FastAuth v0.8.1

Fixed

• Authentication no longer blocks the event loop. Every route and dependency
  that hashes a password or queries the database was declared async def,
  which meant FastAPI ran it on the event loop: a single login held the whole
  process for the duration of its bcrypt verification (roughly 200ms), and
  every authenticated request blocked the loop for the length of its user
  lookup. Concurrent logins queued behind one another and stalled unrelated
  traffic. Those handlers are now synchronous, so FastAPI runs them in a
  threadpool. No API changes: request and response shapes are identical, and
  throughput under concurrency improves substantially.

FastAuth v0.8.0

Added

• scripts/prepare_release.py bumps every version location and rolls the
  changelog's [Unreleased] section into a dated release in one command. It
  refuses to run when there are no notes to release.

• scripts/check_release.py verifies the version agrees across all four files
  it is written in, that the changelog has notes for it, and that no stale
  domains remain. CI runs it on every push and again before publishing.

• CI now lints and builds the documentation site, so a broken docs build fails
  the pull request instead of surfacing on Vercel after merge.

• A one-button Release workflow: it reads the changelog, infers whether the
  change is a patch, minor or major, bumps every version location, tests,
  commits, tags and pushes.

• prepare_release.py infers the bump from the [Unreleased] headings, so the
  version follows from what changed rather than from a judgement call.

• Dependency and security automation: Dependabot for Python, npm and GitHub
  Actions; CodeQL analysis; pip-audit and pnpm audit on every push and
  weekly, so a CVE published against an unchanged dependency is still found.

• Coverage measurement with a regression threshold. Currently 81% overall, with
  the security-critical paths higher: core/auth.py 94%, routers 96%,
  security/ 97-100%.

• tests/test_docs_match_api.py asserts the documented API matches the API
  that exists: the routes the app mounts, the endpoint reference, AGENTS.md,
  and the route count the landing page advertises. Documentation drift is now
  a test failure rather than something noticed later by a user.

• A weekly external link check for the documentation, advisory only so a
  third-party site being briefly unreachable never fails a build.

• tests/test_cli.py covers settings discovery, .env parsing, role
  initialization and superadmin creation. CLI coverage rises from 34% to 74%
  and the project total from 81% to 89%.

Fixed

• The CLI could discover a wrong database URL. A pattern like
  create_engine("sqlite:///" + name) matched the settings regex and yielded
  "sqlite:///" — a URL that looks plausible and points nowhere. The patterns
  now require the string literal to be the complete value, so a concatenated
  expression falls through to importing the module and evaluating it properly.
• A .env file could override the real environment. SECRET_KEY set in a
  deployment was silently replaced by a stale .env shipped in the image,
  signing every token with the wrong key. The real environment now always
  wins, and .env fills in only what is missing.
• Removed an unused import from exceptions.py.
• The CI consistency job failed on every dependency-update pull request. Its
  changelog check diffed against the base branch with a three-dot range, which
  needs a merge base that the default shallow clone does not fetch. The job now
  checks out full history, the check is advisory and cannot fail a build, and
  dependency bumps skip it entirely.

Changed

• Every workflow now declares least-privilege permissions, so CI jobs get a
  read-only token instead of inheriting the repository default.
• The publish workflow validates the release before publishing rather than
  after, so a missing changelog section stops the release instead of producing
  one with empty notes.
• The publish workflow now runs the full Python 3.10-3.14 matrix rather than
  3.12 alone. A tag can point at a commit that never went through pull-request
  CI, so this is the only guarantee that what ships runs everywhere it claims.

Upgrading

No action needed for most projects, but one behaviour changed deliberately:

A .env file no longer overrides real environment variables. Previously a
.env value won; now the environment does, and .env fills in only what is
missing. This matches dotenv tooling elsewhere and closes a real hazard, where
a stale .env in a deployed image silently replaced the production
SECRET_KEY.

If you relied on .env taking precedence, unset the variable in the
environment instead, or pass the value explicitly with --secret-key /
--db-url.

FastAuth v0.7.0

Added

• New documentation site at fastauth.pythowner.com,
  built with Next.js and MDX and deployed on Vercel. Includes full-text search,
  flow diagrams for the token and password reset cycles, a concepts guide that
  explains hashing, JWTs, cookies and RBAC from scratch, a symptom-first
  troubleshooting page, and a reading mode.
• llms.txt so AI coding agents integrate FastAuth correctly rather than
  guessing at the API.
• A documented versioning and deprecation policy, in the README and the docs.

Changed

• One obvious way to do each thing. Four long-form names are superseded by
  shorter equivalents. The old names still work and now emit a
  DeprecationWarning; they will be removed in 1.0.

  Deprecated	Replacement
  auth.get_current_active_user_dependency()	auth.current_user
  auth.is_admin()	auth.admin
  auth.require_roles([...])	auth.roles(...)
  auth.require_all_roles([...])	auth.all_roles(...)

