From 7cffbb4d0712d2206230eda32a626c1b4d6ca97e Mon Sep 17 00:00:00 2001
From: "Jens L." <jens@goauthentik.io>
Date: Tue, 5 May 2026 17:25:01 +0200
Subject: [PATCH] tenants: add option to mark flag as deprecated (#22063)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---
 authentik/flows/apps.py                                      | 1 +
 authentik/tenants/api/settings.py                            | 2 ++
 authentik/tenants/flags.py                                   | 1 +
 packages/client-ts/src/models/CurrentBrandFlags.ts           | 1 +
 packages/client-ts/src/models/PatchedSettingsRequestFlags.ts | 1 +
 schema.yml                                                   | 4 ++++
 web/src/admin/admin-settings/AdminSettingsForm.ts            | 4 ++++
 7 files changed, 14 insertions(+)

diff --git a/authentik/flows/apps.py b/authentik/flows/apps.py
index 728fc04208..4339fa792d 100644
--- a/authentik/flows/apps.py
+++ b/authentik/flows/apps.py
@@ -29,6 +29,7 @@ class RefreshOtherFlowsAfterAuthentication(Flag[bool], key="flows_refresh_others
     default = False
     visibility = "public"
     description = _("Refresh other tabs after successful authentication.")
+    deprecated = True
 
 
 class ContinuousLogin(Flag[bool], key="flows_continuous_login"):
diff --git a/authentik/tenants/api/settings.py b/authentik/tenants/api/settings.py
index 8ba2720609..917b03456c 100644
--- a/authentik/tenants/api/settings.py
+++ b/authentik/tenants/api/settings.py
@@ -59,6 +59,8 @@ class FlagsJSONExtension(OpenApiSerializerFieldExtension):
             props[_flag.key] = build_basic_type(get_args(_flag.__orig_bases__[0])[0])
             if _flag.description:
                 props[_flag.key]["description"] = _flag.description
+            if _flag.deprecated:
+                props[_flag.key]["deprecated"] = _flag.deprecated
         return build_object_type(props, required=props.keys())
 
 
diff --git a/authentik/tenants/flags.py b/authentik/tenants/flags.py
index 69c53c9c9c..cbe58bafb7 100644
--- a/authentik/tenants/flags.py
+++ b/authentik/tenants/flags.py
@@ -18,6 +18,7 @@ class Flag[T]:
         Literal["none"] | Literal["public"] | Literal["authenticated"] | Literal["system"]
     ) = "none"
     description: str | None = None
+    deprecated = False
 
     def __init_subclass__(cls, key: str, **kwargs):
         cls.__key = key
diff --git a/packages/client-ts/src/models/CurrentBrandFlags.ts b/packages/client-ts/src/models/CurrentBrandFlags.ts
index 2088e6e8e9..d7eb510d38 100644
--- a/packages/client-ts/src/models/CurrentBrandFlags.ts
+++ b/packages/client-ts/src/models/CurrentBrandFlags.ts
@@ -40,6 +40,7 @@ export interface CurrentBrandFlags {
      * Refresh other tabs after successful authentication.
      * @type {boolean}
      * @memberof CurrentBrandFlags
+     * @deprecated
      */
     flowsRefreshOthers: boolean;
 }
diff --git a/packages/client-ts/src/models/PatchedSettingsRequestFlags.ts b/packages/client-ts/src/models/PatchedSettingsRequestFlags.ts
index 23629944c2..22578d20c0 100644
--- a/packages/client-ts/src/models/PatchedSettingsRequestFlags.ts
+++ b/packages/client-ts/src/models/PatchedSettingsRequestFlags.ts
@@ -40,6 +40,7 @@ export interface PatchedSettingsRequestFlags {
      * Refresh other tabs after successful authentication.
      * @type {boolean}
      * @memberof PatchedSettingsRequestFlags
+     * @deprecated
      */
     flowsRefreshOthers: boolean;
 }
diff --git a/schema.yml b/schema.yml
index 3ff7c1bbb7..d5a9821dec 100644
--- a/schema.yml
+++ b/schema.yml
@@ -37189,6 +37189,7 @@ components:
             flows_refresh_others:
               type: boolean
               description: Refresh other tabs after successful authentication.
+              deprecated: true
           required:
           - core_default_app_access
           - enterprise_audit_include_expanded_diff
@@ -51199,6 +51200,7 @@ components:
             flows_refresh_others:
               type: boolean
               description: Refresh other tabs after successful authentication.
+              deprecated: true
           required:
           - core_default_app_access
           - enterprise_audit_include_expanded_diff
@@ -55981,6 +55983,7 @@ components:
             flows_refresh_others:
               type: boolean
               description: Refresh other tabs after successful authentication.
+              deprecated: true
           required:
           - core_default_app_access
           - enterprise_audit_include_expanded_diff
@@ -56069,6 +56072,7 @@ components:
             flows_refresh_others:
               type: boolean
               description: Refresh other tabs after successful authentication.
+              deprecated: true
           required:
           - core_default_app_access
           - enterprise_audit_include_expanded_diff
diff --git a/web/src/admin/admin-settings/AdminSettingsForm.ts b/web/src/admin/admin-settings/AdminSettingsForm.ts
index 84c47b9eb9..44d6b01fca 100644
--- a/web/src/admin/admin-settings/AdminSettingsForm.ts
+++ b/web/src/admin/admin-settings/AdminSettingsForm.ts
@@ -8,6 +8,7 @@ import "#elements/forms/Radio";
 import "#elements/forms/SearchSelect/index";
 import "#elements/utils/TimeDeltaHelp";
 import "./AdminSettingsFooterLinks.js";
+import "#elements/Alert";
 
 import { akFooterLinkInput, IFooterLinkInput } from "./AdminSettingsFooterLinks.js";
 
@@ -287,6 +288,9 @@ export class AdminSettingsForm extends Form<SettingsRequest> {
                         help=${msg(
                             "When enabled, other flow tabs in a session will refresh upon a successful authentication.",
                         )}
+                        .bighelp=${html`<ak-alert class="pf-c-radio__description" inline plain>
+                            ${msg("This flag is deprecated.")}
+                        </ak-alert>`}
                     >
                     </ak-switch-input>
                     <ak-switch-input