|
1 | | -Changelog |
2 | | -========= |
3 | | - |
4 | | -1.3.0 [unreleased] |
5 | | ------------------- |
6 | | - |
7 | | -* Fix a race condition in creation of AccessToken with external oauth2 server. |
8 | | -* **Backwards-incompatible** squashed migrations: |
9 | | - If you are currently on a release < 1.2.0, you will need to first install 1.2.x then `manage.py migrate` before |
10 | | - upgrading to >= 1.3.0. |
11 | | - |
12 | | - |
13 | | -1.2.0 [2018-06-03] |
14 | | ------------------- |
15 | | - |
16 | | -* **Compatibility**: Python 3.4 is the new minimum required version. |
17 | | -* **Compatibility**: Django 2.0 is the new minimum required version. |
18 | | -* **New feature**: Added TokenMatchesOASRequirements Permissions. |
19 | | -* validators.URIValidator has been updated to match URLValidator behaviour more closely. |
20 | | -* Moved `redirect_uris` validation to the application clean() method. |
21 | | - |
22 | | - |
23 | | -1.1.2 [2018-05-12] |
24 | | ------------------- |
25 | | - |
26 | | -* Return state with Authorization Denied error (RFC6749 section 4.1.2.1) |
27 | | -* Fix a crash with malformed base64 authentication headers |
28 | | -* Fix a crash with malformed IPv6 redirect URIs |
29 | | - |
30 | | - |
31 | | -1.1.1 [2018-05-08] |
32 | | ------------------- |
33 | | - |
34 | | -* **Critical**: Django OAuth Toolkit 1.1.0 contained a migration that would revoke all existing |
35 | | - RefreshTokens (`0006_auto_20171214_2232`). This release corrects the migration. |
36 | | - If you have already ran it in production, please see the following issue for more details: |
37 | | - https://github.com/jazzband/django-oauth-toolkit/issues/589 |
38 | | - |
39 | | - |
40 | | -1.1.0 [2018-04-13] |
41 | | ------------------- |
42 | | - |
43 | | -* **Notice**: The Django OAuth Toolkit project is now hosted by JazzBand. |
44 | | -* **Compatibility**: Django 1.11 is the new minimum required version. Django 1.10 is no longer supported. |
45 | | -* **Compatibility**: This will be the last release to support Django 1.11 and Python 2.7. |
46 | | -* **New feature**: Option for RFC 7662 external AS that uses HTTP Basic Auth. |
47 | | -* **New feature**: Individual applications may now override the `ALLOWED_REDIRECT_URI_SCHEMES` |
48 | | - setting by returning a list of allowed redirect uri schemes in `Application.get_allowed_schemes()`. |
49 | | -* **New feature**: The new setting `ERROR_RESPONSE_WITH_SCOPES` can now be set to True to include required |
50 | | - scopes when DRF authorization fails due to improper scopes. |
51 | | -* **New feature**: The new setting `REFRESH_TOKEN_GRACE_PERIOD_SECONDS` controls a grace period during which |
52 | | - refresh tokens may be re-used. |
53 | | -* An `app_authorized` signal is fired when a token is generated. |
54 | | - |
55 | | - |
56 | | -1.0.0 [2017-06-07] |
57 | | ------------------- |
58 | | - |
59 | | -* **New feature**: AccessToken, RefreshToken and Grant models are now swappable. |
60 | | -* #477: **New feature**: Add support for RFC 7662 (IntrospectTokenView, introspect scope) |
61 | | -* **Compatibility**: Django 1.10 is the new minimum required version |
62 | | -* **Compatibility**: Django 1.11 is now supported |
63 | | -* **Backwards-incompatible**: The `oauth2_provider.ext.rest_framework` module |
64 | | - has been moved to `oauth2_provider.contrib.rest_framework` |
65 | | -* #177: Changed `id` field on Application, AccessToken, RefreshToken and Grant to BigAutoField (bigint/bigserial) |
66 | | -* #321: Added `created` and `updated` auto fields to Application, AccessToken, RefreshToken and Grant |
67 | | -* #476: Disallow empty redirect URIs |
68 | | -* Fixed bad `url` parameter in some error responses. |
69 | | -* Django 2.0 compatibility fixes. |
70 | | -* The dependency on django-braces has been dropped. |
71 | | -* The oauthlib dependency is no longer pinned. |
72 | | - |
73 | | - |
74 | | -0.12.0 [2017-02-24] |
75 | | -------------------- |
76 | | - |
77 | | -* **New feature**: Class-based scopes backends. Listing scopes, available scopes and default scopes |
78 | | - is now done through the class that the `SCOPES_BACKEND_CLASS` setting points to. |
79 | | - By default, this is set to `oauth2_provider.scopes.SettingsScopes` which implements the |
80 | | - legacy settings-based scope behaviour. No changes are necessary. |
81 | | -* **Dropped support for Python 3.2 and Python 3.3**, added support for Python 3.6 |
82 | | -* Support for the `scopes` query parameter, deprecated in 0.6.1, has been dropped |
