- Optionally ignore and log
jwt.exceptions.InvalidTokenErrors
when decoding JWT from cookie.
- Add support for Python 3.11 & 3.12
- Switch from
edx-sphinx-theme
tosphinx-book-theme
since the former is deprecated - Added support for Django 4.2
- fix:
utils.get_role_auth_claim_for_user()
now preserves the order of (role, context) pairs as returned by the get_assignment() function.
- Drop support for Django<3.2
- Replacing ugettext with gettext to resolve RemovedInDjango40 error.
- Added Django40 Support
- Replacing ugettext_lazy with gettext_lazy to resolve RemovedInDjango40Warning.
- Added support for django 3.0, 3.1, 3.2
- Modifies
create_role_auth_claim_for_user
to return a list of unique (role:context) entries, so that the JWT does not become too large to fit in cookies/headers.
- Add a
UserRoleAssignment.applies_to_all
field, because explicit is better than implicit. See the ADR at docs/decisions/0002-explicit-role-assignment-wildcard.rst.
- Update PyPI token.
- Removed
python_2_unicode_compatible
decorator.
PermissionRequiredForListingMixin.get_queryset()
should allow falseybase_queryset
properties, like an emptyQuerySet
object. Adds tests to verify that this is the case.
- Update
get_assignments()
to guard against AnonymousUsers. - Update
contexts_accessible_from_database()
to useget_assignments()
instead of building a "custom" QuerySet.
- Adds a PermissionRequiredForListingMixin that can be used in DRF ModelViewSets and supports a list action. This should allow list actions to return all of the elements from a base_queryset that the requesting user has access to, either via their JWT or DB-assigned roles.
- Adds/modifies utility functions that deal with permission-checking to support multiple roles and multiple contexts.
- Exposes a new
utils.feature_roles_from_jwt()
function, which, given a decoded JWT, will provide a mapping of feature roles to contexts/identifiers. - Modifies
utils.user_has_access_via_database()
to check for multiple database role assignments for a given user and role name (i.e. uses afilter()
instead of aget()
).
- Removed support for django 2.0 and 2.1
- Added Support for Python 3.8
- Added check for AnonymousUser in user_has_access_via_database to prevent 500 errors.
- Added support for Django 2.0, 2.1, and 2.2.
- Fix bug in implicit role check when the same role has multiple contexts available.
- Update PermissionRequiredMixin to pass through an object to rule predicates, if self.get_permision_required exists and is callable
- Updated requirements.
- Updated utils for user with multiple contexts.
- Use functools.wraps to prevent the decorator from swallowing the view name
- store current request on thread local storage using crum.
- edx-drf-extensions version upgrade.
- Removed get_request_or_stub and get_decoded_jwt_from_request from utils.py
- edx-drf-extensions version upgrade.
- Check for JWT presence in implicit permission.
- Refactor role retrieval to remove the dependency on django models for assigning roles.
- Get JWT token from request.auth if it is not set on the cookie. This supports client credentials oauth2 flow.
- Update context checks for implicit and explicit access for all resources access.
- Adding support for checking context for implicit and explicit access.
- Adding an additional argument for the permission_required decorator
- Adding a mixin for authz permissions support.
- Adding a decorator for authz permissions support.
- Adding django admin support for models extending UserRoleAssignment.
- Adding a number of utils for roles in JWTs and the database
- Adding get_context to the UserRoleAssignment class.
- Quality fixes
- Bumping version so we get pip updated with new models we added
- First release on PyPI.