the37lab-authlib 0.1.1762438606__py3-none-any.whl → 0.1.1768813136__py3-none-any.whl

the37lab_authlib/auth.py

@@ -1,5 +1,4 @@
 import inspect
-import inspect
 from flask import Blueprint, request, jsonify, current_app, url_for, redirect, g
 import jwt
 from datetime import datetime, timedelta
@@ -20,27 +19,36 @@ import msal
 import smtplib
 from email.mime.text import MIMEText
 from email.mime.multipart import MIMEMultipart
+import secrets
+import string
+from cachetools import TTLCache
+import json
+from pathlib import Path
 
 logging.basicConfig(level=logging.DEBUG)
 logger = logging.getLogger(__name__)
 
 class AuthManager:
-    def __init__(self, app=None, db_dsn=None, jwt_secret=None, oauth_config=None, id_type='integer', environment_prefix=None, api_tokens=None, cache_ttl=10, allow_oauth_auto_create=None, email_username=None, email_password=None, email_address=None, email_reply_to=None, email_server=None, email_port=None):
+    def __init__(self, app=None, db_dsn=None, jwt_secret=None, oauth_config=None, id_type='integer', environment_prefix=None, api_tokens=None, cache_ttl=10, allow_oauth_auto_create=None, email_username=None, email_password=None, email_address=None, email_reply_to=None, email_server=None, email_port=None, role_implications=None):
         self.user_override = None
-        self._user_cache = {}
         self._cache_ttl = cache_ttl or 10  # 10 seconds
+        self._user_cache = TTLCache(maxsize=10000, ttl=self._cache_ttl)
+        self._fetch_locks = {}  # Locks for preventing concurrent fetches
+        self._fetch_locks_lock = threading.Lock()  # Lock for managing fetch_locks dict
         self._last_used_updates = {}  # Track pending updates
         self._update_lock = threading.Lock()
         self._update_thread = None
         self._shutdown_event = threading.Event()
+        self._token_resolvers = {}  # Registered functions for token resolution
+        self.role_implications = role_implications or {}
 
         # Determine prefix: empty if environment_prefix is None/empty, otherwise use it with '_' delimiter
         prefix = (environment_prefix.upper() + '_') if environment_prefix else ''
-        
+
         # Arguments have priority over environment variables
         db_dsn = db_dsn or os.getenv(f'{prefix}DATABASE_URL')
         jwt_secret = jwt_secret or os.getenv(f'{prefix}JWT_SECRET')
-        
+
         # OAuth config: use argument if provided, otherwise build from env vars
         if oauth_config is None:
             google_client_id = os.getenv(f'{prefix}GOOGLE_CLIENT_ID')
@@ -51,7 +59,7 @@ class AuthManager:
                     'client_id': google_client_id,
                     'client_secret': google_client_secret
                 }
-        
+
         # OAuth auto-create: use argument if provided, otherwise check env var (defaults to False)
         if allow_oauth_auto_create is not None:
             self.allow_oauth_auto_create = allow_oauth_auto_create
@@ -61,7 +69,7 @@ class AuthManager:
                 self.allow_oauth_auto_create = auto_create_env.lower() in ['1', 'true', 'yes']
             else:
                 self.allow_oauth_auto_create = False
-        
+
         # API tokens: use argument if provided, otherwise parse from env var
         if api_tokens is None:
             api_tokens_env = os.getenv(f'{prefix}API_TOKENS')
@@ -71,12 +79,12 @@ class AuthManager:
                     if ':' in entry:
                         key, user = entry.split(':', 1)
                         api_tokens[key.strip()] = user.strip()
-        
+
         # User override: use argument if provided, otherwise check env var
         user_override_env = os.getenv(f'{prefix}USER_OVERRIDE')
         if user_override_env:
             self.user_override = user_override_env
-        
+
         # Email configuration: arguments have priority
         email_username = email_username or os.getenv(f'{prefix}EMAIL_USERNAME')
         email_password = email_password or os.getenv(f'{prefix}EMAIL_PASSWORD')
@@ -84,7 +92,7 @@ class AuthManager:
         email_reply_to = email_reply_to or os.getenv(f'{prefix}EMAIL_REPLY_TO')
         email_server = email_server or os.getenv(f'{prefix}EMAIL_SERVER')
         email_port = email_port or os.getenv(f'{prefix}EMAIL_PORT')
-            
+
         self.expiry_time = parse_duration(os.getenv(f'{prefix}JWT_TOKEN_EXPIRY_TIME', 'PT1H'))
         if self.user_override and (api_tokens or db_dsn):
             raise ValueError('Cannot set user_override together with api_tokens or db_dsn')
@@ -94,7 +102,7 @@ class AuthManager:
         self.db = Database(db_dsn, id_type=id_type) if db_dsn else None
         self.jwt_secret = jwt_secret
         self.oauth_config = oauth_config or {}
-        
+
         # Email configuration
         self.email_username = email_username
         self.email_password = email_password
@@ -108,7 +116,7 @@ class AuthManager:
             self.email_reply_to = None
         self.email_server = email_server
         self.email_port = int(email_port) if email_port else 587
-        
+
         self.public_endpoints = {
             'auth.login',
             'auth.oauth_login',
@@ -120,14 +128,67 @@ class AuthManager:
             'auth.resend_validation'
         }
         self.bp = None
-        
+        if self.db:
+            self._ensure_admin_role()
+
         if app:
             self.init_app(app)
-        
+
         # Start the background update thread
         self._start_update_thread()
 
