innovationhub-cli 1.1.0 → 2.0.1

package/templates/python/alembic.ini

@@ -0,0 +1,39 @@
+# Alembic configuration file.
+[alembic]
+script_location = alembic
+prepend_sys_path = .
+sqlalchemy.url = driver://user:pass@localhost/dbname
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

package/templates/python/app/auth/__init__.py

@@ -0,0 +1,5 @@
+from app.auth.dependencies import get_current_user, require_role
+from app.auth.enums import Role
+from app.auth.router import router
+
+__all__ = ["get_current_user", "require_role", "Role", "router"]

package/templates/python/app/auth/dependencies.py

@@ -0,0 +1,118 @@
+import uuid
+from datetime import UTC, datetime, timedelta
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jose import JWTError, jwt
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth.enums import Role
+from app.common.errors import ERRORS
+from app.core.config import settings
+from app.core.database import get_db
+
+security = HTTPBearer()
+
+
+def create_access_token(user_id: uuid.UUID, email: str, role: str) -> str:
+    """Cria um JWT access token."""
+    expire = datetime.now(UTC) + timedelta(minutes=settings.JWT_EXPIRATION_MINUTES)
+    payload = {
+        "sub": str(user_id),
+        "email": email,
+        "role": role,
+        "exp": expire,
+    }
+    return jwt.encode(payload, settings.JWT_SECRET, algorithm="HS256")
+
+
+def create_refresh_token(user_id: uuid.UUID, email: str, role: str, jti: str) -> str:
+    """Cria um JWT refresh token."""
+    expire = datetime.now(UTC) + timedelta(days=settings.JWT_REFRESH_EXPIRATION_DAYS)
+    payload = {
+        "sub": str(user_id),
+        "email": email,
+        "role": role,
+        "jti": jti,
+        "exp": expire,
+    }
+    return jwt.encode(payload, settings.JWT_REFRESH_SECRET, algorithm="HS256")
+
+
+def decode_access_token(token: str) -> dict:
+    """Decodifica e valida um access token."""
+    try:
+        return jwt.decode(token, settings.JWT_SECRET, algorithms=["HS256"])
+    except JWTError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["INVALID_TOKEN"],
+        ) from exc
+
+
+def decode_refresh_token(token: str) -> dict:
+    """Decodifica e valida um refresh token."""
+    try:
+        return jwt.decode(token, settings.JWT_REFRESH_SECRET, algorithms=["HS256"])
+    except JWTError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERRORS["AUTH"]["ACCESS_DENIED"],
+        ) from exc
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: AsyncSession = Depends(get_db),
+):
+    """Dependency que extrai e valida o usuário atual do token JWT."""
+    from app.user.models import User
+
+    payload = decode_access_token(credentials.credentials)
+    user_id = payload.get("sub")
+
+    if not user_id:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["INVALID_TOKEN"],
+        )
+
+    user = await db.get(User, uuid.UUID(user_id))
+
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["INVALID_TOKEN"],
+        )
+
+    if user.deleted_at is not None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["ACCOUNT_DELETED"],
+        )
+
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["ACCOUNT_DISABLED"],
+        )
+
+    return user
+
+
+def require_role(*roles: Role):
+    """
+    Dependency factory que verifica se o usuário tem um dos papéis necessários.
+
+    Uso: @router.get("/", dependencies=[Depends(require_role(Role.ADMIN))])
+    """
+
+    async def role_checker(current_user=Depends(get_current_user)):
+        if current_user.role not in [r.value for r in roles]:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail=ERRORS["AUTH"]["ACCESS_DENIED"],
+            )
+        return current_user
+
+    return role_checker

package/templates/python/app/auth/enums.py

@@ -0,0 +1,6 @@
+from enum import StrEnum
+
+
+class Role(StrEnum):
+    USER = "user"
+    ADMIN = "admin"

package/templates/python/app/auth/models.py

@@ -0,0 +1,18 @@
+from sqlalchemy import Boolean, Column, ForeignKey, String
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import relationship
+
+from app.common.base_model import BaseModel
+
+
+class RefreshToken(BaseModel):
+    """Entidade de refresh token."""
+
+    __tablename__ = "refresh_tokens"
+
+    jti: str = Column(String, unique=True, nullable=False)
+    hashed_token: str = Column(String, nullable=False)
+    is_revoked: bool = Column(Boolean, default=False, nullable=False)
+
+    user_id = Column(UUID(as_uuid=True), ForeignKey("users.id"), nullable=False)
+    user = relationship("User", back_populates="refresh_tokens")

