authentik,authentik-outposts.ldap: 2024.2.2 -> 2024.6.0

3 files changed, 106 insertions, 25 deletions

diff --git a/pkgs/by-name/au/authentik/ldap.nix b/pkgs/by-name/au/authentik/ldap.nix
index 2d74c3911aa21..d2e40497ce9b9 100644
--- a/pkgs/by-name/au/authentik/ldap.nix
+++ b/pkgs/by-name/au/authentik/ldap.nix
@@ -4,14 +4,14 @@ buildGoModule {
   pname = "authentik-ldap-outpost";
   inherit (authentik) version src;
 
-  vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
+  vendorHash = "sha256-hxtyXyCfVemsjYQeo//gd68x4QO/4Vcww8i2ocsUVW8=";
 
   CGO_ENABLED = 0;
 
   subPackages = [ "cmd/ldap" ];
 
   meta = authentik.meta // {
-    description = "Authentik ldap outpost. Needed for the extendal ldap API";
+    description = "The authentik ldap outpost. Needed for the external ldap API.";
     homepage = "https://goauthentik.io/docs/providers/ldap/";
     mainProgram = "ldap";
   };
diff --git a/pkgs/by-name/au/authentik/outposts.nix b/pkgs/by-name/au/authentik/outposts.nix
index 05649628b3e8e..6f9ade9cc54b2 100644
--- a/pkgs/by-name/au/authentik/outposts.nix
+++ b/pkgs/by-name/au/authentik/outposts.nix
@@ -1,5 +1,3 @@
-{ callPackage }:
-
-{
+{ callPackage }: {
   ldap = callPackage ./ldap.nix { };
 }
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index 3b0132ee0a5ba..bb7f88d8d0780 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -1,23 +1,25 @@
 { lib
 , stdenvNoCC
+, callPackages
 , fetchFromGitHub
+, fetchzip
 , buildNpmPackage
 , buildGoModule
 , runCommand
 , openapi-generator-cli
 , nodejs
-, python3
+, python312
 , codespell
 , makeWrapper }:
 
 let
-  version = "2024.2.2";
+  version = "2024.6.0";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     rev = "version/${version}";
-    hash = "sha256-2B1RgKY5tpDBdzguEyWqzg15w5x/dLS2ffjbnxbpINs=";
+    hash = "sha256-eYxabUUQVeURrVAaF/Ecohzw9LJj0LZyCSM43gNvajY=";
   };
 
   meta = with lib; {
@@ -32,7 +34,7 @@ let
   website = buildNpmPackage {
     pname = "authentik-website";
     inherit version src meta;
-    npmDepsHash = "sha256-paACBXG7hEQSLekxCvxNns2Tg9rN3DUgz6o3A/lAhA8=";
+    npmDepsHash = "sha256-JM+ae+zDsMdvovd2p4IJIH89KlMeDU7HOZjFbDCyehw=";
 
     NODE_ENV = "production";
     NODE_OPTIONS = "--openssl-legacy-provider";
@@ -42,11 +44,12 @@ let
     '';
 
     installPhase = ''
-      cp -r help $out
+      mkdir $out
+      cp -r build $out/help
     '';
 
-    npmInstallFlags = [ "--include=dev" ];
-    npmBuildScript = "build-docs-only";
+    npmBuildScript = "build-bundled";
+    npmFlags = [ "--ignore-scripts" ];
   };
 
   clientapi = stdenvNoCC.mkDerivation {
@@ -79,10 +82,11 @@ let
     src = runCommand "authentik-webui-source" {} ''
       mkdir -p $out/web/node_modules/@goauthentik/
       cp -r ${src}/web $out/
+      ln -s ${src}/package.json $out/
       ln -s ${src}/website $out/
       ln -s ${clientapi} $out/web/node_modules/@goauthentik/api
     '';
-    npmDepsHash = "sha256-Xtzs91m+qu7jTwr0tMeS74gjlZs4vufGGlplPVf9yew=";
+    npmDepsHash = "sha256-LAy2o/gs9lwbZT4NqD2GSsx7PCipnkthwnX9ICVpAWU=";
 
     postPatch = ''
       cd web
@@ -102,7 +106,7 @@ let
     npmInstallFlags = [ "--include=dev" ];
   };
 
-  python = python3.override {
+  python = python312.override {
     self = python;
     packageOverrides = final: prev: {
       django-tenants = prev.buildPythonPackage rec {
@@ -117,32 +121,105 @@ let
         format = "setuptools";
         doCheck = false; # Tests require postgres
 
-        propagatedBuildInputs = with prev; [
+        propagatedBuildInputs = with final; [
           django
           psycopg
           gunicorn
         ];
       };
 
