fix tests

Signed-off-by: Jens Langhammer <[email protected]>

authentik/core/models.py

@@ -319,10 +319,19 @@ def app_entitlements(self, app: "Application | None") -> QuerySet["ApplicationEn
         if not app:
             return []
         all_groups = self.all_groups()
-        return app.applicationentitlement_set.filter(
-            Q(bindings__user=self) | Q(bindings__group__in=all_groups),
+        qs = app.applicationentitlement_set.filter(
+            Q(
+                Q(bindings__user=self) | Q(bindings__group__in=all_groups),
+                bindings__negate=False,
+            )
+            | Q(
+                Q(~Q(bindings__user=self), bindings__user__isnull=False)
+                | Q(~Q(bindings__group__in=all_groups), bindings__group__isnull=False),
+                bindings__negate=True,
+            ),
             bindings__enabled=True,
         )
+        return qs
 
     @property
     def serializer(self) -> Serializer:

authentik/core/tests/test_application_entitlements.py

@@ -17,16 +17,13 @@ def setUp(self) -> None:
         self.other_user = create_test_user()
         self.provider = OAuth2Provider.objects.create(
             name="test",
-            redirect_uris="http://some-other-domain",
             authorization_flow=create_test_flow(),
         )
         self.app: Application = Application.objects.create(
             name=generate_id(),
             slug=generate_id(),
             provider=self.provider,
         )
-        ent = ApplicationEntitlement.objects.create(app=self.app, name=generate_id())
-        PolicyBinding.objects.create(target=ent, user=self.other_user, order=0)
 
     def test_user(self):
         """Test user-direct assignment"""
@@ -56,3 +53,20 @@ def test_group_indirect(self):
         ents = self.user.app_entitlements(self.app)
         self.assertEqual(len(ents), 1)
         self.assertEqual(ents[0].name, ent.name)
+
+    def test_negate_user(self):
+        """Test with negate flag"""
+        ent = ApplicationEntitlement.objects.create(app=self.app, name=generate_id())
+        PolicyBinding.objects.create(target=ent, user=self.other_user, order=0, negate=True)
+        ents = self.user.app_entitlements(self.app)
+        self.assertEqual(len(ents), 1)
+        self.assertEqual(ents[0].name, ent.name)
+
+    def test_negate_group(self):
+        """Test with negate flag"""
+        other_group = Group.objects.create(name=generate_id())
+        ent = ApplicationEntitlement.objects.create(app=self.app, name=generate_id())
+        PolicyBinding.objects.create(target=ent, group=other_group, order=0, negate=True)
+        ents = self.user.app_entitlements(self.app)
+        self.assertEqual(len(ents), 1)
+        self.assertEqual(ents[0].name, ent.name)