* Fix#9250: Prevent token overwrite and improve security
- Fix key collision issue that could overwrite existing tokens
- Use force_insert=True only for new token instances
- Replace os.urandom with secrets.token_hex for better security
- Add comprehensive test suite to verify fix and backward compatibility
- Ensure existing tokens can still be updated without breaking changes
* Fix code style: remove trailing whitespace and unused imports
* Fix#9250: Prevent token overwrite with minimal changes
- Add force_insert=True to Token.save() for new objects to prevent overwriting existing tokens
- Revert generate_key method to original implementation (os.urandom + binascii)
- Update tests to work with original setUp() approach
- Remove verbose comments and unrelated changes per reviewer feedback
* Fix flake8 violations: remove extra blank lines and trailing whitespace
* Update tests/test_authtoken.py
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>
* Update tests/test_authtoken.py
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>
* Update tests/test_authtoken.py
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>
* Fix token key regeneration behavior and add test
* Update tests/test_authtoken.py
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>
---------
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>
Thanks to Jon Dufresne (@jdufresne) for review.
Co-authored-by: Asif Saif Uddin <auvipy@gmail.com>
Co-authored-by: Rizwan Mansuri <Rizwan@webbyfox.com>
