CHANGELOG 📋

Unreleased

Releases

2.0.0

• [BREAKING] Minimum FastAPI version increased to 0.124.0.

• [BREAKING] Requires() now takes only keyword arguments to avoid argument-ordering confusion.

• [BREAKING] For Indigo tokens, populates AuthContext.user_id based on preferred_username claim. This allows us to have a consistent user_id value between Indigo and Entra ID tokens.

• Adds Role.INTERNAL and Role.SCI_COMMUNITY.

• Deprecates Role.OPS_REVIEWER_TECHNICAL, Role.OPS_REVIEWER_SCIENCE, and Role.OPS_PROPOSAL_ADMIN.

• Bugfix: watchdog() would raise false positive SecurityHoleError because it missed nested Requires() policies.

• Warn callers when using audience values that lack ‘test:’ or ‘live:’ prefixes.

• Adds support for Requires(groups=) to enforce that a token contains particular group memberships.

• Restores Entra Role.APP2PP functionality: Detects Indigo client credentials tokens and assigns Role.APP2APP.

• verify_auth now includes required groups in CSV and JSON policy outputs.

1.5.0

• Adds support for Indigo IAM access tokens alongside Entra ID tokens.

• Changed: Requires(audience=) parameter now accepts an iterable of strings or a single string.

1.4.0

• Adds support for Microsoft Entra ‘app tokens’ for app2app flows without a user present.

• Adds ‘AuthContext.token_claims’ to provide easy access to decoded claims from the access token.

• Relaxes library dependencies so authlib won’t block consumers updating their FastAPI.

• Supports both v1 and v2 MS Entra ‘iss’ claims.

1.3.0

• Bugfix: enforce Role enum on Requires(roles={})

• Adds verify_auth script to auto-generate policy summaries.

• Relaxed validation rules to accept api:// prefix in token aud claims.

1.2.0

• Added OPERATIONS_SCIENTIST role

1.1.0

• Added OPS_PROPOSAL_ADMIN, OPS_REVIEWER_SCIENCE and OPS_REVIEWER_TECHNICAL Roles for the PHT

1.0

• Initial release: utilities for enforcing authorisation rules in SKAO applications.