root: add spell checker and fix typos

.github/workflows/test.yml

@@ -170,6 +170,22 @@ jobs:
           cache: "pnpm"
           cache-dependency-path: "pnpm-lock.yaml"
       - run: make ${{ matrix.target }}/lint
+  lint_spellcheck:
+    name: Lint (spellcheck)
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: pnpm/action-setup@v6.1.0
+        with:
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        with:
+          node-version-file: "package.json"
+          cache: "pnpm"
+          cache-dependency-path: "pnpm-lock.yaml"
+      - run: make lint-spellcheck
   build_rs_e2e:
     uses: ./.github/workflows/_build-rs.yml
     with:

.gitignore

@@ -45,3 +45,7 @@ target/
 *.profraw
 
 node_modules/
+
+# Spell checker
+.cspellcache
+cspell-report.*

Makefile

@@ -83,6 +83,10 @@ lint-rs-ci:
 		${RS_TEST_FLAGS} \
 		-- -D warnings
 
+lint-spellcheck:
+	pnpm install
+	pnpm run lint:spellcheck
+
 .PHONY: lint
 lint:$(foreach target,$(TARGETS),${target}/lint)
 	"$(MAKE)" lint-rs

README.md

@@ -10,7 +10,7 @@
 # authentik Platform
 
 > [!CAUTION]
-> The authentik Platform is in a pre-alpha state and features/behaviours might change without notice. Use at your own risk.
+> The authentik Platform is in a pre-alpha state and features/behaviors might change without notice. Use at your own risk.
 
 ## Development
 

ak-cli/Cargo.toml

@@ -24,7 +24,7 @@ tracing = { workspace = true }
 open = "5.3.5"
 pbjson-types = { workspace = true }
 psl = { workspace = true }
-ratatui = "0.30.1"
+ratatui = "0.30.1" # spellchecker:ignore ratatui
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }

ak-nss/src/mapping.rs

@@ -133,7 +133,7 @@ mod tests {
     #[test]
     fn group_entry_strips_nul_bytes_including_members() {
         let g = ak_group_to_group_entry(AKGroup {
-            name: "admi\0ns".to_owned(),
+            name: "admi\0ns".to_owned(), // spellchecker:ignore admi
             gid: 200,
             passwd: "x\0".to_owned(),
             members: vec!["ali\0ce".to_owned(), "bob".to_owned()],

ak-platform/src/grpc/method_caller.rs

@@ -58,7 +58,7 @@ impl MethodCaller {
     }
 
     /// Call a gRPC method by its path (e.g. `/ping.Ping/Ping`).
-    /// `data` is the raw serialised proto request (no gRPC framing).
+    /// `data` is the raw serialized proto request (no gRPC framing).
     ///
     /// A non-OK gRPC status is a successful call that returned an error, so it comes
     /// back in the [`MethodResponse`]. The `Err` variant is reserved for the call not
@@ -117,7 +117,7 @@ impl MethodCaller {
     }
 }
 
-/// Outcome of a [`MethodCaller::call`]: the raw serialised proto response, or the gRPC
+/// Outcome of a [`MethodCaller::call`]: the raw serialized proto response, or the gRPC
 /// status the handler returned instead.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct MethodResponse {

ak-platform/src/tui.rs

@@ -73,7 +73,7 @@ pub fn value_to_tree_node(label: &str, value: &Value) -> TreeNode {
         }
 
         Value::String(s) => {
-            // Mirror the Go behaviour: if the string is itself valid JSON, recurse
+            // Mirror the Go behavior: if the string is itself valid JSON, recurse
             if let Ok(inner) = serde_json::from_str::<Value>(s)
                 && matches!(inner, Value::Object(_) | Value::Array(_))
             {
@@ -132,7 +132,7 @@ fn leaf_node(label: &str, value: &str) -> TreeNode {
     TreeNode::new(format!("{}: {}", styled_key(label), styled_value(value)))
 }
 
