@dewtech/dare-cli 3.0.0 → 3.1.0

package/templates/stacks/python-fastapi/app/routers/users.py

@@ -0,0 +1,46 @@
+"""Users router: GET /users, POST /users."""
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.orm import Session
+
+from app.core.security import decode_access_token
+from app.db.session import get_db
+from app.repositories.user_repository import UserRepository
+from app.schemas.user import UserCreate, UserOut, UserPage
+from app.services.user_service import EmailAlreadyInUse, UserService
+
+router = APIRouter()
+bearer = HTTPBearer(auto_error=True)
+
+
+def _require_admin(creds: HTTPAuthorizationCredentials) -> None:
+    payload = decode_access_token(creds.credentials)
+    if not payload or payload.get("role") != "ADMIN":
+        raise HTTPException(status.HTTP_403_FORBIDDEN, "admin role required")
+
+
+@router.get("", response_model=UserPage)
+def list_users(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    creds: HTTPAuthorizationCredentials = Depends(bearer),
+    db: Session = Depends(get_db),
+) -> UserPage:
+    payload = decode_access_token(creds.credentials)
+    if not payload:
+        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Invalid token")
+    return UserService(UserRepository(db)).list(page, limit)
+
+
+@router.post("", response_model=UserOut, status_code=status.HTTP_201_CREATED)
+def create_user(
+    dto: UserCreate,
+    creds: HTTPAuthorizationCredentials = Depends(bearer),
+    db: Session = Depends(get_db),
+) -> UserOut:
+    _require_admin(creds)
+    service = UserService(UserRepository(db))
+    try:
+        return service.create(dto)
+    except EmailAlreadyInUse as exc:
+        raise HTTPException(status.HTTP_409_CONFLICT, "email already in use") from exc

package/templates/stacks/python-fastapi/app/schemas/user.py

@@ -0,0 +1,56 @@
+"""Pydantic IN/OUT schemas for user resource."""
+import re
+import uuid
+from datetime import datetime
+from typing import Annotated, Literal
+
+from pydantic import BaseModel, ConfigDict, EmailStr, Field, field_validator
+
+
+class LoginIn(BaseModel):
+    email: EmailStr
+    password: Annotated[str, Field(min_length=8)]
+
+    @field_validator("password")
+    @classmethod
+    def password_complexity(cls, v: str) -> str:
+        if not re.search(r"[A-Z]", v):
+            raise ValueError("password must contain an uppercase letter")
+        if not re.search(r"\d", v):
+            raise ValueError("password must contain a digit")
+        return v
+
+
+class LoginOut(BaseModel):
+    access_token: str
+    expires_in: int
+    token_type: Literal["bearer"] = "bearer"
+
+
+class UserOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+    id: uuid.UUID
+    email: EmailStr
+    role: str
+    created_at: datetime
+
+
+class UserCreate(BaseModel):
+    email: EmailStr
+    password: Annotated[str, Field(min_length=8)]
+    role: Literal["USER", "ADMIN"] = "USER"
+
+    @field_validator("password")
+    @classmethod
+    def password_complexity(cls, v: str) -> str:
+        if not re.search(r"[A-Z]", v):
+            raise ValueError("password must contain an uppercase letter")
+        if not re.search(r"\d", v):
+            raise ValueError("password must contain a digit")
+        return v
+
+
+class UserPage(BaseModel):
+    items: list[UserOut]
+    total: int
+    page: int

package/templates/stacks/python-fastapi/app/services/auth_service.py

@@ -0,0 +1,22 @@
+"""Authentication service — login flow."""
+from app.core.security import create_access_token, verify_password
+from app.repositories.user_repository import UserRepository
+from app.schemas.user import LoginIn, LoginOut
+
+
+class InvalidCredentials(Exception):
+    """Raised when email or password don't match."""
+
+
+class AuthService:
+    def __init__(self, repo: UserRepository) -> None:
+        self.repo = repo
+
+    def login(self, dto: LoginIn) -> LoginOut:
+        user = self.repo.find_by_email(dto.email.lower().strip())
+        if user is None or not verify_password(dto.password, user.password):
+            raise InvalidCredentials
+        token, expires_in = create_access_token(
+            str(user.id), claims={"email": user.email, "role": user.role}
+        )
+        return LoginOut(access_token=token, expires_in=expires_in)

