[oss-candidate] rework r1: goauthentik/authentik#26402

[askalf]

Maintainer said

BeryJu, 2026-10-08 12:20 UTC, goauthentik#26402 (comment) (after approving the PR at goauthentik#26402 (review)):

@askalf Could you move this new hashing logic to its own file, blueprints/v1/hash.py? I tried to make this change but wasn't able to push to your fork

Change

One commit, 07efd0633, on fix/blueprint-file-tag-hash-r1, cut from the submitted head 3d788d473.

• authentik/blueprints/v1/hash.py (new, 60 lines): iter_file_tags, MISSING_FILE_MARKER and blueprint_hash, byte-for-byte the definitions that sat in tasks.py on the submitted head (diff of the two function bodies is empty apart from the trailing blank lines). Its imports are exactly what those three need: Generator, sha512, Path, Any, yaml.load, YAMLError, and BlueprintLoader, File, YAMLTag from common.
• authentik/blueprints/v1/tasks.py: the three definitions removed (-59), from authentik.blueprints.v1.hash import blueprint_hash added, and the sha512 / Generator / Any / File / YAMLTag imports that only the moved code used dropped. The common import line goes back to the single-line form it has on main. The two call sites (blueprints_find at tasks.py:140, apply_blueprint at tasks.py:201) are unchanged.
• No test change. authentik/blueprints/tests/test_v1_tasks.py drives blueprints_find and apply_blueprint through authentik.blueprints.v1.tasks and never imports the hashing functions, so the file is untouched. Nothing else in the tree references blueprint_hash, iter_file_tags or MISSING_FILE_MARKER (grep -rn over authentik/ and website/).

Against main (1495c1d2a) the PR diff is now: hash.py +60, tasks.py +3 -2, test_v1_tasks.py +214 (the tests already approved upstream).

Behaviour is identical. The hashing function from the submitted head's tasks.py and the one imported from the round's hash.py were run over nine blueprints covering every branch (plain, invalid YAML, readable !File, missing !File, !File nested in !Format, mapping-node !File, NUL in the path, missing-then-readable sequence, YAML alias) with /agent-output/oss/authentik/probe-move-equivalence.py:

$ python probe-move-equivalence.py /agent-workspace/oss/authentik-wt-submitted /agent-workspace/oss/authentik-wt-1791463174
# arm: fixed (/agent-workspace/oss/authentik-wt-submitted)
# arm: fixed (hash.py) (/agent-workspace/oss/authentik-wt-1791463174)
SAME: plain  56725a46a4fd08c8
SAME: invalid  c2d03c6efb16c3f8
SAME: readable  44115a1a177a59f8
SAME: missing  81ce8eea423469ab
SAME: nested  e89a6e6b13d484a5
SAME: mapping  f577d2d21072f02d
SAME: nul  82bdccca167db98f
SAME: two  8b3511ff84998b46
SAME: alias  23469414b869bdac
9 identical, 0 differ across 2 arms

The repro that mirrors the committed tests, against the round head (the same script that gave 3 failed / 5 passed on main when the candidate was opened):

$ python repro.py /agent-workspace/oss/authentik-wt-1791463174
# arm: fixed (hash.py) (/agent-workspace/oss/authentik-wt-1791463174)
PASS: test_file_tag_content_changed — 690e4ee192d5df46 vs 9a7ee0d25bfa43bd
PASS: test_file_tag_content_changed_nested — 4f0acbb926b61300 vs ba40d9c5158f43c2
PASS: test_file_tag_created — a0d2ff7b80c3669a vs fc073dbdf4a8c4dc
PASS: test_file_tag_content_unchanged (control)
PASS: test_file_tag_missing (control)
PASS: test_file_tag_path_from_tag (control)
PASS: plain blueprint hash unchanged (control)
PASS: invalid yaml hash unchanged (control)

8 passed, 0 failed

Lint at the pinned versions (pyproject.toml: black==26.5.1, ruff==0.16.10):

$ black --check authentik/blueprints/v1/hash.py authentik/blueprints/v1/tasks.py authentik/blueprints/tests/test_v1_tasks.py
All done! ✨ 🍰 ✨
3 files would be left unchanged.
black rc=0
$ ruff check authentik/blueprints/v1/hash.py authentik/blueprints/v1/tasks.py authentik/blueprints/tests/test_v1_tasks.py
All checks passed!
ruff rc=0

The Django test file (manage.py test authentik.blueprints.tests.test_v1_tasks) needs postgres, which this container does not have; the ticket records the hunter-rework CI workflow run 37636608849 green at the submitted head, and the fork's CI - Main will run on this branch. The harness-based runs above execute the real common.py tag classes and the real hash.py.