-/// Minimal ANSI 256-color wrapper — keeps parity with lipgloss colour ints.
+/// Minimal ANSI 256-color wrapper — keeps parity with lipgloss color ints.
 fn ansi_color(s: &str, code: u8) -> String {
     format!("\x1b[38;5;{code}m{s}\x1b[0m")
 }

cspell.config.jsonc

@@ -0,0 +1,212 @@
+{
+    "$schema": "https://raw.githubusercontent.com/streetsidesoftware/cspell/refs/heads/main/cspell.schema.json",
+    "name": "authentik-platform-cspell",
+    "description": "authentik platform's spell checker configuration",
+    "version": "0.2",
+    "readonly": true,
+    "language": "en-US",
+    // Only report words that are known misspellings (with a suggested fix) or
+    // explicitly forbidden via `flagWords`. Unknown-but-plausible words — project
+    // jargon, identifiers, integration names — pass silently, so new terms do not
+    // require dictionary entries. This mirrors CodeSpell's behavior, which checks
+    // against a curated list of common misspellings rather than flagging every
+    // word absent from a dictionary.
+    "unknownWords": "report-common-typos",
+    "cache": {
+        "useCache": true,
+        "cacheLocation": "./.cspellcache",
+        "cacheStrategy": "content"
+    },
+    "reporters": [
+        "default",
+        [
+            "@cspell/cspell-json-reporter",
+            {
+                "outFile": "./cspell-report.json"
+            }
+        ]
+    ],
+    // In typo-only mode, a dictionary entry is needed only when a legitimate term
+    // collides with the common-misspellings list. Record such collisions here
+    // rather than reviving per-topic dictionary files.
+    "dictionaryDefinitions": [
+        {
+            "name": "en-x-authentik-overrides",
+            "path": "./hack/cspell/overrides.txt",
+            "description": "Legitimate terms that collide with the common-misspellings list",
+            "addWords": true
+        }
+    ],
+    "dictionaries": ["en-x-authentik-overrides"],
+    // British spellings to reject in favor of American variants. The `->` form
+    // forbids the left word and offers the right word as the suggested fix.
+    "flagWords": [
+        // -our -> -or
+        "colour->color",
+        "colours->colors",
+        "coloured->colored",
+        "colouring->coloring",
+        "behaviour->behavior",
+        "behaviours->behaviors",
+        "favour->favor",
+        "favourite->favorite",
+        "favourites->favorites",
+        "flavour->flavor",
+        "flavours->flavors",
+        "honour->honor",
+        "labour->labor",
+        "neighbour->neighbor",
+        "neighbours->neighbors",
+        // -ise/-isation -> -ize/-ization
+        "organise->organize",
+        "organised->organized",
+        "organising->organizing",
+        "organisation->organization",
+        "initialise->initialize",
+        "initialised->initialized",
+        "initialising->initializing",
+        "initialisation->initialization",
+        "authorise->authorize",
+        "authorised->authorized",
+        "authorisation->authorization",
+        "customise->customize",
+        "customised->customized",
+        "customisation->customization",
+        "serialise->serialize",
+        "serialised->serialized",
+        "deserialise->deserialize",
+        "deserialised->deserialized",
+        "normalise->normalize",
+        "normalised->normalized",
+        "normalisation->normalization",
+        "synchronise->synchronize",
+        "synchronised->synchronized",
+        "optimise->optimize",
+        "optimised->optimized",
+        "optimisation->optimization",
+        "recognise->recognize",
+        "recognised->recognized",
+        "specialise->specialize",
+        "prioritise->prioritize",
+        "prioritised->prioritized",
+        "summarise->summarize",
+        "summarised->summarized",
+        "minimise->minimize",
+        "maximise->maximize",
+        "utilise->utilize",
+        "finalise->finalize",
+        "finalised->finalized",
+        // -yse -> -yze
+        "analyse->analyze",
+        "analysed->analyzed",
+        "analysing->analyzing",
+        // -re -> -er
+        "centre->center",
+        "centres->centers",
+        "centred->centered",
+        // -ce -> -se and misc
+        "licence->license",
+        "defence->defense",
+        "catalogue->catalog",
+        "dialogue->dialog",
+        "programme->program",
+        "grey->gray",
+        "artefact->artifact",
+        "artefacts->artifacts"
+    ],
+    "patterns": [
+        {
+            "name": "EncodedURI",
+            "description": "Encoded URIs, which are common in authentik's codebases and often contain many false positives.",
+            "pattern": "[a-zA-Z]+%3A%2F%2F.+"
+        }
+    ],
+    // Only content-scoping patterns belong here (encoded blobs, upstream
+    // identifiers spelled the British way) — not word allowlists. Unknown words
+    // are no longer reported, so shape-of-word escapes are unnecessary.
+    "ignoreRegExpList": [
+        // Encoded URIs
+        "EncodedURI",
+        // Basic auth header
+        "Basic [a-zA-Z0-9+/=]+"
+    ],
+    "languageSettings": [
+        {
+            "languageId": "markdown,mdx",
+            "ignoreRegExpList": [
+                // Fenced code blocks
+                "/^\\s*```[\\s\\S]*?^\\s*```/gm",
+                // Markdown inline codeblocks
+                "`[^`\\s]+`",
+                "`\\w+[^`]*?\\w+`"
+            ]
+        },
+        {
+            "languageId": "typescript,javascript,typescriptreact,javascriptreact,mdx,astro",
+            "ignoreRegExpList": [
+                "js-hex-escape",
+                "js-unicode-escape",
+                "js-regexp-flags",
+                "js-hex-number"
+            ]
+        },
+        {
+            "languageId": "python",
+            "includeRegExpList": ["comments"]
+        },
+        {
+            "languageId": "css,scss",
+            "ignoreRegExpList": [
+                // data URIs, which are common in CSS and often contain many false positives.
+                "data:.+"
+            ]
+        }
+    ],
+    "ignorePaths": [
+        //#region Spell checker
+        "{cspell.*,cSpell.*,.cspell.*,cspell.config.*}", // CSpell configuration files
+        "cspell-report.{json,html,txt}", // CSpell report files
+        "./hack/cspell", // Custom dictionary files
+        //#endregion
+        //#region Monorepo
+        "LICENSE", // License file
+        ".gitignore", // Git ignore file
+        ".gitattributes", // Git attributes file
+        "*-lock.{json,yaml}", // Lock files (pnpm)
+        "Cargo.lock", // Lock file (Cargo)
+        "pnpm-workspace.yaml", // pnpm workspace config
+        ".vscode/**", // VSCode configuration
+        "dist", // Distributed build output
+        "coverage/**", // Coverage output
+        ".test-output", // Test output
+        ".env", // Environment files
+        "*.tsbuildinfo", // TypeScript build info
+        "./cache", // Shared build cache
+        "**/vendor/**", // Vendored code
+        "**vendored**", // Vendored files
+        //#endregion
+        //#region JavaScript/TypeScript
+        "node_modules", // Node modules
+        "package.json", // Package manifest file
+        "*.min.{js,css}", // Minified JS and CSS files
+        "*.min.{js,css}.map", // Source maps for minified files
+        //#endregion
+        //#region Rust
+        "target", // Rust compilation artifacts
+        "./ak-platform/src/generated", // Generated protobuf code
+        //#endregion
+        //#region Apple
+        "./ee/psso/Bridge/Generated", // Generated Swift bridge
+        "*.{xib,storyboard,pbxproj,xcworkspacedata,xcscheme,xcsettings,xctestplan}", // Xcode-generated files
+        "*.xcassets", // Xcode asset catalogs
+        //#endregion
+        //#region Media/Static
+        "*.{png,jpg,ico,icns,pdf,svg}" // Binary files
+        //#endregion
+    ],
+    "useGitignore": true,
+    "features": {
+        "weighted-suggestions": true
+    },
+    "failFast": false
+}

