internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: goauthentik/authentik

Issue:
no webauthn device register possible
**Describe the bug**
If webauthn device is already registered authentication works without any issue.

But as long as no webauthn device is configured one can neither enforce it in the validation flow nor manually in the user profile.
**To Reproduce**
Steps to reproduce the behavior:
1. delete webauthn device
2. logout
3. login
4. try to add webauthn device in user profile settings

**Expected behavior**
webauthn device can be registered

**Logs**
<details>
    <summary>Stacktrace from authentik</summary>

```
Traceback (most recent call last):
  File "/authentik/flows/views/executor.py", line 291, in get
    stage_response = self.current_stage_view.dispatch(request)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/ak-root/venv/lib/python3.12/site-packages/django/views/generic/base.py", line 143, in dispatch
    return handler(request, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/flows/stage.py", line 95, in get
    challenge = self._get_challenge(*args, **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/flows/stage.py", line 172, in _get_challenge
    challenge = self.get_challenge(*args, **kwargs)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/authentik/stages/authenticator_webauthn/stage.py", line 114, in get_challenge
    "registration": loads(options_to_json(registration_options)),
                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/ak-root/venv/lib/python3.12/site-packages/webauthn/helpers/options_to_json.py", line 71, in options_to_json
    ] = _selection.authenticator_attachment.value
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
builtins.AttributeError: 'str' object has no attribute 'value'
```
</details>


**Version and Deployment (please complete the following information):**
- authentik version: 2024.2.1
- Deployment: helm




Discussion:

Resolving patch:
diff --git a/authentik/stages/authenticator_webauthn/stage.py b/authentik/stages/authenticator_webauthn/stage.py
--- a/authentik/stages/authenticator_webauthn/stage.py
+++ b/authentik/stages/authenticator_webauthn/stage.py
@@ -10,6 +10,7 @@
 from webauthn.helpers.bytes_to_base64url import bytes_to_base64url
 from webauthn.helpers.exceptions import InvalidRegistrationResponse
 from webauthn.helpers.structs import (
+    AuthenticatorAttachment,
     AuthenticatorSelectionCriteria,
     PublicKeyCredentialCreationOptions,
     ResidentKeyRequirement,
@@ -91,7 +92,7 @@ def get_challenge(self, *args, **kwargs) -> Challenge:
         # set, cast it to string to ensure it's not a django class
         authenticator_attachment = stage.authenticator_attachment
         if authenticator_attachment:
-            authenticator_attachment = str(authenticator_attachment)
+            authenticator_attachment = AuthenticatorAttachment(str(authenticator_attachment))
 
         registration_options: PublicKeyCredentialCreationOptions = generate_registration_options(
             rp_id=get_rp_id(self.request),


Test patch:
Repository: goauthentik/authentik

Issue:
Authentik sending email to nobody
**Describe the bug**
Authentik attempted to send email to zero email addresses (To field is blank)

**To Reproduce**
These aren't 100% confirmed but this is what my situation was:

1. Turn off worker
2. Capture oauth authorization URL and change the redirect URL to something invalid
3. Use new invalid URL
4. Turn worker back on

**Expected behavior**
Emails should have a valid target

**Screenshots**
<img width="1739" alt="Screenshot 2023-12-21 at 2 12 08 PM" src="https://github.com/goauthentik/authentik/assets/13932583/fa277323-d245-4de0-8400-b6c308c1071d">


**Logs**
Log files are too large.

**Version and Deployment (please complete the following information):**

-   authentik version: [e.g. 2021.8.5] 2023.10.5
-   Deployment: [e.g. docker-compose, helm] docker-compose

**Additional context**
What's really bizarre is that the user who "initiated" the authorization is a service user for Jellyfin's LDAP service, which shouldn't be possible either.



