*/api: simplify lookups for per-user

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

authentik/events/api/notification.py

@@ -1,4 +1,5 @@
 """Notification API Views"""
+from guardian.utils import get_anonymous_user
 from rest_framework import mixins
 from rest_framework.fields import ReadOnlyField
 from rest_framework.serializers import ModelSerializer
@@ -48,6 +49,5 @@ class NotificationViewSet(
     ]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
-            return super().get_queryset()
+        return Notification.objects.filter(user=user)
-        return Notification.objects.filter(user=self.request.user)

authentik/providers/oauth2/api/tokens.py

@@ -1,4 +1,5 @@
 """OAuth2Provider API Views"""
+from guardian.utils import get_anonymous_user
 from rest_framework import mixins
 from rest_framework.fields import CharField, ListField
 from rest_framework.serializers import ModelSerializer
@@ -38,11 +39,10 @@ class AuthorizationCodeViewSet(
     ordering = ["provider", "expires"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
+        if user.is_superuser:
             return super().get_queryset()
-        if self.request.user.is_superuser:
+        return super().get_queryset().filter(user=user)
-            return super().get_queryset()
-        return super().get_queryset().filter(user=self.request.user)
 
 
 class RefreshTokenViewSet(
@@ -59,8 +59,7 @@ class RefreshTokenViewSet(
     ordering = ["provider", "expires"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
+        if user.is_superuser:
             return super().get_queryset()
-        if self.request.user.is_superuser:
+        return super().get_queryset().filter(user=user)
-            return super().get_queryset()
-        return super().get_queryset().filter(user=self.request.user)

authentik/sources/oauth/api/source_connection.py

@@ -1,4 +1,5 @@
 """OAuth Source Serializer"""
+from guardian.utils import get_anonymous_user
 from rest_framework.viewsets import ModelViewSet
 
 from authentik.core.api.sources import SourceSerializer
@@ -26,8 +27,7 @@ class UserOAuthSourceConnectionViewSet(ModelViewSet):
     filterset_fields = ["source__slug"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
+        if user.is_superuser:
             return super().get_queryset()
-        if self.request.user.is_superuser:
+        return super().get_queryset().filter(user=user)
-            return super().get_queryset()
-        return super().get_queryset().filter(user=self.request.user)

authentik/stages/authenticator_static/api.py

@@ -1,5 +1,6 @@
 """AuthenticatorStaticStage API Views"""
 from django_otp.plugins.otp_static.models import StaticDevice
+from guardian.utils import get_anonymous_user
 from rest_framework.permissions import IsAdminUser
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -44,9 +45,8 @@ class StaticDeviceViewSet(ModelViewSet):
     ordering = ["name"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
-            return super().get_queryset()
+        return StaticDevice.objects.filter(user=user)
-        return StaticDevice.objects.filter(user=self.request.user)
 
 
 class StaticAdminDeviceViewSet(ReadOnlyModelViewSet):

authentik/stages/authenticator_totp/api.py

@@ -1,5 +1,6 @@
 """AuthenticatorTOTPStage API Views"""
 from django_otp.plugins.otp_totp.models import TOTPDevice
+from guardian.utils import get_anonymous_user
 from rest_framework.permissions import IsAdminUser
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -47,9 +48,8 @@ class TOTPDeviceViewSet(ModelViewSet):
     ordering = ["name"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
-            return super().get_queryset()
+        return TOTPDevice.objects.filter(user=user)
-        return TOTPDevice.objects.filter(user=self.request.user)
 
 
 class TOTPAdminDeviceViewSet(ReadOnlyModelViewSet):

authentik/stages/authenticator_webauthn/api.py

@@ -1,4 +1,5 @@
 """AuthenticateWebAuthnStage API Views"""
+from guardian.utils import get_anonymous_user
 from rest_framework.permissions import IsAdminUser
 from rest_framework.serializers import ModelSerializer
 from rest_framework.viewsets import ModelViewSet, ReadOnlyModelViewSet
@@ -46,9 +47,8 @@ class WebAuthnDeviceViewSet(ModelViewSet):
     ordering = ["name"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
-            return super().get_queryset()
+        return WebAuthnDevice.objects.filter(user=user)
-        return WebAuthnDevice.objects.filter(user=self.request.user)
 
 
 class WebAuthnAdminDeviceViewSet(ReadOnlyModelViewSet):

authentik/stages/consent/api.py

@@ -1,4 +1,5 @@
 """ConsentStage API Views"""
+from guardian.utils import get_anonymous_user
 from rest_framework import mixins
 from rest_framework.viewsets import GenericViewSet, ModelViewSet
 
@@ -50,8 +51,7 @@ class UserConsentViewSet(
     ordering = ["application", "expires"]
 
     def get_queryset(self):
-        if not self.request:
+        user = self.request.user if self.request else get_anonymous_user()
+        if user.is_superuser:
             return super().get_queryset()
-        if self.request.user.is_superuser:
+        return super().get_queryset().filter(user=user)
-            return super().get_queryset()
-        return super().get_queryset().filter(user=self.request.user)