🚀 New issue to wemake-services/django-modern-rest by @ZhdanovAM72
📝 Add a built-in JWT access token verification flow. (#1129)


FEATURE

Thesis

Add a built-in JWT access token verification flow.

For example, django-modern-rest could provide a reusable controller:

from dmr.security.jwt.views import VerifyTokenSyncController


class TokenVerifyController(VerifyTokenSyncController):
    pass

Expected behavior:

• accept an encoded token from the request body
• decode and validate the JWT
• reject malformed tokens
• reject expired tokens
• reject refresh tokens when an access token is expected
• verify that the token subject belongs to an existing active user
• return a successful empty response when the token is valid

The exact public API can be different. It could be implemented as a controller,
auth class, or reusable JWT verification component.

Reasoning

django-modern-rest already provides JWT obtain and refresh controllers, but
applications commonly also need a token verification endpoint.

Without built-in support, each project has to implement the same logic manually:

from django.conf import settings
from dmr.exceptions import NotAuthenticatedError
from dmr.security.jwt.token import JWToken


token = JWToken.decode(
    encoded_token=encoded_token,
    secret=str(settings.SECRET_KEY),
    algorithm="HS256",
)

if token.extras.get("type") != "access":
    raise NotAuthenticatedError

user = User.objects.get(pk=token.sub)

if not user.is_active:
    raise NotAuthenticatedError

This logic is not application-specific. It is part of the common JWT API
surface.

Providing it in django-modern-rest would reduce duplication and make JWT support
more complete. It would also make error handling more consistent with the
existing obtain and refresh controllers.


#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

KaiCode, our annual festival of open source projects, is announcing winners of the 2026 competition (and rewarding some cash to help them grow):

raprogramm/yew-nav-link 6★
Perfect $2048

ahoo-wang/wow 296★
Excellent $1024

choplogic/chop-logic-components 5★
Awesome $512

These projects were selected out of all 153 submitted this year. As you see, popularity didn't matter, but only the quality of code, discipline of development, strictness of testing and delivery pipelines, and the accuracy of documentation.

Many thanks to nine Jury members, who manually reviewed all 14 finalists. Thanks to the Steering Committee (Alexander Medvednikov and Nikita Sobolev) — they validated the results of the Jury. Thanks to Claude Code — he helped us not to miss important details in every finalist.

You are welcome to submit your open source project to the next year competition!

всех приглашаю для участия в следующем году :)

Обновить mypy до 2.3 в dry-python/returns

https://github.com/dry-python/returns/pull/2462

#python #typing

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Fix all `@contextmanager` entries with `Iterator` return type (#1181)


Using @contextmanager with Iterator return type is deprecated.
It must use Generator return type.

🖼️Image

We need to fix all places where we use -> Iterator together with contextmanager decorator.


#bug #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Setup stricter `__slots__` check in CI (#1183)


We would need to enable:

• --require-subclass
• --detect-unused-slots (it is experimental)

Docs: https://slotscheck.readthedocs.io/en/latest/cli.html#cli

And fix all issues :)


#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to ag2ai/faststream by @DeoLeung
📝 Feature: relax typer version (#2969)


if no incompatibility, it will be great to relax the cap of typer, easy for projects using faststream cli to upgrade typer


#enhancement #good_first_issue #faststream #ag2ai
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Support migration from `dj-rest-auth` (#1193)


This is a critical component in DRF's world: https://github.com/iMerica/dj-rest-auth
We need to provide a clean migration path from dj-rest-auth to django-modern-rest.

Without this component many project's can really migrate, because they would have to re-invent the most critical part: auth. This is not something we can allow for our users.

How?

