|
1 |
| -Changelog |
2 |
| -========= |
3 |
| - |
4 |
| -1.3.0 [unreleased] |
5 |
| ------------------- |
6 |
| - |
7 |
| -* Fix a race condition in creation of AccessToken with external oauth2 server. |
8 |
| -* **Backwards-incompatible** squashed migrations: |
9 |
| - If you are currently on a release < 1.2.0, you will need to first install 1.2.x then `manage.py migrate` before |
10 |
| - upgrading to >= 1.3.0. |
11 |
| - |
12 |
| - |
13 |
| -1.2.0 [2018-06-03] |
14 |
| ------------------- |
15 |
| - |
16 |
| -* **Compatibility**: Python 3.4 is the new minimum required version. |
17 |
| -* **Compatibility**: Django 2.0 is the new minimum required version. |
18 |
| -* **New feature**: Added TokenMatchesOASRequirements Permissions. |
19 |
| -* validators.URIValidator has been updated to match URLValidator behaviour more closely. |
20 |
| -* Moved `redirect_uris` validation to the application clean() method. |
21 |
| - |
22 |
| - |
23 |
| -1.1.2 [2018-05-12] |
24 |
| ------------------- |
25 |
| - |
26 |
| -* Return state with Authorization Denied error (RFC6749 section 4.1.2.1) |
27 |
| -* Fix a crash with malformed base64 authentication headers |
28 |
| -* Fix a crash with malformed IPv6 redirect URIs |
29 |
| - |
30 |
| - |
31 |
| -1.1.1 [2018-05-08] |
32 |
| ------------------- |
33 |
| - |
34 |
| -* **Critical**: Django OAuth Toolkit 1.1.0 contained a migration that would revoke all existing |
35 |
| - RefreshTokens (`0006_auto_20171214_2232`). This release corrects the migration. |
36 |
| - If you have already ran it in production, please see the following issue for more details: |
37 |
| - https://github.com/jazzband/django-oauth-toolkit/issues/589 |
38 |
| - |
39 |
| - |
40 |
| -1.1.0 [2018-04-13] |
41 |
| ------------------- |
42 |
| - |
43 |
| -* **Notice**: The Django OAuth Toolkit project is now hosted by JazzBand. |
44 |
| -* **Compatibility**: Django 1.11 is the new minimum required version. Django 1.10 is no longer supported. |
45 |
| -* **Compatibility**: This will be the last release to support Django 1.11 and Python 2.7. |
46 |
| -* **New feature**: Option for RFC 7662 external AS that uses HTTP Basic Auth. |
47 |
| -* **New feature**: Individual applications may now override the `ALLOWED_REDIRECT_URI_SCHEMES` |
48 |
| - setting by returning a list of allowed redirect uri schemes in `Application.get_allowed_schemes()`. |
49 |
| -* **New feature**: The new setting `ERROR_RESPONSE_WITH_SCOPES` can now be set to True to include required |
50 |
| - scopes when DRF authorization fails due to improper scopes. |
51 |
| -* **New feature**: The new setting `REFRESH_TOKEN_GRACE_PERIOD_SECONDS` controls a grace period during which |
52 |
| - refresh tokens may be re-used. |
53 |
| -* An `app_authorized` signal is fired when a token is generated. |
54 |
| - |
55 |
| - |
56 |
| -1.0.0 [2017-06-07] |
57 |
| ------------------- |
58 |
| - |
59 |
| -* **New feature**: AccessToken, RefreshToken and Grant models are now swappable. |
60 |
| -* #477: **New feature**: Add support for RFC 7662 (IntrospectTokenView, introspect scope) |
61 |
| -* **Compatibility**: Django 1.10 is the new minimum required version |
62 |
| -* **Compatibility**: Django 1.11 is now supported |
63 |
| -* **Backwards-incompatible**: The `oauth2_provider.ext.rest_framework` module |
64 |
| - has been moved to `oauth2_provider.contrib.rest_framework` |
65 |