+      django-cte = prev.buildPythonPackage rec {
+        pname = "django-cte";
+        version = "1.3.3";
+        src = fetchFromGitHub {
+          owner = "dimagi";
+          repo = pname;
+          rev = "v${version}";
+          hash = "sha256-OCENg94xHBeeE4A2838Cu3q2am2im2X4SkFSjc6DuhE=";
+        };
+        doCheck = false; # Tests require postgres
+        format = "setuptools";
+      };
+
+      django-pgactivity = prev.buildPythonPackage rec {
+        pname = "django-pgactivity";
+        version = "1.4.1";
+        src = fetchFromGitHub {
+          owner = "Opus10";
+          repo = pname;
+          rev = version;
+          hash = "sha256-VwH7fwLcoH2Z9D/OY9iieM0cRhyDKOpAzqQ+4YVE3vU=";
+        };
+        nativeBuildInputs = with prev; [
+          poetry-core
+        ];
+        propagatedBuildInputs = with final; [
+          django
+        ];
+        pyproject = true;
+      };
+
+      django-pglock = prev.buildPythonPackage rec {
+        pname = "django-pglock";
+        version = "1.5.1";
+        src = fetchFromGitHub {
+          owner = "Opus10";
+          repo = pname;
+          rev = version;
+          hash = "sha256-ZoEHDkGmrcNiMe/rbwXsEPZo3LD93cZp6zjftMKjLeg=";
+        };
+        nativeBuildInputs = with prev; [
+          poetry-core
+        ];
+        propagatedBuildInputs = with final; [
+          django
+          django-pgactivity
+        ];
+        pyproject = true;
+      };
+
       tenant-schemas-celery = prev.buildPythonPackage rec {
         pname = "tenant-schemas-celery";
-        version = "2.2.0";
+        version = "3.0.0";
         src = fetchFromGitHub {
           owner = "maciej-gol";
           repo = pname;
           rev = version;
-          hash = "sha256-OpIJobjWZE5GQGnHADioeoJo3A6DAKh0HdO10k4rsX4=";
+          hash = "sha256-3ZUXSAOBMtj72sk/VwPV24ysQK+E4l1HdwKa78xrDtg=";
         };
         format = "setuptools";
         doCheck = false;
 
-        propagatedBuildInputs = with prev; [
+        propagatedBuildInputs = with final; [
           freezegun
           more-itertools
           psycopg2
         ];
       };
 
+      scim2-filter-parser = prev.buildPythonPackage rec {
+        pname = "scim2-filter-parser";
+        version = "0.5.1";
+        # For some reason the normal fetchPypi does not work
+        src = fetchzip {
+          url = "https://files.pythonhosted.org/packages/54/df/ad9718acce76e81a93c57327356eecd23701625f240fbe03d305250399e6/scim2_filter_parser-0.5.1.tar.gz";
+          hash = "sha256-DZAdRj6qyySggsvJZC47vdvXbHrB1ra3qiYBEUiceJ4=";
+        };
+
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace-fail 'poetry>=0.12' 'poetry-core>=1.0.0' \
+            --replace-fail 'poetry.masonry.api' 'poetry.core.masonry.api'
+        '';
+
+        nativeBuildInputs = [ prev.poetry-core ];
+        pyproject = true;
+
+        propagatedBuildInputs = with final; [
+          sly
+        ];
+      };
+
       authentik-django = prev.buildPythonPackage {
         pname = "authentik-django";
         inherit version src meta;
@@ -157,9 +234,8 @@ let
             --replace-fail './media' '/var/lib/authentik/media'
           substituteInPlace pyproject.toml \
             --replace-fail 'dumb-init = "*"' "" \
-            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2' \
-            --replace-fail 'version = "4.9.4"' 'version = "*"' \
-            --replace-fail 'version = "<2"' 'version = "*"'
+            --replace-fail 'djangorestframework = "3.14.0"' 'djangorestframework = "*"' \
+            --replace-fail 'djangorestframework-guardian' 'djangorestframework-guardian2'
           substituteInPlace authentik/stages/email/utils.py \
             --replace-fail 'web/' '${webui}/'
         '';
@@ -177,9 +253,11 @@ let
           deepmerge
           defusedxml
           django
+          django-cte
           django-filter
           django-guardian
           django-model-utils
+          django-pglock
           django-prometheus
           django-redis
           django-storages
@@ -190,14 +268,16 @@ let
           drf-spectacular
           duo-client
           facebook-sdk
+          fido2
           flower
           geoip2
+          google-api-python-client
           gunicorn
-          httptools
+          jsonpatch
           kubernetes
           ldap3
           lxml
-          jsonpatch
+          msgraph-sdk
           opencontainers
           packaging
           paramiko
@@ -208,8 +288,10 @@ let
           pyjwt
           pyyaml
           requests-oauthlib
+          scim2-filter-parser
           sentry-sdk
           service-identity
+          setproctitle
           structlog
           swagger-spec-validator
           tenant-schemas-celery
@@ -218,7 +300,6 @@ let
           ua-parser
           urllib3
           uvicorn
-          uvloop
           watchdog
           webauthn
           websockets
@@ -258,7 +339,7 @@ let
 
     CGO_ENABLED = 0;
 
-    vendorHash = "sha256-UIJBCTq7AJGUDIlZtJaWCovyxlMPzj2BCJQqthybEz4=";
+    vendorHash = "sha256-hxtyXyCfVemsjYQeo//gd68x4QO/4Vcww8i2ocsUVW8=";
 
     postInstall = ''
       mv $out/bin/server $out/bin/authentik
@@ -294,6 +375,8 @@ in stdenvNoCC.mkDerivation {
     runHook postInstall
   '';
 
+  passthru.outposts = callPackages ./outposts.nix { };
+
   nativeBuildInputs = [ makeWrapper ];
 
   meta = meta // {