=%s" % prerelease, file=_output)
+    print("imageTags=%s" % image_tags_rendered, file=_output)
+    print("imageMainTag=%s" % image_main_tag, file=_output)

.github/actions/docker-push-variables/test.sh

@@ -0,0 +1,7 @@
+#!/bin/bash -x
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+GITHUB_OUTPUT=/dev/stdout \
+    GITHUB_REF=ref \
+    GITHUB_SHA=sha \
+    IMAGE_NAME=ghcr.io/goauthentik/server,beryju/authentik \
+    python $SCRIPT_DIR/push_vars.py

.github/workflows/ci-main.yml

@@ -28,10 +28,7 @@ jobs:
           - bandit
           - black
           - codespell
-          - isort
           - pending-migrations
-          # - pylint
-          - pyright
           - ruff
     runs-on: ubuntu-latest
     steps:

.vscode/extensions.json

@@ -10,8 +10,7 @@
         "Gruntfuggly.todo-tree",
         "mechatroner.rainbow-csv",
         "ms-python.black-formatter",
-        "ms-python.isort",
-        "ms-python.pylint",
+        "charliermarsh.ruff",
         "ms-python.python",
         "ms-python.vscode-pylance",
         "ms-python.black-formatter",

Makefile

@@ -5,7 +5,7 @@ PWD = $(shell pwd)
 UID = $(shell id -u)
 GID = $(shell id -g)
 NPM_VERSION = $(shell python -m scripts.npm_version)
-PY_SOURCES = authentik tests scripts lifecycle
+PY_SOURCES = authentik tests scripts lifecycle .github
 DOCKER_IMAGE ?= "authentik:test"
 
 GEN_API_TS = "gen-ts-api"
@@ -59,15 +59,12 @@ test: ## Run the server tests and produce a coverage report (locally)
 	coverage report
 
 lint-fix:  ## Lint and automatically fix errors in the python source code. Reports spelling errors.
-	isort $(PY_SOURCES)
 	black $(PY_SOURCES)
-	ruff --fix $(PY_SOURCES)
+	ruff check --fix $(PY_SOURCES)
 	codespell -w $(CODESPELL_ARGS)
 
 lint: ## Lint the python and golang sources
 	bandit -r $(PY_SOURCES) -x node_modules
-	./web/node_modules/.bin/pyright $(PY_SOURCES)
-	pylint $(PY_SOURCES)
 	golangci-lint run -v
 
 core-install:
@@ -249,9 +246,6 @@ ci--meta-debug:
 	python -V
 	node --version
 
-ci-pylint: ci--meta-debug
-	pylint $(PY_SOURCES)
-
 ci-black: ci--meta-debug
 	black --check $(PY_SOURCES)
 
@@ -261,14 +255,8 @@ ci-ruff: ci--meta-debug
 ci-codespell: ci--meta-debug
 	codespell $(CODESPELL_ARGS) -s
 
-ci-isort: ci--meta-debug
-	isort --check $(PY_SOURCES)
-
 ci-bandit: ci--meta-debug
 	bandit -r $(PY_SOURCES)
 
-ci-pyright: ci--meta-debug
-	./web/node_modules/.bin/pyright $(PY_SOURCES)
-
 ci-pending-migrations: ci--meta-debug
 	ak makemigrations --check

authentik/__init__.py

@@ -1,13 +1,12 @@
 """authentik root module"""
 
 from os import environ
-from typing import Optional
 
-__version__ = "2023.10.7"
+__version__ = "2024.2.1"
 ENV_GIT_HASH_KEY = "GIT_BUILD_HASH"
 
 
-def get_build_hash(fallback: Optional[str] = None) -> str:
+def get_build_hash(fallback: str | None = None) -> str:
     """Get build hash"""
     build_hash = environ.get(ENV_GIT_HASH_KEY, fallback if fallback else "")
     return fallback if build_hash == "" and fallback else build_hash

authentik/api/apps.py

@@ -18,7 +18,7 @@ def ready(self) -> None:
 