  The replacements accept role names directly or as a list, so both
  auth.roles("admin", "moderator") and auth.roles(["admin", "moderator"])
  work. The deprecated forms now accept either shape too, rather than requiring
  a list.

• session_getter is documented. Leave it out and FastAuth opens sessions
  on the engine you gave it, which is what most apps want. Pass your own only
  when routes must share a session with the rest of your app.

Fixed

• token_url now defaults to /token. It previously defaulted to token
  with no leading slash, while the router registers /token. That value is
  what Swagger's Authorize button posts to, and a relative URL resolves
  against the docs path, breaking as soon as the app is mounted under a prefix.
  A missing leading slash is now added automatically, so passing "token" is
  corrected rather than broken.

Removed

• The previous hand-written static documentation site (index.html,
  easy-mode.html, style.css, scripts.js), replaced by the new site.

Upgrading

No action needed. Deprecated names keep working until 1.0. To find them in your
code, make deprecation warnings fail your tests:

[tool.pytest.ini_options]
filterwarnings = ["error::DeprecationWarning"]

Full Changelog: v0.6.0...v0.7.0

FastAuth v0.6.0

FastAuth 0.6.0 is a complete overhaul: modern dependency stack, one-call setup, production safety mode, and full account lifecycle flows.

Highlights

• One-call integration: auth.setup(app) mounts login, refresh, registration, logout, roles, and error handling
• Zero config: FastAuth(engine=engine) is enough in development; secrets come from the environment in production
• Production mode: production=True enforces a strong secret, secure cookies, and no default admin password
• Account flows: password reset and change, email verification, and token revocation (POST /logout/all)
• Ready-made dependencies: auth.current_user, auth.admin, auth.roles(...), auth.required, auth.verified_user

Fixes

• Works with modern bcrypt (4.x and 5.x): passlib replaced with direct bcrypt
• Removed the shared database session (not thread-safe, and one failed request could break later logins)
• The disabled flag is enforced on login, token refresh, and protected routes
• Duplicate email on registration returns 409 instead of a server error
• Custom user models are respected by role checks and the CLI
• An explicit Authorization header takes precedence over the auth cookie

Project

• Packaging moved to pyproject.toml; python-jose dropped; Python 3.10+
• 41 tests running in CI on Python 3.10 to 3.14
• Automated PyPI releases via trusted publishing
• Redesigned documentation site plus a new easy-mode tutorial for students
• AGENTS.md so AI coding assistants can integrate FastAuth correctly

Breaking changes

• Python 3.10+ required
• Root-level module shims (fastauth.py, User.py) removed; import from the fastauth package
• FastAuth.session removed
• cookie_secure defaults to False in development and True in production mode
• The user table gains email_verified and token_version columns. For existing databases:

ALTER TABLE user ADD COLUMN email_verified BOOLEAN DEFAULT 0;
ALTER TABLE user ADD COLUMN token_version INTEGER DEFAULT 0;

Install: uv add fastauth_iq "fastapi[standard]" · PyPI: https://pypi.org/project/fastauth-iq/0.6.0/

Version 0.3.3

Version 0.3.3 (May 5, 2025)

Enhanced CLI Configuration Detection

• Added support for automatically detecting database URLs and secret keys from multiple sources:
  • Environment variables (DATABASE_URL, SECRET_KEY)
  • .env files in project directories
  • Imported modules in Python applications
  • Database engine objects in imported modules
• Improved error messages when configuration is not found
• Enhanced search for configuration in common files (config.py, settings.py, db.py, etc.)

Benefits

• More flexible configuration options for projects using FastAuth
• No need to explicitly pass database URL and secret key when they are defined elsewhere
• Better integration with different project setups and architectures
• Seamless support for both direct configuration and configuration from environment variables

Full Changelog: Release...Release-V-0.3.3

v0.3.2 Release

FastAuth v0.3.2 Release Notes

Release Highlights

FastAuth 0.3.2 brings significant documentation and usability improvements to make the library more accessible and user-friendly:

📱 Responsive Documentation

• Completely redesigned documentation with full mobile and tablet responsiveness
• Improved navigation menu with collapsible sections for smaller screens
• Optimized layout with better margins and spacing across all device sizes

🌐 New Documentation Hub

• Launched official documentation site at hu55ain3laa.github.io/fastauth
• Interactive examples and comprehensive API reference
• Smooth, native CSS-based scrolling for better performance

🚀 Additional Improvements

• Fixed issues with navigation links for role-based authorization sections
• Enhanced visual appearance with centered content and improved typography
• Updated project metadata with better links and documentation references
• Improved accessibility for all users across different devices

🔧 Technical Updates

• Added proper GitHub Pages integration for documentation
• Fixed SVG logo display on PyPI and other platforms
• Updated copyright and authorship information

This release focuses on making FastAuth more accessible to developers of all experience levels, with special attention to the documentation experience. The responsive design ensures that users can effectively learn and implement FastAuth on any device.

Full Changelog: https://github.com/hu55ain3laa/fastauth/commits/Release