web/admin: show selected policy engine mode on bindings pages, allow setting it on sources

web/src/admin/applications/ApplicationForm.ts

@@ -1,5 +1,6 @@
 import "@goauthentik/admin/applications/ProviderSelectModal";
 import { iconHelperText } from "@goauthentik/admin/helperText";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
 import "@goauthentik/components/ak-file-input";
@@ -27,7 +28,6 @@ import { ifDefined } from "lit/directives/if-defined.js";
 
 import { Application, CoreApi, Provider } from "@goauthentik/api";
 
-import { policyOptions } from "./PolicyOptions.js";
 import "./components/ak-backchannel-input";
 import "./components/ak-provider-search-input";
 
@@ -169,7 +169,7 @@ export class ApplicationForm extends WithCapabilitiesConfig(ModelForm<Applicatio
                 label=${msg("Policy engine mode")}
                 required
                 name="policyEngineMode"
-                .options=${policyOptions}
+                .options=${policyEngineModes}
                 .value=${this.instance?.policyEngineMode}
             ></ak-radio-input>
             <ak-form-group>

web/src/admin/applications/ApplicationViewPage.ts

@@ -333,7 +333,10 @@ export class ApplicationViewPage extends AKElement {
                     <div class="pf-c-card__title">
                         ${msg("These policies control which users can access this application.")}
                     </div>
-                    <ak-bound-policies-list .target=${this.application.pk}>
+                    <ak-bound-policies-list
+                        .target=${this.application.pk}
+                        .policyEngineMode=${this.application.policyEngineMode}
+                    >
                     </ak-bound-policies-list>
                 </div>
             </section>

web/src/admin/applications/wizard/steps/ak-application-wizard-application-step.ts

@@ -1,6 +1,6 @@
-import { policyOptions } from "@goauthentik/admin/applications/PolicyOptions.js";
 import { ApplicationWizardStep } from "@goauthentik/admin/applications/wizard/ApplicationWizardStep.js";
 import "@goauthentik/admin/applications/wizard/ak-wizard-title.js";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { isSlug } from "@goauthentik/common/utils.js";
 import { camelToSnake } from "@goauthentik/common/utils.js";
 import "@goauthentik/components/ak-radio-input";
@@ -142,7 +142,7 @@ export class ApplicationWizardApplicationStep extends ApplicationWizardStep {
                     label=${msg("Policy engine mode")}
                     required
                     name="policyEngineMode"
-                    .options=${policyOptions}
+                    .options=${policyEngineModes}
                     .value=${app.policyEngineMode}
                     .errorMessages=${errors.policyEngineMode ?? []}
                 ></ak-radio-input>

web/src/admin/flows/BoundStagesList.ts

@@ -113,7 +113,10 @@ export class BoundStagesList extends Table<FlowStageBinding> {
                                 "These bindings control if this stage will be applied to the flow.",
                             )}
                         </p>
-                        <ak-bound-policies-list .target=${item.policybindingmodelPtrId}>
+                        <ak-bound-policies-list
+                            .target=${item.policybindingmodelPtrId}
+                            .policyEngineMode=${item.policyEngineMode}
+                        >
                         </ak-bound-policies-list>
                     </div>
                 </div>

web/src/admin/flows/FlowForm.ts

@@ -1,4 +1,5 @@
 import { DesignationToLabel, LayoutToLabel } from "@goauthentik/admin/flows/utils";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { AuthenticationEnum } from "@goauthentik/api/dist/models/AuthenticationEnum";
 import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
 import { first } from "@goauthentik/common/utils";
@@ -22,7 +23,6 @@ import {
     FlowDesignationEnum,
     FlowLayoutEnum,
     FlowsApi,
-    PolicyEngineMode,
 } from "@goauthentik/api";
 