+    def _ensure_admin_role(self):
+        try:
+            with self.db.get_cursor() as cur:
+                cur.execute("SELECT COUNT(*) AS role_count FROM roles")
+                result = cur.fetchone() or {}
+                if result.get('role_count', 0):
+                    return
+                role = Role('administrator', 'Default administrator role', self.db.get_id_generator())
+                columns = ['name', 'description', 'created_at']
+                values = [role.name, role.description, role.created_at]
+                placeholders = ['%s', '%s', '%s']
+                if role.id is not None:
+                    columns.insert(0, 'id')
+                    values.insert(0, role.id)
+                    placeholders.insert(0, '%s')
+                cur.execute(
+                    f"INSERT INTO roles ({', '.join(columns)}) VALUES ({', '.join(placeholders)})",
+                    values
+                )
+                logger.info('Default admin role created')
+        except Exception:
+            logger.exception('Ensure admin role failed')
+
+    def _ensure_admin_role(self):
+        try:
+            with self.db.get_cursor() as cur:
+                cur.execute("SELECT COUNT(*) AS user_count FROM users")
+                result = cur.fetchone() or {}
+                if result.get('user_count', 0):
+                    return
+                # Generate a secure 12-character password
+                alphabet = string.ascii_letters + string.digits + string.punctuation
+                password = ''.join(secrets.choice(alphabet) for _ in range(12))
+                logger.info(f"There were no users in the database. A temporary user `admin` has been created with password: {password}")
+                role = Role('administrator', 'Default administrator role', self.db.get_id_generator())
+                columns = ['name', 'description', 'created_at']
+                values = [role.name, role.description, role.created_at]
+                placeholders = ['%s', '%s', '%s']
+                if role.id is not None:
+                    columns.insert(0, 'id')
+                    values.insert(0, role.id)
+                    placeholders.insert(0, '%s')
+                cur.execute(
+                    f"INSERT INTO roles ({', '.join(columns)}) VALUES ({', '.join(placeholders)})",
+                    values
+                )
+                logger.info('Default admin role created')
+        except Exception:
+            logger.exception('Ensure admin role failed')
+
     def _extract_token_from_header(self):
+        #print('request.headers', request.headers, 'authorization', request.authorization, 'request', request)
         auth = request.authorization
         if not auth or not auth.token:
             raise AuthError('No authorization header or token', 401)
@@ -157,68 +218,83 @@ class AuthManager:
             }
         try:
             parsed = ApiToken.parse_token(api_token)
-            
+
             # Check cache first
             cache_key = f"api_token_{parsed['id']}"
-            current_time = datetime.utcnow()
-            
-            if cache_key in self._user_cache:
-                cached_data, cache_time = self._user_cache[cache_key]
-                if (current_time - cache_time).total_seconds() < self._cache_ttl:
-                    logger.debug(f"Returning cached API token data for ID: {parsed['id']}")
-                    return cached_data.copy()  # Return a copy to avoid modifying cache
-            
-            # Cache miss or expired, fetch from database
-            with self.db.get_cursor() as cur:
-                # First get the API token record
-                cur.execute("""
-                    SELECT t.*, u.*, r.name as role_name FROM api_tokens t
-                    JOIN users u ON t.user_id = u.id
-                    LEFT JOIN user_roles ur ON ur.user_id = u.id
-                    LEFT JOIN roles r ON ur.role_id = r.id
-                    WHERE t.id = %s
-                """, (parsed['id'],))
-                results = cur.fetchall()
-                if not results:
-                    raise AuthError('Invalid API token')
-
-                # Get the first row for token/user data (all rows will have same token/user data)
-                result = results[0]
-                
-                # Verify the nonce
-                if not bcrypt.checkpw(parsed['nonce'].encode('utf-8'), result['token'].encode('utf-8')):
-                    raise AuthError('Invalid API token')
-
-                # Check if token is expired
-                if result['expires_at'] and result['expires_at'] < datetime.utcnow():
-                    raise AuthError('API token has expired')
-
-                # Schedule last used timestamp update (asynchronous with 10s delay)
-                self._schedule_last_used_update(parsed['id'])
-
-                # Extract roles from results
-                roles = [row['role_name'] for row in results if row['role_name'] is not None]
-
-                # Construct user object
-                user_data = {
-                    'id': result['user_id'],
-                    'username': result['username'],
-                    'email': result['email'],
-                    'real_name': result['real_name'],
-                    'roles': roles
-                }
 
-            # Cache the result
-            self._user_cache[cache_key] = (user_data.copy(), current_time)
-            
-            # Clean up expired cache entries
-            self._cleanup_cache()
-            
-            return user_data
+            cached_data = self._user_cache.get(cache_key)
+            if cached_data is not None:
+                logger.debug(f"Returning cached API token data for ID: {parsed['id']}")
+                return cached_data.copy()  # Return a copy to avoid modifying cache
+
+            # Cache miss - get or create lock for this key
+            with self._fetch_locks_lock:
+                if cache_key not in self._fetch_locks:
+                    self._fetch_locks[cache_key] = threading.Lock()
+                fetch_lock = self._fetch_locks[cache_key]
+
+            # Acquire lock to prevent concurrent fetches
+            with fetch_lock:
+                # Double-check cache after acquiring lock
+                cached_data = self._user_cache.get(cache_key)
+                if cached_data is not None:
+                    logger.debug(f"Returning cached API token data for ID: {parsed['id']} (after lock)")
+                    return cached_data.copy()
+
+                # Fetch from database
+                with self.db.get_cursor() as cur:
+                    # First get the API token record
+                    cur.execute("""
+                        SELECT t.*, u.*, r.name as role_name FROM api_tokens t
+                        JOIN users u ON t.user_id = u.id
+                        LEFT JOIN user_roles ur ON ur.user_id = u.id
+                        LEFT JOIN roles r ON ur.role_id = r.id
+                        WHERE t.id = %s
+                    """, (parsed['id'],))
+                    results = cur.fetchall()
+                    if not results:
+                        raise AuthError('Invalid API token')
+
+                    # Get the first row for token/user data (all rows will have same token/user data)
+                    result = results[0]
+
+                    # Verify the nonce
+                    if not bcrypt.checkpw(parsed['nonce'].encode('utf-8'), result['token'].encode('utf-8')):
+                        raise AuthError('Invalid API token')
+
+                    # Check if token is expired
+                    if result['expires_at'] and result['expires_at'] < datetime.utcnow():
+                        raise AuthError('API token has expired')
+
+                    # Schedule last used timestamp update (asynchronous with 10s delay)
+                    self._schedule_last_used_update(parsed['id'])
+
+                    # Extract roles from results
+                    roles = [row['role_name'] for row in results if row['role_name'] is not None]
+
+                    # Construct user object
+                    user_data = {
+                        'id': result['user_id'],
+                        'username': result['username'],
+                        'email': result['email'],
+                        'real_name': result['real_name'],
+                        'roles': roles
+                    }
+
+                # Cache the result
+                self._user_cache[cache_key] = user_data.copy()
+
+                return user_data
         except ValueError:
             raise AuthError('Invalid token format')
 
     def _authenticate_request(self):
+        if hasattr(g, 'requesting_user'):
+            return g.requesting_user
+        g.requesting_user = self._authenticate_request_helper()
+        return g.requesting_user
+
+    def _authenticate_request_helper(self):
         if self.user_override:
             return {
                 'id': self.user_override,
@@ -267,7 +343,7 @@ class AuthManager:
             endpoint = f"{self.bp.name}.{f.__name__}"
             self.add_public_endpoint(endpoint)
         return f
-    
+
     def init_app(self, app):
         app.auth_manager = self
         app.register_blueprint(self.create_blueprint())
@@ -300,17 +376,17 @@ class AuthManager:
             data = request.get_json()
             username = data.get('username')
             password = data.get('password')
-            
+
             if not username or not password:
                 raise AuthError('Username and password required', 400)
-            
+
             with self.db.get_cursor() as cur:
                 cur.execute("SELECT * FROM users WHERE username = %s", (username,))
                 user = cur.fetchone()
-                
+
                 if not user or not self._verify_password(password, user['password_hash']):
                     raise AuthError('Invalid username or password', 401)
-                
+
                 # Fetch roles
                 cur.execute("""
                     SELECT r.name FROM roles r
@@ -319,14 +395,14 @@ class AuthManager:
                 """, (user['id'],))
                 roles = [row['name'] for row in cur.fetchall()]
                 user['roles'] = roles
-                
+
                 # Check if user is validated
                 if 'validated' not in roles:
                     raise AuthError('Account not yet validated. Please check your email for the validation link.', 403)
-                
+
                 token = self._create_token(user)
                 refresh_token = self._create_refresh_token(user)
-                
+
                 return jsonify({
                     'token': token,
                     'refresh_token': refresh_token,
@@ -350,21 +426,21 @@ class AuthManager:
         def oauth_callback():
             code = request.args.get('code')
             provider = request.args.get('state')
-            
+
             if not code or not provider:
                 raise AuthError('Invalid OAuth callback', 400)
             from urllib.parse import urlencode, urlparse, urlunparse
             get_redirect_uri = self.get_redirect_uri()
             parsed_uri = urlparse(get_redirect_uri)
             frontend_url = os.getenv('FRONTEND_URL', urlunparse((parsed_uri.scheme, parsed_uri.netloc, '', '', '', '')))
-            
+
             #if provider == 'microsoft':
             #    client = msal.ConfidentialClientApplication(
             #        self.oauth_config[provider]['client_id'], client_credential=self.oauth_config[provider]['client_secret'], authority=f"https://login.microsoftonline.com/common"
             #    )
             #    result = client.acquire_token_by_authorization_code(code, scopes=["email"], redirect_uri=self.get_redirect_uri())
             #    code = result['access_token']
-            
+
             try:
                 user_info = self._get_oauth_user_info(provider, code)
                 token = self._create_token(user_info)
@@ -414,7 +490,7 @@ class AuthManager:
             try:
                 payload = jwt.decode(refresh_token, self.jwt_secret, algorithms=['HS256'])
                 user_id = payload['sub']
-                
+
                 with self.db.get_cursor() as cur:
                     cur.execute("SELECT * FROM users WHERE id = %s", (user_id,))
                     user = cur.fetchone()
@@ -447,7 +523,7 @@ class AuthManager:
 
