goauthentik / goauthentik/authentik

Example recovery flow default-recovery-skip-if-restored seems broken

Open
#18,631 0 comments 1 reaction 1 assignee Claimed by @BeryJu View on GitHub
status/reviewing
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Do you see an area that can be clarified or expanded, a technical inaccuracy, or a broken link?

The example recovery flow ("Recovery with email verification") appears to have a broken expression policy, `default-recovery-skip-if-restored`:

This policy has
```
return bool(request.context.get('is_restored', True))
```

This seems to be wrong / not what was intended. Some debug statements from evaluating this policy

Case 1 (not restored):
```
server-1 | request.context.get('is_restored') None
server-1 | request.context.get('is_restored', True) True
server-1 | bool(request.context.get('is_restored', True)) True
```

Case 2 (restored):
```
server-1 | request.context.get('is_restored') Flow Token ...-password-reset (expires=2025-12-05 13:53:56.636334+00:00)
server-1 | request.context.get('is_restored', True) Flow Token ...-password-reset (expires=2025-12-05 13:53:56.636334+00:00)
server-1 | bool(request.context.get('is_restored', True)) True
```

In both cases, the result is true and the stage will be shown.

### Link

https://docs.goauthentik.io/add-secure-apps/flows-stages/flow/examples/flows/#recovery-with-email-verification

### Solution

Change from
```
return bool(request.context.get('is_restored', True))
```
to
```
return not bool(request.context.get('is_restored', False))
```

The latter should return `False` when a flow token is present `bool(Token..) -> True -> not -> False` and thus skip the stage, and return True when no flow token is present `bool(False) -> False -> not -> True` and thus show the stage

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.