From 97958e72e8a9223c539397d90ef7552d80512d60 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 9 Dec 2024 17:43:11 +0000
Subject: [PATCH 1/2] kanidm: add back 1.3 compatibility

---
 pkgs/by-name/ka/kanidm/generic.nix | 36 +++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix
index 5bbf2a135eab..607062bafdda 100644
--- a/pkgs/by-name/ka/kanidm/generic.nix
+++ b/pkgs/by-name/ka/kanidm/generic.nix
@@ -55,18 +55,24 @@ rustPlatform.buildRustPackage rec {
   postPatch =
     let
       format = (formats.toml { }).generate "${KANIDM_BUILD_PROFILE}.toml";
-      profile = {
-        admin_bind_path = "/run/kanidmd/sock";
-        cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
-        default_config_path = "/etc/kanidm/server.toml";
-        default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
-        htmx_ui_pkg_path = "@htmx_ui_pkg_path@";
-      };
+      profile =
+        {
+          admin_bind_path = "/run/kanidmd/sock";
+          cpu_flags = if stdenv.hostPlatform.isx86_64 then "x86_64_legacy" else "none";
+          default_config_path = "/etc/kanidm/server.toml";
+          default_unix_shell_path = "${lib.getBin bashInteractive}/bin/bash";
+          htmx_ui_pkg_path = "@htmx_ui_pkg_path@";
+        }
+        // lib.optionalAttrs (lib.versions.majorMinor version == "1.3") {
+          web_ui_pkg_path = "@web_ui_pkg_path@";
+        };
     in
     ''
       cp ${format profile} libs/profiles/${KANIDM_BUILD_PROFILE}.toml
-      substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml \
-        --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg"
+      substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg"
+    ''
+    + lib.optionalString (lib.versions.majorMinor version == "1.3") ''
+      substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml --replace-fail '@web_ui_pkg_path@' "$out/ui/pkg"
     '';
 
   nativeBuildInputs = [
@@ -83,10 +89,14 @@ rustPlatform.buildRustPackage rec {
   ];
 
   # The UI needs to be in place before the tests are run.
-  postBuild = ''
-    mkdir -p $out/ui
-    cp -r server/core/static $out/ui/hpkg
-  '';
+  postBuild =
+    ''
+      mkdir -p $out/ui
+      cp -r server/core/static $out/ui/hpkg
+    ''
+    + lib.optionalString (lib.versions.majorMinor version == "1.3") ''
+      cp -r server/web_ui/pkg $out/ui/pkg
+    '';
 
   # Upstream runs with the Rust equivalent of -Werror,
   # which breaks when we upgrade to new Rust before them.

From 21b973775711b1609bc054e11acc8fa5c19c2e72 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 9 Dec 2024 17:43:11 +0000
Subject: [PATCH 2/2] kanidm: permit hydra to build unmaintained 1.3 release

Building kanidm can take a non-trivial amount of time and compute resources.
We don't have any evidence of vulnerabilities and only marked it insecure
due to upstream dropping support
---
 pkgs/top-level/release.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 24683706ab8d..0140f0bd9d6a 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -35,6 +35,7 @@
     # so users choosing to allow don't have to rebuild them every time.
     permittedInsecurePackages = [
       "olm-3.2.16" # see PR #347899
+      "kanidm_1_3-1.3.3"
     ];
   }; }