Reply

Moved to authentik/blueprints/v1/hash.py in 07efd06: iter_file_tags, MISSING_FILE_MARKER and blueprint_hash are there unchanged, and tasks.py imports blueprint_hash from it for the two call sites in blueprints_find and apply_blueprint. The tests in test_v1_tasks.py go through blueprints_find and apply_blueprint, so they did not need to change.

[askalf]

Verification at 07efd06

Verified the move against submitted base 3d788d473f13a626e86d144af41505a6b5646f2c. No tests were changed in this round. The new module contains the same definitions and imports the dependencies they use; tasks.py imports blueprint_hash and its existing blueprints_find and apply_blueprint calls remain intact. The ## Reply describes only these changes. The nine probe cases below are boundary checks, not committed tests. Hash prefixes for temporary file paths vary per run.

$ /agent-workspace/tmphome/akvenv/bin/python /agent-output/oss/authentik/probe-move-equivalence.py /agent-workspace/oss/authentik-wt-breaker-submitted /agent-workspace/oss/authentik-wt-breaker-r1
# arm: fixed (/agent-workspace/oss/authentik-wt-breaker-submitted)
# arm: fixed (hash.py) (/agent-workspace/oss/authentik-wt-breaker-r1)
SAME: plain  56725a46a4fd08c8
SAME: invalid  c2d03c6efb16c3f8
SAME: readable  c537c8202499f0d9
SAME: missing  9331d0102349acd1
SAME: nested  2b719393e40aef25
SAME: mapping  f577d2d21072f02d
SAME: nul  82bdccca167db98f
SAME: two  70b0860a44f85540
SAME: alias  220cd73658040de8
9 identical, 0 differ across 2 arms

The existing issue reproduction also passes on both arms (the three regression cases distinguish the original unmodified main, not the submitted base for this move):

$ /agent-workspace/tmphome/akvenv/bin/python /agent-output/oss/authentik/repro.py /agent-workspace/oss/authentik-wt-breaker-submitted
# arm: fixed (/agent-workspace/oss/authentik-wt-breaker-submitted)
PASS: test_file_tag_content_changed — 8371900b34c448c4 vs 84e4a8d327ffb676
PASS: test_file_tag_content_changed_nested — 5e5dc22e3f76fa5a vs 5792dac137ee5e39
PASS: test_file_tag_created — 4895fbca5843dd88 vs 2180afa51267f430
PASS: test_file_tag_content_unchanged (control)
PASS: test_file_tag_missing (control)
PASS: test_file_tag_path_from_tag (control)
PASS: plain blueprint hash unchanged (control)
PASS: invalid yaml hash unchanged (control)

8 passed, 0 failed
$ /agent-workspace/tmphome/akvenv/bin/python /agent-output/oss/authentik/repro.py /agent-workspace/oss/authentik-wt-breaker-r1
# arm: fixed (hash.py) (/agent-workspace/oss/authentik-wt-breaker-r1)
PASS: test_file_tag_content_changed — 87a273a96ac5af46 vs 5d3c1f23a6399d2e
PASS: test_file_tag_content_changed_nested — 16228ea49c7895cb vs 738ce37e05869dc0
PASS: test_file_tag_created — efe9a9cb5fb89758 vs 7d84d19b29933d6d
PASS: test_file_tag_content_unchanged (control)
PASS: test_file_tag_missing (control)
PASS: test_file_tag_path_from_tag (control)
PASS: plain blueprint hash unchanged (control)
PASS: invalid yaml hash unchanged (control)

8 passed, 0 failed

black --check on the three blueprint files: 3 files would be left unchanged. ruff check: All checks passed! git diff --check 3d788d473..07efd0633: clean. gh pr checks 2 --repo sprayberry-code/authentik: no checks reported on the 'fix/blueprint-file-tag-hash-r1' branch; gh run list returned [] at verification. The database-backed Django test file cannot run here without PostgreSQL. Upstream issue #26289 is open; main's later change to tasks.py removes tenant dispatch in its watcher and does not implement !File hashing.

Rules: prior-art-recheck-at-gate=covered(main commit 35aa0b1 and issue state) | formatter-at-the-pinned-version=covered(black 26.5.1, ruff 0.16.10) | reads-as-generated=covered(whole round diff grep) | tests-sized-to-the-bug=covered(no test added for equivalent move)

[sprayberry-redline]

Approve. The extraction preserves the hashing definitions and their dependencies, with both task call sites using the imported function. The reply accurately describes the move and why the existing task-level tests remain unchanged.

No CI checks are reported for this branch; verification records equivalent results across nine boundary probes, while the database-backed Django tests remain unrun at this head.