All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- Raises a more specific exception
ForbiddenError
when the user of an operation is authenticated properly, but authorization fails. This enables better handling of authorization error, differentiating when the user context is missing or invalid, and when the context is valid but the user has no rights to do a certain operation. See #371.
- Improves the automatic rotation of
JWKS
: when validatingJWTs
,JWKS
are refreshed automatically if an unknownkid
is encountered, andJWKS
were last fetched more thanrefresh_time
seconds ago (by default 120 seconds). - Corrects an inconsistency in how
claims
are read in theUser
class.
- Adds built-in support for dependency injection, using the new
ContainerProtocol
inrodi
v2. - Removes the synchronous code API, maintaining only the asynchronous code API
for
AuthenticationStrategy.authenticate
andAuthoreoizationStrategy.authorize
. - Replaces
setup.py
withpyproject.toml
. - Reduces imports verbosity.
- Improves the
identity_getter
code API. - Corrects
Identity.__getitem__
to raiseKeyError
if a claim is missing.
- Workflow maintenance.
- Adds
sub
,access_token
, andrefresh_token
properties to theIdentity
. class - Adds
py.typed
file.
- Adds classes to handle
JWT
s validation, but only forRSA
keys. - Fixes issue (wrong arrangement in test) #5.
- Includes
Python 3.10
in the CI/CD matrix. - Enforces
black
andisort
in the CI pipeline.
- Corrects a bug in the
Policy
class (#2). - Changes the type annotation of
Identity
claims (#3).
- Completely migrates to GitHub Workflows.
- Improves build to test Python 3.6 and 3.9.
- Adds a changelog.
- Improves badges.
- Improves code quality using
flake8
andblack
.