| -* #177: Changed `id` field on Application, AccessToken, RefreshToken and Grant to BigAutoField (bigint/bigserial) |
66 |
| -* #321: Added `created` and `updated` auto fields to Application, AccessToken, RefreshToken and Grant |
67 |
| -* #476: Disallow empty redirect URIs |
68 |
| -* Fixed bad `url` parameter in some error responses. |
69 |
| -* Django 2.0 compatibility fixes. |
70 |
| -* The dependency on django-braces has been dropped. |
71 |
| -* The oauthlib dependency is no longer pinned. |
72 |
| - |
73 |
| - |
74 |
| -0.12.0 [2017-02-24] |
75 |
| -------------------- |
76 |
| - |
77 |
| -* **New feature**: Class-based scopes backends. Listing scopes, available scopes and default scopes |
78 |
| - is now done through the class that the `SCOPES_BACKEND_CLASS` setting points to. |
79 |
| - By default, this is set to `oauth2_provider.scopes.SettingsScopes` which implements the |
80 |
| - legacy settings-based scope behaviour. No changes are necessary. |
81 |
| -* **Dropped support for Python 3.2 and Python 3.3**, added support for Python 3.6 |
82 |
| -* Support for the `scopes` query parameter, deprecated in 0.6.1, has been dropped |
83 |
| -* #448: Added support for customizing applications' allowed grant types |
84 |
| -* #141: The `is_usable(request)` method on the Application model can be overridden to dynamically |
85 |
| - enable or disable applications. |
86 |
| -* #434: Relax URL patterns to allow for UUID primary keys |
87 |
| - |
88 |
| - |
89 |
| -0.11.0 [2016-12-1] |
90 |
| ------------------- |
91 |
| - |
92 |
| -* #424: Added a ROTATE_REFRESH_TOKEN setting to control whether refresh tokens are reused or not |
93 |
| -* #315: AuthorizationView does not overwrite requests on get |
94 |
| -* #425: Added support for Django 1.10 |
95 |
| -* #396: Added an IsAuthenticatedOrTokenHasScope Permission |
96 |
| -* #357: Support multiple-user clients by allowing User to be NULL for Applications |
97 |
| -* #389: Reuse refresh tokens if enabled. |
98 |
| - |
99 |
| - |
100 |
| -0.10.0 [2015-12-14] |
101 |
| -------------------- |
102 |
| - |
103 |
| -* **#322: dropping support for python 2.6 and django 1.4, 1.5, 1.6** |
104 |
| -* #310: Fixed error that could occur sometimes when checking validity of incomplete AccessToken/Grant |
105 |
| -* #333: Added possibility to specify the default list of scopes returned when scope parameter is missing |
106 |
| -* #325: Added management views of issued tokens |
107 |
| -* #249: Added a command to clean expired tokens |
108 |
| -* #323: Application registration view uses custom application model in form class |
109 |
| -* #299: 'server_class' is now pluggable through Django settings |
110 |
| -* #309: Add the py35-django19 env to travis |
111 |
| -* #308: Use compact syntax for tox envs |
112 |
| -* #306: Django 1.9 compatibility |
113 |
| -* #288: Put additional information when generating token responses |
114 |
| -* #297: Fixed doc about SessionAuthenticationMiddleware |
115 |
| -* #273: Generic read write scope by resource |
116 |
| - |
117 |
| - |
118 |
| -0.9.0 [2015-07-28] |
119 |
| ------------------- |
120 |
| - |
121 |
| -* ``oauthlib_backend_class`` is now pluggable through Django settings |
122 |
| -* #127: ``application/json`` Content-Type is now supported using ``JSONOAuthLibCore`` |
123 |
| -* #238: Fixed redirect uri handling in case of error |
124 |
| -* #229: Invalidate access tokens when getting a new refresh token |
125 |
| -* added support for oauthlib 1.0 |
