goauthentik / goauthentik/authentik
Example recovery flow default-recovery-skip-if-restored seems broken
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?
The example recovery flow ("Recovery with email verification") appears to have a broken expression policy, `default-recovery-skip-if-restored`:
This policy has
```
return bool(request.context.get('is_restored', True))
```
This seems to be wrong / not what was intended. Some debug statements from evaluating this policy
Case 1 (not restored):
```
server-1 | request.context.get('is_restored') None
server-1 | request.context.get('is_restored', True) True
server-1 | bool(request.context.get('is_restored', True)) True
```
Case 2 (restored):
```
server-1 | request.context.get('is_restored') Flow Token ...-password-reset (expires=2025-12-05 13:53:56.636334+00:00)
server-1 | request.context.get('is_restored', True) Flow Token ...-password-reset (expires=2025-12-05 13:53:56.636334+00:00)
server-1 | bool(request.context.get('is_restored', True)) True
```
In both cases, the result is true and the stage will be shown.
### Link
https://docs.goauthentik.io/add-secure-apps/flows-stages/flow/examples/flows/#recovery-with-email-verification
### Solution
Change from
```
return bool(request.context.get('is_restored', True))
```
to
```
return not bool(request.context.get('is_restored', False))
```
The latter should return `False` when a flow token is present `bool(Token..) -> True -> not -> False` and thus skip the stage, and return True when no flow token is present `bool(False) -> False -> not -> True` and thus show the stage
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.