feat(auth): add Authentik authentication

[SwerkF]

What

Adds Authentik as a dedicated authentication provider alongside Google and generic OpenID Connect. Administrators can configure and enable it from god mode, while users can sign in or register through a separate Authentik action.

Authentik credentials are encrypted at rest. The integration includes validation, localized interface strings, automated tests, and self-hosting documentation.

Why

Self-hosted instances can connect directly to Authentik without using or replacing the generic OpenID Connect provider. Both providers retain separate credentials, redirect URIs, settings, and sign-in buttons.

How to test

1. In Authentik, create an OAuth2/OpenID provider using a confidential client.
2. Set its redirect URI to:
   http://localhost:3000/api/auth/oauth2/callback/authentik
3. Open God mode -> Integrations -> Auth provider -> Authentik.
4. Enter the discovery URL, client ID, client secret, and scopes.
5. Keep the openid profile email scopes and enable Authentik.
6. Open the login page in a private browser window.
7. Confirm that the Authentik button starts authentication and returns to the application.
8. Confirm that Google and generic OpenID Connect remain independently configurable.
9. Disable Authentik and confirm that its login and registration actions disappear.
10. Verify open, invite-only, and closed registration modes when authenticating a new account.

Checklist

• bun run typecheck passes
• bun run lint and bun run format:check pass
• Tests added or updated for the changed behaviour
• Database schema changed: migration generated with bun run db:generate and committed
• New environment variables documented in .env.example
• Docs updated (README.md or the relevant AGENTS.md)

Screenshots

Authentik configuration section in god mode:

Login page with the Authentik action:

Registration page with the Authentik action:

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[SwerkF]

I have read the CLA Document and I hereby sign the CLA

[Copilot]

🟡 Changes recommended

Address whitespace-only Authentik configuration handling, align Coolify MinIO image sources, and keep the integration test at the HTTP-contract layer.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds Authentik as a dedicated encrypted OIDC provider with god-mode configuration, web login/registration, group synchronization, documentation, translations, and tests.

Changes:

• Added provider configuration, validation, API routes, and OAuth integration.
• Added administration UI, authentication actions, and localized strings.
• Updated documentation, tests, and Coolify MinIO configuration.

File summaries

File	Summary
packages/auth/src/instance.ts	Authentik encrypted settings and usability checks
packages/auth/src/index.ts	Authentik provider wiring
packages/auth/AGENTS.md	Package documentation
docs/self-hosting.md	Authentik setup instructions
docker-compose.coolify.yml	MinIO image configuration
apps/web/src/services/queryKeys.ts	Authentik query key
apps/web/src/lib/api/endpoints/settings.ts	Public Authentik config type
apps/web/src/lib/api/endpoints/god.ts	Authentik API client types and calls
apps/web/src/features/god/services/god.service.ts	Authentik settings hooks
apps/web/src/features/god/hooks/useGodAuthentikForm.ts	Form state and save logic
apps/web/src/features/god/GodAuthProviderPage.tsx	Authentik settings loading
apps/web/src/features/god/components/auth-provider/GodAuthProviderForm.tsx	Authentik form integration
apps/web/src/features/god/components/auth-provider/GodAuthentikSettings.tsx	Authentik settings UI
apps/web/src/features/auth/services/auth.service.ts	Authentik sign-in helper
apps/web/src/features/auth/hooks/useRedirectError.ts	Authentik error handling
apps/web/src/features/auth/components/register/AuthRegisterProviders.tsx	Registration provider action
apps/web/src/features/auth/components/register/AuthRegisterForm.tsx	Registration flow integration
apps/web/src/features/auth/components/login/AuthLoginForm.tsx	Login flow integration
apps/web/src/features/auth/components/login/AuthLoginAlternatives.tsx	Authentik login action
apps/web/src/features/auth/components/AuthMessagePanel.tsx	Provider message actions
apps/web/messages/zh-CN/god.json	Chinese god-mode translations
apps/web/messages/zh-CN/auth.json	Chinese authentication translations
apps/web/messages/uk/god.json	Ukrainian god-mode translations
apps/web/messages/uk/auth.json	Ukrainian authentication translations
apps/web/messages/ru/god.json	Russian god-mode translations
apps/web/messages/ru/auth.json	Russian authentication translations
apps/web/messages/pt-BR/god.json	Portuguese god-mode translations
apps/web/messages/pt-BR/auth.json	Portuguese authentication translations
apps/web/messages/id/god.json	Indonesian god-mode translations
apps/web/messages/id/auth.json	Indonesian authentication translations
apps/web/messages/fr/god.json	French god-mode translations
apps/web/messages/fr/auth.json	French authentication translations
apps/web/messages/en/god.json	English god-mode translations
apps/web/messages/en/auth.json	English authentication translations
apps/web/messages/ar/god.json	Arabic god-mode translations
apps/web/messages/ar/auth.json	Arabic authentication translations
apps/api/src/modules/scim/oidc-sync.ts	Provider-specific group synchronization
apps/api/src/modules/god/model.ts	Authentik request and response schemas
apps/api/src/modules/god/index.ts	Authentik god-mode routes
apps/api/src/modules/god/__tests__/integration/god-oidc.test.ts	Authentik integration tests
apps/api/src/app.ts	Public configuration and callback handling

Review details

Suppressed comments (1)

packages/auth/src/instance.ts:435

• These checks use raw .length, so a PUT can persist whitespace-only discovery URL, client ID, and secret and hasConfiguredAuthentik() will report the provider usable. /auth-config can then expose a button that fails when the OAuth plugin uses those invalid values; trim or reject whitespace before storing and when evaluating usability.

• Files reviewed: 41/41 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[croffasia]

@SwerkF This functionality duplicates the existing OpenID. Why not use what's already there for your case?