package/templates/stacks/python-fastapi/app/services/user_service.py

@@ -0,0 +1,31 @@
+"""User service — create/list business logic."""
+from app.core.security import hash_password
+from app.repositories.user_repository import UserRepository
+from app.schemas.user import UserCreate, UserOut, UserPage
+
+
+class EmailAlreadyInUse(Exception):
+    """Raised when a user with the same email already exists."""
+
+
+class UserService:
+    def __init__(self, repo: UserRepository) -> None:
+        self.repo = repo
+
+    def list(self, page: int, limit: int) -> UserPage:
+        items, total = self.repo.page(page, limit)
+        return UserPage(
+            items=[UserOut.model_validate(u) for u in items],
+            total=total,
+            page=max(1, page),
+        )
+
+    def create(self, dto: UserCreate) -> UserOut:
+        if self.repo.find_by_email(dto.email.lower().strip()) is not None:
+            raise EmailAlreadyInUse
+        created = self.repo.create(
+            email=dto.email.lower().strip(),
+            password=hash_password(dto.password),
+            role=dto.role,
+        )
+        return UserOut.model_validate(created)

package/templates/stacks/python-fastapi/gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+*$py.class
+.venv/
+.env
+.env.local
+.pytest_cache/
+.ruff_cache/
+.coverage
+dist/
+*.egg-info/
+.DS_Store

package/templates/stacks/python-fastapi/llms.txt.j2

@@ -0,0 +1,53 @@
+# {{ projectName }}
+
+DARE-shaped FastAPI 0.115+ API. Layered Design: Router → Service → Repository → Model.
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+python -m venv .venv
+source .venv/bin/activate
+pip install -e ".[dev]"
+alembic upgrade head
+uvicorn app.main:app --reload
+```
+
+## Commands
+
+- `uvicorn app.main:app --reload` — dev server (port 8000)
+- `pytest` — pytest suite
+- `ruff check .` — lint
+- `pip-audit` — dependency audit
+- `alembic revision --autogenerate -m "..."` — new migration
+- `alembic upgrade head` — apply migrations
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST | `/auth/login` | none | Exchange email+password for JWT |
+| GET | `/auth/me` | Bearer | Current user info |
+| GET | `/users` | Bearer | List users (query: page, limit) |
+| POST | `/users` | Bearer (admin) | Create user |
+| GET | `/openapi.json` | none | OpenAPI 3.1 document |
+| GET | `/docs` | none | Swagger UI |
+
+## Layered Design
+
+- `app/routers/` — HTTP layer (FastAPI APIRouter)
+- `app/services/` — business logic
+- `app/repositories/` — DB queries via SQLAlchemy
+- `app/models/` — SQLAlchemy declarative
+- `app/schemas/` — Pydantic IN/OUT
+
+Routers never touch SQLAlchemy directly — they call services which call repositories.
+
+## Env vars
+
+See `.env.example`. Required: `DATABASE_URL`, `JWT_SECRET`.
+
+## DARE skills
+
+See `.dare/skills.yml`.

package/templates/stacks/python-fastapi/openapi.json.j2

@@ -0,0 +1,43 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "{{ projectName }}",
+    "version": "0.1.0",
+    "description": "DARE-shaped FastAPI API"
+  },
+  "paths": {
+    "/auth/login": {
+      "post": {
+        "summary": "Exchange email+password for JWT",
+        "responses": {
+          "200": { "description": "JWT issued" },
+          "401": { "description": "Invalid credentials" }
+        }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "summary": "Current user",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "User" }, "401": { "description": "Unauthorized" } }
+      }
+    },
+    "/users": {
+      "get": {
+        "summary": "List users",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "Page of users" } }
+      },
+      "post": {
+        "summary": "Create user (admin)",
+        "security": [{ "bearer": [] }],
+        "responses": { "201": { "description": "Created" }, "403": { "description": "Forbidden" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }
+    }
+  }
+}

package/templates/stacks/python-fastapi/pyproject.toml.j2

@@ -0,0 +1,45 @@
+[project]
+name = "{{ projectName }}"
+version = "0.1.0"
+description = "DARE-shaped FastAPI API"
+requires-python = ">=3.11"
+dependencies = [
+    "fastapi>=0.115,<1.0",
+    "uvicorn[standard]>=0.30,<1.0",
+    "pydantic[email]>=2.7,<3.0",
+    "pydantic-settings>=2.4,<3.0",
+    "sqlalchemy>=2.0,<3.0",
+    "alembic>=1.13,<2.0",
+    "psycopg[binary]>=3.2,<4.0",
+    "python-jose[cryptography]>=3.3,<4.0",
+    "passlib[bcrypt]>=1.7,<2.0",
+    "slowapi>=0.1.9,<0.2.0",
+    "python-multipart>=0.0.9",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.2,<9.0",
+    "pytest-asyncio>=0.23,<1.0",
+    "httpx>=0.27,<1.0",
+    "ruff>=0.5,<1.0",
+    "pip-audit>=2.7,<3.0",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["app"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP"]
+ignore = ["E501"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"