 @customElement("ak-flow-form")
@@ -285,23 +285,7 @@ export class FlowForm extends WithCapabilitiesConfig(ModelForm<Flow, string>) {
                         name="policyEngineMode"
                     >
                         <ak-radio
-                            .options=${[
-                                {
-                                    label: "any",
-                                    value: PolicyEngineMode.Any,
-                                    default: true,
-                                    description: html`${msg(
-                                        "Any policy must match to grant access",
-                                    )}`,
-                                },
-                                {
-                                    label: "all",
-                                    value: PolicyEngineMode.All,
-                                    description: html`${msg(
-                                        "All policies must match to grant access",
-                                    )}`,
-                                },
-                            ]}
+                            .options=${policyEngineModes}
                             .value=${this.instance?.policyEngineMode}
                         >
                         </ak-radio>

web/src/admin/flows/FlowViewPage.ts

@@ -272,7 +272,10 @@ export class FlowViewPage extends AKElement {
                             ${msg("These bindings control which users can access this flow.")}
                         </div>
                         <div class="pf-c-card__body">
-                            <ak-bound-policies-list .target=${this.flow.policybindingmodelPtrId}>
+                            <ak-bound-policies-list
+                                .target=${this.flow.policybindingmodelPtrId}
+                                .policyEngineMode=${this.flow.policyEngineMode}
+                            >
                             </ak-bound-policies-list>
                         </div>
                     </div>

web/src/admin/policies/BoundPoliciesList.ts

@@ -1,6 +1,7 @@
 import "@goauthentik/admin/groups/GroupForm";
 import "@goauthentik/admin/policies/PolicyBindingForm";
 import { PolicyBindingNotice } from "@goauthentik/admin/policies/PolicyBindingForm";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import "@goauthentik/admin/policies/PolicyWizard";
 import {
     PolicyBindingCheckTarget,
@@ -29,6 +30,9 @@ export class BoundPoliciesList extends Table<PolicyBinding> {
     @property()
     target?: string;
 
+    @property()
+    policyEngineMode: string = "";
+
     @property({ type: Array })
     allowedTypes: PolicyBindingCheckTarget[] = [
         PolicyBindingCheckTarget.group,
@@ -236,6 +240,23 @@ export class BoundPoliciesList extends Table<PolicyBinding> {
                 </button>
             </ak-forms-modal> `;
     }
+
+    renderPolicyEngineMode(): TemplateResult {
+        const policyEngineMode = policyEngineModes.find(
+            (pem) => pem.value === this.policyEngineMode,
+        );
+        if (policyEngineMode === undefined) {
+            return html``;
+        }
+        return html`<div class="pf-c-content pf-u-pl-xl">
+            ${msg(str`The currently selected policy engine mode is ${policyEngineMode.label}.`)}
+            ${policyEngineMode.description}
+        </div>`;
+    }
+
+    renderToolbarContainer(): TemplateResult {
+        return html`${this.renderPolicyEngineMode()} ${super.renderToolbarContainer()}`;
+    }
 }
 
 declare global {

web/src/admin/applications/PolicyOptions.ts → web/src/admin/policies/PolicyEngineModes.ts

@@ -3,7 +3,7 @@ import { html } from "lit";
 
 import { PolicyEngineMode } from "@goauthentik/api";
 
-export const policyOptions = [
+export const policyEngineModes = [
     {
         label: "any",
         value: PolicyEngineMode.Any,

web/src/admin/sources/oauth/OAuthSourceForm.ts

@@ -1,5 +1,6 @@
 import "@goauthentik/admin/common/ak-flow-search/ak-source-flow-search";
 import { iconHelperText, placeholderHelperText } from "@goauthentik/admin/helperText";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import {
     GroupMatchingModeToLabel,
@@ -504,6 +505,22 @@ export class OAuthSourceForm extends WithCapabilitiesConfig(BaseSourceForm<OAuth
                         </p>
                     </ak-form-element-horizontal>
                 </div>
+            </ak-form-group>
+            <ak-form-group>
+                <span slot="header"> ${msg("Advanced settings")} </span>
+                <div slot="body" class="pf-c-form">
+                    <ak-form-element-horizontal
+                        label=${msg("Policy engine mode")}
+                        ?required=${true}
+                        name="policyEngineMode"
+                    >
+                        <ak-radio
+                            .options=${policyEngineModes}
+                            .value=${this.instance?.policyEngineMode}
+                        >
+                        </ak-radio>
+                    </ak-form-element-horizontal>
+                </div>
             </ak-form-group>`;
     }
 }

