Release v4.2.0: Token-based Authentication feature #78
Conversation
obervinov
added
documentation
There was a problem hiding this comment.
Pull request overview
This PR introduces token-based authentication functionality (v4.2.0) to enable temporary access for frontend applications (web UIs, mobile apps, CLI tools) without storing user credentials. The implementation uses PBKDF2 hashing with salts for secure token storage and includes single-use token enforcement.
Key Changes
- Added three new token management methods:
issue_token(),validate_token(), andrevoke_token() - Implemented PBKDF2-based token hashing with 100,000 iterations and unique salts per token
- Added backward compatibility for deployments without the
users_tokensdatabase table
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
| users/users.py | Added three token management methods (issue_token, validate_token, revoke_token) with PBKDF2 security |
| users/storage.py | Added database operations for token storage, retrieval, and marking as used with backward compatibility checks |
| tests/test_tokens.py | Comprehensive test suite covering token lifecycle, security, expiration, single-use enforcement, and edge cases |
| tests/postgres/tables.sql | Added users_tokens table schema with indexed user_id for token storage |
| pyproject.toml | Version bump from 4.1.3 to 4.2.0 |
| README.md | Added extensive documentation for token authentication feature with usage examples and security details |
| CHANGELOG.md | Added v4.2.0 release notes documenting the new token authentication feature |
| .github/copilot-instructions.md | New file documenting project architecture, conventions, and token authentication implementation guidelines |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| token_hash = hashlib.pbkdf2_hmac('sha256', token_id.encode(), token_salt.encode(), 100_000).hex() | ||
|
|
||
| # Calculate expiration | ||
| expires_at = datetime.now() + timedelta(minutes=ttl_minutes) |
There was a problem hiding this comment.
Using datetime.now() without timezone information can lead to inconsistencies when comparing timestamps across different systems or when the database uses timezone-aware timestamps. Consider using datetime.now(timezone.utc) or datetime.utcnow() for consistency with the PostgreSQL NOW() function which returns UTC time by default.
There was a problem hiding this comment.
I've made a separate issue on this and plan to fix it in the future #79
v4.2.0 - 2025-12-31
What's Changed
Full Changelog: v4.1.3...v4.2.0 by @obervinov in #78
🚀 Features
issue_token,validate_token,revoke_tokenusers_tokenstable