peter/daybook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
daybook/CHANGELOG.md
peter 19c1798f90 Release v0.2.0: multiple named API keys per user 
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-09-04 10:52:43 +01:00

4 KiB
Raw Permalink Blame History

Changelog

All notable changes to Daybook are recorded here. Format loosely follows Keep a Changelog; versions are SemVer and match the git tags (vX.Y.Z) and daybook_project.__version__.

Unreleased

Nothing yet.

0.2.0 — 2026-09-04

Added

  • Multiple named API keys per user. Each user can now hold several keys — one per agent or script — named and revocable individually, managed from a new Settings → API Keys page (a table with name, key, created, last-used, and per-row revoke). Keys are viewable on demand (dbk_-prefixed).
  • Gated key-provisioning API for automated test installations: GET/POST /api/keys and DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset → follows DJANGO_DEBUG, so off in deployment). Advertised as key_provisioning_api in /api/capabilities; returns 403 when disabled.
  • API keys track last_used_at (throttled to one write/minute) so stale keys are visible before you revoke them.

Changed

  • Auth now resolves bearer tokens against the new ApiKey model instead of the single DRF authtoken.Token. Existing tokens are migrated 1:1 into named ("default") keys with the same value — no client reconfiguration needed.
  • Settings → Account no longer manages a single token; it links to API Keys. Creating a user (Settings → Users) issues an initial named key.

0.1.1 — 2026-09-03

Fixed

  • Deployment crash-loop: the vendored gridjs.umd.js referenced a gridjs.umd.js.map sourcemap that isn't in the repo, so collectstatic (strict manifest storage) failed on container start and v0.1.0 never came up. Removed the dangling sourcemap trailer (debug-only, no runtime effect).

Added

  • GET /api/skill serves the bundled agent-posting skill as Markdown (or ?format=json), with DAYBOOK_URL pre-filled to the instance's own origin so the instructions are ready to hand to an AI. Advertised as skill_url in /api/capabilities.

Changed

  • Rewrote the posting skill (skills/daybook-posting/SKILL.md) to be location-agnostic: no longer assumes a local source checkout, reframes DAYBOOK_URL as set-your-instance, and adds a raw curl fallback.

0.1.0 — 2026-09-03

First tagged release.

Artifacts & rendering

  • Artifact kinds: markdown, html_fragment, html_full, deck, json, csv, image, pdf, binary.
  • .xlsx uploads convert server-side to a csv artifact (active sheet, saved formula results).
  • Markdown code blocks get syntax highlighting; tables (markdown & html_fragment) render styled — monospace cells, sans-serif headers.
  • json/csv render as an interactive collapsible tree / sortable table (Grid.js + renderjson, vendored locally).
  • Unified off-white document background; system sans-serif body text.

API

  • POST/GET/PATCH/DELETE /api/artifacts, list filters (source/label/day/ kind/q), /api/assets image upload, /api/capabilities (reports version). Per-user bearer-token ingest; session-authed reads.
  • Server-side validation: per-kind content shape, field length limits, string-typed source fields, valid-JSON for json.

Sharing, quotas, security

  • Per-artifact public share links (/s/{token}), owner-toggled, revocable.
  • Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
  • Allowlist HTML sanitization (nh3) + script-src 'none' CSP for the themed kinds; deep-JSON parse errors return 400 (not 500).

UI

  • Multi-user auth; feed with source sidebar + label filtering; settings area (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.

Deployment

  • Dockerised (Gunicorn + whitenoise), SQLite, git-based deploy with a runbook (deploy/cloud_agent_deploy.md) and health check.