From 1b35766ad3f85d643ba89ad250f31d71834b2f7c Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Fri, 7 Aug 2026 12:00:00 +0000
Subject: [PATCH] fix(authentik): make matrix-recovery blueprint apply again

The flow entry only set designation. FlowSerializer requires name and title as well (neither has a model default), so validation failed, the entry never got a model instance, and every following KeyOf matrix_recovery_flow reference failed with it. The blueprint had status error on every run.

Corroborated inside the same ConfigMap: matrix-invitation-flow sets name and title and applies successfully.

Values are taken from the live database so nothing changes on the page users see. The typo in mail-adress is left as is - changing user-facing text would be a separate decision.

Closes axion1337.chat/axion1337.chat-gitops#60
---
 apps/authentik/authentik-blueprints.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/apps/authentik/authentik-blueprints.yaml b/apps/authentik/authentik-blueprints.yaml
index fc5dce3..1d548f4 100644
--- a/apps/authentik/authentik-blueprints.yaml
+++ b/apps/authentik/authentik-blueprints.yaml
@@ -114,12 +114,25 @@ data:
       # stages the built-in default-recovery-flow already uses successfully,
       # plus our own redirect stage instead of falling back to the authentik
       # dashboard (blocked for type=external Matrix users).
+      # ⚠️ name und title MUESSEN hier stehen. Der FlowSerializer verlangt beide
+      # (keine Model-Defaults). Fehlen sie, scheitert die Validierung, der Eintrag
+      # bekommt keine Model-Instanz - und JEDES nachfolgende `!KeyOf
+      # matrix_recovery_flow` laeuft ins Leere. Genau das war der Zustand bis
+      # 2026-08-07: der Blueprint wurde bei jedem Lauf verworfen (gitops#60).
+      # Gegenprobe im selben ConfigMap: matrix-invitation-flow setzt beide und
+      # laeuft durch.
+      #
+      # Die Werte sind der Stand aus der Datenbank, damit sich an der angezeigten
+      # Seite nichts aendert. (Der Tippfehler "mail-adress" ist so gewachsen und
+      # bleibt bewusst stehen - Textaenderung waere eine eigene Entscheidung.)
       - model: authentik_flows.flow
         state: present
         identifiers:
           slug: matrix-recovery
         id: matrix_recovery_flow
         attrs:
+          name: "Welcome to aXion1337! Please provide a username or mail-adress."
+          title: "Welcome to aXion1337! Please provide a username or mail-adress."
           designation: recovery
 
       - model: authentik_flows.flowstagebinding