From b36a3100e6904d063fd0ddca2b48422c0b2e8ac3 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Sat, 7 Aug 2021 22:26:36 +0200
Subject: [PATCH] outposts: allow empty provider list for embedded provider

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 authentik/outposts/api/outposts.py        | 9 ++++++++-
 web/src/pages/outposts/OutpostForm.ts     | 9 ++++++++-
 web/src/pages/outposts/OutpostListPage.ts | 7 ++++++-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/authentik/outposts/api/outposts.py b/authentik/outposts/api/outposts.py
index f011b9242..742e526db 100644
--- a/authentik/outposts/api/outposts.py
+++ b/authentik/outposts/api/outposts.py
@@ -15,6 +15,7 @@ from authentik.core.api.used_by import UsedByMixin
 from authentik.core.api.utils import PassiveSerializer, is_dict
 from authentik.core.models import Provider
 from authentik.outposts.api.service_connections import ServiceConnectionSerializer
+from authentik.outposts.managed import MANAGED_OUTPOST
 from authentik.outposts.models import Outpost, OutpostConfig, OutpostType, default_outpost_config
 from authentik.providers.ldap.models import LDAPProvider
 from authentik.providers.proxy.models import ProxyProvider
@@ -24,8 +25,10 @@ class OutpostSerializer(ModelSerializer):
     """Outpost Serializer"""
 
     config = JSONField(validators=[is_dict], source="_config")
+    # Need to set allow_empty=True for the embedded outpost with no providers
+    # is checked for other providers in the API Viewset
     providers = PrimaryKeyRelatedField(
-        allow_empty=False,
+        allow_empty=True,
         many=True,
         queryset=Provider.objects.select_subclasses().all(),
     )
@@ -49,6 +52,10 @@ class OutpostSerializer(ModelSerializer):
                         f"{provider.__class__.__name__} providers."
                     )
                 )
+        if self.instance and self.instance.managed == MANAGED_OUTPOST:
+            return providers
+        if len(providers) < 1:
+            raise ValidationError("This list may not be empty.")
         return providers
 
     def validate_config(self, config) -> dict:
diff --git a/web/src/pages/outposts/OutpostForm.ts b/web/src/pages/outposts/OutpostForm.ts
index 6cfbdc9e9..f4fcd69e6 100644
--- a/web/src/pages/outposts/OutpostForm.ts
+++ b/web/src/pages/outposts/OutpostForm.ts
@@ -15,6 +15,9 @@ export class OutpostForm extends ModelForm<Outpost, string> {
     @property()
     type: OutpostTypeEnum = OutpostTypeEnum.Proxy;
 
+    @property({type: Boolean})
+    embedded: boolean = false;
+
     loadInstance(pk: string): Promise<Outpost> {
         return new OutpostsApi(DEFAULT_CONFIG)
             .outpostsInstancesRetrieve({
@@ -161,7 +164,11 @@ export class OutpostForm extends ModelForm<Outpost, string> {
                     >.
                 </p>
             </ak-form-element-horizontal>
-            <ak-form-element-horizontal label=${t`Providers`} ?required=${true} name="providers">
+            <ak-form-element-horizontal
+                label=${t`Providers`}
+                ?required=${!this.embedded}
+                name="providers"
+            >
                 <select class="pf-c-form-control" multiple>
                     ${until(this.renderProviders(), html`<option>${t`Loading...`}</option>`)}
                 </select>
diff --git a/web/src/pages/outposts/OutpostListPage.ts b/web/src/pages/outposts/OutpostListPage.ts
index f6205c1b7..a03644c95 100644
--- a/web/src/pages/outposts/OutpostListPage.ts
+++ b/web/src/pages/outposts/OutpostListPage.ts
@@ -80,7 +80,12 @@ export class OutpostListPage extends TablePage<Outpost> {
             html`<ak-forms-modal>
                     <span slot="submit"> ${t`Update`} </span>
                     <span slot="header"> ${t`Update Outpost`} </span>
-                    <ak-outpost-form slot="form" .instancePk=${item.pk}> </ak-outpost-form>
+                    <ak-outpost-form
+                        slot="form"
+                        .instancePk=${item.pk}
+                        .embedded=${item.managed === "goauthentik.io/outposts/embedded"}
+                    >
+                    </ak-outpost-form>
                     <button slot="trigger" class="pf-c-button pf-m-plain">
                         <i class="fas fa-edit"></i>
                     </button>