83 | | -* #448: Added support for customizing applications' allowed grant types |
84 | | -* #141: The `is_usable(request)` method on the Application model can be overridden to dynamically |
85 | | - enable or disable applications. |
86 | | -* #434: Relax URL patterns to allow for UUID primary keys |
87 | | - |
88 | | - |
89 | | -0.11.0 [2016-12-1] |
90 | | ------------------- |
91 | | - |
92 | | -* #424: Added a ROTATE_REFRESH_TOKEN setting to control whether refresh tokens are reused or not |
93 | | -* #315: AuthorizationView does not overwrite requests on get |
94 | | -* #425: Added support for Django 1.10 |
95 | | -* #396: Added an IsAuthenticatedOrTokenHasScope Permission |
96 | | -* #357: Support multiple-user clients by allowing User to be NULL for Applications |
97 | | -* #389: Reuse refresh tokens if enabled. |
98 | | - |
99 | | - |
100 | | -0.10.0 [2015-12-14] |
101 | | -------------------- |
102 | | - |
103 | | -* **#322: dropping support for python 2.6 and django 1.4, 1.5, 1.6** |
104 | | -* #310: Fixed error that could occur sometimes when checking validity of incomplete AccessToken/Grant |
105 | | -* #333: Added possibility to specify the default list of scopes returned when scope parameter is missing |
106 | | -* #325: Added management views of issued tokens |
107 | | -* #249: Added a command to clean expired tokens |
108 | | -* #323: Application registration view uses custom application model in form class |
109 | | -* #299: 'server_class' is now pluggable through Django settings |
110 | | -* #309: Add the py35-django19 env to travis |
111 | | -* #308: Use compact syntax for tox envs |
112 | | -* #306: Django 1.9 compatibility |
113 | | -* #288: Put additional information when generating token responses |
114 | | -* #297: Fixed doc about SessionAuthenticationMiddleware |
115 | | -* #273: Generic read write scope by resource |
116 | | - |
117 | | - |
118 | | -0.9.0 [2015-07-28] |
119 | | ------------------- |
120 | | - |
121 | | -* ``oauthlib_backend_class`` is now pluggable through Django settings |
122 | | -* #127: ``application/json`` Content-Type is now supported using ``JSONOAuthLibCore`` |
123 | | -* #238: Fixed redirect uri handling in case of error |
124 | | -* #229: Invalidate access tokens when getting a new refresh token |
125 | | -* added support for oauthlib 1.0 |
126 | | - |
127 | | - |
128 | | -0.8.2 [2015-06-25] |
129 | | ------------------- |
130 | | - |
131 | | -* Fix the migrations to be two-step and allow upgrade from 0.7.2 |
132 | | - |
133 | | - |
134 | | -0.8.1 [2015-04-27] |
135 | | ------------------- |
136 | | - |
137 | | -* South migrations fixed. Added new django migrations. |
138 | | - |
139 | | - |
140 | | -0.8.0 [2015-03-27] |
141 | | ------------------- |
142 | | - |
143 | | -* Several docs improvements and minor fixes |
144 | | -* #185: fixed vulnerabilities on Basic authentication |
145 | | -* #173: ProtectResourceMixin now allows OPTIONS requests |
146 | | -* Fixed client_id and client_secret characters set |
147 | | -* #169: hide sensitive informations in error emails |
148 | | -* #161: extend search to all token types when revoking a token |
149 | | -* #160: return empty response on successful token revocation |
150 | | -* #157: skip authorization form with ``skip_authorization_completely`` class field |
151 | | -* #155: allow custom uri schemes |
152 | | -* fixed ``get_application_model`` on Django 1.7 |
153 | | -* fixed non rotating refresh tokens |
154 | | -* #137: fixed base template |
155 | | -* customized ``client_secret`` lenght |
156 | | -* #38: create access tokens not bound to a user instance for *client credentials* flow |
157 | | - |
158 | | - |
159 | | -0.7.2 [2014-07-02] |
160 | | ------------------- |
161 | | - |
162 | | -* Don't pin oauthlib |
163 | | - |
164 | | - |
165 | | -0.7.0 [2014-03-01] |
166 | | ------------------- |
167 | | - |
168 | | -* Created a setting for the default value for approval prompt. |
169 | | -* Improved docs |
170 | | -* Don't pin django-braces and six versions |
171 | | - |
172 | | -**Backwards incompatible changes in 0.7.0** |
173 | | - |
174 | | -* Make Application model truly "swappable" (introduces a new non-namespaced setting OAUTH2_PROVIDER_APPLICATION_MODEL) |
175 | | - |
176 | | - |
177 | | -0.6.1 [2014-02-05] |
178 | | ------------------- |
179 | | - |
180 | | - * added support for `scope` query parameter keeping backwards compatibility for the original `scopes` parameter. |
181 | | - * __str__ method in Application model returns name when available |
182 | | - |
183 | | - |
184 | | -0.6.0 [2014-01-26] |
185 | | ------------------- |
