rbac: Add show all to roles tab, add role tab to groups #19097

PeshekDotDev · 2025-12-29T13:11:02Z

Details

This PR adds the "roles" tab to groups.

The Roles tab now also has an "Assigned Roles" tab (showing only directly assigned roles), and an "All Roles" tab (that shows inherited and assigned roles)

Checklist

Local tests pass (ak test authentik/)
The code has been formatted (make lint-fix)

If an API change has been made

The API schema has been updated (make gen-build)

If changes to the frontend have been made

The code has been formatted (make web)

If applicable

The documentation has been updated
The documentation has been formatted (make docs)

netlify · 2025-12-29T13:12:20Z

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	`68d1125`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/695b9fec5bc6ff000801c3e7
😎 Deploy Preview	https://deploy-preview-19097--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2025-12-29T13:12:50Z

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	`68d1125`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/695b9fecde96a70008f9af47
😎 Deploy Preview	https://deploy-preview-19097--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2025-12-29T13:18:46Z

Codecov Report

❌ Patch coverage is 50.00000% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.30%. Comparing base (bc24815) to head (c9bd016).
⚠️ Report is 13 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/rbac/api/roles.py	37.50%	15 Missing ⚠️
authentik/core/api/groups.py	71.42%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #19097      +/-   ##
==========================================
- Coverage   93.37%   93.30%   -0.08%     
==========================================
  Files         949      949              
  Lines       52254    52304      +50     
==========================================
+ Hits        48794    48801       +7     
- Misses       3460     3503      +43

Flag	Coverage Δ
conformance	`38.79% <36.84%> (+<0.01%)`	⬆️
e2e	`44.69% <50.00%> (+0.01%)`	⬆️
integration	`23.40% <36.84%> (-0.03%)`	⬇️
unit	`91.56% <50.00%> (-0.03%)`	⬇️
unit-migrate	`91.61% <50.00%> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

netlify · 2025-12-29T22:06:44Z

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	`bcb55a7`
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/695bdd2067a2fa0008c5ed08
😎 Deploy Preview	https://deploy-preview-19097--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2025-12-29T22:10:32Z

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-c9bd016b2ccc77ab4e09f9fe12d4c12deef84708
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-c9bd016b2ccc77ab4e09f9fe12d4c12deef84708

Afterwards, run the upgrade commands from the latest release notes.

BeryJu · 2025-12-30T17:14:28Z

authentik/core/api/groups.py

+        direct_role_pks = set(instance.roles.values_list("pk", flat=True))
+        inherited_roles = instance.all_roles().exclude(pk__in=direct_role_pks)


logic wise looks fine but I think this is gonna cost us a lot of query time when listing groups, I think we either have to pre-fetch things or only include this field in the detail view

I went with with an include, let me know if it looks good

GirlBossRush

Looks good code wise. Minor nits 👏🏻

web/src/admin/groups/GroupViewPage.ts

GirlBossRush · 2025-12-30T17:30:20Z

web/src/admin/roles/RelatedRoleList.ts

+        // Handle user filtering - always fetch both direct and inherited roles
+        const [directResponse, inheritedResponse] = await Promise.all([
+            new RbacApi(DEFAULT_CONFIG).rbacRolesList({
+                ...config,
+                users: this.targetUser?.pk ? [this.targetUser.pk] : undefined,
+            }),
+            new RbacApi(DEFAULT_CONFIG).rbacRolesList({
+                ...config,
+                inheritedUserRoles: this.targetUser?.pk,
+            }),
+        ]);


Consider something like this at the top of the class:

class RelatedRoleList { #api = new CoreApi(DEFAULT_CONFIG); ... async apiEndpoint() { this.#api.rbacRolesList({ ...config, inheritedUserRoles: this.targetUser?.pk, })}

I updated this, let me know what you think

web/src/admin/roles/RelatedRoleList.ts

web/src/admin/users/UserViewPage.ts

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

gergosimonyi · 2026-01-05T14:10:28Z

authentik/core/api/groups.py

            OpenApiParameter("include_users", bool, default=True),
            OpenApiParameter("include_children", bool, default=False),
            OpenApiParameter("include_parents", bool, default=False),
+            OpenApiParameter("include_inherited_roles", bool, default=False),


Almost nobody should ever use this in list, but I don't see any harm including it.

web/src/admin/groups/GroupViewPage.ts

gergosimonyi

Conditional on #19194

* improve sort order and inherit visual * Update web/src/admin/groups/GroupViewPage.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * Update web/src/admin/users/UserViewPage.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * Update web/src/admin/roles/RelatedRoleList.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * Update web/src/admin/roles/RelatedRoleList.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * Update web/src/admin/roles/RelatedRoleList.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * Update web/src/admin/roles/RelatedRoleList.ts Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]> * setup include inherited roles and fix returning nothing * update api calls * fix rendering error * do not use set * change from exception handling * go off query param * fix wording * fix linting error for new group api structure --------- Signed-off-by: Connor Peshek <[email protected]> Co-authored-by: Teffen Ellis <[email protected]>

authentik-automation · 2026-01-05T23:15:25Z

🍒 Cherry-pick to version-2025.12 created: #19199

…19097 to version-2025.12) (#19199) rbac: Add show all to roles tab, add role tab to groups (#19097) * improve sort order and inherit visual * Update web/src/admin/groups/GroupViewPage.ts * Update web/src/admin/users/UserViewPage.ts * Update web/src/admin/roles/RelatedRoleList.ts * Update web/src/admin/roles/RelatedRoleList.ts * Update web/src/admin/roles/RelatedRoleList.ts * Update web/src/admin/roles/RelatedRoleList.ts * setup include inherited roles and fix returning nothing * update api calls * fix rendering error * do not use set * change from exception handling * go off query param * fix wording * fix linting error for new group api structure --------- Signed-off-by: Connor Peshek <[email protected]> Co-authored-by: Connor Peshek <[email protected]> Co-authored-by: Teffen Ellis <[email protected]> Co-authored-by: Marcelo Elizeche Landó <[email protected]>