         # Class is defined here as it needs to be created early enough that drf-spectacular will
         # find it, but also won't cause any import issues
-        # pylint: disable=unused-variable
+
         class TokenSchema(OpenApiAuthenticationExtension):
             """Auth schema"""
 

authentik/api/authentication.py

@@ -1,7 +1,7 @@
 """API Authentication"""
 
 from hmac import compare_digest
-from typing import Any, Optional
+from typing import Any
 
 from django.conf import settings
 from rest_framework.authentication import BaseAuthentication, get_authorization_header
@@ -17,7 +17,7 @@
 LOGGER = get_logger()
 
 
-def validate_auth(header: bytes) -> Optional[str]:
+def validate_auth(header: bytes) -> str | None:
     """Validate that the header is in a correct format,
     returns type and credentials"""
     auth_credentials = header.decode().strip()
@@ -32,7 +32,7 @@ def validate_auth(header: bytes) -> Optional[str]:
     return auth_credentials
 
 
-def bearer_auth(raw_header: bytes) -> Optional[User]:
+def bearer_auth(raw_header: bytes) -> User | None:
     """raw_header in the Format of `Bearer ....`"""
     user = auth_user_lookup(raw_header)
     if not user:
@@ -42,7 +42,7 @@ def bearer_auth(raw_header: bytes) -> Optional[User]:
     return user
 
 
-def auth_user_lookup(raw_header: bytes) -> Optional[User]:
+def auth_user_lookup(raw_header: bytes) -> User | None:
     """raw_header in the Format of `Bearer ....`"""
     from authentik.providers.oauth2.models import AccessToken
 
@@ -75,7 +75,7 @@ def auth_user_lookup(raw_header: bytes) -> Optional[User]:
     raise AuthenticationFailed("Token invalid/expired")
 
 
-def token_secret_key(value: str) -> Optional[User]:
+def token_secret_key(value: str) -> User | None:
     """Check if the token is the secret key
     and return the service account for the managed outpost"""
     from authentik.outposts.apps import MANAGED_OUTPOST

authentik/api/tests/test_auth.py

@@ -25,17 +25,17 @@ class TestAPIAuth(TestCase):
     def test_invalid_type(self):
         """Test invalid type"""
         with self.assertRaises(AuthenticationFailed):
-            bearer_auth("foo bar".encode())
+            bearer_auth(b"foo bar")
 
     def test_invalid_empty(self):
         """Test invalid type"""
-        self.assertIsNone(bearer_auth("Bearer ".encode()))
-        self.assertIsNone(bearer_auth("".encode()))
+        self.assertIsNone(bearer_auth(b"Bearer "))
+        self.assertIsNone(bearer_auth(b""))
 
     def test_invalid_no_token(self):
         """Test invalid with no token"""
         with self.assertRaises(AuthenticationFailed):
-            auth = b64encode(":abc".encode()).decode()
+            auth = b64encode(b":abc").decode()
             self.assertIsNone(bearer_auth(f"Basic :{auth}".encode()))
 
     def test_bearer_valid(self):

authentik/api/tests/test_viewsets.py

@@ -1,6 +1,6 @@
 """authentik API Modelviewset tests"""
 
-from typing import Callable
+from collections.abc import Callable
 
 from django.test import TestCase
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -26,6 +26,6 @@ def tester(self: TestModelViewSets):
 
 
 for _, viewset, _ in router.registry:
-    if not issubclass(viewset, (ModelViewSet, ReadOnlyModelViewSet)):
+    if not issubclass(viewset, ModelViewSet | ReadOnlyModelViewSet):
         continue
     setattr(TestModelViewSets, f"test_viewset_{viewset.__name__}", viewset_tester_factory(viewset))

authentik/api/v3/urls.py

@@ -33,7 +33,7 @@
             app_name=_authentik_app.name,
         )
         continue
-    urls: list = getattr(api_urls, "api_urlpatterns")
+    urls: list = api_urls.api_urlpatterns
     for url in urls:
         if isinstance(url, URLPattern):
             _other_urls.append(url)