• ◻️ Support default login views
• ◻️ Support registration default views
• ◻️ Support password change default views
• ◻️ Support OAuth flow #1012
• ◻️ Support MFA
• ◻️ Support Passkeys
• ◻️ Support cookie-based JWT auth flow (currently, we only support headers)
• ◻️ Support AI skill for migration from dj-rest-auth to django-modern-rest

For all features we would require:

• Strict AI review for the best practices of the method (because I am not an expert in several things here, so we need someone else's opinion), security folks are welcome!
• Docs
• Schemes, how everything works, like dj-rest-auth has
• Lots of tests :)

This is a big project, so any help / contributions are welcome!
Let's do it together, friends :)


#feature #help_wanted #django_modern_rest
sent via relator

друзья, фича очень большая. помощь очень нужна :) можно брать отдельные подзадачи оттуда

🚀 New issue to wemake-services/django-modern-rest by @Lancetnik
📝 Add `pytest-timeout` to fail hanging tests fast (#1195)


FEATURE

Thesis

Add pytest-timeout to the test dependencies and enable a global per-test timeout, so a hanging test fails fast and names itself instead of stalling the job.

[dependency-groups]
unit-test = [
  # ...
  "pytest-timeout>=2.4,<3",
]

[tool.pytest.ini_options]
# Fail hanging tests instead of blocking CI:
timeout = 30
timeout_method = "thread"

Tests that legitimately need longer raise their own budget with the marker:

@pytest.mark.timeout(120)
def test_something_genuinely_slow() -> None: ...

Reasoning
• Nothing currently bounds a hang. Only .github/workflows/relator.yml sets timeout-minutes; test.yml, test-extras.yml, build-wheels.yml and codspeed.yml do not, so a single deadlocked test burns the GitHub Actions default of 6 hours per job — multiplied across the Python/Django matrix.
• The suite has real hang-prone surface. asyncio_mode = 'auto' means every async test can deadlock on an unawaited future; tests/test_integration/test_throttling/test_backends/test_redis_backend/ talks to a live Redis/Valkey; the streaming tests consume generators; the smoke tests spawn subprocesses. Today a wedged backend looks like "CI is slow", not "CI is broken".
• Attribution. A job-level timeout-minutes kills the run without telling you which test hung. pytest-timeout dumps the stack of the offending test and keeps going, which is the difference between a five-minute fix and a bisect.
• Locally too. The same protection applies to just unit, where a hang currently requires a manual Ctrl-C and offers no traceback.
• Cheap. One pure-Python dev dependency, no runtime impact on the shipped package.

Notes / open questions
• It has to go in the unit-test group specifically: that group is the minimal one installed by cibuildwheel, and with --strict-config in addopts an unknown timeout ini key would make pytest error out anywhere the plugin isn't installed.
• timeout_method = "thread" behaves the same on every platform (relevant for the Windows wheel jobs); signal gives a slightly nicer traceback but is POSIX-only. Happy to go with either.
• The 30s default is a starting point — it should be set above the slowest current test so the change is a no-op for a green suite. Worth a --durations run to pick the number.

#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to ag2ai/faststream by @sobolevn
📝 Consider using `syrupy` for tests (#2978)


Link: https://pypi.org/project/syrupy/

Example usage:

• https://github.com/wemake-services/django-modern-rest/blob/master/tests/test_unit/test_plugins/test_msgspec/test_msgspec_snapshots.py
• https://github.com/wemake-services/django-modern-rest/blob/master/tests/test_unit/test_plugins/test_msgspec/__snapshots__/test_msgspec_snapshots.ambr

#good_first_issue #faststream #ag2ai
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Flaky test: `test_redis_async_leaky_bucket` (#1204)


Using --randomly-seed=706466424: https://github.com/wemake-services/django-modern-rest/actions/runs/30856534508/job/91828743292#step:9:3033

=========================== short test summary info ============================
FAILED tests/test_integration/test_throttling/test_backends/test_redis_backend/test_redis_backend.py::test_redis_async_leaky_bucket[True] - assert 200 == <HTTPStatus.TOO_MANY_REQUESTS: 429>
 +  where 200 = <HttpResponse status_code=200, "application/json">.status_code
 +  and   <HTTPStatus.TOO_MANY_REQUESTS: 429> = HTTPStatus.TOO_MANY_REQUESTS
============ 1 failed, 2787 passed, 14 skipped in 231.98s (0:03:51) ============

We need to investigate why it failed and fix / refactor it.