             with self.db.get_cursor() as cur:
                 cur.execute("""
-                    SELECT * FROM api_tokens 
+                    SELECT * FROM api_tokens
                     WHERE user_id = %s AND id = %s
                 """, (g.requesting_user['id'], token))
                 api_token = cur.fetchone()
@@ -462,7 +538,7 @@ class AuthManager:
             # Update last used timestamp
             with self.db.get_cursor() as cur:
                 cur.execute("""
-                    UPDATE api_tokens 
+                    UPDATE api_tokens
                     SET last_used_at = %s
                     WHERE id = %s
                 """, (datetime.utcnow(), api_token['id']))
@@ -478,7 +554,7 @@ class AuthManager:
 
             with self.db.get_cursor() as cur:
                 cur.execute("""
-                    DELETE FROM api_tokens 
+                    DELETE FROM api_tokens
                     WHERE user_id = %s AND id = %s
                     RETURNING id
                 """, (g.requesting_user['id'], token))
@@ -491,26 +567,26 @@ class AuthManager:
         @bp.route('/register', methods=['POST'])
         def register():
             data = request.get_json()
-            
+
             password = data.get('password')
             if not password:
                 raise AuthError('Password is required', 400)
-            
+
             username = data.get('username')
             email = data.get('email')
-            
+
             if not username:
                 raise AuthError('Username is required', 400)
             if not email:
                 raise AuthError('Email is required', 400)
-            
+
             # Validate password strength
             self._validate_password_strength(password, username=username, email=email)
-            
+
             # Hash the password
             salt = bcrypt.gensalt()
             password_hash = bcrypt.hashpw(password.encode('utf-8'), salt)
-            
+
             user = User(
                 username=username,
                 email=email,
@@ -523,10 +599,10 @@ class AuthManager:
                 # Check if username or email already exists
                 cur.execute("SELECT id FROM users WHERE username = %s OR email = %s", (username, email))
                 existing_user = cur.fetchone()
-                
+
                 if existing_user:
                     user_id = existing_user['id']
-                    
+
                     # Check if user is validated
                     cur.execute("""
                         SELECT r.name FROM roles r
@@ -536,16 +612,16 @@ class AuthManager:
                     if cur.fetchone():
                         # User is validated, reject registration
                         raise AuthError('Username or email already exists', 400)
-                    
+
                     # User exists but not validated - allow re-registration
                     # This works even if the previous registration hasn't expired yet
                     # Update existing user with new registration data
                     cur.execute("""
-                        UPDATE users 
+                        UPDATE users
                         SET username = %s, email = %s, real_name = %s, password_hash = %s, updated_at = %s
                         WHERE id = %s
                     """, (username, email, user.real_name, password_hash.decode('utf-8'), datetime.utcnow(), user_id))
-                    
+
                     # Remove all existing register-* roles (including non-expired ones)
                     cur.execute("""
                         DELETE FROM user_roles
@@ -554,7 +630,7 @@ class AuthManager:
                             SELECT id FROM roles WHERE name LIKE 'register-%'
                         )
                     """, (user_id,))
-                    
+
                     user.id = user_id
                 else:
                     # New user - create it
@@ -572,12 +648,12 @@ class AuthManager:
                             VALUES (%s, %s, %s, %s, %s, %s, %s)
                         """, (user.id, user.username, user.email, user.real_name, password_hash.decode('utf-8'),
                               user.created_at, user.updated_at))
-                
+
                 # Generate nonce and timestamp for validation
                 nonce = str(uuid.uuid4())
                 timestamp = int(time.time())
                 role_name = f'register-{nonce}-{timestamp}'
-                
+
                 # Create temporary validation role
                 cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
                 role = cur.fetchone()
@@ -598,14 +674,14 @@ class AuthManager:
                         role_id = role_obj.id
                 else:
                     role_id = role['id']
-                
+
                 # Associate role with user
                 cur.execute("""
                     INSERT INTO user_roles (user_id, role_id)
                     VALUES (%s, %s)
                     ON CONFLICT (user_id, role_id) DO NOTHING
                 """, (user.id, role_id))
-                
+
                 # Send validation email
                 frontend_url = self._get_frontend_url()
                 validation_link = f"{frontend_url}/register/{nonce}"
@@ -637,15 +713,15 @@ If you did not register for this account, please ignore this email.
                     WHERE r.name LIKE %s
                 """, (f'register-{nonce}-%',))
                 results = cur.fetchall()
-                
+
                 if not results:
                     raise AuthError('Invalid or expired validation link', 400)
-                
+
                 # Check if expired (24 hours)
                 current_time = int(time.time())
                 user_id = None
                 expired = True
-                
+
                 for row in results:
                     role_name = row['role_name']
                     if role_name.startswith(f'register-{nonce}-'):
@@ -657,10 +733,10 @@ If you did not register for this account, please ignore this email.
                                 break
                         except (ValueError, IndexError):
                             continue
-                
+
                 if expired or not user_id:
                     raise AuthError('Validation link has expired. Please request a new validation email.', 400)
-                
+
                 # Remove all register-* roles from user
                 cur.execute("""
                     DELETE FROM user_roles
@@ -669,7 +745,7 @@ If you did not register for this account, please ignore this email.
                         SELECT id FROM roles WHERE name LIKE 'register-%%'
                     )
                 """, (user_id,))
-                
+
                 # Ensure validated role exists
                 cur.execute("SELECT id FROM roles WHERE name = 'validated'")
                 validated_role = cur.fetchone()
@@ -690,14 +766,14 @@ If you did not register for this account, please ignore this email.
                         validated_role_id = role_obj.id
                 else:
                     validated_role_id = validated_role['id']
-                
+
                 # Add validated role to user
                 cur.execute("""
                     INSERT INTO user_roles (user_id, role_id)
                     VALUES (%s, %s)
                     ON CONFLICT (user_id, role_id) DO NOTHING
                 """, (user_id, validated_role_id))
-            
+
             return jsonify({'message': 'Account validated successfully. You can now log in.'})
 
