goauthentik / goauthentik/authentik

Blueprint delete of stage bindings is unsafe when KeyOf is still referenced

Open
#25,329 0 comments 0 reactions 0 assignees View on GitHub
bug enhancement/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

## What

blueprint delete of stage bindings is unsafe (!KeyOf still referenced; deleting a missing binding fails the whole apply).

## Want

- Blueprint delete of stage bindings is unsafe (!KeyOf still referenced
- Deleting a missing binding fails the whole apply)

## Ideas this came from

- [#20309 Blueprints fail to delete stage when it references another stage using !KeyOf](https://github.com/goauthentik/authentik/issues/20309) — I am trying to add a delete option for a blueprint, so it can be cleanly uninstalled with "one click". However, even though the blueprint execution is "successf
- [#20456 Deleting non-existent flow stage bindings via blueprints fails](https://github.com/goauthentik/authentik/issues/20456) — Trying to delete a flow stage binding from a flow fails if the binding is already deleted. Consider the following blueprint Applying this blueprting when the fl

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the two blueprint deletion cases described in this issue and compare them with linked issues #20309 and #20456. Done means deleting stage bindings remains safe when !KeyOf references another stage, and an already-missing binding does not fail the whole blueprint apply.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.