Skip to content

core: add digraph group hierarchy#17050

Merged
gergosimonyi merged 47 commits intomainfrom
core/add-digraph-group-hierarchy
Dec 8, 2025
Merged

core: add digraph group hierarchy#17050
gergosimonyi merged 47 commits intomainfrom
core/add-digraph-group-hierarchy

Conversation

@gergosimonyi
Copy link
Collaborator

@gergosimonyi gergosimonyi commented Sep 26, 2025 •
edited
Loading

No description provided.

@netlify
Copy link

netlify bot commented Sep 26, 2025 •
edited
Loading

✅ Deploy Preview for authentik-docs canceled.

Name Link
🔨 Latest commit 6e8243f
🔍 Latest deploy log https://app.netlify.com/projects/authentik-docs/deploys/6936a35e62ef240008eb2351

@netlify
Copy link

netlify bot commented Sep 26, 2025 •
edited
Loading

✅ Deploy Preview for authentik-integrations canceled.

Name Link
🔨 Latest commit 6e8243f
🔍 Latest deploy log https://app.netlify.com/projects/authentik-integrations/deploys/6936a35e8009e300084ae595

@netlify
Copy link

netlify bot commented Sep 26, 2025 •
edited
Loading

✅ Deploy Preview for authentik-storybook ready!

Name Link
🔨 Latest commit 6e8243f
🔍 Latest deploy log https://app.netlify.com/projects/authentik-storybook/deploys/6936a35ed612b30008cc956a
😎 Deploy Preview https://deploy-preview-17050--authentik-storybook.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@codecov
Copy link

codecov bot commented Sep 26, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 96.54428% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.19%. Comparing base (37ca473) to head (6e8243f).
⚠️ Report is 15 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
authentik/core/models.py 90.32% 9 Missing ⚠️
authentik/core/auth.py 71.42% 4 Missing ⚠️
authentik/core/api/groups.py 95.45% 1 Missing ⚠️
authentik/core/api/users.py 96.66% 1 Missing ⚠️
authentik/rbac/api/rbac.py 0.00% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #17050      +/-   ##
==========================================
- Coverage   93.21%   93.19%   -0.02%     
==========================================
  Files         933      929       -4     
  Lines       51255    51175      -80     
==========================================
- Hits        47775    47695      -80     
  Misses       3480     3480
Flag Coverage Δ
e2e 44.92% <46.00%> (+0.15%) ⬆️
integration 23.14% <30.45%> (+0.33%) ⬆️
unit 91.41% <95.89%> (-0.03%) ⬇️
unit-migrate 91.46% <95.89%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@cheggerdev
Copy link

cheggerdev commented Sep 26, 2025

This raises the question: What is an indirect group? So far it includes all groups with an parent.
With this PR will it be still so or do indirect groups include all children ? The answer is important because it decides whether expression policies and property mappings using user.ak_groups() will continue to work or require an adaption.

@gergosimonyi gergosimonyi force-pushed the core/add-digraph-group-hierarchy branch from 286060d to 3721a97 Compare October 6, 2025 11:35
@gergosimonyi
Copy link
Collaborator Author

gergosimonyi commented Oct 6, 2025

@cheggerdev

The definition for "indirect groups of a user" doesn't change in this PR. That definition is: "any ancestor of the user's direct groups" (and by "direct groups" here, I mean user.ak_groups.all()).

This PR only changes the group hierarchy in one way: groups can now have multiple parents. Notably, your example of user.ak_groups isn't affected, it stays a standard django-managed ManyToManyField.

BeryJu
BeryJu reviewed Oct 10, 2025
View reviewed changes
BeryJu
BeryJu reviewed Oct 10, 2025
View reviewed changes
BeryJu
BeryJu reviewed Oct 10, 2025
View reviewed changes
BeryJu
BeryJu reviewed Oct 10, 2025
View reviewed changes
@gergosimonyi gergosimonyi force-pushed the core/add-digraph-group-hierarchy branch from 3721a97 to 14ded8a Compare October 13, 2025 10:58
BeryJu and others added 2 commits October 13, 2025 14:35
@gergosimonyi gergosimonyi mentioned this pull request Oct 16, 2025
Open
@kiaraly
Copy link

kiaraly commented Oct 16, 2025 •
edited
Loading

This raises the question: What is an indirect group? So far it includes all groups with an parent. With this PR will it be still so or do indirect groups include all children ? The answer is important because it decides whether expression policies and property mappings using user.ak_groups() will continue to work or require an adaption.