package/templates/stacks/python-fastapi/tests/test_auth.py

@@ -0,0 +1,22 @@
+"""Smoke tests for auth router using httpx + FastAPI's TestClient."""
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+client = TestClient(app)
+
+
+def test_healthz_returns_ok() -> None:
+    res = client.get("/healthz")
+    assert res.status_code == 200
+    assert res.json() == {"status": "ok"}
+
+
+def test_login_rejects_bad_email() -> None:
+    res = client.post("/auth/login", json={"email": "not-an-email", "password": "Str0ngPass"})
+    assert res.status_code == 422
+
+
+def test_login_rejects_short_password() -> None:
+    res = client.post("/auth/login", json={"email": "u@example.com", "password": "short"})
+    assert res.status_code == 422

package/templates/stacks/ruby-rails-8/.dare/skills.yml

@@ -0,0 +1,50 @@
+# DARE v3.0 — Skills manifest
+# Lists which DARE skills are active in this project.
+# Used by: dare validate, rake dare:metrics, CI checks
+
+version: "3.0"
+stack: ruby-rails-8
+
+skills:
+  dare-ax:
+    version: "1.0"
+    enabled: true
+    artifacts:
+      - llms.txt
+      - public/openapi.json
+
+  dare-layered-design:
+    version: "1.0"
+    enabled: true
+    directories:
+      - app/handlers
+      - app/services
+      - app/repositories
+      - app/models
+      - app/presenters
+
+  dare-llm-integration:
+    version: "1.0"
+    enabled: true
+    directories:
+      - app/llm/providers
+      - app/llm/prompts
+      - app/llm/validators
+      - app/llm/cache
+      - app/llm/rate_limit
+
+  dare-realtime:
+    version: "1.0"
+    enabled: true
+    directories:
+      - app/channels
+
+  dare-quality-telemetry:
+    version: "1.0"
+    enabled: true
+    rake_task: dare:metrics
+    metrics:
+      - M-01  # llms.txt exists
+      - M-02  # OpenAPI spec exists
+      - M-03  # CLI --json support
+      - M-04  # Rate limiting configured

package/templates/stacks/ruby-rails-8/.env.example

@@ -0,0 +1,20 @@
+# Application
+RAILS_ENV=development
+PORT=3000
+LOG_LEVEL=info
+
+# Database
+DATABASE_URL=postgresql://user:pass@localhost:5432/myapp_development
+
+# Rails master key lives in config/master.key (NOT here) — never commit it.
+# SECRET_KEY_BASE is derived from credentials in production.
+
+# Action Cable / Redis
+REDIS_URL=redis://localhost:6379/1
+
+# Rate limit (rack-attack)
+RATE_LIMIT_PER_MIN=60
+
+# LLM provider (optional)
+LLM_PROVIDER=dummy
+# OPENAI_API_KEY=

package/templates/stacks/ruby-rails-8/.github/workflows/dare-ci.yml

@@ -0,0 +1,112 @@
+# DARE v3.1 — CI/CD Pipeline for Rails 8 stack
+# Runs on every push and pull_request
+# Validates: bundle audit + rubocop + rspec + dare:metrics (M-01 to M-04)
+
+name: DARE CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  audit:
+    name: Audit dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+      - name: bundle audit
+        run: |
+          gem install bundler-audit
+          bundle audit check --update
+
+  lint:
+    name: Lint (RuboCop)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+      - name: rubocop
+        run: bundle exec rubocop
+
+  test:
+    name: Test (Ruby ${{ matrix.ruby }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.3"]
+
+    services:
+      postgres:
+        image: postgres:14
+        env:
+          POSTGRES_USER:     postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB:       app_test
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
+      redis:
+        image: redis:7
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 6379:6379
+
+    env:
+      RAILS_ENV:    test
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/app_test
+      REDIS_URL:    redis://localhost:6379/0
+      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Set up database
+        run: bundle exec rails db:create db:migrate RAILS_ENV=test
+
+      - name: Run RSpec
+        run: bundle exec rspec --format progress --format RspecJunitFormatter --out tmp/rspec.xml
+        continue-on-error: false
+
+      - name: Run DARE metrics validation
+        run: bundle exec rake dare:metrics
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: rspec-results
+          path: tmp/rspec.xml
+
+      - name: Upload DARE metrics
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dare-metrics
+          path: tmp/dare_metrics.json