Discussion:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
My thinking is that since the Jellyfin user is also an Authentik admin, that it could be causing some weird configuration issue.
If the receivers of the "configuration errors" emails do not have email addresses configured, this is expected.
I feel like Authentik should still have a check saying "If user does not have an email, do not send email"

Resolving patch:
diff --git a/authentik/events/models.py b/authentik/events/models.py
--- a/authentik/events/models.py
+++ b/authentik/events/models.py
@@ -452,6 +452,13 @@ def send_webhook_slack(self, notification: "Notification") -> list[str]:
 
     def send_email(self, notification: "Notification") -> list[str]:
         """Send notification via global email configuration"""
+        if notification.user.email.strip() == "":
+            LOGGER.info(
+                "Discarding notification as user has no email address",
+                user=notification.user,
+                notification=notification,
+            )
+            return None
         subject_prefix = "authentik Notification: "
         context = {
             "key_value": {


Test patch:
Repository: goauthentik/authentik

Issue:
API fails to parse UserGroup objects that don't have parent_group set
**Describe the bug**
The authentik_client API published on PyPI fails to parse UserGroup objects that don't have `parent_group` set. Not all groups will have a parent group, and parsing `Group` objects works just fine. 

**To Reproduce**
Steps to reproduce the behavior:

1. Import and configure authentik_client in Python 3.12.2
2. Initialize the baseAPI object.
3. Initialize the coreAPI object from baseAPI.
4. Call `coreAPI.core_users_list()`

**Expected behavior**
I would expect it to parse the groups without issue, as calling `core_groups_list()`, which outputs `Group` objects that may or may not contain `parent_group`

**Screenshots**
If applicable, add screenshots to help explain your problem.
![image](https://github.com/goauthentik/authentik/assets/35052448/cec5c3a3-a8fc-4670-a150-cf3d361ebd53)


**Logs**
Output of docker-compose logs or kubectl logs respectively

**Version and Deployment (please complete the following information):**

-   authentik version: 2024.2.2
-   Deployment: docker-compose
-   Python version: 3.12.2
-   authentik_client version: 2024.2.2-1710845398

**Additional context**
A few of my groups do not have a parent group, as they shouldn't or don't need to.


Discussion:

Resolving patch:
diff --git a/authentik/core/api/users.py b/authentik/core/api/users.py
--- a/authentik/core/api/users.py
+++ b/authentik/core/api/users.py
@@ -85,7 +85,7 @@ class UserGroupSerializer(ModelSerializer):
     """Simplified Group Serializer for user's groups"""
 
     attributes = JSONDictField(required=False)
-    parent_name = CharField(source="parent.name", read_only=True)
+    parent_name = CharField(source="parent.name", read_only=True, allow_null=True)
 
     class Meta:
         model = Group
diff --git a/authentik/root/settings.py b/authentik/root/settings.py
--- a/authentik/root/settings.py
+++ b/authentik/root/settings.py
@@ -156,6 +156,7 @@
         "UserTypeEnum": "authentik.core.models.UserTypes",
     },
     "ENUM_ADD_EXPLICIT_BLANK_NULL_CHOICE": False,
+    "ENUM_GENERATE_CHOICE_DESCRIPTION": False,
     "POSTPROCESSING_HOOKS": [
         "authentik.api.schema.postprocess_schema_responses",
         "drf_spectacular.hooks.postprocess_schema_enums",


Test patch:
Repository: goauthentik/authentik

Issue:
OIDC Well-known URL won't configure endpoint URLs
**Describe the bug**
When entering the OIDC Well-known URL for an OpenID OAuth source, it won't automatically configure the endpoint URLs. Instead it prompts a "Bad Request" error and says "This field may not be blank." for every endpoint.

**To Reproduce**
Steps to reproduce the behavior:

1. Go to 'Directory > Federation and Social login'
2. Click on 'Create > OpenID OAuth Source > Next'
3. Enter your credentials (Name, Slug, Key, Secret and the Well-known URL)
4. Click on 'Finish'
5. See error

**Expected behavior**
Uppon clicking on 'Finish' authentik should configure the missing endpoints using the Well-known URL.