         @bp.route('/resend-validation', methods=['POST'])
@@ -706,10 +782,10 @@ If you did not register for this account, please ignore this email.
             data = request.get_json()
             email = data.get('email')
             username = data.get('username')
-            
+
             if not email and not username:
                 raise AuthError('Email or username is required', 400)
-            
+
             with self.db.get_cursor() as cur:
                 # Find user by email or username
                 if email:
@@ -717,11 +793,11 @@ If you did not register for this account, please ignore this email.
                 else:
                     cur.execute("SELECT * FROM users WHERE username = %s", (username,))
                 user = cur.fetchone()
-                
+
                 if not user:
                     # Don't reveal if user exists
                     return jsonify({'message': 'If an account exists, a validation email has been sent.'})
-                
+
                 # Check if user is already validated
                 cur.execute("""
                     SELECT r.name FROM roles r
@@ -731,7 +807,7 @@ If you did not register for this account, please ignore this email.
                 if cur.fetchone():
                     # User is already validated, don't reveal this
                     return jsonify({'message': 'If an account exists, a validation email has been sent.'})
-                
+
                 # Remove existing register-* roles
                 cur.execute("""
                     DELETE FROM user_roles
@@ -740,12 +816,12 @@ If you did not register for this account, please ignore this email.
                         SELECT id FROM roles WHERE name LIKE 'register-%%'
                     )
                 """, (user['id'],))
-                
+
                 # Generate new nonce and timestamp
                 nonce = str(uuid.uuid4())
                 timestamp = int(time.time())
                 role_name = f'register-{nonce}-{timestamp}'
-                
+
                 # Create new validation role
                 cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
                 role = cur.fetchone()
@@ -766,14 +842,14 @@ If you did not register for this account, please ignore this email.
                         role_id = role_obj.id
                 else:
                     role_id = role['id']
-                
+
                 # Associate role with user
                 cur.execute("""
                     INSERT INTO user_roles (user_id, role_id)
                     VALUES (%s, %s)
                     ON CONFLICT (user_id, role_id) DO NOTHING
                 """, (user['id'], role_id))
-                
+
                 # Send validation email
                 frontend_url = self._get_frontend_url()
                 validation_link = f"{frontend_url}/register/{nonce}"
@@ -789,7 +865,7 @@ This link will expire in 24 hours.
 If you did not request this email, please ignore it.
 """
                 self._send_email(user['email'], email_subject, email_body)
-            
+
             return jsonify({'message': 'If an account exists, a validation email has been sent.'})
 
         @bp.route('/request-password-reset', methods=['POST'])
@@ -797,19 +873,19 @@ If you did not request this email, please ignore it.
         def request_password_reset():
             data = request.get_json()
             username = data.get('username')
-            
+
             if not username:
                 raise AuthError('Username is required', 400)
-            
+
             with self.db.get_cursor() as cur:
                 # Find user by username
                 cur.execute("SELECT * FROM users WHERE username = %s", (username,))
                 user = cur.fetchone()
-                
+
                 if not user:
                     # Don't reveal if user exists
                     return jsonify({'message': 'If an account exists, a password reset email has been sent.'})
-                
+
                 # Remove existing password-reset-* roles
                 cur.execute("""
                     DELETE FROM user_roles
@@ -818,12 +894,12 @@ If you did not request this email, please ignore it.
                         SELECT id FROM roles WHERE name LIKE 'password-reset-%%'
                     )
                 """, (user['id'],))
-                
+
                 # Generate new nonce and timestamp
                 nonce = str(uuid.uuid4())
                 timestamp = int(time.time())
                 role_name = f'password-reset-{nonce}-{timestamp}'
-                
+
                 # Create new password reset role
                 cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
                 role = cur.fetchone()
@@ -844,14 +920,14 @@ If you did not request this email, please ignore it.
                         role_id = role_obj.id
                 else:
                     role_id = role['id']
-                
+
                 # Associate role with user
                 cur.execute("""
                     INSERT INTO user_roles (user_id, role_id)
                     VALUES (%s, %s)
                     ON CONFLICT (user_id, role_id) DO NOTHING
                 """, (user['id'], role_id))
-                
+
                 # Send password reset email
                 frontend_url = self._get_frontend_url()
                 reset_link = f"{frontend_url}/password-reset/{nonce}"
@@ -867,7 +943,7 @@ This link will expire in 24 hours.
 If you did not request a password reset, please ignore this email.
 """
                 self._send_email(user['email'], email_subject, email_body)
-            
+
             return jsonify({'message': 'If an account exists, a password reset email has been sent.'})
 
         @bp.route('/password-reset/<nonce>', methods=['GET'])
@@ -883,15 +959,15 @@ If you did not request a password reset, please ignore this email.
                     WHERE r.name LIKE %s
                 """, (f'password-reset-{nonce}-%',))
                 results = cur.fetchall()
-                
+
                 if not results:
                     raise AuthError('Invalid or expired password reset link', 400)
-                
+
                 # Check if expired (24 hours)
                 current_time = int(time.time())
                 user_id = None
                 expired = True
-                
+
                 for row in results:
                     role_name = row['role_name']
                     if role_name.startswith(f'password-reset-{nonce}-'):
@@ -903,14 +979,14 @@ If you did not request a password reset, please ignore this email.
                                 break
                         except (ValueError, IndexError):
                             continue
-                
+
                 if expired or not user_id:
                     raise AuthError('Password reset link has expired. Please request a new password reset email.', 400)
-                
+
                 # Return user info (username only for security)
                 cur.execute("SELECT username FROM users WHERE id = %s", (user_id,))
                 user = cur.fetchone()
-                
+
                 return jsonify({'username': user['username'], 'message': 'Password reset link is valid.'})
 
         @bp.route('/password-reset/<nonce>', methods=['POST'])
@@ -919,12 +995,12 @@ If you did not request a password reset, please ignore this email.
             data = request.get_json()
             password = data.get('password')
             confirm_password = data.get('confirmPassword')
-            
+
             if not password:
                 raise AuthError('Password is required', 400)
             if password != confirm_password:
                 raise AuthError('Passwords do not match', 400)
-            
+
             with self.db.get_cursor() as cur:
                 # Find user with password-reset-{nonce}-{timestamp} role
                 cur.execute("""
@@ -935,17 +1011,17 @@ If you did not request a password reset, please ignore this email.
                     WHERE r.name LIKE %s
                 """, (f'password-reset-{nonce}-%',))
                 results = cur.fetchall()
-                
+
                 if not results:
                     raise AuthError('Invalid or expired password reset link', 400)
-                
+
                 # Check if expired (24 hours)
                 current_time = int(time.time())
                 user_id = None
                 username = None
                 email = None
                 expired = True
-                
+
                 for row in results:
                     role_name = row['role_name']
                     if role_name.startswith(f'password-reset-{nonce}-'):
@@ -959,24 +1035,24 @@ If you did not request a password reset, please ignore this email.
                                 break
                         except (ValueError, IndexError):
                             continue
-                
+
                 if expired or not user_id:
                     raise AuthError('Password reset link has expired. Please request a new password reset email.', 400)
-                
+
                 # Validate password strength
                 self._validate_password_strength(password, username=username, email=email)
-                
+
                 # Hash new password
                 salt = bcrypt.gensalt()
                 password_hash = bcrypt.hashpw(password.encode('utf-8'), salt)
-                
+
                 # Update user's password
                 cur.execute("""
-                    UPDATE users 
+                    UPDATE users
                     SET password_hash = %s, updated_at = %s
                     WHERE id = %s
                 """, (password_hash.decode('utf-8'), datetime.utcnow(), user_id))
-                
+
                 # Remove all password-reset-* roles from user
                 cur.execute("""
                     DELETE FROM user_roles
@@ -985,9 +1061,58 @@ If you did not request a password reset, please ignore this email.
                         SELECT id FROM roles WHERE name LIKE 'password-reset-%%'
                     )
                 """, (user_id,))
-            
+
             return jsonify({'message': 'Password has been reset successfully. You can now log in with your new password.'})
 
