From cb8379031a765f6a7604841ed7ff6eb1b9029df2 Mon Sep 17 00:00:00 2001 From: "gcp-cherry-pick-bot[bot]" <98988430+gcp-cherry-pick-bot[bot]@users.noreply.github.com> Date: Sat, 15 Jun 2024 00:27:33 +0900 Subject: [PATCH 01/41] admin: system api: fix FIPS status schema (cherry-pick #10110) (#10112) admin: system api: fix FIPS status schema (#10110) Co-authored-by: Marc 'risson' Schmitt --- authentik/admin/api/system.py | 2 +- schema.yml | 4 ++-- web/src/admin/admin-overview/cards/FipsStatusCard.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/authentik/admin/api/system.py b/authentik/admin/api/system.py index 5b2e91ce53c4..ac9df17e71a9 100644 --- a/authentik/admin/api/system.py +++ b/authentik/admin/api/system.py @@ -33,7 +33,7 @@ class RuntimeDict(TypedDict): platform: str uname: str openssl_version: str - openssl_fips_mode: bool | None + openssl_fips_enabled: bool | None authentik_version: str diff --git a/schema.yml b/schema.yml index d356a2129e9a..baa970150321 100644 --- a/schema.yml +++ b/schema.yml @@ -47406,7 +47406,7 @@ components: type: string openssl_version: type: string - openssl_fips_mode: + openssl_fips_enabled: type: boolean nullable: true authentik_version: @@ -47415,7 +47415,7 @@ components: - architecture - authentik_version - environment - - openssl_fips_mode + - openssl_fips_enabled - openssl_version - platform - python_version diff --git a/web/src/admin/admin-overview/cards/FipsStatusCard.ts b/web/src/admin/admin-overview/cards/FipsStatusCard.ts index 5f9e4168bac3..47f05e1a67d0 100644 --- a/web/src/admin/admin-overview/cards/FipsStatusCard.ts +++ b/web/src/admin/admin-overview/cards/FipsStatusCard.ts @@ -29,7 +29,7 @@ export class FipsStatusCard extends AdminStatusCard { } getStatus(value: SystemInfo): Promise { - return value.runtime.opensslFipsMode + return value.runtime.opensslFipsEnabled ? this.setStatus(msg("OK"), { icon: "fa fa-check-circle pf-m-success", message: html`${msg("FIPS compliance: passing")}`, From 4d7f380b2d4f3e857d1dc255e507a0381585930c Mon Sep 17 00:00:00 2001 From: "gcp-cherry-pick-bot[bot]" <98988430+gcp-cherry-pick-bot[bot]@users.noreply.github.com> Date: Sat, 15 Jun 2024 00:33:28 +0900 Subject: [PATCH 02/41] web: bump API Client version (cherry-pick #10113) (#10114) --- web/package-lock.json | 8 ++++---- web/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/web/package-lock.json b/web/package-lock.json index 7d2000c1afc9..3405e24f5a44 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -17,7 +17,7 @@ "@codemirror/theme-one-dark": "^6.1.2", "@formatjs/intl-listformat": "^7.5.7", "@fortawesome/fontawesome-free": "^6.5.2", - "@goauthentik/api": "^2024.4.2-1718362364", + "@goauthentik/api": "^2024.4.2-1718378698", "@lit-labs/task": "^3.1.0", "@lit/context": "^1.1.2", "@lit/localize": "^0.12.1", @@ -2977,9 +2977,9 @@ } }, "node_modules/@goauthentik/api": { - "version": "2024.4.2-1718362364", - "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.4.2-1718362364.tgz", - "integrity": "sha512-Ds1Xm71/8zs1TLDPc/tmOL+xqZ0BbSAV24xMOzinSNQQB3cEqOdyJHFH27TEt86RgYM37d7xmedCZXJU6Oy/vg==" + "version": "2024.4.2-1718378698", + "resolved": "https://registry.npmjs.org/@goauthentik/api/-/api-2024.4.2-1718378698.tgz", + "integrity": "sha512-6t59bHFjG05cKbujqtGaG0EOeZDAzP7uwkFHmULL9LEJ/BeqGopuogjH8gY9xPFRgZPAd+eMCkrhPA+en4AOUA==" }, "node_modules/@hcaptcha/types": { "version": "1.0.3", diff --git a/web/package.json b/web/package.json index 51716ce9d015..b529286e7ebc 100644 --- a/web/package.json +++ b/web/package.json @@ -38,7 +38,7 @@ "@codemirror/theme-one-dark": "^6.1.2", "@formatjs/intl-listformat": "^7.5.7", "@fortawesome/fontawesome-free": "^6.5.2", - "@goauthentik/api": "^2024.4.2-1718362364", + "@goauthentik/api": "^2024.4.2-1718378698", "@lit-labs/task": "^3.1.0", "@lit/context": "^1.1.2", "@lit/localize": "^0.12.1", From f89a4fc276b629a85ecfb81f495efefd8406f130 Mon Sep 17 00:00:00 2001 From: "gcp-cherry-pick-bot[bot]" <98988430+gcp-cherry-pick-bot[bot]@users.noreply.github.com> Date: Fri, 14 Jun 2024 18:33:26 +0200 Subject: [PATCH 03/41] website/docs: update 2024.6 release notes with latest changes (cherry-pick #10109) (#10115) Co-authored-by: Marc 'risson' Schmitt --- website/docs/releases/2024/v2024.6.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/website/docs/releases/2024/v2024.6.md b/website/docs/releases/2024/v2024.6.md index 5ef12d27e8b1..7b928a3c8298 100644 --- a/website/docs/releases/2024/v2024.6.md +++ b/website/docs/releases/2024/v2024.6.md @@ -92,6 +92,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6 ## Minor changes/fixes - admin: system api: do not show FIPS status if no valid license (#10091) +- admin: system api: fix FIPS status schema (#10110) - core: FIPS (#9683) - core: add include_users flag to single group retrieval (#9721) - core: add option to select group for property mapping testing (#9834) @@ -110,6 +111,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6 - enterprise/providers/google_workspace: ensure no group is created when no property mappings are set (#9783) - enterprise/providers/microsoft_entra: fix error when updating connection attributes (#10039) - enterprise/providers/microsoft_entra: initial account sync to microsoft entra (#9632) +- enterprise/providers: import user/group data when manually linking objects (#10089) - enterprise/stages/source: fix error when creating source stage from blueprint (#9810) - events: ensure all models' **str** can be called without any further lookups (#9480) - events: fix geoip enrich context not converting to json-seriazable data (#9885) @@ -122,6 +124,7 @@ helm upgrade authentik authentik/authentik -f values.yaml --version ^2024.6 - lifecycle: always try custom redis URL (#9441) - lifecycle: close database connection after migrating (#9516) - lifecycle: fix ak test-all command +- policies/reputation: save to database directly (#10059) - policies: fix ak_call_policy failing when used in testing (#9853) - providers/oauth2: don't handle api scope as special scope (#9910) - providers/proxy: rework redirect mechanism (#8594) From 35cd1264063c37ac1dd406eab98a1d1b7c31f3f0 Mon Sep 17 00:00:00 2001 From: Marc 'risson' Schmitt Date: Fri, 14 Jun 2024 18:42:26 +0200 Subject: [PATCH 04/41] release: 2024.6.0-rc1 --- .bumpversion.cfg | 2 +- authentik/__init__.py | 2 +- blueprints/schema.json | 2 +- docker-compose.yml | 4 ++-- internal/constants/constants.go | 2 +- pyproject.toml | 2 +- schema.yml | 2 +- web/src/common/constants.ts | 2 +- 8 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.bumpversion.cfg b/.bumpversion.cfg index c81647f94fbf..956fb5a475f2 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 2024.4.2 +current_version = 2024.6.0-rc1 tag = True commit = True parse = (?P\d+)\.(?P\d+)\.(?P\d+)(?:-(?P[a-zA-Z-]+)(?P[1-9]\\d*))? diff --git a/authentik/__init__.py b/authentik/__init__.py index 468069e6e14b..d542fa161d36 100644 --- a/authentik/__init__.py +++ b/authentik/__init__.py @@ -2,7 +2,7 @@ from os import environ -__version__ = "2024.4.2" +__version__ = "2024.6.0" ENV_GIT_HASH_KEY = "GIT_BUILD_HASH" diff --git a/blueprints/schema.json b/blueprints/schema.json index d32ba34e501d..81a199907479 100644 --- a/blueprints/schema.json +++ b/blueprints/schema.json @@ -2,7 +2,7 @@ "$schema": "http://json-schema.org/draft-07/schema", "$id": "https://goauthentik.io/blueprints/schema.json", "type": "object", - "title": "authentik 2024.4.2 Blueprint schema", + "title": "authentik 2024.6.0 Blueprint schema", "required": [ "version", "entries" diff --git a/docker-compose.yml b/docker-compose.yml index 75de64289587..61954e8372b0 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -31,7 +31,7 @@ services: volumes: - redis:/data server: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.0} restart: unless-stopped command: server environment: @@ -52,7 +52,7 @@ services: - postgresql - redis worker: - image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2} + image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.6.0} restart: unless-stopped command: worker environment: diff --git a/internal/constants/constants.go b/internal/constants/constants.go index e9bd7f9e53f2..18aee7750ba9 100644 --- a/internal/constants/constants.go +++ b/internal/constants/constants.go @@ -29,4 +29,4 @@ func UserAgent() string { return fmt.Sprintf("authentik@%s", FullVersion()) } -const VERSION = "2024.4.2" +const VERSION = "2024.6.0" diff --git a/pyproject.toml b/pyproject.toml index 73e705cfff10..636a5c6045d8 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [tool.poetry] name = "authentik" -version = "2024.4.2" +version = "2024.6.0" description = "" authors = ["authentik Team "] diff --git a/schema.yml b/schema.yml index baa970150321..e0cfad438957 100644 --- a/schema.yml +++ b/schema.yml @@ -1,7 +1,7 @@ openapi: 3.0.3 info: title: authentik - version: 2024.4.2 + version: 2024.6.0 description: Making authentication simple. contact: email: hello@goauthentik.io diff --git a/web/src/common/constants.ts b/web/src/common/constants.ts index 8d8a1631bfba..fe31e878002c 100644 --- a/web/src/common/constants.ts +++ b/web/src/common/constants.ts @@ -3,7 +3,7 @@ export const SUCCESS_CLASS = "pf-m-success"; export const ERROR_CLASS = "pf-m-danger"; export const PROGRESS_CLASS = "pf-m-in-progress"; export const CURRENT_CLASS = "pf-m-current"; -export const VERSION = "2024.4.2"; +export const VERSION = "2024.6.0"; export const TITLE_DEFAULT = "authentik"; export const ROUTE_SEPARATOR = ";"; From b6157ecaf1425460dbea312e6075fdd4eefdc6ab Mon Sep 17 00:00:00 2001 From: "gcp-cherry-pick-bot[bot]" <98988430+gcp-cherry-pick-bot[bot]@users.noreply.github.com> Date: Sun, 16 Jun 2024 19:52:04 +0200 Subject: [PATCH 05/41] policies/reputation: fix existing reputation update (cherry-pick #10124) (#10125) policies/reputation: fix existing reputation update (#10124) * add failing test case * fix reputation update * lint --------- Signed-off-by: Marc 'risson' Schmitt Co-authored-by: Marc 'risson' Schmitt --- authentik/policies/reputation/signals.py | 27 +++++++++++++++--------- authentik/policies/reputation/tests.py | 9 ++++++++ 2 files changed, 26 insertions(+), 10 deletions(-) diff --git a/authentik/policies/reputation/signals.py b/authentik/policies/reputation/signals.py index 31042f8406bb..a3969c4d9e54 100644 --- a/authentik/policies/reputation/signals.py +++ b/authentik/policies/reputation/signals.py @@ -1,6 +1,8 @@ """authentik reputation request signals""" from django.contrib.auth.signals import user_logged_in +from django.db import transaction +from django.db.models import F from django.dispatch import receiver from django.http import HttpRequest from structlog.stdlib import get_logger @@ -19,16 +21,21 @@ def update_score(request: HttpRequest, identifier: str, amount: int): """Update score for IP and User""" remote_ip = ClientIPMiddleware.get_client_ip(request) - Reputation.objects.update_or_create( - ip=remote_ip, - identifier=identifier, - defaults={ - "score": amount, - "ip_geo_data": GEOIP_CONTEXT_PROCESSOR.city_dict(remote_ip) or {}, - "ip_asn_data": ASN_CONTEXT_PROCESSOR.asn_dict(remote_ip) or {}, - "expires": reputation_expiry(), - }, - ) + with transaction.atomic(): + reputation, created = Reputation.objects.select_for_update().get_or_create( + ip=remote_ip, + identifier=identifier, + defaults={ + "score": amount, + "ip_geo_data": GEOIP_CONTEXT_PROCESSOR.city_dict(remote_ip) or {}, + "ip_asn_data": ASN_CONTEXT_PROCESSOR.asn_dict(remote_ip) or {}, + "expires": reputation_expiry(), + }, + ) + + if not created: + reputation.score = F("score") + amount + reputation.save() LOGGER.debug("Updated score", amount=amount, for_user=identifier, for_ip=remote_ip) diff --git a/authentik/policies/reputation/tests.py b/authentik/policies/reputation/tests.py index 7d4e33fb7947..50b7b5a1966b 100644 --- a/authentik/policies/reputation/tests.py +++ b/authentik/policies/reputation/tests.py @@ -39,6 +39,15 @@ def test_user_reputation(self): ) self.assertEqual(Reputation.objects.get(identifier=self.test_username).score, -1) + def test_update_reputation(self): + """test reputation update""" + Reputation.objects.create(identifier=self.test_username, ip=self.test_ip, score=43) + # Trigger negative reputation + authenticate( + self.request, self.backends, username=self.test_username, password=self.test_username + ) + self.assertEqual(Reputation.objects.get(identifier=self.test_username).score, 42) + def test_policy(self): """Test Policy""" request = PolicyRequest(user=self.user) From eef02f2892e1e88f8555cc7c6873ce71d539c463 Mon Sep 17 00:00:00 2001 From: "gcp-cherry-pick-bot[bot]" <98988430+gcp-cherry-pick-bot[bot]@users.noreply.github.com> Date: Tue, 18 Jun 2024 17:39:04 +0900 Subject: [PATCH 06/41] core: include version in built JS files (cherry-pick #9558) (#10148) core: include version in built JS files (#9558) * web: fix esbuild issue with style sheets Getting ESBuild, Lit, and Storybook to all agree on how to read and parse stylesheets is a serious pain. This fix better identifies the value types (instances) being passed from various sources in the repo to the three *different* kinds of style processors we're using (the native one, the polyfill one, and whatever the heck Storybook does internally). Falling back to using older CSS instantiating techniques one era at a time seems to do the trick. It's ugly, but in the face of the aggressive styling we use to avoid Flashes of Unstyled Content (FLoUC), it's the logic with which we're left. In standard mode, the following warning appears on the console when running a Flow: ``` Autofocus processing was blocked because a document already has a focused element. ``` In compatibility mode, the following **error** appears on the console when running a Flow: ``` crawler-inject.js:1106 Uncaught TypeError: Failed to execute 'observe' on 'MutationObserver': parameter 1 is not of type 'Node'. at initDomMutationObservers (crawler-inject.js:1106:18) at crawler-inject.js:1114:24 at Array.forEach () at initDomMutationObservers (crawler-inject.js:1114:10) at crawler-inject.js:1549:1 initDomMutationObservers @ crawler-inject.js:1106 (anonymous) @ crawler-inject.js:1114 initDomMutationObservers @ crawler-inject.js:1114 (anonymous) @ crawler-inject.js:1549 ``` Despite this error, nothing seems to be broken and flows work as anticipated. * core: include version in built JS files * add fallback * include build hash * format * fix stuff why does this even work locally * idk man node * just not use import assertions * web: add no-console, use proper dirname path * web: retarget to use the base package.json file. * web: encode path to