From 82c79d69beba0d6f7e648c2b5c763cd0128d7ffc Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 9 Nov 2026 12:24:32 -0600 Subject: [PATCH] fix(health): register the token_broker health check only when tokens are enabled With AUTHENTIK_QBIT_TOKENS off the check could only ever report UNKNOWN "not configured", and core has no way to remove a registered check, so the health page showed a permanent UNKNOWN row. Register it only when getTokensEnabled() is true; the other checks are unchanged. Co-Authored-By: Claude Sonnet 5.5 --- .../health/AuthentikHealthChecks.java | 8 +++++- .../health/AuthentikHealthChecksTest.java | 27 +++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java b/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java index 55aec00..47bee06 100644 --- a/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java +++ b/src/main/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecks.java @@ -65,7 +65,13 @@ public final class AuthentikHealthChecks public static void register(QInstance instance, AuthentikQBitConfig config) { HealthChecksMetaData registry = HealthChecksMetaData.ofOrWithNew(instance); - for(String name : List.of("api", "api_token", "mapper", "token_broker")) + ///////////////////////////////////////////////////////////////////////////////////////////////// + // the token broker is only used when tokens are on; with tokens off a registered check // + // could only ever report UNKNOWN "not configured", and core cannot remove a registered check. // + ///////////////////////////////////////////////////////////////////////////////////////////////// + List names = Boolean.TRUE.equals(config.getTokensEnabled()) + ? List.of("api", "api_token", "mapper", "token_broker") : List.of("api", "api_token", "mapper"); + for(String name : names) { registry.withCheck(new HealthCheckMetaData().withName("authentik." + name).withLabel("Authentik " + name) .withComponent("authentik").withCategory(HealthCategory.IDENTITY).withKind(HealthCheckKind.DEPENDENCY) diff --git a/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java b/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java index 9b43269..dda38d0 100644 --- a/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java +++ b/src/test/java/com/kingsrook/qbits/authentik/health/AuthentikHealthChecksTest.java @@ -117,6 +117,33 @@ class AuthentikHealthChecksTest + /******************************************************************************* + ** With tokens off the token broker is not used, so no token_broker check is + ** registered (it could only ever show UNKNOWN "not configured"); the rest stay. + *******************************************************************************/ + @Test + void registrationWithTokensOffOmitsTokenBroker() throws QException + { + QInstance tokensOff = AuthentikTestSupport.produce(AuthentikTestSupport.unitConfig().withApiToken(SECRET).withTokensEnabled(false)); + var checks = HealthChecksMetaData.ofOrWithNew(tokensOff).resolveAll(tokensOff); + assertThat(checks).extracting(c -> c.getName()).containsExactly("authentik.api", "authentik.api_token", "authentik.mapper"); + } + + + + /******************************************************************************* + ** With tokens explicitly on the token broker check is registered as before. + *******************************************************************************/ + @Test + void registrationWithTokensOnKeepsTokenBroker() throws QException + { + QInstance tokensOn = AuthentikTestSupport.produce(AuthentikTestSupport.unitConfig().withApiToken(SECRET).withTokensEnabled(true)); + var checks = HealthChecksMetaData.ofOrWithNew(tokensOn).resolveAll(tokensOn); + assertThat(checks).extracting(c -> c.getName()).containsExactly("authentik.api", "authentik.api_token", "authentik.mapper", "authentik.token_broker"); + } + + + /******************************************************************************* ** Version responses are allowlisted before entering details. *******************************************************************************/ -- 2.54.0