**Screenshots**

![grafik](https://github.com/goauthentik/authentik/assets/145431101/b7056922-b35f-44fb-a926-4e2ebf8b9041)

**Version and Deployment:**

-   authentik version: 2024.2.2 
-   Deployment: docker-compose

**Additional context**
I thought, it might have something to do with connectivity and proxy, since we are running authentik behind a corporate proxy. But I can curl the Well-known URL from inside the containers.



Discussion:

Resolving patch:
diff --git a/authentik/sources/oauth/api/source.py b/authentik/sources/oauth/api/source.py
--- a/authentik/sources/oauth/api/source.py
+++ b/authentik/sources/oauth/api/source.py
@@ -130,7 +130,13 @@ class Meta:
             "oidc_jwks_url",
             "oidc_jwks",
         ]
-        extra_kwargs = {"consumer_secret": {"write_only": True}}
+        extra_kwargs = {
+            "consumer_secret": {"write_only": True},
+            "request_token_url": {"allow_blank": True},
+            "authorization_url": {"allow_blank": True},
+            "access_token_url": {"allow_blank": True},
+            "profile_url": {"allow_blank": True},
+        }
 
 
 class OAuthSourceFilter(FilterSet):


Test patch:
Repository: goauthentik/authentik

Issue:
The SCIM JSON for User and Group schema attribute allows only one value
The SCIM JSON for User and Group schema attribute allows only one value. The schemas attribute check should only check for a minimum number of entries not for a maximum. 

For example I would like to be able so support the following

            "schemas": [
                "urn:ietf:params:scim:schemas:extension:servicenow:2.0:User",
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"
            ]

To Reproduce
Steps to reproduce the behavior:
Create Property mapping, add

return {
    "schemas" : [
                "urn:ietf:params:scim:schemas:core:2.0:User",
                "urn:ietf:params:scim:schemas:extention:enterprise:2.0:User"
            ],
    "userName": request.user.username,
    "name": {
        "formatted": request.user.name,
        "givenName": givenName,
        "familyName": familyName,
    },

Expected behavior
JSON containing schemas attribute 

Instead I get 
Stopping sync due to error: Error 1 validation error for User schemas Tuple should have at most 1 item after validation, not 2 [type=too_long, input_value=['urn:ietf:params:scim:sc...on:enterprise:2.0:User'], input_type=list] For further information visit https://errors.pydantic.dev/2.4/v/too_long

Version and Deployment (please complete the following information):

authentik version: [2023.10.2]
Deployment: [docker-compose]


Discussion:

Resolving patch:
diff --git a/authentik/providers/scim/clients/schema.py b/authentik/providers/scim/clients/schema.py
--- a/authentik/providers/scim/clients/schema.py
+++ b/authentik/providers/scim/clients/schema.py
@@ -13,14 +13,18 @@
 class User(BaseUser):
     """Modified User schema with added externalId field"""
 
-    schemas: tuple[str] = ("urn:ietf:params:scim:schemas:core:2.0:User",)
+    schemas: list[str] = [
+        "urn:ietf:params:scim:schemas:core:2.0:User",
+    ]
     externalId: str | None = None
 
 
 class Group(BaseGroup):
     """Modified Group schema with added externalId field"""
 
-    schemas: tuple[str] = ("urn:ietf:params:scim:schemas:core:2.0:Group",)
+    schemas: list[str] = [
+        "urn:ietf:params:scim:schemas:core:2.0:Group",
+    ]
     externalId: str | None = None
 
 


Test patch:
Repository: goauthentik/authentik

Issue:
http-basic-auth headers for external OAuth source
**Describe your question**
 Is there a way to have authentik send http-basic-auth headers (as per [RFC6749 2.3.1](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1)) for external IdPs? I can't find any settings regarding this and it doesn't seem to do that by default.

**Relevant info**
An external IdP we use as a login source updated their underlying software. They now require applications to send http-basic-auth headers for OIDC client authentication. Before the update, login worked just fine.
Now we receive an error message: "Authentication failed: Could not retrieve token." and the logs show an HTTP 401 Unauthorized error, when trying to reach the IdP's token endpoint.