ee/wcp/credprovider/src/credential.rs

@@ -791,7 +791,7 @@ mod tests {
         assert_eq!(flow.counts(), (1, 1));
     }
 
-    /// Ordinary behaviour at a logon screen, and each round has to leave
+    /// Ordinary behavior at a logon screen, and each round has to leave
     /// exactly one browser warming.
     #[test]
     fn reselecting_the_tile_preloads_again() {
@@ -1016,7 +1016,7 @@ mod tests {
     }
 
     /// `COMPUTER\alice` is a Windows account name; authentik would not
-    /// recognise the person by it.
+    /// recognize the person by it.
     #[test]
     fn a_local_tile_hints_the_username_without_the_computer_name() {
         let flow = FakeAuthFlow::completed("alice");

hack/cspell/overrides.txt

@@ -0,0 +1,4 @@
+# Legitimate terms that the spell checker's common-misspellings list would
+# otherwise report as typos. Only add a word here when `make lint-spellcheck`
+# flags it with a suggested "fix" and the original spelling is intentional.
+unparseable

package.json

@@ -1,5 +1,15 @@
 {
     "name": "authentik-platform",
     "private": true,
-    "packageManager": "pnpm@11.5.1"
+    "packageManager": "pnpm@12.4.0",
+    "scripts": {
+        "lint:spellcheck": "cspell . --config cspell.config.jsonc"
+    },
+    "devDependencies": {
+        "@cspell/cspell-json-reporter": "^10.3.6",
+        "cspell": "^10.3.6"
+    },
+    "engines": {
+        "node": ">=24"
+    }
 }