web/admin: add application bindings to the application wizard

[kensternberg-authentik]

web: wizard for applications, now with bindings!

What

Purpose

• Add policy bindings to the application wizard

The Wizard Base:

• Restructures the Wizard base code.
  • ak-wizard-steps holds the steps and listens for NavigationRequest events to move from one step to the next.
  • WizardStep is a base class (no component registration provided) that provides the whole frame, not just the form. It receives the navigation content for the sidebar from ak-wizard-steps, and provides the styling for the header, footer, sidebar, and main form. It has abstractions for buttons, renderMain(), handleButton(), handleEnable(), in a section well-marked as “Public API”. Steps inherit from this class.

Conceptually:

• A wizard is a series of pages (“steps”) with a distinct beginning and end, linked in a series, to complete a task.
• Later steps in the series are inaccessible until an earlier steps has granted access to it.
• Access is predicated on the earlier step being complete and valid. The developer is responsible for determining what “complete and valid” means.
• The series is visible, giving the customer a sense of how much effort is needed to complete the task.
• A parent object maintains (and can modify as needed) the list of steps. It can maintain the information being collected from the user. Alternatively, that information can be kept in each step.

Details:

• Keeping with the Lit paradigm, “requests to change the system flow up, information changed by valid requests flows down.”
• The information flows up using events: WizardNavigation, WizardUpdate, WizardClose.
• The information flows down using properties.

The Application Wizard

• ak-application-wizard-main holds the list of steps, providing a unique slot name for each.
  • It maintains the ApplicationWizardState object.
• ApplicationWizardStep inherits from WizardStep and provides:
  • A means of extraction information from forms
  • A convenience method for updating the ApplicationWizardState object, enabling future steps, and navigating to a future step, in the correct order.
  • A method for cleaning error from the error reporting mechanism as the user navigates from an error-handling state.
  • The title, description, and cancelability of the wizard.
• Steps:
  • step: Handles the application. A good starting point for understanding the point of the Wizard. Check the handleButton() method to understand how we enable or disable access to future steps.
  • provider-choice: Just a list. Shows validation without the form.
  • provider: Uses a very esoteric Lit feature, unsafeStaticTag, which enables the display to show anything that conforms to the expectations of ApplicationWizardProviderForm.
    • ApplicationWizardProviderForm repeats some of the base of ApplicationWizardStep, but allows us to provide multiple variants on a single form without having to create separate steps for each form.
    • The forms (provider-for-ldap, provider-for-radius) are therefore just the form and any fetchers needed to populate it.
  • bindings: Shows the table of bindings. Has a custom display for “This table is empty.”
  • edit-binding: Showcase for the SearchSelectEZ configuration format. Has an override on the handleButton feature to figure out which binding is about to be overridden. Is also a .hidden page; it doesn’t show up on the navigation sidebar, as is only navigable-to by buttons not associated with the button bar at the bottom.
  • submit: Has a lot of machinery of state: Reviewing with errors, reviewing without errors, running submission, and success. Uses ts-pattern a lot to make sure the state/request pairs make sense.

Why !?!?!?

The key insight is that, even though a wizard is a series in order, that order can’t be simply maintained in a list. The parent needs various strategies for swapping pages in and out of the sequence, while still maintaining a coherent idea of “flow” and providing the visual cues the user needs to feel confident that the work can be completed and completed quickly. The entire mechanism for using an array and index to navigate, with index numbering, blocked the implementation of the bindings pages.

One thing led to another. Sigh Really wish this hadn’t been as much of a mess as it turned out. The end result is pretty good, though. Definitely re-usable.

One important feature to note is that the wizard is not tied to the ModalButton object; it’s simply embedded in a modal as-needed. This allows us to use wizards in other places, such as just being in a DIV, or just a page on its own.

Checklist

• The code has been formatted (make web)

[netlify]

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	29362ea
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/673542ff63e7e300081cd9e5

[netlify]

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	59b74e9
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/672506d1828b980008793657
😎 Deploy Preview	https://deploy-preview-11462--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[codecov]

❌ 1 Tests Failed:

Tests completed	Failed	Passed	Skipped
1591	1	1590	1

View the top 1 failed tests by shortest run time

authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI test_create_transactional_bindings

Stack Traces | 0.372s run time

self = <unittest.case._Outcome object at 0x7f41db06df70>
test_case = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
subTest = False

    @contextlib.contextmanager
    def testPartExecutor(self, test_case, subTest=False):
        old_success = self.success
        self.success = True
        try:
>           yield

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:58: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
result = <TestCaseFunction test_create_transactional_bindings>

    def run(self, result=None):
        if result is None:
            result = self.defaultTestResult()
            startTestRun = getattr(result, 'startTestRun', None)
            stopTestRun = getattr(result, 'stopTestRun', None)
            if startTestRun is not None:
                startTestRun()
        else:
            stopTestRun = None
    
        result.startTest(self)
        try:
            testMethod = getattr(self, self._testMethodName)
            if (getattr(self.__class__, "__unittest_skip__", False) or
                getattr(testMethod, "__unittest_skip__", False)):
                # If the class or method was skipped.
                skip_why = (getattr(self.__class__, '__unittest_skip_why__', '')
                            or getattr(testMethod, '__unittest_skip_why__', ''))
                _addSkip(result, self, skip_why)
                return result
    
            expecting_failure = (
                getattr(self, "__unittest_expecting_failure__", False) or
                getattr(testMethod, "__unittest_expecting_failure__", False)
            )
            outcome = _Outcome(result)
            start_time = time.perf_counter()
            try:
                self._outcome = outcome
    
                with outcome.testPartExecutor(self):
                    self._callSetUp()
                if outcome.success:
                    outcome.expecting_failure = expecting_failure
                    with outcome.testPartExecutor(self):
>                       self._callTestMethod(testMethod)