package/templates/python/app/auth/router.py

@@ -0,0 +1,68 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth import service as auth_service
+from app.auth.dependencies import get_current_user
+from app.auth.schemas import (
+    ChangePasswordRequest,
+    LoginRequest,
+    LoginResponse,
+    MessageResponse,
+    RefreshTokenRequest,
+)
+from app.core.database import get_db
+from app.user.models import User
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+@router.post(
+    "/login",
+    response_model=LoginResponse,
+    summary="Autentica um usuário",
+    responses={200: {"description": "Usuário autenticado com sucesso."}},
+)
+async def login(data: LoginRequest, db: AsyncSession = Depends(get_db)):
+    return await auth_service.login(db, data.email, data.password)
+
+
+@router.post(
+    "/logout",
+    status_code=200,
+    summary="Faz logout do usuário",
+    responses={200: {"description": "Logout realizado com sucesso."}},
+)
+async def logout(data: RefreshTokenRequest, db: AsyncSession = Depends(get_db)):
+    await auth_service.logout(db, data.refresh_token)
+    return {"message": "Logout realizado com sucesso."}
+
+
+@router.post(
+    "/refresh",
+    response_model=LoginResponse,
+    summary="Atualiza os tokens de acesso",
+    responses={
+        200: {"description": "Tokens atualizados com sucesso."},
+        401: {"description": "O refresh token é inválido ou expirou."},
+    },
+)
+async def refresh_tokens(data: RefreshTokenRequest, db: AsyncSession = Depends(get_db)):
+    return await auth_service.refresh_tokens(db, data.refresh_token)
+
+
+@router.patch(
+    "/change-password",
+    response_model=MessageResponse,
+    summary="Altera a senha do usuário logado",
+    responses={
+        200: {"description": "Senha alterada com sucesso."},
+        401: {"description": "Não autorizado."},
+        400: {"description": "Requisição inválida."},
+    },
+)
+async def change_password(
+    data: ChangePasswordRequest,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    return await auth_service.change_password(db, current_user.id, data)

package/templates/python/app/auth/schemas.py

@@ -0,0 +1,58 @@
+import uuid
+
+from pydantic import BaseModel, EmailStr, Field
+
+from app.auth.enums import Role
+
+
+class LoginRequest(BaseModel):
+
+    email: EmailStr
+    password: str
+
+
+class LoginResponse(BaseModel):
+
+    access_token: str
+    refresh_token: str
+    expires_in: int
+    refresh_expires_in: int
+    user: "UserOut"
+
+
+
+class RefreshTokenRequest(BaseModel):
+
+    refresh_token: str
+
+
+
+class ChangePasswordRequest(BaseModel):
+
+    old_password: str
+    new_password: str = Field(..., min_length=8)
+
+
+class MessageResponse(BaseModel):
+    message: str
+
+
+# --- User schemas (para evitar import circular, definimos aqui) ---
+
+
+class UserOut(BaseModel):
+    """Schema de saída do usuário (sem password)."""
+
+    model_config = {"from_attributes": True}
+
+    id: uuid.UUID
+    email: str
+    name: str
+    phone: str | None = None
+    is_active: bool
+    role: Role
+    must_change_password: bool
+
+
+# Resolve forward reference
+LoginResponse.model_rebuild()