+        @bp.route('/change-password', methods=['POST'])
+        def change_password():
+            user = g.requesting_user
+            if not user:
+                raise AuthError('Authentication required', 401)
+
+            data = request.get_json()
+            current_password = data.get('currentPassword')
+            password = data.get('password')
+            confirm_password = data.get('confirmPassword')
+
+            if not current_password or not password or not confirm_password:
+                raise AuthError('Current password, new password, and confirmation are required', 400)
+
+            if password != confirm_password:
+                raise AuthError('New password and confirmation do not match', 400)
+
+            with self.db.get_cursor() as cur:
+                # Get user with password hash
+                cur.execute("SELECT * FROM users WHERE id = %s", (user['id'],))
+                db_user = cur.fetchone()
+
+                if not db_user:
+                    raise AuthError('User not found', 404)
+
+                # Check if user has a password (OAuth-only users might not have one)
+                if not db_user.get('password_hash'):
+                    raise AuthError('No password set for this account. Please use password reset instead.', 400)
+
+                # Verify current password
+                if not self._verify_password(current_password, db_user['password_hash']):
+                    raise AuthError('Current password is incorrect', 401)
+
+                # Validate new password strength
+                self._validate_password_strength(password, username=db_user['username'], email=db_user.get('email'))
+
+                # Hash new password
+                salt = bcrypt.gensalt()
+                password_hash = bcrypt.hashpw(password.encode('utf-8'), salt)
+
+                # Update user's password
+                cur.execute("""
+                    UPDATE users
+                    SET password_hash = %s, updated_at = %s
+                    WHERE id = %s
+                """, (password_hash.decode('utf-8'), datetime.utcnow(), user['id']))
+
+            return jsonify({'message': 'Password has been changed successfully.'})
+
         @bp.route('/roles', methods=['GET'])
         def get_roles():
             with self.db.get_cursor() as cur:
@@ -1001,7 +1126,7 @@ If you did not request a password reset, please ignore this email.
             self._require_admin_role()
             with self.db.get_cursor() as cur:
                 cur.execute("""
-                    SELECT u.*, 
+                    SELECT u.*,
                            COALESCE(array_agg(r.name) FILTER (WHERE r.name IS NOT NULL), '{}') as roles
                     FROM users u
                     LEFT JOIN user_roles ur ON ur.user_id = u.id
@@ -1016,36 +1141,36 @@ If you did not request a password reset, please ignore this email.
         def admin_create_user():
             self._require_admin_role()
             data = request.get_json()
-            
+
             # Validate required fields
             required_fields = ['username', 'email', 'real_name', 'password']
             for field in required_fields:
                 if not data.get(field):
                     raise AuthError(f'{field} is required', 400)
-            
+
             # Validate password strength
             self._validate_password_strength(data['password'], username=data['username'], email=data['email'])
-            
+
             # Hash the password
             salt = bcrypt.gensalt()
             password_hash = bcrypt.hashpw(data['password'].encode('utf-8'), salt)
-            
+
             with self.db.get_cursor() as cur:
                 # Check if username or email already exists
-                cur.execute("SELECT id FROM users WHERE username = %s OR email = %s", 
+                cur.execute("SELECT id FROM users WHERE username = %s OR email = %s",
                            (data['username'], data['email']))
                 if cur.fetchone():
                     raise AuthError('Username or email already exists', 400)
-                
+
                 # Create user
                 cur.execute("""
                     INSERT INTO users (username, email, real_name, password_hash, created_at, updated_at)
                     VALUES (%s, %s, %s, %s, %s, %s)
                     RETURNING id
-                """, (data['username'], data['email'], data['real_name'], 
+                """, (data['username'], data['email'], data['real_name'],
                       password_hash.decode('utf-8'), datetime.utcnow(), datetime.utcnow()))
                 user_id = cur.fetchone()['id']
-                
+
                 # Assign roles if provided
                 if data.get('roles'):
                     for role_name in data['roles']:
@@ -1057,33 +1182,33 @@ If you did not request a password reset, please ignore this email.
                                 VALUES (%s, %s)
                                 ON CONFLICT (user_id, role_id) DO NOTHING
                             """, (user_id, role['id']))
-            
+
             return jsonify({'id': user_id}), 201
 
         @bp.route('/admin/users/<user_id>', methods=['PUT'])
         def admin_update_user(user_id):
             self._require_admin_role()
             data = request.get_json()
-            
+
             with self.db.get_cursor() as cur:
                 # Check if user exists and get current username/email
                 cur.execute("SELECT id, username, email FROM users WHERE id = %s", (user_id,))
                 user = cur.fetchone()
                 if not user:
                     raise AuthError('User not found', 404)
-                
+
                 # Get username and email for password validation (use updated values if provided)
                 username = data.get('username', user['username'])
                 email = data.get('email', user['email'])
-                
+
                 # Validate password strength if password is being updated
                 if 'password' in data:
                     self._validate_password_strength(data['password'], username=username, email=email)
-                
+
                 # Update user fields
                 update_fields = []
                 update_values = []
-                
+
                 if 'username' in data:
                     update_fields.append('username = %s')
                     update_values.append(data['username'])
@@ -1098,23 +1223,23 @@ If you did not request a password reset, please ignore this email.
                     password_hash = bcrypt.hashpw(data['password'].encode('utf-8'), salt)
                     update_fields.append('password_hash = %s')
                     update_values.append(password_hash.decode('utf-8'))
-                
+
                 if update_fields:
                     update_fields.append('updated_at = %s')
                     update_values.append(datetime.utcnow())
                     update_values.append(user_id)
-                    
+
                     cur.execute(f"""
-                        UPDATE users 
+                        UPDATE users
                         SET {', '.join(update_fields)}
                         WHERE id = %s
                     """, update_values)
-                
+
                 # Update roles if provided
                 if 'roles' in data:
                     # Remove existing roles
                     cur.execute("DELETE FROM user_roles WHERE user_id = %s", (user_id,))
-                    
+
                     # Add new roles
                     for role_name in data['roles']:
                         cur.execute("SELECT id FROM roles WHERE name = %s", (role_name,))
@@ -1124,22 +1249,22 @@ If you did not request a password reset, please ignore this email.
                                 INSERT INTO user_roles (user_id, role_id)
                                 VALUES (%s, %s)
                             """, (user_id, role['id']))
-            
+
             return jsonify({'success': True})
 
         @bp.route('/admin/users/<user_id>', methods=['DELETE'])
         def admin_delete_user(user_id):
             self._require_admin_role()
-            
+
             with self.db.get_cursor() as cur:
                 # Check if user exists
                 cur.execute("SELECT id FROM users WHERE id = %s", (user_id,))
                 if not cur.fetchone():
                     raise AuthError('User not found', 404)
-                
+
                 # Delete user (cascade will handle related records)
                 cur.execute("DELETE FROM users WHERE id = %s", (user_id,))
-            
+
             return jsonify({'success': True})
 
         @bp.route('/admin/roles', methods=['GET'])
@@ -1154,74 +1279,74 @@ If you did not request a password reset, please ignore this email.
         def admin_create_role():
             self._require_admin_role()
             data = request.get_json()
-            
+
             if not data.get('name'):
                 raise AuthError('Role name is required', 400)
-            
+
             with self.db.get_cursor() as cur:
                 # Check if role already exists
                 cur.execute("SELECT id FROM roles WHERE name = %s", (data['name'],))
                 if cur.fetchone():
                     raise AuthError('Role already exists', 400)
-                
+
                 cur.execute("""
                     INSERT INTO roles (name, description, created_at)
                     VALUES (%s, %s, %s)
                     RETURNING id
                 """, (data['name'], data.get('description', ''), datetime.utcnow()))
                 role_id = cur.fetchone()['id']
-            
+
             return jsonify({'id': role_id}), 201
 