**Logs**
server-1:
{
    "auth_via": "unauthenticated",
    "domain_url": "[authentik.idp]", 
    "event": "Unable to fetch access token", 
    "exc": "HTTPError('401 Client Error: Unauthorized for url: https://[external.idp]/oauth2/token')",
    "host": "[authentik.idp]",
    "level": "warning",
    "logger": "authentik.sources.oauth.clients.oauth2",
    "pid": 55,
    "request_id": "51bca021eac7412bb2e54233753761cf",
    "response": "401 Client Error: Unauthorized for url: https://[external.idp]/oauth2/token",
    "schema_name": "public",
    "timestamp": "2024-04-15T11:22:40.705924"
}

Note that [url.idp] is redacted.

**Version and Deployment:**

-   authentik version: 2024.2.2
-   Deployment: docker-compose


Discussion:

Resolving patch:
diff --git a/authentik/sources/oauth/clients/oauth2.py b/authentik/sources/oauth/clients/oauth2.py
--- a/authentik/sources/oauth/clients/oauth2.py
+++ b/authentik/sources/oauth/clients/oauth2.py
@@ -80,7 +80,7 @@ def get_access_token(self, **request_kwargs) -> dict[str, Any] | None:
             access_token_url = self.source.source_type.access_token_url or ""
             if self.source.source_type.urls_customizable and self.source.access_token_url:
                 access_token_url = self.source.access_token_url
-            response = self.session.request(
+            response = self.do_request(
                 "post", access_token_url, data=args, headers=self._default_headers, **request_kwargs
             )
             response.raise_for_status()


Test patch:
Repository: goauthentik/authentik

Issue:
2024.4.0 LongRunningTransaction
**Describe the bug**
Prometheus alert for a long running transaction.

I think the transaction is

```
SELECT pg_advisory_unlock($1)
```

**To Reproduce**
No activity, sitting idle

**Expected behavior**
Shouldn't have the alert

**Screenshots**

**Logs**

**Version and Deployment (please complete the following information):**
2024.4.0 kubernetes

**Additional context**
Add any other context about the problem here.



Discussion:
Can confirm, same thing happens on mine. 
This appears to happen once a day - happened again, same query
So it seems that this is a side-effect of https://github.com/goauthentik/authentik/pull/9081 and part of the connection not being fully released, even though we only (currently) use advisory locks to prevent multiple servers/workers from migrating at the same time

Resolving patch:
diff --git a/lifecycle/migrate.py b/lifecycle/migrate.py
--- a/lifecycle/migrate.py
+++ b/lifecycle/migrate.py
@@ -117,6 +117,8 @@ def run_migrations():
         )
     finally:
         release_lock(curr)
+        curr.close()
+        conn.close()
 
 
 if __name__ == "__main__":


Test patch:
Repository: facebookresearch/habitat-lab

Issue:
Mistake in Agent class' docs
Agent's class docs string states that user has to implement 2 methods: `reset` and `step`. However, If I understood correctly, there's no method named `step` and there is method `act` instead. This is quite tiny issue but still.
https://github.com/facebookresearch/habitat-api/blob/c7443c39c5186e517d8a4b7c87a1b42106e4e77a/habitat/core/agent.py#L10-L17


Discussion:

Resolving patch:
diff --git a/habitat/core/agent.py b/habitat/core/agent.py
--- a/habitat/core/agent.py
+++ b/habitat/core/agent.py
@@ -13,7 +13,7 @@ class standardizes agents to allow seamless benchmarking. To implement an
     agent the user has to implement two methods:
 
         reset
-        step
+        act
     """
 
     def reset(self) -> None:


