Roadmap
This page is an honest accounting of what AllSafe Fast does today, what's actively being built, and what's planned for the future. We don't list planned features as if they exist — every feature is marked with its real status.
Implemented means the feature is available in the current release and covered by tests. In Progress means it's being actively developed but not yet shipped. Planned means it's on the roadmap but work hasn't started. If a feature isn't listed here at all, it's not on the roadmap — feel free to open a discussion on GitHub.
Implemented
These features are available today, tested, and documented.
Authentication Providers
| Feature | Description | Status |
|---|---|---|
| Password authentication | Email + password sign-up and sign-in with Argon2id hashing, email verification, and password reset. | Implemented |
| OAuth 2.0 | Authorization Code flow with PKCE. Supports Google, GitHub, GitLab, and any OAuth 2.0 provider. | Implemented |
| OIDC | OpenID Connect with JWKS discovery and ID token verification. Supports any OIDC-compliant provider. | Implemented |
| Magic Link | Passwordless sign-in via a one-time link sent to the user's email. 15-minute expiry, single use. | Implemented |
| Email OTP | Passwordless sign-in via a 6-digit one-time code. 15-minute expiry, 3 attempts max. | Implemented |
Session Management
| Feature | Description | Status |
|---|---|---|
| JWT access tokens | Short-lived (15 min) signed JWTs with user identity, roles, and permissions embedded as claims. Verified in memory. | Implemented |
| Refresh token rotation | Long-lived (30 day) refresh tokens. Each use issues a new token and revokes the old one. Stored as SHA-256 hashes. | Implemented |
| Theft detection | If a revoked refresh token is reused, all of the user's sessions are immediately revoked and a TokenReuseError is raised. | Implemented |
Authorization
| Feature | Description | Status |
|---|---|---|
| Roles | Role-based access control. Require a single role or any of several roles via auth.user(role=...) or auth.user(roles=[...]). | Implemented |
| Permissions | Permission-based access control. Require a single permission or all of a set via auth.user(permission=...) or auth.user(permissions=[...]). | Implemented |
Security
| Feature | Description | Status |
|---|---|---|
| Rate limiting | Sliding-window rate limiter for auth endpoints. Redis backend for production, in-memory for development. | Implemented |
| Argon2id password hashing | OWASP-recommended memory-hard algorithm. Auto-generated salts, configurable parameters. | Implemented |
| CSRF protection | Cookie-based auth requires the X-AllSafe-CSRF header on every state-changing request. | Implemented |
| Enumeration prevention | Login, sign-up, and password-reset return generic messages that don't reveal whether an email is registered. | Implemented |
| Production guards | Refuses to start in production with a default secret key, insecure cookies, or an insecure configuration. | Implemented |
Extensibility
| Feature | Description | Status |
|---|---|---|
| Hooks | 14 lifecycle events for user, session, password, email, and account operations. Register via decorator, dict, or register_many. | Implemented |
| Plugins | Implement the AllSafePlugin protocol to contribute routes, tables, hooks, and schemas. | Implemented |
Tooling & Storage
| Feature | Description | Status |
|---|---|---|
| CLI | allsafe init, allsafe secret, allsafe db generate, allsafe db migrate, allsafe doctor. | Implemented |
| In-memory storage | Default for development and testing. asyncio.Lock-guarded. Lost on restart. | Implemented |
| SQLAlchemy storage | Production backend. Async PostgreSQL with native UUID and ARRAY types, cascade deletes, indexed lookups. | Implemented |
In Progress
These features are being actively developed. They may be partially implemented in the current release but are not yet stable or complete.
| Feature | Description | Status |
|---|---|---|
| Additional database adapters | Redis adapter for distributed session storage and rate limiting. MongoDB adapter for NoSQL deployments. Both implement the existing storage protocols. | In Progress |
| Benchmark suite | Performance benchmarks comparing in-memory vs SQLAlchemy backends, measuring JWT verification latency, and tracking throughput under load. Used to catch regressions. | In Progress |
Features in this section may have partial implementations or may change before they're marked as Implemented. Don't build production code against them yet. Watch the GitHub repository for release notes announcing their stabilization.
Planned
These features are on the roadmap. They are not yet implemented and don't have a release date. If one of these is important to you, open a GitHub discussion or upvote an existing one — it helps us prioritize.
| Feature | Description | Status |
|---|---|---|
| WebAuthn / FIDO2 | Passwordless authentication with hardware security keys and platform authenticators (Touch ID, Windows Hello). Support for both registration and authentication ceremonies. | Planned |
| SAML | SAML 2.0 service provider support for enterprise single sign-on. SP-initiated and IdP-initiated flows, signed and encrypted assertions. | Planned |
| Multi-tenant organizations | Organization and team management. Users belong to organizations, organizations have members with roles, resources can be scoped to organizations. | Planned |
| API key authentication | Long-lived API keys for service-to-service and programmatic access. Scoped keys with expiration, revocation, and usage tracking. | Planned |
| Session management UI | A prebuilt dashboard for users to view their active sessions (device, IP, location, last active) and revoke any of them. Drop-in router for your app. | Planned |
| Admin dashboard | A prebuilt admin interface for managing users, accounts, roles, permissions, and sessions. Search, filter, impersonate, ban, and audit log. | Planned |
The roadmap is driven by user feedback. If you need a planned feature sooner, or have a feature request that isn't listed, open a discussion on GitHub Discussions. Pull requests for planned features are welcome — please open an issue first to coordinate.
Status Summary
20 Implemented
Five auth providers, JWT sessions with refresh rotation and theft detection, roles, permissions, rate limiting, Argon2id, CSRF, enumeration prevention, production guards, hooks, plugins, CLI, two storage backends.
2 In Progress
Additional database adapters (Redis, MongoDB) and a benchmark suite for performance regression testing.
6 Planned
WebAuthn/FIDO2, SAML, multi-tenant organizations, API key auth, session management UI, and an admin dashboard.