Skip to content

Closes #20210: Implement new version of API token #20477

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Oct 7, 2025
Merged

Closes #20210: Implement new version of API token #20477

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
1ee23ba
Initial work on #20210
jeremystretch Oct 2, 2025
5dc48f3
Enforce a fixed key length for v2 tokens
jeremystretch Oct 2, 2025
11099b0
Rename pepper field to pepper_id for clarity
jeremystretch Oct 2, 2025
43fc7fb
Add constraints to enforce v1/v2-dependent fields
jeremystretch Oct 2, 2025
f82f084
Misc cleanup
jeremystretch Oct 2, 2025
adce67a
Standardize on the use of v2 tokens in tests
jeremystretch Oct 2, 2025
f6290dd
Toggle plaintext display for v1 tokens
jeremystretch Oct 3, 2025
d69042f
Clean up token tables
jeremystretch Oct 3, 2025
a54c508
Misc cleanup
jeremystretch Oct 3, 2025
ac335c3
Clean up filterset tests
jeremystretch Oct 3, 2025
6388705
Clean up TokenForm
jeremystretch Oct 3, 2025
917a2c2
Validate peppers on init
jeremystretch Oct 3, 2025
9b85d92
Clean up auth backend
jeremystretch Oct 3, 2025
9a68cde
Merge branch 'feature' into 20210-new-token-auth
jeremystretch Oct 3, 2025
bb75bce
Clean up tests
jeremystretch Oct 3, 2025
82db8a9
Update documentation
jeremystretch Oct 3, 2025
c63e60a
Add a token prefix
jeremystretch Oct 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
235 changes: 211 additions & 24 deletions contrib/openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166111,6 +166111,91 @@
"type": "string"
}
},
{
"in": "query",
"name": "pepper_id",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "pepper_id__empty",
"schema": {
"type": "boolean"
}
},
{
"in": "query",
"name": "pepper_id__gt",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "pepper_id__gte",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "pepper_id__lt",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "pepper_id__lte",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "pepper_id__n",
"schema": {
"type": "array",
"items": {
"type": "integer",
"format": "int32"
}
},
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "q",
Expand Down Expand Up @@ -166171,6 +166256,19 @@
"explode": true,
"style": "form"
},
{
"in": "query",
"name": "version",
"schema": {
"type": "integer",
"x-spec-enum-id": "b5df70f0bffd12cb",
"enum": [
1,
2
]
},
"description": "* `1` - v1\n* `2` - v2"
},
{
"in": "query",
"name": "write_enabled",
Expand Down Expand Up @@ -228068,6 +228166,17 @@
"type": "object",
"description": "Extends the built-in ModelSerializer to enforce calling full_clean() on a copy of the associated instance during\nvalidation. (DRF does not do this by default; see https://github.com/encode/django-rest-framework/issues/3144)",
"properties": {
"version": {
"enum": [
1,
2
],
"type": "integer",
"description": "* `1` - v1\n* `2` - v2",
"x-spec-enum-id": "b5df70f0bffd12cb",
"minimum": 0,
"maximum": 32767
},
"user": {
"oneOf": [
{
Expand All @@ -228078,6 +228187,10 @@
}
]
},
"description": {
"type": "string",
"maxLength": 200
},
"expires": {
"type": "string",
"format": "date-time",
Expand All @@ -228088,19 +228201,20 @@
"format": "date-time",
"nullable": true
},
"key": {
"type": "string",
"writeOnly": true,
"maxLength": 40,
"minLength": 40
},
"write_enabled": {
"type": "boolean",
"description": "Permit create/update/delete operations using this key"
},
"description": {
"pepper_id": {
"type": "integer",
"maximum": 32767,
"minimum": 0,
"nullable": true,
"description": "ID of the cryptographic pepper used to hash the token (v2 only)"
},
"token": {
"type": "string",
"maxLength": 200
"minLength": 1
}
}
},
Expand Down Expand Up @@ -244302,9 +244416,30 @@
"type": "string",
"readOnly": true
},
"version": {
"enum": [
1,
2
],
"type": "integer",
"description": "* `1` - v1\n* `2` - v2",