         @bp.route('/admin/roles/<role_id>', methods=['PUT'])
         def admin_update_role(role_id):
             self._require_admin_role()
             data = request.get_json()
-            
+
             with self.db.get_cursor() as cur:
                 # Check if role exists
                 cur.execute("SELECT id FROM roles WHERE id = %s", (role_id,))
                 if not cur.fetchone():
                     raise AuthError('Role not found', 404)
-                
+
                 update_fields = []
                 update_values = []
-                
+
                 if 'name' in data:
                     update_fields.append('name = %s')
                     update_values.append(data['name'])
                 if 'description' in data:
                     update_fields.append('description = %s')
                     update_values.append(data['description'])
-                
+
                 if update_fields:
                     update_values.append(role_id)
                     cur.execute(f"""
-                        UPDATE roles 
+                        UPDATE roles
                         SET {', '.join(update_fields)}
                         WHERE id = %s
                     """, update_values)
-            
+
             return jsonify({'success': True})
 
         @bp.route('/admin/roles/<role_id>', methods=['DELETE'])
         def admin_delete_role(role_id):
             self._require_admin_role()
-            
+
             with self.db.get_cursor() as cur:
                 # Check if role exists
                 cur.execute("SELECT id FROM roles WHERE id = %s", (role_id,))
                 if not cur.fetchone():
                     raise AuthError('Role not found', 404)
-                
+
                 # Check if role is assigned to any users
                 cur.execute("SELECT COUNT(*) as count FROM user_roles WHERE role_id = %s", (role_id,))
                 count = cur.fetchone()['count']
                 if count > 0:
                     raise AuthError('Cannot delete role that is assigned to users', 400)
-                
+
                 cur.execute("DELETE FROM roles WHERE id = %s", (role_id,))
-            
+
             return jsonify({'success': True})
 
         @bp.route('/admin/api-tokens', methods=['GET'])
@@ -1241,13 +1366,13 @@ If you did not request a password reset, please ignore this email.
         def admin_create_token():
             self._require_admin_role()
             data = request.get_json()
-            
+
             if not data.get('user_id') or not data.get('name'):
                 raise AuthError('user_id and name are required', 400)
-            
+
             expires_in_days = data.get('expires_in_days')
             token = self.create_api_token(data['user_id'], data['name'], expires_in_days)
-            
+
             return jsonify({
                 'id': token.id,
                 'name': token.name,
@@ -1259,31 +1384,31 @@ If you did not request a password reset, please ignore this email.
         @bp.route('/admin/api-tokens/<token_id>', methods=['DELETE'])
         def admin_delete_token(token_id):
             self._require_admin_role()
-            
+
             with self.db.get_cursor() as cur:
                 cur.execute("DELETE FROM api_tokens WHERE id = %s", (token_id,))
                 if cur.rowcount == 0:
                     raise AuthError('Token not found', 404)
-            
+
             return jsonify({'success': True})
 
         @bp.route('/admin/invite', methods=['POST'])
         def admin_send_invitation():
             self._require_admin_role()
             data = request.get_json()
-            
+
             if not data.get('email'):
                 raise AuthError('Email is required', 400)
-            
+
             # Check if user already exists
             with self.db.get_cursor() as cur:
                 cur.execute("SELECT id FROM users WHERE email = %s", (data['email'],))
                 if cur.fetchone():
                     raise AuthError('User with this email already exists', 400)
-            
+
             # Send invitation email (placeholder - implement actual email sending)
             invitation_token = str(uuid.uuid4())
-            
+
             # Store invitation in database (you might want to create an invitations table)
             # For now, we'll just return success
             return jsonify({
@@ -1299,61 +1424,122 @@ If you did not request a password reset, please ignore this email.
             logger.debug(f"Validating token: {token}")
             payload = jwt.decode(token, self.jwt_secret, algorithms=['HS256'])
             logger.debug(f"Token payload: {payload}")
+
+            # Check if token has function-based resolution
+            if 'f' in payload:
+                func_name = payload['f']
+                data = payload['data']
+
+                # Look up function from registered token resolvers
+                if func_name not in self._token_resolvers:
+                    raise AuthError(f'Function "{func_name}" not found. Register it using register_token_resolver().', 401)
+
+                func = self._token_resolvers[func_name]
+                if not callable(func):
+                    raise AuthError(f'"{func_name}" is not callable', 401)
+
+                # Call function with data
+                try:
+                    result = func(data)
+                except AuthError:
+                    raise
+                except Exception as e:
+                    logger.error(f"Error calling function {func_name}: {str(e)}")
+                    raise AuthError(f'Error resolving user data: {str(e)}', 500)
+
+                # Validate function return format
+                if not isinstance(result, dict):
+                    raise AuthError('Function must return a dict', 500)
+                if 'user' not in result:
+                    raise AuthError('Function must return dict with "user" key', 500)
+                if 'roles' not in result:
+                    raise AuthError('Function must return dict with "roles" key', 500)
+
+                # Ensure roles is a list of strings
+                roles = result['roles']
+                if not isinstance(roles, list):
+                    raise AuthError('roles must be a list', 500)
+
+                user = result['user'].copy()
+                user['roles'] = roles
+                return user
+
+            # Check if token has user/roles directly (new format without function)
+            if 'user' in payload and 'roles' in payload:
+                user = payload['user'].copy()
+                roles = payload['roles']
+
+                # Normalize roles: if dicts, extract 'name' field
+                if isinstance(roles, list) and len(roles) > 0 and isinstance(roles[0], dict):
+                    roles = [role['name'] for role in roles if isinstance(role, dict) and 'name' in role]
+
+                user['roles'] = roles
+                return user
+
+            # Fall back to existing format with 'sub' (database lookup)
+            if 'sub' not in payload:
+                raise AuthError('Invalid token format', 401)
+
             user_id = int(payload['sub'])  # Convert string ID back to integer
-            
+
             # Check cache first
             cache_key = f"user_{user_id}"
-            current_time = datetime.utcnow()
-            
-            if cache_key in self._user_cache:
-                cached_data, cache_time = self._user_cache[cache_key]
-                if (current_time - cache_time).total_seconds() < self._cache_ttl:
-                    logger.debug(f"Returning cached user data for ID: {user_id}")
-                    return cached_data.copy()  # Return a copy to avoid modifying cache
-            
-            # Cache miss or expired, fetch from database
-            with self.db.get_cursor() as cur:
-                cur.execute("""
-                    SELECT u.*, r.name as role_name FROM users u
-                    LEFT JOIN user_roles ur ON ur.user_id = u.id
-                    LEFT JOIN roles r ON ur.role_id = r.id
-                    WHERE u.id = %s
-                """, (user_id,))
-                results = cur.fetchall()
-                if not results:
-                    logger.error(f"User not found for ID: {user_id}")
-                    raise AuthError('User not found', 404)
-                
-                # Get the first row for user data (all rows will have same user data)
-                user = results[0]
-                
-                # Extract roles from results
-                roles = [row['role_name'] for row in results if row['role_name'] is not None]
-                user['roles'] = roles
 