#bug #help_wanted #ci #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Provide a helper method to `Router` for better includes (#1223)


Currently we have to write this code:

router = Router(
    prefix='api/',
    urls=[
        path(
            model_simple_urls.router.prefix,
            include(
                (model_simple_urls.router.urls, 'model_simple'),
                namespace='model_simple',
            ),
        ), 
    ],
)

To include urls from one router to another.
I propose changing the API to be:

router = Router(
    prefix='api/',
    urls=[
        path(
            *model_simple_urls.router.to_include(namespace='model_simple'),
        ), 
    ],
)

#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Add `--skip-validation` optional flag to `dmr_export_schema` CLI command (#1225)


django-modern-rest/dmr/management/commands/dmr_export_schema.py

Lines 62 to 69 in ea7d1d0

Currently a call to .convert() here does not have skip_validation= flag. Which is very important, without it and with [openapi] extra, schemas with some small violations won't be able to export.

We need to add a new CLI flag for this. With False as default.


#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Fix `OpenAPIFormat.IRI` value (#1226)


See the spec https://datatracker.ietf.org/doc/html/draft-bhutton-json-schema-validation-00#section-7.3.5

It must be 'iri', not 'iri-reference':

django-modern-rest/dmr/openapi/objects/enums.py

Lines 33 to 34 in ea7d1d0

We also must mark these enums as @enums.unique


#bug #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Fix missing (#1232)


We currently miss these fields from Schema type definition:

django-modern-rest/dmr/openapi/objects/schema.py

Lines 17 to 18 in 03e7b14

•

 $ref — https://json-schema.org/draft/2020-12/json-schema-core#section-8.2.3.1
 "$ref" — References another schema by URI.

•

 $anchor — https://json-schema.org/draft/2020-12/json-schema-core#section-8.2.2
 "$anchor" — Defines a plain-name fragment anchor within a schema resource.

•

 $comment — https://json-schema.org/draft/2020-12/json-schema-core#section-8.3
 "$comment" — A developer comment; has no effect on validation.

•

 $schema — https://json-schema.org/draft/2020-12/json-schema-core#section-8.1.1
 "$schema" — Declares which JSON Schema dialect the schema is written against.

It would require a CHANGELOG entry and a test case, since we don't use them as of right now.


#feature #good_first_issue #help_wanted #openapi #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Improve `Token` customizations coverage (#1191)


I added several customization options to both

• token views

 django-modern-rest/dmr/security/token/views.py

 Lines 54 to 61 in 36a8567

• token auth

 django-modern-rest/dmr/security/token/auth/base.py

 Lines 84 to 88 in 36a8567

There are several integration tests that cover this:

django-modern-rest/django_test_app/server/apps/token_auth/views/obtain.py

Lines 46 to 57 in 36a8567

But, it not enough. What we need is more unit tests:

• Test all auth classes: async and sync types for headers / cookies / query
• Test all views: async and sync
• Test all options
• Test both positive and negative cases

#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator

🚀 New issue to ag2ai/faststream by @IvanKirpichnikov
📝 Feature: Add `RedisBatchStreamMessage` annotated alias (#3004)


Add to faststream/redis/annotations.py the alias for RedisBatchStreamMessage is similar to the aliases for RedisMessage, RedisChannelMessage, etc.


#enhancement #good_first_issue #redis #faststream #ag2ai
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Remove `tomli` from`additional_dependencies` in pre-commit (#1255)


We don't need it, since we run py3.11+ with tomllib:

django-modern-rest/.pre-commit-config.yaml

Lines 61 to 62 in d1f2b6c


#good_first_issue #help_wanted #ci #django_modern_rest
sent via relator

🚀 New issue to wemake-services/django-modern-rest by @sobolevn
📝 Support `ty` for type-checking (#1257)


Very interesting

Things to do:

• Install specific ty version
• Enable its strict mode
• Type-check dmr/ and typesafety/ directories
• Fix all real problems found by it
• Ignore all false-positives
• Add a changelog entry
• Update list of support type-checkers in README.md

If it produces way to many errors for one specific problem: disable it in config instead.


#feature #good_first_issue #help_wanted #django_modern_rest
sent via relator