* main: outpost/proxyv2: reduce max number of postgres connections (#19211) web/maintenance: lint pass to add missing HTMLElementEventMap entries (#18953) translate: Updates for project authentik and language pt_BR (#19082) core: bump goauthentik.io/api/v3 from 3.2026020.6 to 3.2026020.7 (#19202) lifecycle/aws: bump aws-cdk from 2.1100.1 to 2.1100.2 in /lifecycle/aws (#19203) core: bump axllent/mailpit from v1.28.0 to v1.28.1 in /tests/e2e (#19204) web: bump knip from 5.79.0 to 5.80.0 in /web (#19207) website/integrations: glpi: add step (#19208) admin/files: support %(theme)s variable in media file paths (#19108) web: bump the eslint group across 1 directory with 3 updates (#19205) core: add last_login filter to users API (#18993) website/docs: rewrite section about users and perms (#19195) rbac: Add show all to roles tab, add role tab to groups (#19097) web: Defer table refresh, visibility checks. (#19194) Add docs for roles (#19196) web: Merge branch -- Stale notifications, synchronized context objects, rendering fixes (#19141) root: codespell: ignore Python virtual env, group patterns. (#19180)

PeshekDotDev marked this pull request as ready for review December 29, 2025 18:31

PeshekDotDev requested review from a team as code owners December 29, 2025 18:31

BeryJu changed the title ~~RBAC: Add show all to roles tab, add role tab to groups~~ rbac: Add show all to roles tab, add role tab to groups Dec 29, 2025

PeshekDotDev self-assigned this Dec 29, 2025

PeshekDotDev changed the base branch from version-2025.12 to main December 29, 2025 22:00

PeshekDotDev requested review from a team as code owners December 29, 2025 22:00

improve sort order and inherit visual

c526a61

PeshekDotDev force-pushed the backport-group-inheritance branch from 3e65903 to c526a61 Compare December 29, 2025 22:05

PeshekDotDev added the backport/version-2025.12 Add this label to PRs to backport changes to version-2025.12 label Dec 29, 2025

BeryJu reviewed Dec 30, 2025

View reviewed changes

GirlBossRush approved these changes Dec 30, 2025

View reviewed changes

PeshekDotDev and others added 12 commits January 4, 2026 07:53

Update web/src/admin/groups/GroupViewPage.ts

ac5dfe8

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

Update web/src/admin/users/UserViewPage.ts

618f6db

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

Update web/src/admin/roles/RelatedRoleList.ts

bfb2609

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

Update web/src/admin/roles/RelatedRoleList.ts

a97e2da

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

Update web/src/admin/roles/RelatedRoleList.ts

824b232

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

Update web/src/admin/roles/RelatedRoleList.ts

80ab63e

Co-authored-by: Teffen Ellis <[email protected]> Signed-off-by: Connor Peshek <[email protected]>

setup include inherited roles and fix returning nothing

5aa8348

update api calls

28bf4d4

Merge branch 'main' into backport-group-inheritance

f88fa75

fix rendering error

68d1125

do not use set

467acfc

change from exception handling

66ada5e

go off query param

76f190a

gergosimonyi reviewed Jan 5, 2026

View reviewed changes

dominic-r reviewed Jan 5, 2026

View reviewed changes

web/src/admin/groups/GroupViewPage.ts Show resolved Hide resolved

fix wording

bcb55a7

gergosimonyi approved these changes Jan 5, 2026

View reviewed changes

fix linting error for new group api structure

c9bd016

PeshekDotDev enabled auto-merge (squash) January 5, 2026 23:11

PeshekDotDev merged commit 4ac0172 into main Jan 5, 2026
140 of 143 checks passed

PeshekDotDev deleted the backport-group-inheritance branch January 5, 2026 23:14

authentik-automation bot mentioned this pull request Jan 5, 2026

rbac: Add show all to roles tab, add role tab to groups (cherry-pick #19097 to version-2025.12) #19199

Merged

		direct_role_pks = set(instance.roles.values_list("pk", flat=True))
		inherited_roles = instance.all_roles().exclude(pk__in=direct_role_pks)

Uh oh!

rbac: Add show all to roles tab, add role tab to groups #19097

rbac: Add show all to roles tab, add role tab to groups #19097

Uh oh!

Conversation

PeshekDotDev commented Dec 29, 2025

Details

Checklist

Uh oh!

netlify bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-integrations ready!

Uh oh!

netlify bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-docs ready!

Uh oh!

codecov bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

netlify bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for authentik-storybook ready!

Uh oh!

github-actions bot commented Dec 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BeryJu Dec 30, 2025

Choose a reason for hiding this comment

Uh oh!

PeshekDotDev Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

GirlBossRush left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

GirlBossRush Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

PeshekDotDev Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gergosimonyi Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gergosimonyi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

authentik-automation bot commented Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

netlify bot commented Dec 29, 2025 •

edited

Loading

netlify bot commented Dec 29, 2025 •

edited

Loading

codecov bot commented Dec 29, 2025 •

edited

Loading

netlify bot commented Dec 29, 2025 •

edited

Loading

github-actions bot commented Dec 29, 2025 •

edited

Loading

GirlBossRush Dec 30, 2025 •

edited

Loading