-            # Cache the result
-            self._user_cache[cache_key] = (user.copy(), current_time)
-            
-            # Clean up expired cache entries
-            self._cleanup_cache()
-            
-            return user
+            cached_data = self._user_cache.get(cache_key)
+            if cached_data is not None:
+                logger.debug(f"Returning cached user data for ID: {user_id}")
+                return cached_data.copy()  # Return a copy to avoid modifying cache
+
+            # Cache miss - get or create lock for this key
+            with self._fetch_locks_lock:
+                if cache_key not in self._fetch_locks:
+                    self._fetch_locks[cache_key] = threading.Lock()
+                fetch_lock = self._fetch_locks[cache_key]
+
+            # Acquire lock to prevent concurrent fetches
+            with fetch_lock:
+                # Double-check cache after acquiring lock
+                cached_data = self._user_cache.get(cache_key)
+                if cached_data is not None:
+                    logger.debug(f"Returning cached user data for ID: {user_id} (after lock)")
+                    return cached_data.copy()
+
+                # Fetch from database
+                if not self.db:
+                    raise AuthError('Database not configured for token validation', 500)
+
+                with self.db.get_cursor() as cur:
+                    cur.execute("""
+                        SELECT u.*, r.name as role_name FROM users u
+                        LEFT JOIN user_roles ur ON ur.user_id = u.id
+                        LEFT JOIN roles r ON ur.role_id = r.id
+                        WHERE u.id = %s
+                    """, (user_id,))
+                    results = cur.fetchall()
+                    if not results:
+                        logger.error(f"User not found for ID: {user_id}")
+                        raise AuthError('User not found', 404)
+
+                    # Get the first row for user data (all rows will have same user data)
+                    user = results[0]
+
+                    # Extract roles from results
+                    roles = [row['role_name'] for row in results if row['role_name'] is not None]
+                    user['roles'] = roles
+
+                # Cache the result
+                self._user_cache[cache_key] = user.copy()
+
+                return user
         except jwt.InvalidTokenError as e:
             logger.error(f"Invalid token error: {str(e)}")
             raise AuthError('Invalid token', 401)
+        except AuthError:
+            raise
         except Exception as e:
             logger.error(f"Unexpected error during token validation: {str(e)}")
             raise AuthError(str(e), 500)
 
-    def _cleanup_cache(self):
-        """Remove expired cache entries."""
-        current_time = datetime.utcnow()
-        expired_keys = [
-            key for key, (_, cache_time) in self._user_cache.items()
-            if (current_time - cache_time).total_seconds() >= self._cache_ttl
-        ]
-        for key in expired_keys:
-            del self._user_cache[key]
 
     def _start_update_thread(self):
         """Start the background thread for processing last_used_at updates."""
@@ -1374,21 +1560,21 @@ If you did not request a password reset, please ignore this email.
             try:
                 current_time = time.time()
                 tokens_to_update = []
-                
+
                 # Collect tokens that need updating (older than 10 seconds)
                 with self._update_lock:
                     for token_id, schedule_time in list(self._last_used_updates.items()):
                         if current_time - schedule_time >= 10:  # 10 second delay
                             tokens_to_update.append(token_id)
                             del self._last_used_updates[token_id]
-                
+
                 # Perform batch update
                 if tokens_to_update:
                     self._perform_batch_update(tokens_to_update)
-                
+
                 # Sleep for a short interval
                 time.sleep(10)
-                
+
             except Exception as e:
                 logger.error(f"Error in update worker: {e}")
                 time.sleep(5)  # Wait longer on error
@@ -1400,13 +1586,13 @@ If you did not request a password reset, please ignore this email.
                 # Update all tokens in a single query
                 placeholders = ','.join(['%s'] * len(token_ids))
                 cur.execute(f"""
-                    UPDATE api_tokens 
+                    UPDATE api_tokens
                     SET last_used_at = %s
                     WHERE id IN ({placeholders})
                 """, [datetime.utcnow()] + token_ids)
-                
+
                 logger.debug(f"Updated last_used_at for {len(token_ids)} tokens: {token_ids}")
-                
+
         except Exception as e:
             logger.error(f"Error performing batch update: {e}")
 
@@ -1420,6 +1606,28 @@ If you did not request a password reset, please ignore this email.
     def get_current_user(self):
         return self._authenticate_request()
 
+    def _expand_roles(self, roles):
+        """Expand roles list to include all implied roles.
+
+        Args:
+            roles: List of role names
+
+        Returns:
+            Set of role names including all implied roles
+        """
+        expanded = set(roles)
+        to_process = list(roles)
+
+        while to_process:
+            role = to_process.pop()
+            if role in self.role_implications:
+                for implied_role in self.role_implications[role]:
+                    if implied_role not in expanded:
+                        expanded.add(implied_role)
+                        to_process.append(implied_role)
+
+        return expanded
+
     def _require_admin_role(self):
         """Require the current user to have administrator role."""
         user = g.requesting_user
@@ -1431,7 +1639,7 @@ If you did not request a password reset, please ignore this email.
         with self.db.get_cursor() as cur:
             cur.execute("""
                 SELECT id, name, created_at, expires_at, last_used_at
-                FROM api_tokens 
+                FROM api_tokens
                 WHERE user_id = %s
                 ORDER BY created_at DESC
             """, (user_id,))
@@ -1440,7 +1648,7 @@ If you did not request a password reset, please ignore this email.
     def create_api_token(self, user_id, name, expires_in_days=None):
         """Create a new API token for a user."""
         token = ApiToken(user_id, name, expires_in_days)
-        
+
         with self.db.get_cursor() as cur:
             cur.execute("""
                 INSERT INTO api_tokens (id, user_id, name, token, created_at, expires_at)
@@ -1448,6 +1656,84 @@ If you did not request a password reset, please ignore this email.
             """, (token.id, token.user_id, token.name, token.token, token.created_at, token.expires_at))
             return token
 
+    def register_token_resolver(self, name: str, func):
+        """Register a function to be used for token resolution.
+
+        Args:
+            name: Function name (string identifier used in create_jwt_token)
+            func: Callable function that takes a dict and returns dict with 'user' and 'roles'
+
+        Raises:
+            ValueError: If func is not callable
+        """
+        if not callable(func):
+            raise ValueError(f'Function must be callable')
+        self._token_resolvers[name] = func
+        logger.debug(f"Registered token resolver: {name}")
+
+    def create_jwt_token(self, user_input: dict, f: str = None) -> str:
+        """Create a JWT token from user input dict.
+
+        Args:
+            user_input: Dict containing user and roles data
+            f: Optional function name to call during token validation
+
+        Returns:
+            JWT token string
+
+        Raises:
+            AuthError: If validation fails or required keys are missing
+        """
+        if f is None:
+            # Validate user_input structure
+            if 'user' not in user_input:
+                raise AuthError('user_input must contain "user" key', 400)
+            if 'roles' not in user_input:
+                raise AuthError('user_input must contain "roles" key', 400)
+
+            user = user_input['user']
+            roles = user_input['roles']
+
+            # Validate user dict
+            if not isinstance(user, dict):
+                raise AuthError('user must be a dict', 400)
+            if 'id' not in user:
+                raise AuthError('user must contain "id" key', 400)
+            if 'username' not in user:
+                raise AuthError('user must contain "username" key', 400)
+
+            # Validate roles list
+            if not isinstance(roles, list):
+                raise AuthError('roles must be a list', 400)
+            for role in roles:
+                if not isinstance(role, dict):
+                    raise AuthError('each role must be a dict', 400)
+                if 'id' not in role:
+                    raise AuthError('each role must contain "id" key', 400)
+                if 'name' not in role:
+                    raise AuthError('each role must contain "name" key', 400)
+
+            # Create JWT payload with user and roles
+            payload = {
+                'user': user,
+                'roles': roles,
+                'exp': datetime.utcnow() + self.expiry_time,
+                'iat': datetime.utcnow()
+            }
+        else:
+            # Store function name and user_input in payload
+            payload = {
+                'f': f,
+                'data': user_input,
+                'exp': datetime.utcnow() + self.expiry_time,
+                'iat': datetime.utcnow()
+            }
+
+        logger.debug(f"Creating JWT token with payload: {payload}")
+        token = jwt.encode(payload, self.jwt_secret, algorithm='HS256')
+        logger.info(f"Created JWT token")
+        return token
+
     def _create_token(self, user):
         payload = {
             'sub': str(user['id']),
@@ -1474,63 +1760,63 @@ If you did not request a password reset, please ignore this email.
         """Validate password strength and return error message listing all rules and failures."""
         rules = []
         failures = []
-        
+
         # Rule 1: Minimum length
         min_length = 8
         rules.append(f"At least {min_length} characters long")
         if len(password) < min_length:
             failures.append(f"At least {min_length} characters long")
-        
+
         # Rule 2: Maximum length
         max_length = 128
         rules.append(f"No more than {max_length} characters long")
         if len(password) > max_length:
             failures.append(f"No more than {max_length} characters long")
-        
+
         # Rule 3: Uppercase letter
         rules.append("Contains at least one uppercase letter (A-Z)")
         if not re.search(r'[A-Z]', password):
             failures.append("Contains at least one uppercase letter (A-Z)")
-        
+
         # Rule 4: Lowercase letter
         rules.append("Contains at least one lowercase letter (a-z)")
         if not re.search(r'[a-z]', password):
             failures.append("Contains at least one lowercase letter (a-z)")
-        
+
         # Rule 5: Digit
         rules.append("Contains at least one number (0-9)")
         if not re.search(r'\d', password):
             failures.append("Contains at least one number (0-9)")
-        
+
         # Rule 6: Special character
         rules.append("Contains at least one special character (!@#$%^&*()_+-=[]{}|;:,.<>?)")
         if not re.search(r'[!@#$%^&*()_+\-=\[\]{}|;:,.<>?]', password):
             failures.append("Contains at least one special character (!@#$%^&*()_+-=[]{}|;:,.<>?)")
-        
+
         # Rule 7: Not contain username
         if username:
             rules.append("Does not contain your username")
             if username.lower() in password.lower():
                 failures.append("Does not contain your username")
-        
+
         # Rule 8: Not contain email username
         if email:
             email_username = email.split('@')[0].lower()
             rules.append("Does not contain your email username")
             if email_username and email_username in password.lower():
                 failures.append("Does not contain your email username")
-        
+
         # Rule 9: Not a common password
         common_passwords = {'password', 'password123', '12345678', 'qwerty', 'abc123', 'letmein', 'welcome', 'monkey', '1234567890', 'password1'}
         rules.append("Is not a common password")
         if password.lower() in common_passwords:
             failures.append("Is not a common password")
-        
+
         if failures:
             all_rules_text = "\n".join([f"  {'✗' if rule in failures else '✓'} {rule}" for rule in rules])
             error_msg = f"Password does not meet the following requirements:\n\n{all_rules_text}\n\nPlease fix the issues marked with ✗."
             raise AuthError(error_msg, 400)
-        
+
         return True
 