root package.json using git This is the most authoritative way of finding the root of the git project. * use full version to match frontend * add fallback for missing .git folder --------- Signed-off-by: Jens Langhammer Co-authored-by: Jens L Co-authored-by: Ken Sternberg --- .bumpversion.cfg | 2 ++ Dockerfile | 1 + authentik/api/templates/api/browser.html | 4 +-- authentik/core/templates/base/skeleton.html | 5 +-- authentik/core/templates/if/admin.html | 4 +-- authentik/core/templates/if/flow.html | 3 +- authentik/core/templates/if/user.html | 4 +-- authentik/core/templatetags/__init__.py | 0 authentik/core/templatetags/authentik_core.py | 27 ++++++++++++++++ .../providers/rac/templates/if/rac.html | 4 +-- authentik/root/settings.py | 4 +-- package.json | 2 +- proxy.Dockerfile | 3 +- web/build.mjs | 32 +++++++++++++++++-- 14 files changed, 76 insertions(+), 19 deletions(-) create mode 100644 authentik/core/templatetags/__init__.py create mode 100644 authentik/core/templatetags/authentik_core.py diff --git a/.bumpversion.cfg b/.bumpversion.cfg index 956fb5a475f2..6f0528130544 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -17,6 +17,8 @@ optional_value = final [bumpversion:file:pyproject.toml] +[bumpversion:file:package.json] + [bumpversion:file:docker-compose.yml] [bumpversion:file:schema.yml] diff --git a/Dockerfile b/Dockerfile index ceedb0f8d676..745078bf2a4f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,6 +31,7 @@ RUN --mount=type=bind,target=/work/web/package.json,src=./web/package.json \ --mount=type=cache,id=npm-web,sharing=shared,target=/root/.npm \ npm ci --include=dev +COPY ./package.json /work COPY ./web /work/web/ COPY ./website /work/website/ COPY ./gen-ts-api /work/web/node_modules/@goauthentik/api diff --git a/authentik/api/templates/api/browser.html b/authentik/api/templates/api/browser.html index 9434db93db4c..a84ef3cb257d 100644 --- a/authentik/api/templates/api/browser.html +++ b/authentik/api/templates/api/browser.html @@ -1,13 +1,13 @@ {% extends "base/skeleton.html" %} -{% load static %} +{% load authentik_core %} {% block title %} API Browser - {{ brand.branding_title }} {% endblock %} {% block head %} - +{% versioned_script "dist/standalone/api-browser/index-%v.js" %} {% endblock %} diff --git a/authentik/core/templates/base/skeleton.html b/authentik/core/templates/base/skeleton.html index 377485948b90..18413f1eafac 100644 --- a/authentik/core/templates/base/skeleton.html +++ b/authentik/core/templates/base/skeleton.html @@ -1,5 +1,6 @@ {% load static %} {% load i18n %} +{% load authentik_core %} @@ -14,8 +15,8 @@ {% endblock %} - - + {% versioned_script "dist/poly-%v.js" %} + {% versioned_script "dist/standalone/loading/index-%v.js" %} {% block head %} {% endblock %} diff --git a/authentik/core/templates/if/admin.html b/authentik/core/templates/if/admin.html index b3b761f8843d..9a548dfd9d73 100644 --- a/authentik/core/templates/if/admin.html +++ b/authentik/core/templates/if/admin.html @@ -1,9 +1,9 @@ {% extends "base/skeleton.html" %} -{% load static %} +{% load authentik_core %} {% block head %} - +{% versioned_script "dist/admin/AdminInterface-%v.js" %} {% include "base/header_js.html" %} diff --git a/authentik/core/templates/if/flow.html b/authentik/core/templates/if/flow.html index 197c3ffdaad6..a5b3d7f592c5 100644 --- a/authentik/core/templates/if/flow.html +++ b/authentik/core/templates/if/flow.html @@ -1,6 +1,7 @@ {% extends "base/skeleton.html" %} {% load static %} +{% load authentik_core %} {% block head_before %} {{ block.super }} @@ -17,7 +18,7 @@ {% endblock %} {% block head %} - +{% versioned_script "dist/flow/FlowInterface-%v.js" %}