Test patch:
Repository: facebookresearch/habitat-lab

Issue:
Incorrect render() method in VectorEnv class.
https://github.com/facebookresearch/habitat-api/blob/8c5329ce9f777395b45c2daac135377e629ec148/habitat/core/vector_env.py#L313-L331
In this function you send tuple 
```python
(args, {"mode": "rgb_array", **kwargs})
``` 
However, it does not contain command index that you want to be executed by worker. Furthermore, your environments do not have ```rgb_array``` mode of rendering, they use ```rgb``` instead. This makes ```render()``` incorrect.
I think you have to replace line with ```write_fn``` call with:
```python
write_fn( (RENDER_COMMAND, (args, {"mode": "rgb", **kwargs})) )
```


Discussion:
Thanks for catching this @titardrew, the `rgb_array` usage is legacy code and should have been updated, if possible can you send a PR for making this change?

Resolving patch:
diff --git a/habitat/core/vector_env.py b/habitat/core/vector_env.py
--- a/habitat/core/vector_env.py
+++ b/habitat/core/vector_env.py
@@ -316,7 +316,7 @@ def render(
         """Render observations from all environments in a tiled image.
         """
         for write_fn in self._connection_write_fns:
-            write_fn((args, {"mode": "rgb_array", **kwargs}))
+            write_fn((RENDER_COMMAND, (args, {"mode": "rgb", **kwargs})))
         images = [read_fn() for read_fn in self._connection_read_fns]
         tile = tile_images(images)
         if mode == "human":


Test patch:
diff --git a/test/test_habitat_env.py b/test/test_habitat_env.py
--- a/test/test_habitat_env.py
+++ b/test/test_habitat_env.py
@@ -211,6 +211,7 @@ def test_rl_vectorized_envs():
         assert len(rewards) == num_envs
         assert len(dones) == num_envs
         assert len(infos) == num_envs
+        assert envs.render(mode="rgb_array"), "vector env render is broken"
         if (i + 1) % configs[0].ENVIRONMENT.MAX_EPISODE_STEPS == 0:
             assert all(dones), "dones should be true after max_episode steps"
Repository: facebookresearch/habitat-lab

Issue:
resume_all is wrong wrt indexing of the paused environments 
[code](https://github.com/facebookresearch/habitat-api/blob/master/habitat/core/vector_env.py#L342)

### Steps to reproduce

1. `pause(0)`

2. ` pause(0)`

3. `resume_all()`


Discussion:

Resolving patch:
diff --git a/habitat/core/vector_env.py b/habitat/core/vector_env.py
--- a/habitat/core/vector_env.py
+++ b/habitat/core/vector_env.py
@@ -315,10 +315,19 @@ def close(self) -> None:
         if self._is_waiting:
             for read_fn in self._connection_read_fns:
                 read_fn()
+
         for write_fn in self._connection_write_fns:
             write_fn((CLOSE_COMMAND, None))
+
+        for _, _, write_fn, _ in self._paused:
+            write_fn((CLOSE_COMMAND, None))
+
         for process in self._workers:
             process.join()
+
+        for _, _, _, process in self._paused:
+            process.join()
+
         self._is_closed = True
 
     def pause_at(self, index: int) -> None:
@@ -342,7 +351,7 @@ def pause_at(self, index: int) -> None:
     def resume_all(self) -> None:
         """Resumes any paused envs.
         """
-        for index, read_fn, write_fn, worker in self._paused:
+        for index, read_fn, write_fn, worker in reversed(self._paused):
             self._connection_read_fns.insert(index, read_fn)
             self._connection_write_fns.insert(index, write_fn)
             self._workers.insert(index, worker)


Test patch:
diff --git a/test/test_habitat_env.py b/test/test_habitat_env.py
--- a/test/test_habitat_env.py
+++ b/test/test_habitat_env.py
@@ -309,8 +309,8 @@ def test_vec_env_call_func():
     env_ids = envs.call(["get_env_ind"] * num_envs)
     assert env_ids == true_env_ids
 
-    envs.pause_at(3)
-    true_env_ids.pop(3)
+    envs.pause_at(0)
+    true_env_ids.pop(0)
     env_ids = envs.call(["get_env_ind"] * num_envs)
     assert env_ids == true_env_ids
 
