From ed2a696c01d627868ccbcdfec233278f270aeb91 Mon Sep 17 00:00:00 2001
From: MacRimi <ricoextincion@gmail.com>
Date: Sat, 31 Oct 2026 09:45:27 +0100
Subject: [PATCH] fix(oci): point the Authentik summary to the first-run setup

akadmin has no password until it is created in the setup wizard, which
opens from the root address. The summary now says so instead of reporting
a password that could not be retrieved.
---
 lang/sk.json                       |  1 +
 oci/catalog/apps/authentik.json    | 16 +++++-----------
 oci/catalog/curated/authentik.json | 16 +++++-----------
 oci/tests/test_authentik_recipe.py |  9 +++++----
 4 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/lang/sk.json b/lang/sk.json
index f5363d46..455ac489 100644
--- a/lang/sk.json
+++ b/lang/sk.json
@@ -4890,6 +4890,7 @@
   "Open the dashboard from this host on port 8008 to create a new admin account.": "Otvorte dashboard z tohto servera na porte 8008 a vytvorte nový admin účet.",
   "Open the dashboard to create a new admin account:": "Otvorte dashboard a vytvorte nový admin účet:",
   "Open the page of an application in the menu": "Otvoriť stránku aplikácie v ponuke",
+  "Open the web address and create the password of the akadmin user in the first-run setup.": "Otvorte webovú adresu a v prvotnom nastavení vytvorte heslo používateľa akadmin.",
   "Open-source AI-powered coding assistant": "Programátorský asistent využívajúci AI s otvoreným zdrojovým kódom",
   "Open-source UI for building and debugging multi-agent and RAG applications": "Rozhranie s otvoreným zdrojovým kódom na tvorbu a ladenie aplikácií s viacerými agentmi a RAG",
   "Open-source in-memory data store.": "Úložisko údajov v pamäti s otvoreným zdrojovým kódom.",
diff --git a/oci/catalog/apps/authentik.json b/oci/catalog/apps/authentik.json
index 57f2dcca..23d011ff 100644
--- a/oci/catalog/apps/authentik.json
+++ b/oci/catalog/apps/authentik.json
@@ -462,16 +462,7 @@
         "source": "official-compose"
       }
     ],
-    "credentials": [
-      {
-        "label": "Initial administrator account",
-        "type": "static-default",
-        "username": "akadmin",
-        "password": null,
-        "change_required": true,
-        "source": "Authentik documentation; set the akadmin password during the first-run setup"
-      }
-    ]
+    "credentials": []
   },
   "proxmox": {
     "runtime": "native-oci-lxc",
@@ -561,7 +552,10 @@
     ],
     "custom_compose_stack": true,
     "custom_compose_interpolated": false,
-    "stack_image_entrypoints": {}
+    "stack_image_entrypoints": {},
+    "stack_completion_notes": [
+      "Open the web address and create the password of the akadmin user in the first-run setup."
+    ]
   },
   "compatibility": {
     "automatic_install_candidate": true,
diff --git a/oci/catalog/curated/authentik.json b/oci/catalog/curated/authentik.json
index 57f2dcca..23d011ff 100644
--- a/oci/catalog/curated/authentik.json
+++ b/oci/catalog/curated/authentik.json
@@ -462,16 +462,7 @@
         "source": "official-compose"
       }
     ],
-    "credentials": [
-      {
-        "label": "Initial administrator account",
-        "type": "static-default",
-        "username": "akadmin",
-        "password": null,
-        "change_required": true,
-        "source": "Authentik documentation; set the akadmin password during the first-run setup"
-      }
-    ]
+    "credentials": []
   },
   "proxmox": {
     "runtime": "native-oci-lxc",
@@ -561,7 +552,10 @@
     ],
     "custom_compose_stack": true,
     "custom_compose_interpolated": false,
-    "stack_image_entrypoints": {}
+    "stack_image_entrypoints": {},
+    "stack_completion_notes": [
+      "Open the web address and create the password of the akadmin user in the first-run setup."
+    ]
   },
   "compatibility": {
     "automatic_install_candidate": true,
diff --git a/oci/tests/test_authentik_recipe.py b/oci/tests/test_authentik_recipe.py
index c829b708..268d84f9 100644
--- a/oci/tests/test_authentik_recipe.py
+++ b/oci/tests/test_authentik_recipe.py
@@ -153,12 +153,13 @@ class AuthentikRecipeTests(unittest.TestCase):
         self.assertNotIn("frontend", services["postgresql"])
 
     def test_first_run_discloses_the_initial_admin_setup_without_faking_a_password(self):
+        # akadmin has no password until it is created in the setup wizard,
+        # which opens from the root address.
         first_run = self.curated["first_run"]
         self.assertEqual(first_run["endpoints"][0]["port"], 9000)
-        credential = first_run["credentials"][0]
-        self.assertEqual(credential["username"], "akadmin")
-        self.assertIsNone(credential["password"])
-        self.assertTrue(credential["change_required"])
+        self.assertEqual(first_run["endpoints"][0]["path"], "/")
+        self.assertEqual(first_run["credentials"], [])
+        self.assertIn("akadmin", self.curated["proxmox"]["stack_completion_notes"][0])
 
 
 if __name__ == "__main__":