Merge pull request #342 from jazzband/develop

Prepare next release

.codecov.yml

@@ -0,0 +1,11 @@
+coverage:
+  status:
+    project:
+      default: false
+      tests:
+        paths: tests
+        informational: true
+      knox:
+        paths: knox
+        informational: true
+    patch: off

.coveragerc

@@ -0,0 +1,5 @@
+[run]
+branch = True
+source = knox
+omit =
+    */migrations/*

.github/workflows/gh-pages.yml

@@ -0,0 +1,34 @@
+name: Publish Docs to GitHub Pages
+
+permissions:
+  contents: write
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: 3.x
+
+      - name: Install dependencies
+        run: pip install mkdocs-material
+
+      - name: Build docs
+        run: mkdocs build
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          personal_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./site

.github/workflows/test.yml

@@ -9,23 +9,23 @@ jobs:
       fail-fast: false
       max-parallel: 5
       matrix:
-        python-version: ['3.6', '3.7', '3.8', '3.9', '3.10']
+        python-version: ['3.6', '3.7', '3.8', '3.9', '3.10', '3.11', '3.12']
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
 
     - name: Get pip cache dir
       id: pip-cache
       run: |
-        echo "::set-output name=dir::$(pip cache dir)"
+        echo "dir=$(pip cache dir)" >> $GITHUB_OUTPUT
 
     - name: Cache
-      uses: actions/cache@v2
+      uses: actions/cache@v3
       with:
         path: ${{ steps.pip-cache.outputs.dir }}
         key:
@@ -36,8 +36,14 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        python -m pip install --upgrade tox tox-gh-actions
+        python -m pip install --upgrade tox tox-gh-actions coverage
 
     - name: Tox tests
       run: |
         tox -v
+
+    - name: Generate coverage XML report
+      run: coverage xml
+
+    - name: Codecov
+      uses: codecov/codecov-action@v3

.gitignore

@@ -57,3 +57,6 @@ docs/_build/
 target/
 db.sqlite3
 site/
+
+# PyCharm Project
+.idea

.pre-commit-config.yaml

@@ -0,0 +1,9 @@
+repos:
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+  - repo: https://github.com/PyCQA/flake8
+    rev: 7.0.0
+    hooks:
+      - id: flake8

CHANGELOG.md

@@ -1,7 +1,29 @@
+## 5.0.0
+- Tokens created prior to this release will no longer work
+- Fix migration reverse flow, enable migrate 0
+- Various documentation fixes and improvements
+- Drop `cryptography` in favor of hashlib
+- Make custom AuthModel work
+- Token prefix can be set in the setttings
+- Drop support for Django 4.0
+- Add support for Dango 4.2, 5.0 and Python 3.11 and 3.12
+- Cleanup legacy Python 2.0 code
+- Fix isort, flake8 usage for Python 3.10 in the test suite
+- Update Github actions version
+- Upgrade markdown dependency
+- Get rid of the `six` library
+- Add custom login / logout response support
+- Join the jazzband organization
+- Add pre-commit hooks
+- Add tracking of tests code coverage
+- Fix migrations when used in condition with a custom DB
+- Improve typing
+- Use `self.authenticate_header()` in `authenticate()` method to get auth header prefix
+
 ## 4.2.0
-- compatibility with Python up to 3.10 and Django up to 3.2
+- compatibility with Python up to 3.10 and Django up to 4.0
 - integration with github CI instead of travis
-- Migration: "salt" field of model "AuthToken" is removed
+- Migration: "salt" field of model "AuthToken" is removed, WARNING: invalidates old tokens!
 
 ## 4.1.0
 

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+[![Jazzband](https://jazzband.co/static/img/jazzband.svg)](https://jazzband.co/)
+
+This is a [Jazzband](https://jazzband.co/) project. By contributing you agree to abide by the [Contributor Code of Conduct](https://jazzband.co/about/conduct) and follow the [guidelines](https://jazzband.co/about/guidelines).

README.md

@@ -1,17 +1,18 @@
 django-rest-knox
 ================
 
-[![image](https://github.com/James1345/django-rest-knox/workflows/Test/badge.svg?branch=develop)](https://github.com/James1345/django-rest-knox/actions)
+[![Jazzband](https://jazzband.co/static/img/badge.svg)](https://jazzband.co/)
+[![image](https://github.com/jazzband/django-rest-knox/workflows/Test/badge.svg?branch=develop)](https://github.com/jazzband/django-rest-knox/actions)
 
-Authentication Module for django rest auth
+Authentication module for Django rest auth.
 
-Knox provides easy to use authentication for [Django REST
+Knox provides easy-to-use authentication for [Django REST
 Framework](https://www.django-rest-framework.org/) The aim is to allow
-for common patterns in applications that are REST based, with little
+for common patterns in applications that are REST-based, with little
 extra effort; and to ensure that connections remain secure.
 
-Knox authentication is token based, similar to the `TokenAuthentication`
-built in to DRF. However, it overcomes some problems present in the
+Knox authentication is token-based, similar to the `TokenAuthentication`
+built into DRF. However, it overcomes some problems present in the
 default implementation:
 
 -   DRF tokens are limited to one per user. This does not facilitate
@@ -23,13 +24,14 @@ default implementation:
     client to have its own token which is deleted on the server side
     when the client logs out.
 
