Forge 0.5.0

Forge 0.5.0

Authentication, authorization, and baseline security hardening for generated Python REST API projects across FastAPI, Django, and Flask (all three architectures).

Highlights

• Authentication — email/UUID identity, Argon2id passwords, short-lived access JWTs, and rotating opaque SQL refresh sessions with replay-family revocation
• Auth endpoints — registration, login, refresh, logout, logout-all, /me, and password change
• Account security (optional) — email verification and password reset via digest-only, expiring, single-use action tokens (imply Email; Background Jobs remain optional)
• Authorization — reusable authenticated, verified, permission, any-permission, and owner-or-permission policies; SQLAlchemy RBAC roles/permissions; Django-native Groups/Permissions
• Hardening — process-local abuse throttling (429 + Retry-After), trusted hosts, restrictive CORS, baseline security headers (opt-in HSTS in production), auth-route body limits, sensitive-log redaction, production secret/host checks, and auth-state cleanup commands
• Presets — fastapi-auth and django-auth
• Compatibility — existing no-security and Authentication-only configurations remain valid; Authorization implies Authentication; verification/reset imply Email but not Redis or Background Jobs

Security notes

• Access JWTs remain valid until their short expiry after logout; logout-all and password change invalidate older access tokens via auth_version
• Generated rate limits are process-local (not cluster-wide); multi-instance production deployments should also throttle at the gateway
• Selecting Authorization does not automatically protect existing Products, Categories, or Files endpoints — ownership helpers do not replace query scoping

See CHANGELOG.md for full details.

PyPI publication of forge-scaffolder==0.5.0 will follow separately.