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:634: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
method = <bound method TestTransactionalApplicationsAPI.test_create_transactional_bindings of <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>>

    def _callTestMethod(self, method):
>       if method() is not None:

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:589: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>

    def test_create_transactional_bindings(self):
        """Test transactional Application + provider creation"""
        assign_perm("authentik_policies.add_policybinding", self.user)
        self.client.force_login(self.user)
        uid = generate_id()
        group = Group.objects.create(name=generate_id())
        authorization_flow = create_test_flow()
        response = self.client.put(
            reverse("authentik_api:core-transactional-application"),
            data={
                "app": {
                    "name": uid,
                    "slug": uid,
                },
                "provider_model": "authentik_providers_oauth2.oauth2provider",
                "provider": {
                    "name": uid,
                    "authorization_flow": str(authorization_flow.pk),
                },
                "policy_bindings": [{"group": group.pk, "order": 0}],
            },
        )
>       self.assertJSONEqual(response.content.decode(), {"applied": True, "logs": []})

.../core/tests/test_transactional_applications_api.py:70: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
raw = '{"provider":{"invalidation_flow":["This field is required."]}}'
expected_data = {'applied': True, 'logs': []}, msg = None

    def assertJSONEqual(self, raw, expected_data, msg=None):
        """
        Assert that the JSON fragments raw and expected_data are equal.
        Usual JSON non-significant whitespace rules apply as the heavyweight
        is delegated to the json library.
        """
        try:
            data = json.loads(raw)
        except json.JSONDecodeError:
            self.fail("First argument is not valid JSON: %r" % raw)
        if isinstance(expected_data, str):
            try:
                expected_data = json.loads(expected_data)
            except ValueError:
                self.fail("Second argument is not valid JSON: %r" % expected_data)
>       self.assertEqual(data, expected_data, msg=msg)

../../../..../pypoetry/virtualenvs/authentik-xvtLQ9eE-py3.12/lib/python3.12.../django/test/testcases.py:922: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
first = {'provider': {'invalidation_flow': ['This field is required.']}}
second = {'applied': True, 'logs': []}, msg = None

    def assertEqual(self, first, second, msg=None):
        """Fail if the two objects are unequal as determined by the '=='
           operator.
        """
        assertion_func = self._getAssertEqualityFunc(first, second)
>       assertion_func(first, second, msg=msg)

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:885: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
d1 = {'provider': {'invalidation_flow': ['This field is required.']}}
d2 = {'applied': True, 'logs': []}, msg = None

    def assertDictEqual(self, d1, d2, msg=None):
        self.assertIsInstance(d1, dict, 'First argument is not a dictionary')
        self.assertIsInstance(d2, dict, 'Second argument is not a dictionary')
    
        if d1 != d2:
            standardMsg = '%s != %s' % _common_shorten_repr(d1, d2)
            diff = ('\n' + '\n'.join(difflib.ndiff(
                           pprint.pformat(d1).splitlines(),
                           pprint.pformat(d2).splitlines())))
            standardMsg = self._truncateMessage(standardMsg, diff)
>           self.fail(self._formatMessage(msg, standardMsg))

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:1184: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <authentik.core.tests.test_transactional_applications_api.TestTransactionalApplicationsAPI testMethod=test_create_transactional_bindings>
msg = "{'provider': {'invalidation_flow': ['This field is required.']}} != {'applied': True, 'logs': []}\n- {'provider': {'invalidation_flow': ['This field is required.']}}\n+ {'applied': True, 'logs': []}"

    def fail(self, msg=None):
        """Fail immediately, with the given message."""
>       raise self.failureException(msg)
E       AssertionError: {'provider': {'invalidation_flow': ['This field is required.']}} != {'applied': True, 'logs': []}
E       - {'provider': {'invalidation_flow': ['This field is required.']}}
E       + {'applied': True, 'logs': []}

.../hostedtoolcache/Python/3.12.7................../x64/lib/python3.12/unittest/case.py:715: AssertionError

To view individual test run time comparison to the main branch, go to the Test Analytics Dashboard

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ec020955a16da695260b3ff661c2579ffd0ea2b9
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

For arm64, use these values:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-ec020955a16da695260b3ff661c2579ffd0ea2b9-arm64
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-ec020955a16da695260b3ff661c2579ffd0ea2b9

For arm64, use these values:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-ec020955a16da695260b3ff661c2579ffd0ea2b9-arm64

Afterwards, run the upgrade commands from the latest release notes.

[kensternberg-authentik]

Yeah, that's legit. :-)

[rissson]

Btw, this PR won't work with deploy_me until conflicts are resolved