Release notes from GuardPost

v1.0.4

2025-10-18T18:12:28Z

Add a guardpost.protection namespace with classes offering a strategy for brute-force protection against authentication attempts, and to log all failed authentication attempts consistently.
Add an InvalidCredentialsError exception. AuthenticationHandler implementations can raise InvalidCredentialsError when invalid credentials are provided, to enable automatic logging and, if enabled, brute-force protection.
Add RateLimiter class that can block authentication attempts after a configurable threshold is exceeded. By default stores failed attempts in-memory.
Integrate RateLimiter into AuthenticationStrategy with automatic tracking of failed authentication attempts and support for blocking excessive requests.
Add Python 3.14 and remove 3.9 from the build matrix.
Drop support for Python 3.9 (it reached EOL in October 2025).
Add an optional dependency on essentials, to use its Secret class to handle secrets for JWT validation with symmetric encryption. This is useful to support rotating secrets by updating env variables.
Improve exceptions raised for invalid JWTs to include the source exception (exc.__cause__).

2025-10-04T06:44:50Z

Add a roles property to the Identity object.
Add a RolesRequirement class to authorize by sufficient roles (any one is enough).
Add support for validating JWTs signed using symmetric encryption (SymmetricJWTValidator and AsymmetricJWTValidator).
Add support to call the authorize method with an optional set of roles, treated as sufficient roles to succeed authorization.
Add Python 3.12 and 3.13 to the build matrix.
Remove Python 3.8 from the build matrix.
Improve pyproject.toml.
Workflow maintenance.

2023-06-16T18:22:49Z

Raises a more specific exception ForbiddenError when the user of an
operation is authenticated properly, but authorization fails.
This enables better handling of authorization errors, differentiating when the
user context is missing or invalid, and when the context is valid but the
user has no rights to do a certain operation. See #371.

2023-03-20T22:44:56Z

Improves the automatic rotation of JWKS: when validating JWTs, JWKS are
refreshed automatically if an unknown kid is encountered, and JWKS were
last fetched more than refresh_time seconds ago (by default 120 seconds).
Corrects an inconsistency in how claims are read in the User class.

2023-01-07T21:00:12Z

Adds built-in support for dependency injection, using the new ContainerProtocol
in rodi v2.
Partially removes the synchronous code API, maintaining only the asynchronous code API for AuthenticationStrategy.authenticate and AuthorizationStrategy.authorize (authentication handlers and authorization requirements can still be synchronous).
Replaces setup.py with pyproject.toml.
Reduces imports verbosity.
Improves the identity_getter code API.
Corrects Identity.__getitem__ to raise KeyError if a claim is missing.

⚠️ Contains breaking changes

2022-12-29T10:25:15Z

Test release for the new package using the new name neoteroi-auth and the new namespace.
Please refer to the CHANGELOG for more information.

2021-11-14T22:13:06Z

Adds sub, access_token, and refresh_token properties to the Identity
class
Adds py.typed file

2021-10-31T13:29:59Z

2021-01-31T18:52:33Z

No content.

2020-12-12T10:00:49Z

No content.