package/templates/python/app/auth/service.py

@@ -0,0 +1,180 @@
+import uuid
+
+from fastapi import HTTPException, status
+from passlib.context import CryptContext
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth.dependencies import (
+    create_access_token,
+    create_refresh_token,
+    decode_refresh_token,
+)
+from app.auth.models import RefreshToken
+from app.auth.schemas import ChangePasswordRequest, LoginResponse, MessageResponse, UserOut
+from app.common.errors import ERRORS
+from app.core.config import settings
+from app.user.models import User
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def hash_password(password: str) -> str:
+    return pwd_context.hash(password)
+
+
+async def validate_user(db: AsyncSession, email: str, password: str) -> User:
+    """Valida credenciais e retorna o usuário."""
+    stmt = select(User).where(User.email == email)
+    result = await db.execute(stmt)
+    user = result.scalar_one_or_none()
+
+    if not user or not verify_password(password, user.password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["INVALID_CREDENTIALS"],
+        )
+
+    if user.deleted_at is not None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["ACCOUNT_DELETED"],
+        )
+
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["ACCOUNT_DISABLED"],
+        )
+
+    return user
+
+
+async def generate_auth_response(db: AsyncSession, user: User) -> LoginResponse:
+    jti = str(uuid.uuid4())
+
+    access_token = create_access_token(user.id, user.email, user.role)
+    refresh_token = create_refresh_token(user.id, user.email, user.role, jti)
+
+    # Salvar refresh token com hash
+    hashed = hash_password(refresh_token)
+    token_entity = RefreshToken(
+        jti=jti,
+        hashed_token=hashed,
+        is_revoked=False,
+        user_id=user.id,
+    )
+    db.add(token_entity)
+    await db.flush()
+
+    return LoginResponse(
+        access_token=access_token,
+        refresh_token=refresh_token,
+        expires_in=settings.JWT_EXPIRATION_MINUTES * 60,
+        refresh_expires_in=settings.JWT_REFRESH_EXPIRATION_DAYS * 86400,
+        user=UserOut.model_validate(user),
+    )
+
+
+async def login(db: AsyncSession, email: str, password: str) -> LoginResponse:
+    """Autentica o usuário e retorna tokens."""
+    user = await validate_user(db, email, password)
+    return await generate_auth_response(db, user)
+
+
+async def logout(db: AsyncSession, refresh_token: str) -> None:
+    """Revoga o refresh token (logout)."""
+    payload = decode_refresh_token(refresh_token)
+    jti = payload.get("jti")
+    if not jti:
+        return
+
+    stmt = select(RefreshToken).where(RefreshToken.jti == jti)
+    result = await db.execute(stmt)
+    token = result.scalar_one_or_none()
+
+    if token:
+        token.is_revoked = True
+        await db.flush()
+
+
+async def refresh_tokens(db: AsyncSession, refresh_token_str: str) -> LoginResponse:
+    """Rotaciona os tokens (revoga o antigo, gera novos)."""
+    payload = decode_refresh_token(refresh_token_str)
+    jti = payload.get("jti")
+    user_id = payload.get("sub")
+
+    if not jti or not user_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERRORS["AUTH"]["ACCESS_DENIED"],
+        )
+
+    # Verificar se o token existe e não foi revogado
+    stmt = select(RefreshToken).where(RefreshToken.jti == jti)
+    result = await db.execute(stmt)
+    token_record = result.scalar_one_or_none()
+
+    if not token_record or token_record.is_revoked:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERRORS["AUTH"]["ACCESS_DENIED"],
+        )
+
+    # Verificar hash do token
+    if not verify_password(refresh_token_str, token_record.hashed_token):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=ERRORS["AUTH"]["ACCESS_DENIED"],
+        )
+
+    # Revogar o token antigo
+    token_record.is_revoked = True
+    await db.flush()
+
+    # Buscar usuário e gerar novos tokens
+    user = await db.get(User, uuid.UUID(user_id))
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["NOT_FOUND"],
+        )
+
+    return await generate_auth_response(db, user)
+
+
+async def change_password(
+    db: AsyncSession, user_id: uuid.UUID, data: ChangePasswordRequest
+) -> MessageResponse:
+    """Altera a senha do usuário."""
+    user = await db.get(User, user_id)
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["NOT_FOUND"],
+        )
+
+    if not verify_password(data.old_password, user.password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=ERRORS["AUTH"]["OLD_PASSWORD_INCORRECT"],
+        )
+
+    if data.old_password == data.new_password:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=ERRORS["AUTH"]["PASSWORD_SAME_AS_OLD"],
+        )
+
+    user.password = hash_password(data.new_password)
+
+    if user.must_change_password:
+        user.must_change_password = False
+
+    await db.flush()
+
+    return MessageResponse(message=ERRORS["AUTH"]["PASSWORD_CHANGED"])

package/templates/python/app/common/__init__.py

@@ -0,0 +1,18 @@
+from app.common.base_model import Base, BaseModel
+from app.common.base_repository import BaseRepository
+from app.common.errors import ERRORS
+from app.common.pagination import PaginatedResult, PaginationMeta
+from app.common.schemas import BaseQueryParams, SortOrder
+from app.common.utils import create_slug
+
+__all__ = [
+    "Base",
+    "BaseModel",
+    "BaseRepository",
+    "ERRORS",
+    "PaginatedResult",
+    "PaginationMeta",
+    "BaseQueryParams",
+    "SortOrder",
+    "create_slug",
+]

package/templates/python/app/common/base_model.py

@@ -0,0 +1,26 @@
+import uuid
+from datetime import datetime
+
+from sqlalchemy import DateTime, func
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
+
+
+class Base(DeclarativeBase):
+
+    pass
+
+
+class BaseModel(Base):
+
+    __abstract__ = True
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )

package/templates/python/app/common/base_repository.py

@@ -0,0 +1,83 @@
+import uuid
+from typing import Generic, TypeVar
+
+from sqlalchemy import desc, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.common.base_model import BaseModel
+from app.common.pagination import PaginatedResult, PaginationMeta
+
+T = TypeVar("T", bound=BaseModel)
+
+
+class BaseRepository(Generic[T]):
+    """Repositório base genérico."""
+
+    def __init__(self, model: type[T], session: AsyncSession):
+        self.model = model
+        self.session = session
+
+    async def find_all(self) -> list[T]:
+        stmt = select(self.model).order_by(desc(self.model.created_at))
+        result = await self.session.execute(stmt)
+        return list(result.scalars().all())
+
+    async def find_by_id(self, id: uuid.UUID) -> T | None:
+        return await self.session.get(self.model, id)
+
+    async def create(self, data: dict) -> T:
+        entity = self.model(**data)
+        self.session.add(entity)
+        await self.session.flush()
+        await self.session.refresh(entity)
+        return entity
+
+    async def update(self, id: uuid.UUID, data: dict) -> T | None:
+        entity = await self.find_by_id(id)
+        if not entity:
+            return None
+        for key, value in data.items():
+            if value is not None:
+                setattr(entity, key, value)
+        await self.session.flush()
+        await self.session.refresh(entity)
+        return entity
+
+    async def delete(self, id: uuid.UUID) -> None:
+        entity = await self.find_by_id(id)
+        if entity:
+            await self.session.delete(entity)
+            await self.session.flush()
+
+    async def find_all_paginated(
+        self,
+        page: int = 1,
+        limit: int = 10,
+        order_by: str = "created_at",
+        order_dir: str = "DESC",
+    ) -> PaginatedResult[T]:
+        # Contagem total
+        count_stmt = select(func.count()).select_from(self.model)
+        total_result = await self.session.execute(count_stmt)
+        total_items = total_result.scalar() or 0
+
+        # Query paginada
+        column = getattr(self.model, order_by, self.model.created_at)
+        order = desc(column) if order_dir.upper() == "DESC" else column.asc()
+
+        stmt = select(self.model).order_by(order).offset((page - 1) * limit).limit(limit)
+        result = await self.session.execute(stmt)
+        data = list(result.scalars().all())
+
+        total_pages = (total_items + limit - 1) // limit if limit > 0 else 0
+
+        return PaginatedResult(
+            data=data,
+            meta=PaginationMeta(
+                total_items=total_items,
+                item_count=len(data),
+                items_per_page=limit,
+                total_pages=total_pages,
+                current_page=page,
+            ),
+        )

package/templates/python/app/common/errors.py

@@ -0,0 +1,35 @@
+ERRORS = {
+    "AUTH": {
+        "NOT_FOUND": "Usuário não encontrado.",
+        "INVALID_TOKEN": "Token inválido.",
+        "ACCESS_DENIED": "Acesso negado",
+        "EMAIL_IN_USE": "O e-mail já está em uso.",
+        "INVALID_CREDENTIALS": (
+            "E-mail ou senha inválidos. Por favor, verifique seus dados e tente novamente."
+        ),
+        "ACCOUNT_DELETED": "Sua conta foi excluída. Por favor, entre em contato com o suporte.",
+        "ACCOUNT_DISABLED": (
+            "Sua conta está desativada. Por favor, entre em contato com o suporte."
+        ),
+        "OLD_PASSWORD_INCORRECT": "A senha antiga está incorreta. Tente novamente.",
+        "PASSWORD_SAME_AS_OLD": (
+            "A nova senha deve ser diferente da senha antiga. "
+            "Por favor, escolha uma nova senha."
+        ),
+        "PASSWORD_MIN_LENGTH": "A nova senha deve ter no mínimo 8 caracteres.",
+        "PASSWORD_CHANGED": "Senha alterada com sucesso.",
+    },
+    "USER": {
+        "NOT_FOUND": "Usuário não encontrado.",
+        "EMAIL_IN_USE": "O e-mail já está em uso.",
+        "DEFAULT_PASSWORD_NOT_SET": "Variável de ambiente DEFAULT_PASSWORD não configurada.",
+    },
+    "IMAGE": {
+        "REQUIRED": "O arquivo de imagem é obrigatório.",
+    },
+    "COMMON": {
+        "NOT_FOUND": "Recurso não encontrado.",
+        "BAD_REQUEST": "Requisição inválida.",
+        "INVALID_ARRAY_FORMAT": "Formato de array inválido.",
+    },
+}

package/templates/python/app/common/pagination.py

@@ -0,0 +1,22 @@
+from typing import Generic, TypeVar
+
+from pydantic import BaseModel
+
+T = TypeVar("T")
+
+
+class PaginationMeta(BaseModel):
+    """Metadados de paginação."""
+
+    total_items: int
+    item_count: int
+    items_per_page: int
+    total_pages: int
+    current_page: int
+
+
+class PaginatedResult(BaseModel, Generic[T]):
+    """Resultado paginado genérico."""
+
+    data: list[T]
+    meta: PaginationMeta