     def _get_oauth_url(self, provider, redirect_uri):
@@ -1563,13 +1849,13 @@ If you did not request a password reset, please ignore this email.
         if provider == 'microsoft':
             import msal
             client = msal.ConfidentialClientApplication(
-                client_id, 
-                client_credential=client_secret, 
+                client_id,
+                client_credential=client_secret,
                 authority="https://login.microsoftonline.com/common"
             )
             tokens = client.acquire_token_by_authorization_code(
-                code, 
-                scopes=["email"], 
+                code,
+                scopes=["email"],
                 redirect_uri=redirect_uri
             )
         else:
@@ -1644,15 +1930,15 @@ If you did not request a password reset, please ignore this email.
                     INSERT INTO users (username, email, real_name, created_at, updated_at)
                     VALUES (%s, %s, %s, %s, %s)
                     RETURNING id
-                """, (user_obj.username, user_obj.email, user_obj.real_name, 
+                """, (user_obj.username, user_obj.email, user_obj.real_name,
                       user_obj.created_at, user_obj.updated_at))
                 new_id = cur.fetchone()['id']
-                user = {'id': new_id, 'username': user_obj.username, 'email': user_obj.email, 
+                user = {'id': new_id, 'username': user_obj.username, 'email': user_obj.email,
                         'real_name': user_obj.real_name, 'roles': []}
             else:
                 # Update existing user
                 cur.execute("""
-                    UPDATE users 
+                    UPDATE users
                     SET real_name = %s, updated_at = %s
                     WHERE email = %s
                 """, (norm.get('name', norm['email']), datetime.utcnow(), norm['email']))
@@ -1728,12 +2014,12 @@ If you did not request a password reset, please ignore this email.
             # Apple email may be private relay; name not always present
             return {'sub': info.get('sub'), 'email': info.get('email'), 'name': info.get('name')}
         return {'sub': info.get('sub'), 'email': info.get('email'), 'name': info.get('name')}
-    
+
     def _send_email(self, to_email, subject, body):
         if not self.email_server or not self.email_username or not self.email_password:
             logger.error('Email configuration not set, cannot send email')
             raise AuthError('Email configuration not set. Cannot send validation email.', 500)
-        
+
         try:
             msg = MIMEMultipart()
             msg['From'] = self.email_address
@@ -1741,7 +2027,7 @@ If you did not request a password reset, please ignore this email.
             msg['Reply-To'] = self.email_reply_to
             msg['Subject'] = subject
             msg.attach(MIMEText(body, 'plain'))
-            
+
             server = smtplib.SMTP(self.email_server, self.email_port)
             server.starttls()
             server.login(self.email_username, self.email_password)
@@ -1753,7 +2039,7 @@ If you did not request a password reset, please ignore this email.
         except Exception as e:
             logger.error(f'Failed to send email to {to_email}: {e}')
             raise AuthError(f'Failed to send validation email: {str(e)}', 500)
-    
+
     def _get_frontend_url(self):
         frontend_url = os.getenv('FRONTEND_URL')
         if not frontend_url:
@@ -1762,3 +2048,57 @@ If you did not request a password reset, please ignore this email.
             parsed_uri = urlparse(redirect_uri)
             frontend_url = urlunparse((parsed_uri.scheme, parsed_uri.netloc, '', '', '', ''))
         return frontend_url
+
+    def get_version(self):
+        """Get the package version and git version information.
+        
+        Returns:
+            dict: Dictionary with 'package_version', 'git_commit', 'git_branch', 'git_dirty',
+                  'version_tags', 'latest_version_tag', and 'database_name' keys.
+                  Git-related keys may be None if the version file is not found.
+        """
+        package_version = None
+        try:
+            import importlib.metadata
+            package_version = importlib.metadata.version('the37lab_authlib')
+        except Exception:
+            try:
+                p = Path(__file__).parent.parent.parent / 'pyproject.toml'
+                if p.exists():
+                    for line in open(p, 'r', encoding='utf-8'):
+                        if line.strip().startswith('version = '):
+                            package_version = line.split('"')[1] if '"' in line else None
+                            break
+            except Exception:
+                pass
+        
+        git_data = {}
+        try:
+            with open(Path(__file__).parent / '_git_version.txt', 'r', encoding='utf-8') as f:
+                git_data = json.loads(f.read().strip())
+        except Exception:
+            pass
+        
+        database_name = None
+        if self.db and self.db.dsn:
+            try:
+                dsn = self.db.dsn
+                if '://' in dsn:
+                    database_name = dsn.split('/')[-1].split('?')[0]
+                else:
+                    for part in dsn.split():
+                        if part.startswith('dbname='):
+                            database_name = part.split('=')[1]
+                            break
+            except Exception:
+                pass
+        
+        return {
+            'package_version': package_version,
+            'git_commit': git_data.get('commit'),
+            'git_branch': git_data.get('branch'),
+            'git_dirty': git_data.get('dirty'),
+            'version_tags': git_data.get('version_tags', []),
+            'latest_version_tag': git_data.get('latest_version_tag'),
+            'database_name': database_name
+        }