fix(platform): isolate authentik admin styling

infra/authentik/bootstrap-dev.py

@@ -1,5 +1,4 @@
 from os import environ
-from pathlib import Path
 
 from django.db import transaction
 
@@ -21,8 +20,6 @@ from authentik.providers.oauth2.models import (
 from authentik.stages.identification.models import IdentificationStage
 from authentik.stages.password.models import PasswordStage
 
-BRANDING_CSS_PATH = Path("/templates/branding/nodedc-login.css")
-
 GROUP_SPECS = [
     ("nodedc:superadmin", False),
     ("nodedc:launcher:admin", False),
@@ -91,7 +88,10 @@ def ensure_groups():
 
 
 def ensure_user_groups(groups):
-    admin_email = environ.get("NODEDC_BOOTSTRAP_ADMIN_EMAIL", "").strip()
+    admin_email = (
+        environ.get("NODEDC_BOOTSTRAP_ADMIN_EMAIL", "").strip()
+        or environ.get("AUTHENTIK_BOOTSTRAP_EMAIL", "").strip()
+    )
     if not admin_email:
         return None
 
@@ -105,13 +105,19 @@ def ensure_user_groups(groups):
     user.email = admin_email
     user.is_active = True
     user.type = "internal"
-    if environ.get("NODEDC_BOOTSTRAP_ADMIN_PASSWORD"):
-        user.set_password(environ["NODEDC_BOOTSTRAP_ADMIN_PASSWORD"])
+    admin_password = (
+        environ.get("NODEDC_BOOTSTRAP_ADMIN_PASSWORD")
+        or environ.get("AUTHENTIK_BOOTSTRAP_PASSWORD")
+    )
+    if admin_password:
+        user.set_password(admin_password)
     user.save()
 
-    authentik_admins = Group.objects.filter(name="authentik Admins").first()
-    if authentik_admins:
-        user.groups.add(authentik_admins)
+    authentik_admins, _ = Group.objects.get_or_create(name="authentik Admins")
+    if not authentik_admins.is_superuser:
+        authentik_admins.is_superuser = True
+        authentik_admins.save(update_fields=["is_superuser"])
+    user.groups.add(authentik_admins)
 
     for name in groups:
         user.groups.add(groups[name])
@@ -174,12 +180,6 @@ def default_scope_mappings():
     return mappings
 
 
-def read_branding_css():
-    if BRANDING_CSS_PATH.exists():
-        return BRANDING_CSS_PATH.read_text(encoding="utf-8")
-    return ""
-
-
 def ensure_nodedc_brand():
     auth_domain = environ.get("AUTH_DOMAIN", "auth.local.nodedc").strip() or "auth.local.nodedc"
     authentication_flow = Flow.objects.get(slug="default-authentication-flow")
@@ -214,7 +214,9 @@ def ensure_nodedc_brand():
     brand.branding_title = "NODE.DC"
     brand.branding_logo = ""
     brand.branding_favicon = ""
-    brand.branding_custom_css = read_branding_css()
+    # Login styling is injected by flow templates only. Brand custom CSS is global
+    # and Authentik applies it to Admin/User web components as well.
+    brand.branding_custom_css = ""
     brand.flow_authentication = authentication_flow
     brand.flow_invalidation = invalidation_flow
     brand.attributes = {