"x-spec-enum-id": "b5df70f0bffd12cb",
"minimum": 0,
"maximum": 32767
},
"key": {
"type": "string",
"readOnly": true,
"nullable": true,
"description": "v2 token identification key"
},
"user": {
"$ref": "#/components/schemas/BriefUser"
},
"description": {
"type": "string",
"maxLength": 200
},
"created": {
"type": "string",
"format": "date-time",
Expand All @@ -244324,16 +244459,23 @@
"type": "boolean",
"description": "Permit create/update/delete operations using this key"
},
"description": {
"type": "string",
"maxLength": 200
"pepper_id": {
"type": "integer",
"maximum": 32767,
"minimum": 0,
"nullable": true,
"description": "ID of the cryptographic pepper used to hash the token (v2 only)"
},
"token": {
"type": "string"
}
},
"required": [
"created",
"display",
"display_url",
"id",
"key",
"url",
"user"
]
Expand All @@ -244360,6 +244502,17 @@
"type": "string",
"readOnly": true
},
"version": {
"enum": [
1,
2
],
"type": "integer",
"description": "* `1` - v1\n* `2` - v2",
"x-spec-enum-id": "b5df70f0bffd12cb",
"minimum": 0,
"maximum": 32767
},
"user": {
"allOf": [
{
Expand All @@ -244368,6 +244521,10 @@
],
"readOnly": true
},
"key": {
"type": "string",
"readOnly": true
},
"created": {
"type": "string",
"format": "date-time",
Expand All @@ -244383,17 +244540,16 @@
"format": "date-time",
"readOnly": true
},
"key": {
"type": "string",
"readOnly": true
},
"write_enabled": {
"type": "boolean",
"description": "Permit create/update/delete operations using this key"
},
"description": {
"type": "string",
"maxLength": 200
},
"token": {
"type": "string"
}
},
"required": [
Expand All @@ -244411,6 +244567,17 @@
"type": "object",
"description": "Extends the built-in ModelSerializer to enforce calling full_clean() on a copy of the associated instance during\nvalidation. (DRF does not do this by default; see https://github.com/encode/django-rest-framework/issues/3144)",
"properties": {
"version": {
"enum": [
1,
2
],
"type": "integer",
"description": "* `1` - v1\n* `2` - v2",
"x-spec-enum-id": "b5df70f0bffd12cb",
"minimum": 0,
"maximum": 32767
},
"expires": {
"type": "string",
"format": "date-time",
Expand All @@ -244433,6 +244600,10 @@
"type": "string",
"writeOnly": true,
"minLength": 1
},
"token": {
"type": "string",
"minLength": 1
}
},
"required": [
Expand All @@ -244444,6 +244615,17 @@
"type": "object",
"description": "Extends the built-in ModelSerializer to enforce calling full_clean() on a copy of the associated instance during\nvalidation. (DRF does not do this by default; see https://github.com/encode/django-rest-framework/issues/3144)",
"properties": {
"version": {
"enum": [
1,
2
],
"type": "integer",
"description": "* `1` - v1\n* `2` - v2",
"x-spec-enum-id": "b5df70f0bffd12cb",
"minimum": 0,
"maximum": 32767
},
"user": {
"oneOf": [
{
Expand All @@ -244454,6 +244636,10 @@
}
]
},
"description": {
"type": "string",
"maxLength": 200
},
"expires": {
"type": "string",
"format": "date-time",
Expand All @@ -244464,19 +244650,20 @@
"format": "date-time",
"nullable": true
},
"key": {
"type": "string",
"writeOnly": true,
"maxLength": 40,
"minLength": 40
},
"write_enabled": {
"type": "boolean",
"description": "Permit create/update/delete operations using this key"
},
"description": {
"pepper_id": {
"type": "integer",
"maximum": 32767,
"minimum": 0,
"nullable": true,
"description": "ID of the cryptographic pepper used to hash the token (v2 only)"
},
"token": {
"type": "string",
"maxLength": 200
"minLength": 1
}
},
"required": [
Expand Down Expand Up @@ -256709,7 +256896,7 @@
"type": "apiKey",
"in": "header",
"name": "Authorization",
"description": "Token-based authentication with required prefix \"Token\""
"description": "Set `Token <token>` (v1) or `Bearer <token>` (v2) in the Authorization header"
}
}
},
Expand Down
Loading
Loading