web/src/admin/sources/oauth/OAuthSourceViewPage.ts

@@ -244,6 +244,7 @@ export class OAuthSourceViewPage extends AKElement {
                             <ak-bound-policies-list
                                 .target=${this.source.pk}
                                 .typeNotices=${sourceBindingTypeNotices()}
+                                .policyEngineMode=${this.source.policyEngineMode}
                             >
                             </ak-bound-policies-list>
                         </div>

web/src/admin/sources/plex/PlexSourceForm.ts

@@ -1,5 +1,6 @@
 import "@goauthentik/admin/common/ak-flow-search/ak-source-flow-search";
 import { iconHelperText, placeholderHelperText } from "@goauthentik/admin/helperText";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import {
     GroupMatchingModeToLabel,
@@ -424,6 +425,22 @@ export class PlexSourceForm extends WithCapabilitiesConfig(BaseSourceForm<PlexSo
                         </p>
                     </ak-form-element-horizontal>
                 </div>
+            </ak-form-group>
+            <ak-form-group>
+                <span slot="header"> ${msg("Advanced settings")} </span>
+                <div slot="body" class="pf-c-form">
+                    <ak-form-element-horizontal
+                        label=${msg("Policy engine mode")}
+                        ?required=${true}
+                        name="policyEngineMode"
+                    >
+                        <ak-radio
+                            .options=${policyEngineModes}
+                            .value=${this.instance?.policyEngineMode}
+                        >
+                        </ak-radio>
+                    </ak-form-element-horizontal>
+                </div>
             </ak-form-group>`;
     }
 }

web/src/admin/sources/plex/PlexSourceViewPage.ts

@@ -134,6 +134,7 @@ export class PlexSourceViewPage extends AKElement {
                             <ak-bound-policies-list
                                 .target=${this.source.pk}
                                 .typeNotices=${sourceBindingTypeNotices()}
+                                .policyEngineMode=${this.source.policyEngineMode}
                             >
                             </ak-bound-policies-list>
                         </div>

web/src/admin/sources/saml/SAMLSourceForm.ts

@@ -1,6 +1,7 @@
 import "@goauthentik/admin/common/ak-crypto-certificate-search";
 import "@goauthentik/admin/common/ak-flow-search/ak-source-flow-search";
 import { iconHelperText, placeholderHelperText } from "@goauthentik/admin/helperText";
+import { policyEngineModes } from "@goauthentik/admin/policies/PolicyEngineModes";
 import { BaseSourceForm } from "@goauthentik/admin/sources/BaseSourceForm";
 import {
     GroupMatchingModeToLabel,
@@ -584,6 +585,22 @@ export class SAMLSourceForm extends WithCapabilitiesConfig(BaseSourceForm<SAMLSo
                         </p>
                     </ak-form-element-horizontal>
                 </div>
+            </ak-form-group>
+            <ak-form-group>
+                <span slot="header"> ${msg("Advanced settings")} </span>
+                <div slot="body" class="pf-c-form">
+                    <ak-form-element-horizontal
+                        label=${msg("Policy engine mode")}
+                        ?required=${true}
+                        name="policyEngineMode"
+                    >
+                        <ak-radio
+                            .options=${policyEngineModes}
+                            .value=${this.instance?.policyEngineMode}
+                        >
+                        </ak-radio>
+                    </ak-form-element-horizontal>
+                </div>
             </ak-form-group>`;
     }
 }

web/src/admin/sources/saml/SAMLSourceViewPage.ts

@@ -211,6 +211,7 @@ export class SAMLSourceViewPage extends AKElement {
                             <ak-bound-policies-list
                                 .target=${this.source.pk}
                                 .typeNotices=${sourceBindingTypeNotices()}
+                                .policyEngineMode=${this.source.policyEngineMode}
                             >
                             </ak-bound-policies-list>
                         </div>