126 |
| - |
127 |
| - |
128 |
| -0.8.2 [2015-06-25] |
129 |
| ------------------- |
130 |
| - |
131 |
| -* Fix the migrations to be two-step and allow upgrade from 0.7.2 |
132 |
| - |
133 |
| - |
134 |
| -0.8.1 [2015-04-27] |
135 |
| ------------------- |
136 |
| - |
137 |
| -* South migrations fixed. Added new django migrations. |
138 |
| - |
139 |
| - |
140 |
| -0.8.0 [2015-03-27] |
141 |
| ------------------- |
142 |
| - |
143 |
| -* Several docs improvements and minor fixes |
144 |
| -* #185: fixed vulnerabilities on Basic authentication |
145 |
| -* #173: ProtectResourceMixin now allows OPTIONS requests |
146 |
| -* Fixed client_id and client_secret characters set |
147 |
| -* #169: hide sensitive informations in error emails |
148 |
| -* #161: extend search to all token types when revoking a token |
149 |
| -* #160: return empty response on successful token revocation |
150 |
| -* #157: skip authorization form with ``skip_authorization_completely`` class field |
151 |
| -* #155: allow custom uri schemes |
152 |
| -* fixed ``get_application_model`` on Django 1.7 |
153 |
| -* fixed non rotating refresh tokens |
154 |
| -* #137: fixed base template |
155 |
| -* customized ``client_secret`` lenght |
156 |
| -* #38: create access tokens not bound to a user instance for *client credentials* flow |
157 |
| - |
158 |
| - |
159 |
| -0.7.2 [2014-07-02] |
160 |
| ------------------- |
161 |
| - |
162 |
| -* Don't pin oauthlib |
163 |
| - |
164 |
| - |
165 |
| -0.7.0 [2014-03-01] |
166 |
| ------------------- |
167 |
| - |
168 |
| -* Created a setting for the default value for approval prompt. |
169 |
| -* Improved docs |
170 |
| -* Don't pin django-braces and six versions |
171 |
| - |
172 |
| -**Backwards incompatible changes in 0.7.0** |
173 |
| - |
174 |
| -* Make Application model truly "swappable" (introduces a new non-namespaced setting OAUTH2_PROVIDER_APPLICATION_MODEL) |
175 |
| - |
176 |
| - |
177 |
| -0.6.1 [2014-02-05] |
178 |
| ------------------- |
179 |
| - |
180 |
| - * added support for `scope` query parameter keeping backwards compatibility for the original `scopes` parameter. |
181 |
| - * __str__ method in Application model returns name when available |
182 |
| - |
183 |
| - |
184 |
| -0.6.0 [2014-01-26] |
185 |
| ------------------- |
186 |
| - |
187 |
| - * oauthlib 0.6.1 support |
188 |
| - * Django dev branch support |
189 |
| - * Python 2.6 support |
190 |
| - * Skip authorization form via `approval_prompt` parameter |
191 |
| - |
192 |
| -**Bugfixes** |
193 |
| - |
194 |
| - * Several fixes to the docs |
195 |
| - * Issue #71: Fix migrations |
196 |
| - * Issue #65: Use OAuth2 password grant with multiple devices |
197 |
| - * Issue #84: Add information about login template to tutorial. |
198 |
| - * Issue #64: Fix urlencode clientid secret |
199 |
| - |
200 |
| - |
201 |
| -0.5.0 [2013-09-17] |
202 |
| ------------------- |
203 |
| - |
204 |
| - * oauthlib 0.6.0 support |
205 |
| - |
206 |
| -**Backwards incompatible changes in 0.5.0** |
207 |
| - |
208 |
| - * backends.py module has been renamed to oauth2_backends.py so you should change your imports whether you're extending this module |
209 |
| - |
210 |
| -**Bugfixes** |
211 |
| - |
212 |
| - * Issue #54: Auth backend proposal to address #50 |
213 |
| - * Issue #61: Fix contributing page |
214 |
| - * Issue #55: Add support for authenticating confidential client with request body params |
