arXiv Accounts v0.1

Release notes - arXiv-NG - Version accounts-0.1

Bug

• [ARXIVNG-1094] - Patch Catalyst tapir_session cookie verification to prevent session hijacking

New Feature

• [ARXIVNG-945] - Implement legacy integration for endorsements
• [ARXIVNG-947] - Implement legacy integration for authentication
• [ARXIVNG-948] - Decorator to enforce authz scope on Flask routes
• [ARXIVNG-949] - Middleware to unpack auth tokens on requests
• [ARXIVNG-953] - Users with permanent tokens should be automatically logged in
• [ARXIVNG-1050] - Redirect user to referrer after login

Task

• [ARXIVNG-86] - Implement ORM for user session & user tables, etc.
• [ARXIVNG-87] - Create service module to generate legacy session
• [ARXIVNG-89] - Implement blueprint with routes for login and logout
• [ARXIVNG-287] - Implement service module to create session in distributed session store
• [ARXIVNG-288] - Implement login controller
• [ARXIVNG-289] - Implement logout controller
• [ARXIVNG-290] - Implement templates for login and logout
• [ARXIVNG-318] - Implement creation of legacy + NG cookies for login
• [ARXIVNG-319] - Implement invalidate method for legacy session store
• [ARXIVNG-320] - Implement method on database service to validate password
• [ARXIVNG-958] - Documentation with examples of authentication/authorization integration
• [ARXIVNG-1049] - Display error formatting when username/password is incorrect
• [ARXIVNG-1124] - Update arxiv.user to use redis cluster (vs single node)