peter
19c1798f90
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.
- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
Data migration copies every existing authtoken 1:1 into a "default" named
key with the same value, so no client (incl. the sibling test project's
hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
revoke and a create form; keys viewable on demand. Settings -> Account now
links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
follows DEBUG, so off in deployment). Advertised via key_provisioning_api
in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
ApiKey. Full suite 129 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
91 lines
4 KiB
Markdown
91 lines
4 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to Daybook are recorded here. Format loosely follows
|
|
[Keep a Changelog](https://keepachangelog.com/); versions are SemVer and match
|
|
the git tags (`vX.Y.Z`) and `daybook_project.__version__`.
|
|
|
|
## [Unreleased]
|
|
|
|
_Nothing yet._
|
|
|
|
## [0.2.0] — 2026-09-04
|
|
|
|
### Added
|
|
- **Multiple named API keys per user.** Each user can now hold several keys —
|
|
one per agent or script — named and revocable individually, managed from a
|
|
new **Settings → API Keys** page (a table with name, key, created, last-used,
|
|
and per-row revoke). Keys are viewable on demand (`dbk_`-prefixed).
|
|
- **Gated key-provisioning API** for automated test installations:
|
|
`GET/POST /api/keys` and `DELETE /api/keys/{id}`, controlled by
|
|
`DAYBOOK_KEY_PROVISIONING_API` (unset → follows `DJANGO_DEBUG`, so **off in
|
|
deployment**). Advertised as `key_provisioning_api` in `/api/capabilities`;
|
|
returns 403 when disabled.
|
|
- API keys track `last_used_at` (throttled to one write/minute) so stale keys
|
|
are visible before you revoke them.
|
|
|
|
### Changed
|
|
- Auth now resolves bearer tokens against the new `ApiKey` model instead of the
|
|
single DRF `authtoken.Token`. Existing tokens are migrated 1:1 into named
|
|
("default") keys with the same value — no client reconfiguration needed.
|
|
- Settings → Account no longer manages a single token; it links to API Keys.
|
|
Creating a user (Settings → Users) issues an initial named key.
|
|
|
|
## [0.1.1] — 2026-09-03
|
|
|
|
### Fixed
|
|
- Deployment crash-loop: the vendored `gridjs.umd.js` referenced a
|
|
`gridjs.umd.js.map` sourcemap that isn't in the repo, so `collectstatic`
|
|
(strict manifest storage) failed on container start and v0.1.0 never came
|
|
up. Removed the dangling sourcemap trailer (debug-only, no runtime effect).
|
|
|
|
### Added
|
|
- `GET /api/skill` serves the bundled agent-posting skill as Markdown (or
|
|
`?format=json`), with `DAYBOOK_URL` pre-filled to the instance's own
|
|
origin so the instructions are ready to hand to an AI. Advertised as
|
|
`skill_url` in `/api/capabilities`.
|
|
|
|
### Changed
|
|
- Rewrote the posting skill (`skills/daybook-posting/SKILL.md`) to be
|
|
location-agnostic: no longer assumes a local source checkout, reframes
|
|
`DAYBOOK_URL` as set-your-instance, and adds a raw `curl` fallback.
|
|
|
|
## [0.1.0] — 2026-09-03
|
|
|
|
First tagged release.
|
|
|
|
### Artifacts & rendering
|
|
- Artifact kinds: `markdown`, `html_fragment`, `html_full`, `deck`, `json`,
|
|
`csv`, `image`, `pdf`, `binary`.
|
|
- `.xlsx` uploads convert server-side to a `csv` artifact (active sheet,
|
|
saved formula results).
|
|
- Markdown code blocks get syntax highlighting; tables (markdown &
|
|
html_fragment) render styled — monospace cells, sans-serif headers.
|
|
- `json`/`csv` render as an interactive collapsible tree / sortable table
|
|
(Grid.js + renderjson, vendored locally).
|
|
- Unified off-white document background; system sans-serif body text.
|
|
|
|
### API
|
|
- `POST/GET/PATCH/DELETE /api/artifacts`, list filters (source/label/day/
|
|
kind/q), `/api/assets` image upload, `/api/capabilities` (reports
|
|
`version`). Per-user bearer-token ingest; session-authed reads.
|
|
- Server-side validation: per-kind content shape, field length limits,
|
|
string-typed source fields, valid-JSON for `json`.
|
|
|
|
### Sharing, quotas, security
|
|
- Per-artifact public share links (`/s/{token}`), owner-toggled, revocable.
|
|
- Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
|
|
- Allowlist HTML sanitization (nh3) + `script-src 'none'` CSP for the themed
|
|
kinds; deep-JSON parse errors return 400 (not 500).
|
|
|
|
### UI
|
|
- Multi-user auth; feed with source sidebar + label filtering; settings area
|
|
(Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.
|
|
|
|
### Deployment
|
|
- Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a
|
|
runbook (`deploy/cloud_agent_deploy.md`) and health check.
|
|
|
|
[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.2.0...HEAD
|
|
[0.2.0]: https://git.cygnus.systems/peter/daybook/compare/v0.1.1...v0.2.0
|
|
[0.1.1]: https://git.cygnus.systems/peter/daybook/compare/v0.1.0...v0.1.1
|
|
[0.1.0]: https://git.cygnus.systems/peter/daybook/releases/tag/v0.1.0
|