authelia: 4.37.5 -> 4.38.9

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -10,6 +10,9 @@
   This also allows configuring runtime settings of AMDVLK and enabling experimental features.
 - The `moonlight-qt` package ([Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
 
+- `authelia` has been upgraded to version 4.38. This version brings several features and improvements which are detailed in the [release blog post](https://www.authelia.com/blog/4.38-release-notes/).
+  This release also deprecates some configuration keys, which are likely to be removed in future version 5.0, but they are still supported and expected to be working in the current version.
+
 ## New Services {#sec-release-24.11-new-services}
 
 - [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI

pkgs/servers/authelia/default.nix

@@ -1,8 +1,8 @@
-{ lib, fetchFromGitHub, buildGoModule, installShellFiles, callPackage, nixosTests }:
+{ lib, nodejs, pnpm, fetchFromGitHub, buildGoModule, installShellFiles, callPackage, nixosTests }:
 
 let
   inherit (import ./sources.nix { inherit fetchFromGitHub; }) pname version src vendorHash;
-  web = callPackage ./web.nix { };
+  web = callPackage ./web.nix { inherit nodejs pnpm fetchFromGitHub; };
 in
 buildGoModule rec {
   inherit pname version src vendorHash;

pkgs/servers/authelia/sources.nix

@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.37.5";
+  version = "4.38.9";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-xsdBnyPHFIimhp2rcudWqvVR36WN4vBXbxRmvgqMcDw=";
+    hash = "sha256-xhn8+eBf0pF1ujglIoBmj0E1+B3YngEESb/SZlR4Ugk=";
   };
-  vendorHash = "sha256-mzGE/T/2TT4+7uc2axTqG3aeLMnt1r9Ya7Zj2jIkw/w=";
-  npmDepsHash = "sha256-MGs6UAxT5QZd8S3AO75mxuCb6U0UdRkGEjenOVj+Oqs=";
+  vendorHash = "sha256-ZdrtP8E65Xyx2Czdh1EvfofVWvBIwLmQ8/Tx3rSsIzs=";
+  pnpmDepsHash = "sha256-2kABLWeelTml1tcxcgWLHWv/SNqwGxJB+VExusnd+KI=";
 }

pkgs/servers/authelia/update.sh

@@ -25,10 +25,6 @@ replace() {
     sed -i "s@$1@$2@g" "$3"
 }
 
-grab_version() {
-    instantiateClean "authelia.version"
-}
-
 # provide a github token so you don't get rate limited
 # if you use gh cli you can use:
 #     `export GITHUB_TOKEN="$(cat ~/.config/gh/config.yml | yq '.hosts."github.com".oauth_token' -r)"`
@@ -59,29 +55,12 @@ NEW_SRC_HASH="$(fetchNewHash authelia.src)"
 echo "New src hash $NEW_SRC_HASH"
 replace "$TMP_HASH" "$NEW_SRC_HASH" "$DRV_DIR/sources.nix"
 
-# after updating src the next focus is the web dependencies
-# build package-lock.json since authelia uses pnpm
-WEB_DIR=$(mktemp -d)
-clean_up() {
-  rm -rf "$WEB_DIR"
-}
-trap clean_up EXIT
-
-OLD_PWD=$PWD
-cd $WEB_DIR
-OUT=$(nix-build -E "with import $NIXPKGS_ROOT {}; authelia.src" --no-out-link)
-cp -r $OUT/web/package.json .
-npm install --package-lock-only --legacy-peer-deps --ignore-scripts
-mv package-lock.json "$DRV_DIR/"
-cd $OLD_PWD
-
-OLD_NPM_DEPS_HASH="$(instantiateClean authelia.web.npmDepsHash)"
-echo "Old npm deps hash $OLD_NPM_DEPS_HASH"
-replace "$OLD_NPM_DEPS_HASH" "$TMP_HASH" "$DRV_DIR/sources.nix"
-NEW_NPM_DEPS_HASH="$(fetchNewHash authelia.web)"
-echo "New npm deps hash $NEW_NPM_DEPS_HASH"
-replace "$TMP_HASH" "$NEW_NPM_DEPS_HASH" "$DRV_DIR/sources.nix"
-clean_up
+OLD_PNPM_DEPS_HASH="$(instantiateClean authelia.web.pnpmDeps.outputHash)"
+echo "Old pnpm deps hash $OLD_PNPM_DEPS_HASH"
+replace "$OLD_PNPM_DEPS_HASH" "$TMP_HASH" "$DRV_DIR/sources.nix"
+NEW_PNPM_DEPS_HASH="$(fetchNewHash authelia.web)"
+echo "New pnpm deps hash $NEW_PNPM_DEPS_HASH"
+replace "$TMP_HASH" "$NEW_PNPM_DEPS_HASH" "$DRV_DIR/sources.nix"
 
 OLD_GO_VENDOR_HASH="$(instantiateClean authelia.vendorHash)"
 echo "Old go vendor hash $OLD_GO_VENDOR_HASH"

pkgs/servers/authelia/web.nix

@@ -1,21 +1,32 @@
-{ buildNpmPackage, fetchFromGitHub }:
+{ stdenv, nodejs, pnpm, fetchFromGitHub }:
 
 let
-  inherit (import ./sources.nix { inherit fetchFromGitHub; }) pname version src npmDepsHash;
+  inherit (import ./sources.nix { inherit fetchFromGitHub; }) pname version src pnpmDepsHash;
 in
-buildNpmPackage {
+stdenv.mkDerivation (finalAttrs: {
   pname = "${pname}-web";
-  inherit src version npmDepsHash;
+  inherit src version;
 
-  sourceRoot = "${src.name}/web";
+  sourceRoot = "${finalAttrs.src.name}/web";
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+  ];
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src sourceRoot;
+    hash = pnpmDepsHash;
+  };
 
   postPatch = ''
     substituteInPlace ./vite.config.ts \
       --replace 'outDir: "../internal/server/public_html"' 'outDir: "dist"'
-    cp ${./package-lock.json} ./package-lock.json
   '';
 
-  npmFlags = [ "--legacy-peer-deps" ];
+  postBuild = ''
+    pnpm run build
+  '';
 
   installPhase = ''
     runHook preInstall
@@ -25,4 +36,4 @@ buildNpmPackage {
 
     runHook postInstall
   '';
-}
+})

pkgs/top-level/all-packages.nix

@@ -3257,7 +3257,7 @@ with pkgs;
 
   authenticator = callPackage ../applications/misc/authenticator { };
 
-  authelia = callPackage ../servers/authelia { };
+  authelia = callPackage ../servers/authelia { pnpm = pnpm_9; };
 
   authentik-outposts = recurseIntoAttrs (callPackages ../by-name/au/authentik/outposts.nix { });