I think the way you intuitively think about nested groups is that a parent can do everything the child can do, similar to #16282.

However, I can also see how you can think of it as inheritance and then inheriting everything the parent can do makes perfect sense. When you can add multiple parents the outcome is the same and in this version the master admin group would simply get every app specific admin group as a parent.

@BeryJu BeryJu added this to the Release 2025.12 milestone Oct 23, 2025
@BeryJu BeryJu moved this to In Progress in authentik Core Oct 23, 2025
This was referenced Oct 23, 2025
Open
Open
@rissson rissson mentioned this pull request Dec 3, 2025
Open
6 tasks
dewi-tik
dewi-tik reviewed Dec 3, 2025
View reviewed changes
Copy link
Contributor

@dewi-tik dewi-tik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some suggestions

tanberry
tanberry approved these changes Dec 3, 2025
View reviewed changes
Copy link
Contributor

@tanberry tanberry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @gergosimonyi for making our RBAC truly RBAC-y and role-based, and updating the docs!

@gergosimonyi gergosimonyi requested a review from BeryJu December 4, 2025 11:01
@rissson rissson mentioned this pull request Dec 5, 2025
Merged
6 tasks
@BeryJu BeryJu mentioned this pull request Dec 6, 2025
Closed
@remram44 remram44 mentioned this pull request Dec 6, 2025
Closed
@BeryJu
Copy link
Member

BeryJu commented Dec 7, 2025

oh yeah before we merge is it possible to merge at least some of the migrations in authentik_core? @gergosimonyi

@gergosimonyi
Copy link
Collaborator Author

gergosimonyi commented Dec 8, 2025

@BeryJu (I don't like it styled this way but) I merged the last 3.

@gergosimonyi gergosimonyi merged commit f7e2329 into main Dec 8, 2025
136 of 139 checks passed
@gergosimonyi gergosimonyi deleted the core/add-digraph-group-hierarchy branch December 8, 2025 11:04
@github-project-automation github-project-automation bot moved this from In Progress to Done in authentik Core Dec 8, 2025
This was referenced Dec 8, 2025
Closed
Closed
kensternberg-authentik added a commit that referenced this pull request Dec 11, 2025
@kensternberg-authentik
Merge branch 'main' into dev
d15e360 
* main: (23 commits)
  *: Auto compress images (#18673)
  website/integrations: update kimai doc (#18629)
  root: skip current tab when refreshing others (#18674)
  core: add digraph group hierarchy (#17050)
  core: bump astral-sh/uv from 0.9.15 to 0.9.16 (#18668)
  core: bump goauthentik.io/api/v3 from 3.2025120.16 to 3.2025120.18 (#18661)
  web: bump type-fest from 5.3.0 to 5.3.1 in /web (#18663)
  ci: bump peter-evans/create-pull-request from 7.0.9 to 7.0.11 (#18666)
  web: bump vite from 7.2.6 to 7.2.7 in /web (#18662)
  core: bump goauthentik/fips-debian from `a80dbbd` to `10c8086` (#18665)
  ci: bump actions/create-github-app-token from 2.2.0 to 2.2.1 (#18664)
  ci: bump astral-sh/setup-uv from 7.1.4 to 7.1.5 in /.github/actions/setup (#18667)
  website/docs: background tasks: add more detail about "next run" (#18660)
  website/docs: install-config: fix dump_config command (#18659)
  website/integrations: wordpress: fix redirect uri (#18658)
  stages/mtls: always include cert in flow plan (#18657)
  endpoints: fix UI bugs, add user binding, etc (#18609)
  sources/ldap: make server info optional (#18648)
  web/admin: fix event volume chart not updating with query (#18649)
  web: Bump types, fix ESLint errors (#17546)
  ...
@GascPT GascPT mentioned this pull request Dec 17, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tanberry tanberry tanberry approved these changes

@rissson rissson rissson left review comments

@dewi-tik dewi-tik dewi-tik left review comments

@GirlBossRush GirlBossRush GirlBossRush approved these changes

@BeryJu BeryJu BeryJu approved these changes

Assignees

@gergosimonyi gergosimonyi

Labels

None yet

Projects

authentik Core
Status: Done

Milestone

Release 2025.12

Development

Successfully merging this pull request may close these issues.

[Feature Request] Allow Groups to be members of other Groups

8 participants

@gergosimonyi @cheggerdev @kiaraly @BeryJu @GirlBossRush @tanberry @rissson @dewi-tik