package/templates/stacks/ruby-rails-8/Gemfile.erb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+ruby ">= 3.3.0"
+
+# Core — Rails 8 Omakase
+gem "rails", "~> 8.0"
+gem "puma", ">= 5.0"
+gem "bootsnap", require: false
+gem "tzinfo-data", platforms: %i[windows jruby]
+
+# Database
+gem "pg", "~> 1.1"
+
+# Solid Suite (Rails 8 Omakase)
+gem "solid_cache"
+gem "solid_queue"
+
+# Real-time
+gem "redis", "~> 5.0"
+gem "redis-actioncable", require: false
+
+# OpenAPI — single source of truth via rswag
+gem "rswag-api"
+gem "rswag-ui"
+
+# Rate limiting
+gem "rack-attack"
+
+# JSON Schema validation
+gem "json_schemer"
+
+# HTTP client for LLM providers
+gem "faraday", "~> 2.0"
+gem "faraday-retry"
+
+# Background processing
+gem "solid_queue"
+
+group :development, :test do
+  gem "debug", platforms: %i[mri windows linux]
+  gem "rspec-rails", "~> 6.0"
+  gem "factory_bot_rails", "~> 6.0"
+  gem "faker", "~> 3.0"
+  gem "rswag-specs"
+  gem "shoulda-matchers", "~> 5.0"
+  gem "simplecov", require: false
+end
+
+group :development do
+  gem "web-console"
+  gem "rack-mini-profiler"
+  gem "rubocop-rails-omakase", require: false
+end
+
+group :test do
+  gem "database_cleaner-active_record"
+  gem "webmock"
+  gem "vcr"
+end

package/templates/stacks/ruby-rails-8/app/channels/application_cable/channel.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# DARE v3.0 — ApplicationCable::Channel base
+# All channels inherit from this; subscription authorization happens here
+
+module ApplicationCable
+  class Channel < ActionCable::Channel::Base
+    # Convenience: access current_user from connection in all channels
+    delegate :current_user, to: :connection
+  end
+end

package/templates/stacks/ruby-rails-8/app/channels/application_cable/connection.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# DARE v3.0 — Action Cable Connection with cookie-based auth
+# Convention (ADR-03): Every connection validates authentication
+# Unauthorized connections are rejected at the connection level
+
+module ApplicationCable
+  class Connection < ActionCable::Connection::Base
+    identified_by :current_user
+
+    def connect
+      self.current_user = find_verified_user
+    end
+
+    private
+
+    def find_verified_user
+      # Strategy 1: cookie-based session (most common for Rails apps)
+      if (user_id = cookies.signed[:user_id])
+        user = User.find_by(id: user_id)
+        return user if user&.active?
+      end
+
+      # Strategy 2: token-based (for mobile/API clients)
+      if (token = request.params[:token].presence || env["HTTP_X_ACTION_CABLE_TOKEN"])
+        # Implement your token lookup here:
+        # user = User.find_by_auth_token(token)
+        # return user if user&.active?
+      end
+
+      reject_unauthorized_connection
+    end
+  end
+end

package/templates/stacks/ruby-rails-8/app/channels/dare_updates_channel.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# DARE v3.0 — DareUpdatesChannel
+# Convention (ADR-03): subscriptions authorize before streaming
+# This is a generic channel for DARE system events (metrics, deploys, etc.)
+
+class DareUpdatesChannel < ApplicationCable::Channel
+  def subscribed
+    # Reject if not authenticated (connection already checks, but belt-and-suspenders)
+    reject_subscription unless current_user
+
+    stream_from "dare_updates:#{current_user.id}"
+  end
+
+  def unsubscribed
+    stop_all_streams
+  end
+end

package/templates/stacks/ruby-rails-8/app/channels/user_updates_channel.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# DARE v3.0 — UserUpdatesChannel
+# Convention (ADR-03): per-user channel with authorization check
+# Frontend subscribes with: consumer.subscriptions.create({ channel: "UserUpdatesChannel", user_id: 123 })
+
+class UserUpdatesChannel < ApplicationCable::Channel
+  def subscribed
+    user_id = params[:user_id].to_i
+
+    # Authorization: only subscribe to your own updates (or admin)
+    unless current_user.can_view?(user_id)
+      reject_subscription
+      return
+    end
+
+    stream_for user_id
+  end
+
+  def unsubscribed
+    stop_all_streams
+  end
+end