policies: fix current user not being set in server-side policy deny

closes #2039

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

authentik/core/templates/login/base_full.html

@@ -12,6 +12,25 @@
 .pf-c-background-image::before {
     --ak-flow-background: url("/static/dist/assets/images/flow_background.jpg");
 }
+/* Form with user */
+.form-control-static {
+    margin-top: var(--pf-global--spacer--sm);
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+}
+.form-control-static .avatar {
+    display: flex;
+    align-items: center;
+}
+.form-control-static img {
+    margin-right: var(--pf-global--spacer--xs);
+}
+.form-control-static a {
+    padding-top: var(--pf-global--spacer--xs);
+    padding-bottom: var(--pf-global--spacer--xs);
+    line-height: var(--pf-global--spacer--xl);
+}
 </style>
 {% endblock %}
 
@@ -59,13 +78,11 @@
                     <a href="{{ link.href }}">{{ link.name }}</a>
                 </li>
                 {% endfor %}
-                {% if tenant.branding_title != "authentik" %}
                 <li>
                     <a href="https://goauthentik.io?utm_source=authentik">
                         {% trans 'Powered by authentik' %}
                     </a>
                 </li>
-                {% endif %}
             </ul>
         </footer>
     </div>

authentik/policies/denied.py

@@ -3,6 +3,7 @@ from typing import Any, Optional
 
 from django.http.request import HttpRequest
 from django.template.response import TemplateResponse
+from django.urls import reverse
 from django.utils.translation import gettext as _
 
 from authentik.core.models import USER_ATTRIBUTE_DEBUG
@@ -37,4 +38,5 @@ class AccessDeniedResponse(TemplateResponse):
                     self._request
                 ).get(USER_ATTRIBUTE_DEBUG, False):
                     context["policy_result"] = self.policy_result
+        context["cancel"] = reverse("authentik_flows:cancel")
         return context

authentik/policies/templates/policies/denied.html

@@ -12,8 +12,21 @@
 {% endblock %}
 
 {% block card %}
-<form method="POST" class="pf-c-form">
+<form class="pf-c-form">
     {% csrf_token %}
+    {% if user.is_authenticated %}
+        <div class="pf-c-form__group">
+            <div class="form-control-static">
+                <div class="avatar">
+                    <img class="pf-c-avatar" src="{{ user.avatar }}" alt="{% trans "User's avatar" %}" />
+                    {{ user.username }}
+                </div>
+                <div slot="link">
+                    <a href="{{ cancel }}">{% trans "Not you?" %}</a>
+                </div>
+            </div>
+        </div>
+    {% endif %}
     <div class="pf-c-form__group">
         <p>
             <i class="pf-icon pf-icon-error-circle-o"></i>

web/src/authentik.css

@@ -37,6 +37,7 @@ html > form > input {
 .pf-c-login__main {
     display: block;
     position: relative;
+    width: 100%;
 }
 .ak-login-container {
     height: calc(100vh - var(--pf-global--spacer--lg) - var(--pf-global--spacer--lg));

web/src/flows/FlowExecutor.ts

@@ -113,9 +113,6 @@ export class FlowExecutor extends LitElement implements StageHost {
             .pf-c-drawer__content {
                 background-color: transparent;
             }
-            .pf-c-login__main {
-                width: 100%;
-            }
         `);
     }