-    Knox also provides an option for a logged in client to remove *all*
+    Knox also provides an option for a logged-in client to remove *all*
     tokens that the server has - forcing all clients to re-authenticate.
 
 -   DRF tokens are stored unencrypted in the database. This would allow
-    an attacker unrestricted access to an account with a token if the
+    an attacker unrestricted access to an account with a token if the 
     database were compromised.
 
+
     Knox tokens are only stored in a secure hash form (like a password). Even if the
     database were somehow stolen, an attacker would not be able to log
     in with the stolen credentials.
@@ -39,12 +41,11 @@ default implementation:
     the app settings (default is 10 hours.)
 
 More information can be found in the
-[Documentation](https://james1345.github.io/django-rest-knox/)
+[Documentation](https://jazzband.github.io/django-rest-knox/)
 
 # Run the tests locally
 
-If you need to debug a test locally and if you have [docker](https://www.docker.com/) installed:
-
+If you need to debug a test locally and if you have [docker](https://www.docker.com/) installed,
 simply run the ``./docker-run-tests.sh`` script and it will run the test suite in every Python /
 Django versions.
 
@@ -55,7 +56,7 @@ Python / Django versions a bit more tricky.
 
 Our documentation is generated by [Mkdocs](https://www.mkdocs.org).
 
-You can refer to their documentation on how to install it locally.
+You can refer to their [documentation](https://www.mkdocs.org/user-guide/installation/) on how to install it locally.
 
 Another option is to use `mkdocs.sh` in this repository.
 It will run mkdocs in a [docker](https://www.docker.com/) container.

docs/auth.md

@@ -49,18 +49,17 @@ If it is your only default authentication class, remember to overwrite knox's Lo
 
 For instance, you can authenticate users using Basic Authentication by simply overwriting knox's LoginView and setting BasicAuthentication as one of the acceptable authentication classes, as follows: 
 
+**views.py:**
 ```python
-
-views.py:
-
 from knox.views import LoginView as KnoxLoginView
 from rest_framework.authentication import BasicAuthentication
 
 class LoginView(KnoxLoginView):
     authentication_classes = [BasicAuthentication]
+```
 
-urls.py:
-
+**urls.py:**
+```python
 from knox import views as knox_views
 from yourapp.api.views import LoginView
 
@@ -75,10 +74,8 @@ You can use any number of authentication classes if you want to be able to authe
 
 If you decide to use Token Authentication as your only authentication class, you can overwrite knox's login view as such:
 
+**views.py:**
 ```python
-
-views.py:
-
 from django.contrib.auth import login
 
 from rest_framework import permissions
@@ -94,9 +91,10 @@ class LoginView(KnoxLoginView):
         user = serializer.validated_data['user']
         login(request, user)
         return super(LoginView, self).post(request, format=None)
+```
 
-urls.py:
-
+**urls.py:**
+```python
 from knox import views as knox_views
 from yourapp.api.views import LoginView
 

docs/index.md

@@ -1,10 +1,10 @@
 # Django-Rest-Knox
-Knox provides easy to use authentication for [Django REST Framework](https://www.django-rest-framework.org/)
+Knox provides easy-to-use authentication for [Django REST Framework](https://www.django-rest-framework.org/)
 The aim is to allow for common patterns in applications that are REST based,
 with little extra effort; and to ensure that connections remain secure.
 
 Knox authentication is token based, similar to the `TokenAuthentication` built
-in to DRF. However, it overcomes some problems present in the default implementation:
+into DRF. However, it overcomes some problems present in the default implementation:
 
 -   DRF tokens are limited to one per user. This does not facilitate securely
     signing in from multiple devices, as the token is shared. It also requires

docs/installation.md

@@ -2,27 +2,8 @@
 
 ## Requirements
 
-Knox depends on `cryptography` to provide bindings to `OpenSSL` for token generation.
-This requires the OpenSSL build libraries to be available.
-
-### Windows
-Cryptography is a statically linked build, no extra steps are needed.
-
-### Linux
-`cryptography` should build very easily on Linux provided you have a C compiler,
-headers for Python (if you’re not using `pypy`), and headers for the OpenSSL and
-`libffi` libraries available on your system.
-
-Debian and Ubuntu:
-```bash
-sudo apt-get install build-essential libssl-dev libffi-dev python3-dev python-dev
-```
-
-Fedora and RHEL-derivatives:
-```bash
-sudo yum install gcc libffi-devel python-devel openssl-devel
-```
-For other systems or problems, see the [cryptography installation docs](https://cryptography.io/en/latest/installation/)
+Knox depends on pythons internal library `hashlib` to provide bindings to `OpenSSL` or uses
+an internal implementation of hashing algorithms for token generation.
 
 ## Installing Knox
 Knox should be installed with pip
@@ -59,7 +40,7 @@ REST_FRAMEWORK = {
 
 - If you set TokenAuthentication as the only default authentication class on the second step, [override knox's LoginView](auth.md#global-usage-on-all-views) to accept another authentication method and use it instead of knox's default login view.
 
-- Apply the migrations for the models
+- Apply the migrations for the models.
 
 ```bash
 python manage.py migrate