215 |
| - * Issue #53: Quote characters in the url query that are safe for Django but not for oauthlib |
216 |
| - |
217 |
| -0.4.1 [2013-09-06] |
218 |
| ------------------- |
219 |
| - |
220 |
| - * Optimize queries on access token validation |
221 |
| - |
222 |
| -0.4.0 [2013-08-09] |
223 |
| ------------------- |
224 |
| - |
225 |
| -**New Features** |
226 |
| - |
227 |
| - * Add Application management views, you no more need the admin to register, update and delete your application. |
228 |
| - * Add support to configurable application model |
229 |
| - * Add support for function based views |
230 |
| - |
231 |
| -**Backwards incompatible changes in 0.4.0** |
232 |
| - |
233 |
| - * `SCOPE` attribute in settings is now a dictionary to store `{'scope_name': 'scope_description'}` |
234 |
| - * Namespace 'oauth2_provider' is mandatory in urls. See issue #36 |
235 |
| - |
236 |
| -**Bugfixes** |
237 |
| - |
238 |
| - * Issue #25: Bug in the Basic Auth parsing in Oauth2RequestValidator |
239 |
| - * Issue #24: Avoid generation of client_id with ":" colon char when using HTTP Basic Auth |
240 |
| - * Issue #21: IndexError when trying to authorize an application |
241 |
| - * Issue #9: Default_redirect_uri is mandatory when grant_type is implicit, authorization_code or all-in-one |
242 |
| - * Issue #22: Scopes need a verbose description |
243 |
| - * Issue #33: Add django-oauth-toolkit version on example main page |
244 |
| - * Issue #36: Add mandatory namespace to urls |
245 |
| - * Issue #31: Add docstring to OAuthToolkitError and FatalClientError |
246 |
| - * Issue #32: Add docstring to validate_uris |
247 |
| - * Issue #34: Documentation tutorial part1 needs corsheaders explanation |
248 |
| - * Issue #36: Add mandatory namespace to urls |
249 |
| - * Issue #45: Add docs for AbstractApplication |
250 |
| - * Issue #47: Add docs for views decorators |
251 |
| - |
252 |
| -0.3.2 [2013-07-10] |
253 |
| ------------------- |
254 |
| - |
255 |
| - * Bugfix #37: Error in migrations with custom user on Django 1.5 |
256 |
| - |
257 |
| -0.3.1 [2013-07-10] |
258 |
| ------------------- |
259 |
| - |
260 |
| - * Bugfix #27: OAuthlib refresh token refactoring |
261 |
| - |
262 |
| -0.3.0 [2013-06-14] |
263 |
| ------------------- |
264 |
| - |
265 |
| - * `Django REST Framework <http://django-rest-framework.org/>`_ integration layer |
266 |
| - * Bugfix #13: Populate request with client and user in validate_bearer_token |
267 |
| - * Bugfix #12: Fix paths in documentation |
268 |
| - |
269 |
| -**Backwards incompatible changes in 0.3.0** |
270 |
| - |
271 |
| - * `requested_scopes` parameter in ScopedResourceMixin changed to `required_scopes` |
272 |
| - |
273 |
| -0.2.1 [2013-06-06] |
274 |
| ------------------- |
275 |
| - |
276 |
| - * Core optimizations |
277 |
| - |
278 |
| -0.2.0 [2013-06-05] |
279 |
| ------------------- |
280 |
| - |
281 |
| - * Add support for Django1.4 and Django1.6 |
282 |
| - * Add support for Python 3.3 |
283 |
| - * Add a default ReadWriteScoped view |
284 |
| - * Add tutorial to docs |
285 |
| - |
286 |
| -0.1.0 [2013-05-31] |
287 |
| ------------------- |
288 |
| - |
289 |
| - * Support OAuth2 Authorization Flows |
290 |
| - |
291 |
| -0.0.0 [2013-05-17] |
292 |
| ------------------- |
293 |
| - |
294 |
| - * Discussion with Daniel Greenfeld at Django Circus |
295 |
| - * Ignition |
| 1 | +.. mdinclude:: ../CHANGELOG.md |
0 commit comments