core: cache S3 file storage clients

[dominic-r]

Summary

• Reuses the S3 boto client while the configured endpoint, region, TLS, addressing style, signature version, and credentials remain unchanged.
• Invalidates the cached client when relevant S3 session or client config changes.
• Adds unit coverage for client reuse and config-driven refresh without requiring the S3 test service.

Why

The media file listing path can call into S3 URL generation repeatedly. Creating a fresh boto client for every access adds avoidable overhead, which is especially visible on slow S3-compatible backends.

Validation

• uv run ruff check authentik/admin/files/backends/s3.py authentik/admin/files/backends/tests/test_s3_backend.py
• uv run ruff format --check authentik/admin/files/backends/s3.py authentik/admin/files/backends/tests/test_s3_backend.py
• uv run coverage run manage.py test --keepdb authentik/admin/files/backends/tests/test_s3_backend.py (2 passed, 25 skipped; live S3 tests skipped because the local S3 test service is not running)

[netlify]

✅ Deploy Preview for authentik-integrations ready!

Name	Link
🔨 Latest commit	5a27d15
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-integrations/deploys/6a3342d4997615000824f08e
😎 Deploy Preview	https://deploy-preview-23168--authentik-integrations.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for authentik-docs ready!

Name	Link
🔨 Latest commit	5a27d15
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-docs/deploys/6a3342d491ed470008bbb41f
😎 Deploy Preview	https://deploy-preview-23168--authentik-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for authentik-storybook ready!

Name	Link
🔨 Latest commit	5a27d15
🔍 Latest deploy log	https://app.netlify.com/projects/authentik-storybook/deploys/6a3342d48db8c000089d93b1
😎 Deploy Preview	https://deploy-preview-23168--authentik-storybook.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 97.72727% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.23%. Comparing base (52674af) to head (5a27d15).
⚠️ Report is 27 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
authentik/admin/files/backends/s3.py	93.75%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #23168      +/-   ##
==========================================
+ Coverage   93.18%   93.23%   +0.04%     
==========================================
  Files        1032     1035       +3     
  Lines       60196    60351     +155     
  Branches      400      400              
==========================================
+ Hits        56094    56267     +173     
+ Misses       4102     4084      -18     

Flag	Coverage Δ
conformance	36.44% <6.81%> (-0.09%)	⬇️
e2e	41.68% <6.81%> (+0.11%)	⬆️
integration	32.40% <6.81%> (-0.57%)	⬇️
rust	0.00% <ø> (ø)
unit	92.22% <97.72%> (+0.01%)	⬆️
unit-migrate	92.25% <97.72%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[github-actions]

authentik PR Installation instructions

Instructions for docker-compose

Add the following block to your .env file:

AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-5a27d156e798344879b78e838dd8a596348e5ab1
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s

Afterwards, run the upgrade commands from the latest release notes.

Instructions for Kubernetes

Add the following block to your values.yml file:

authentik:
    outposts:
        container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
    image:
        repository: ghcr.io/goauthentik/dev-server
        tag: gh-5a27d156e798344879b78e838dd8a596348e5ab1

Afterwards, run the upgrade commands from the latest release notes.