186 | | - |
187 | | - * oauthlib 0.6.1 support |
188 | | - * Django dev branch support |
189 | | - * Python 2.6 support |
190 | | - * Skip authorization form via `approval_prompt` parameter |
191 | | - |
192 | | -**Bugfixes** |
193 | | - |
194 | | - * Several fixes to the docs |
195 | | - * Issue #71: Fix migrations |
196 | | - * Issue #65: Use OAuth2 password grant with multiple devices |
197 | | - * Issue #84: Add information about login template to tutorial. |
198 | | - * Issue #64: Fix urlencode clientid secret |
199 | | - |
200 | | - |
201 | | -0.5.0 [2013-09-17] |
202 | | ------------------- |
203 | | - |
204 | | - * oauthlib 0.6.0 support |
205 | | - |
206 | | -**Backwards incompatible changes in 0.5.0** |
207 | | - |
208 | | - * backends.py module has been renamed to oauth2_backends.py so you should change your imports whether you're extending this module |
209 | | - |
210 | | -**Bugfixes** |
211 | | - |
212 | | - * Issue #54: Auth backend proposal to address #50 |
213 | | - * Issue #61: Fix contributing page |
214 | | - * Issue #55: Add support for authenticating confidential client with request body params |
215 | | - * Issue #53: Quote characters in the url query that are safe for Django but not for oauthlib |
216 | | - |
217 | | -0.4.1 [2013-09-06] |
218 | | ------------------- |
219 | | - |
220 | | - * Optimize queries on access token validation |
221 | | - |
222 | | -0.4.0 [2013-08-09] |
223 | | ------------------- |
224 | | - |
225 | | -**New Features** |
226 | | - |
227 | | - * Add Application management views, you no more need the admin to register, update and delete your application. |
228 | | - * Add support to configurable application model |
229 | | - * Add support for function based views |
230 | | - |
231 | | -**Backwards incompatible changes in 0.4.0** |
232 | | - |
233 | | - * `SCOPE` attribute in settings is now a dictionary to store `{'scope_name': 'scope_description'}` |
234 | | - * Namespace 'oauth2_provider' is mandatory in urls. See issue #36 |
235 | | - |
236 | | -**Bugfixes** |
237 | | - |
238 | | - * Issue #25: Bug in the Basic Auth parsing in Oauth2RequestValidator |
239 | | - * Issue #24: Avoid generation of client_id with ":" colon char when using HTTP Basic Auth |
240 | | - * Issue #21: IndexError when trying to authorize an application |
241 | | - * Issue #9: Default_redirect_uri is mandatory when grant_type is implicit, authorization_code or all-in-one |
242 | | - * Issue #22: Scopes need a verbose description |
243 | | - * Issue #33: Add django-oauth-toolkit version on example main page |
244 | | - * Issue #36: Add mandatory namespace to urls |
245 | | - * Issue #31: Add docstring to OAuthToolkitError and FatalClientError |
246 | | - * Issue #32: Add docstring to validate_uris |
247 | | - * Issue #34: Documentation tutorial part1 needs corsheaders explanation |
248 | | - * Issue #36: Add mandatory namespace to urls |
249 | | - * Issue #45: Add docs for AbstractApplication |
250 | | - * Issue #47: Add docs for views decorators |
251 | | - |
252 | | -0.3.2 [2013-07-10] |
253 | | ------------------- |
254 | | - |
255 | | - * Bugfix #37: Error in migrations with custom user on Django 1.5 |
256 | | - |
257 | | -0.3.1 [2013-07-10] |
258 | | ------------------- |
259 | | - |
260 | | - * Bugfix #27: OAuthlib refresh token refactoring |
261 | | - |
262 | | -0.3.0 [2013-06-14] |
263 | | ------------------- |
264 | | - |
265 | | - * `Django REST Framework <http://django-rest-framework.org/>`_ integration layer |
266 | | - * Bugfix #13: Populate request with client and user in validate_bearer_token |
267 | | - * Bugfix #12: Fix paths in documentation |
268 | | - |
269 | | -**Backwards incompatible changes in 0.3.0** |
270 | | - |
271 | | - * `requested_scopes` parameter in ScopedResourceMixin changed to `required_scopes` |
272 | | - |
273 | | -0.2.1 [2013-06-06] |
274 | | ------------------- |
275 | | - |
276 | | - * Core optimizations |
277 | | - |
278 | | -0.2.0 [2013-06-05] |
279 | | ------------------- |
280 | | - |
281 | | - * Add support for Django1.4 and Django1.6 |
282 | | - * Add support for Python 3.3 |
283 | | - * Add a default ReadWriteScoped view |
284 | | - * Add tutorial to docs |
285 | | - |
286 | | -0.1.0 [2013-05-31] |
287 | | ------------------- |
288 | | - |
289 | | - * Support OAuth2 Authorization Flows |
290 | | - |
291 | | -0.0.0 [2013-05-17] |
292 | | ------------------- |
293 | | - |
294 | | - * Discussion with Daniel Greenfeld at Django Circus |
295 | | - * Ignition |
| 1 | +.. mdinclude:: ../CHANGELOG.md |
0 commit comments