@@ -325,6 +325,21 @@ def test_vec_env_call_func():
     envs.close()
 
 
+def test_close_with_paused():
+    configs, datasets = _load_test_data()
+    num_envs = len(configs)
+    env_fn_args = tuple(zip(configs, datasets, range(num_envs)))
+    with habitat.VectorEnv(
+        env_fn_args=env_fn_args, multiprocessing_start_method="forkserver"
+    ) as envs:
+        envs.reset()
+
+        envs.pause_at(3)
+        envs.pause_at(0)
+
+    assert envs._is_closed
+
+
 # TODO Bring back this test for the greedy follower
 @pytest.mark.skip
 def test_action_space_shortest_path():
Repository: facebookresearch/habitat-lab

Issue:
Recursive directory lookup can take long
This [line](https://github.com/facebookresearch/habitat-api/blob/master/setup.py#L38) looks for requirements.txt under all directories, this can be especially costly if you have data directories. 

One way to get around this is to only look at specific set of directories and ignore data directories.


Discussion:
@abhiskk What about looking only inside habitat_baselines (plus the main one)? 

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -35,7 +35,9 @@
 DEFAULT_EXCLUSION = ["test", "examples"]
 FULL_REQUIREMENTS = set()
 # collect requirements.txt file in all subdirectories
-for file_name in glob.glob("**/requirements.txt", recursive=True):
+for file_name in ["requirements.txt"] + glob.glob(
+    "habitat_baselines/**/requirements.txt", recursive=True
+):
     with open(file_name) as f:
         reqs = f.read()
         FULL_REQUIREMENTS.update(reqs.strip().split("\n"))


Test patch:
Repository: facebookresearch/habitat-lab

Issue:
Runtime error when running the DD-PPO baseline with 'PROXIMITY_SENSOR'
## ❓ Questions and Help
Hello,
I'm trying to run the DD-PPO RL baseline with all different sensors, specifying them inside the `configs/tasks/pointnav.yaml` file:
<pre>
TASK:
  TYPE: Nav-v0
  SUCCESS_DISTANCE: 0.2

  SENSORS: ['POINTGOAL_WITH_GPS_COMPASS_SENSOR','GPS_SENSOR','HEADING_SENSOR']
</pre>
But when I run the baseline (`sh habitat_baselines/rl/ddppo/single_node.sh`) with the `PROXIMITY_SENSOR`
<pre>
SENSORS: ['POINTGOAL_WITH_GPS_COMPASS_SENSOR','PROXIMITY_SENSOR]
</pre>
I get this error:
<pre>habitat_baselines/rl/ddppo/algo/ddppo_trainer.py&quot;, line 222, in train
    rollouts.observations[sensor][0].copy_(batch[sensor])
RuntimeError: output with shape [2, 1] doesn&apos;t match the broadcast shape [2, 2]</pre>

Am I missing something about the proximity sensor or it is a error in the training script?
Thank you


Discussion:

Resolving patch:
diff --git a/habitat/tasks/nav/nav.py b/habitat/tasks/nav/nav.py
--- a/habitat/tasks/nav/nav.py
+++ b/habitat/tasks/nav/nav.py
@@ -388,7 +388,7 @@ def _get_observation_space(self, *args: Any, **kwargs: Any):
             low=0.0,
             high=self._max_detection_radius,
             shape=(1,),
-            dtype=np.float,
+            dtype=np.float32,
         )
 
     def get_observation(
@@ -396,8 +396,13 @@ def get_observation(
     ):
         current_position = self._sim.get_agent_state().position
 
-        return self._sim.distance_to_closest_obstacle(
-            current_position, self._max_detection_radius
+        return np.array(
+            [
+                self._sim.distance_to_closest_obstacle(
+                    current_position, self._max_detection_radius
+                )
+            ],
+            dtype=np.float32,
         )
 
 


Test patch: