aso 0.2.0__tar.gz

aso-0.2.0/.gitignore

@@ -0,0 +1,48 @@
+# Python
+__pycache__/
+*.py[cod]
+.venv/
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# Env / local
+.env
+*.sqlite
+*.sqlite-journal
+
+# Node
+node_modules/
+public/build/
+public/hot
+
+# Generated by `aso routes:generate` (T-28) -- rewritten from scratch on every run
+resources/js/routes/
+resources/js/actions/
+resources/js/wayfinder/
+
+# The skeleton template is never a buildable project in this repo: its own venv/lock/db are
+# throwaway artifacts from running its tests, not framework state to track.
+/skeleton/.venv/
+/skeleton/uv.lock
+/skeleton/database/database.sqlite
+/skeleton/database/database.sqlite-*
+
+# Spikes
+spikes/**/server.log
+spikes/**/server.pid
+spikes/**/version.txt
+spikes/**/package-lock.json
+spikes/uv.lock
+
+# Logs written by fixture apps (contents only, so a tracked `storage/logs/.gitkeep` survives --
+# a directory-matching pattern here would exclude the whole directory and git cannot re-include
+# a file whose parent directory is excluded)
+storage/logs/*
+**/storage/logs/*
+!**/storage/logs/.gitkeep

aso-0.2.0/.python-version

@@ -0,0 +1 @@
+3.12

aso-0.2.0/BUILD.md

@@ -0,0 +1,75 @@
+# Building Aso (for contributors and coding agents)
+
+The framework is built **spec-first**: every feature has a reviewed guide page in the separate
+docs repo (`../docs/guide/T-xx-*.md`). The code must match the page. When the page and your idea
+disagree, the page wins; if the page is wrong or impossible, say so in your report instead of
+silently doing something else.
+
+Spec precedence: `docs/plan/DECISIONS.md` > `docs/plan/LARAVEL-MAP.md` (names and import paths)
+> the guide page > `docs/plan/RESEARCH-BASELINE.md`. Spike write-ups: `docs/research/spikes/`.
+
+## Layout
+
+```
+src/aso/
+  context.py          per-request context (ContextVar). Read its docstring first.
+  config/             env(), config()
+  foundation/         Application.configure()...create(), MiddlewareConfig, ExceptionsConfig,
+                      stack.py (group stacks + exception boundaries), paths
+  exceptions/         types.py = EVERY framework exception class; handler.py = report/render
+  routing/ http/ session/ database/ inertia/ validation/ auth/ ...   one package per area
+tests/
+  test_spine_loop.py  end-to-end loop through the real stack; must always pass
+  fixtures/blog/      a tiny app used by end-to-end tests
+  <package>/          each package's own tests
+spikes/               Phase 0 proof-of-concepts (reference code, not imported)
+```
+
+## How a request flows (read `foundation/stack.py`)
+
+Global layers: `RequestContextMiddleware` → `MethodSpoofing` → `DatabaseScope` → user globals →
+router. Each matched route's ASGI app is wrapped with its group's stack: for `web`,
+`Boundary(StartSession(Boundary(AuthenticateSession(Boundary(PreventRequestForgery(Boundary(
+HandleInertiaRequests(Boundary(endpoint))))))))`. Exceptions are rendered by the nearest
+boundary through `aso.exceptions.handler`. Unknown URLs hit catch-all fallback routes
+registered last, so they still pass through the group stack.
+
+## Contracts between packages
+
+- **Request context** (`aso.context`): `current()` / `require()`; fields `request`,
+  `group`, `session`, `user`, `inertia`, `shared`, `route`, `route_params`, `extras`. The table in
+  its docstring says which package writes which field. Only write your own fields.
+- **Exceptions**: raise the classes in `aso.exceptions.types`; re-export them from your
+  package at the LARAVEL-MAP §3 path. Never define a second class with the same meaning.
+- **Session**: other packages use `aso.session.session()` and the `Session` methods named in
+  T-18 only.
+- **Database**: other packages use `Model`, `DB` and `aso.database.scope` only.
+- **Framework middleware is pure ASGI** (D-025). Never use `BaseHTTPMiddleware`.
+- **Lazy imports across packages** inside functions, to avoid import cycles at package import time.
+
+## Rules for agents
+
+1. Work **only inside the files and folders your task names**. If you need a change elsewhere
+   (a shared file such as `context.py`, `foundation/*`, `exceptions/types.py`, or another
+   package), do not make it: describe the exact change in your final report.
+2. Do **not** commit, push, publish, or touch `../cli`, `../docs` or git state. The reviewer
+   commits.
+3. Public names and import paths come from LARAVEL-MAP. Do not invent public APIs; private
+   helpers (`_name`) are fine.
+4. Write tests in `tests/<package>/` with pytest (async tests need no decorator: asyncio auto
+   mode). Test behaviour through the real stack where it matters (see `tests/test_spine_loop.py`
+   and its fixture app), plus unit tests.
+5. Before finishing run `uv run pytest -q` (everything, not just yours) and
+   `uv run ruff check src tests`. Report the results honestly, including failures you could not fix.
+6. Keep the code's style: type hints, short docstrings that say *why*, no print statements.
+7. Spec gaps: choose the most Laravel-like behaviour, implement it, and list it in your report under
+   "Decisions I made".
+
+## Commands
+
+```bash
+uv sync                      # install
+uv run pytest -q             # all tests
+uv run ruff check src tests  # lint
+DB_URL=postgresql+asyncpg://postgres:secret@127.0.0.1:55432/aso uv run pytest -q tests/database
+```

aso-0.2.0/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.5
+Name: aso
+Version: 0.2.0
+Summary: The Aso framework: a Laravel-style web framework for Python (FastAPI + Inertia.js + an artisan-like CLI)
+Project-URL: Homepage, https://github.com/Ibnu-Afdel/Aso
+Project-URL: Source, https://github.com/Ibnu-Afdel/Aso
+Project-URL: Issues, https://github.com/Ibnu-Afdel/Aso/issues
+Author-email: Abubeker Afdel <ibnuafdel@gmail.com>
+License: MIT
+Requires-Python: >=3.12
+Requires-Dist: aiosmtplib>=5.1
+Requires-Dist: aiosqlite>=0.22
+Requires-Dist: alembic>=1.20
+Requires-Dist: croniter<7,>=6.2
+Requires-Dist: cryptography>=50
+Requires-Dist: faker>=40
+Requires-Dist: fastapi<0.144,>=0.143
+Requires-Dist: httpx2>=2.13
+Requires-Dist: inflect>=7.5
+Requires-Dist: itsdangerous>=2.2
+Requires-Dist: jinja2>=3.1.6
+Requires-Dist: pwdlib[argon2]>=0.3.1
+Requires-Dist: pydantic[email]<2.15,>=2.14
+Requires-Dist: python-dotenv>=1.2.4
+Requires-Dist: python-multipart>=0.0.20
+Requires-Dist: sqlalchemy[asyncio]<2.2,>=2.1.4
+Requires-Dist: starlette<1.8,>=1.7
+Requires-Dist: typer<0.28,>=0.27
+Requires-Dist: uvicorn[standard]>=0.54
+Requires-Dist: watchfiles>=1.0
+Provides-Extra: mysql
+Requires-Dist: asyncmy>=0.2.16; extra == 'mysql'
+Provides-Extra: pgsql
+Requires-Dist: asyncpg>=0.32; extra == 'pgsql'
+Provides-Extra: redis
+Requires-Dist: redis>=8.1; extra == 'redis'
+Requires-Dist: taskiq-redis>=1.2.4; extra == 'redis'
+Requires-Dist: taskiq>=0.13; extra == 'redis'
+Provides-Extra: testing
+Requires-Dist: pytest-asyncio<1.5,>=1.4; extra == 'testing'
+Requires-Dist: pytest>=9.1; extra == 'testing'
+Description-Content-Type: text/markdown
+
+# Aso
+
+The Aso framework is a Laravel-style web framework for Python: **FastAPI** on the backend,
+**Inertia.js v3 + React** on the frontend, and an artisan-like CLI (`aso make:controller`,
+`aso migrate`, ...).
+
+> **Status: early (0.2.0).** It works end to end, but expect rough edges and breaking changes.
+> Versions up to 0.1.1 were published as `fastogram`; that package is retired.
+> The previous Telegram bot template (0.0.x, FastAPI + aiogram) is kept under the tag
+> `legacy-telegram-template` and on the `release/public-ready` branch.
+
+## Try it
+
+You need [uv](https://docs.astral.sh/uv/), Node 22+ and npm.
+
+```bash
+uvx aso new myapp     # like `laravel new myapp`
+cd myapp
+uv run aso dev        # server + Vite + route watcher
+```
+
+Open http://127.0.0.1:8000, register, and you're in the React starter kit (dashboard, settings,
+password reset, email verification). In local mode mail goes to `storage/logs/`.
+
+Useful commands: `aso list`, `aso route:list`, `aso make:model Post -mcr`,
+`aso migrate`, `uv run pytest`.
+
+## What it looks like
+
+```python
+# routes/web.py
+with Route.middleware("auth").group():
+    Route.get("/posts", [PostController, "index"]).name("posts.index")
+    Route.post("/posts", [PostController, "store"]).name("posts.store")
+
+# app/http/controllers/post_controller.py
+class PostController(Controller):
+    async def index(self):
+        return inertia("posts/index", {"posts": await Post.with_("author").latest().paginate(15)})
+
+    async def store(self, form: StorePostRequest):
+        await Post.create(**form.validated(), user_id=auth().id())
+        return redirect().route("posts.index").with_flash("success", "Post created.")
+```
+
+## Repository layout
+
+```
+src/aso/   the framework library and CLI (published to PyPI as `aso`)
+skeleton/        the app that `aso new` creates (like laravel/laravel)
+tests/           the framework's own tests
+spikes/          Phase 0 proof-of-concept spikes (throwaway)
+```
+
+## License
+
+MIT

aso-0.2.0/README.md

@@ -0,0 +1,57 @@
+# Aso
+
+The Aso framework is a Laravel-style web framework for Python: **FastAPI** on the backend,
+**Inertia.js v3 + React** on the frontend, and an artisan-like CLI (`aso make:controller`,
+`aso migrate`, ...).
+
+> **Status: early (0.2.0).** It works end to end, but expect rough edges and breaking changes.
+> Versions up to 0.1.1 were published as `fastogram`; that package is retired.
+> The previous Telegram bot template (0.0.x, FastAPI + aiogram) is kept under the tag
+> `legacy-telegram-template` and on the `release/public-ready` branch.
+
+## Try it
+
+You need [uv](https://docs.astral.sh/uv/), Node 22+ and npm.
+
+```bash
+uvx aso new myapp     # like `laravel new myapp`
+cd myapp
+uv run aso dev        # server + Vite + route watcher
+```
+
+Open http://127.0.0.1:8000, register, and you're in the React starter kit (dashboard, settings,
+password reset, email verification). In local mode mail goes to `storage/logs/`.
+
+Useful commands: `aso list`, `aso route:list`, `aso make:model Post -mcr`,
+`aso migrate`, `uv run pytest`.
+
+## What it looks like
+
+```python
+# routes/web.py
+with Route.middleware("auth").group():
+    Route.get("/posts", [PostController, "index"]).name("posts.index")
+    Route.post("/posts", [PostController, "store"]).name("posts.store")
+
+# app/http/controllers/post_controller.py
+class PostController(Controller):
+    async def index(self):
+        return inertia("posts/index", {"posts": await Post.with_("author").latest().paginate(15)})
+
+    async def store(self, form: StorePostRequest):
+        await Post.create(**form.validated(), user_id=auth().id())
+        return redirect().route("posts.index").with_flash("success", "Post created.")
+```
+
+## Repository layout
+
+```
+src/aso/   the framework library and CLI (published to PyPI as `aso`)
+skeleton/        the app that `aso new` creates (like laravel/laravel)
+tests/           the framework's own tests
+spikes/          Phase 0 proof-of-concept spikes (throwaway)
+```
+
+## License
+
+MIT

aso-0.2.0/pyproject.toml

@@ -0,0 +1,108 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "aso"
+version = "0.2.0"
+description = "The Aso framework: a Laravel-style web framework for Python (FastAPI + Inertia.js + an artisan-like CLI)"
+readme = "README.md"
+requires-python = ">=3.12"
+license = {text = "MIT"}
+authors = [
+    {name = "Abubeker Afdel", email = "ibnuafdel@gmail.com"}
+]
+dependencies = [
+    "fastapi>=0.143,<0.144",
+    "starlette>=1.7,<1.8",
+    "uvicorn[standard]>=0.54",
+    "pydantic[email]>=2.14,<2.15",
+    "sqlalchemy[asyncio]>=2.1.4,<2.2",
+    "aiosqlite>=0.22",
+    "alembic>=1.20",
+    "typer>=0.27,<0.28",
+    "jinja2>=3.1.6",
+    "itsdangerous>=2.2",
+    "cryptography>=50",
+    "pwdlib[argon2]>=0.3.1",
+    "python-dotenv>=1.2.4",
+    "python-multipart>=0.0.20",
+    "inflect>=7.5",
+    "faker>=40",
+    "aiosmtplib>=5.1",
+    "httpx2>=2.13",
+    "watchfiles>=1.0",
+    "croniter>=6.2,<7",
+]
+
+[project.urls]
+Homepage = "https://github.com/Ibnu-Afdel/Aso"
+Source = "https://github.com/Ibnu-Afdel/Aso"
+Issues = "https://github.com/Ibnu-Afdel/Aso/issues"
+
+[project.optional-dependencies]
+pgsql = ["asyncpg>=0.32"]
+mysql = ["asyncmy>=0.2.16"]
+redis = ["redis>=8.1", "taskiq>=0.13", "taskiq-redis>=1.2.4"]
+testing = ["pytest>=9.1", "pytest-asyncio>=1.4,<1.5"]
+
+[project.scripts]
+aso = "aso.console.cli:main"
+
+[project.entry-points.pytest11]
+aso = "aso.testing.plugin"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1",
+    "pytest-asyncio>=1.4,<1.5",
+    "asyncpg>=0.32",
+    "ruff>=0.14",
+]
+
+[tool.hatch.build]
+exclude = [
+    "**/.venv",
+    "**/.venv/**",
+    "**/uv.lock",
+    "**/database.sqlite",
+    "**/database.sqlite-*",
+    "**/__pycache__",
+    "**/*.py[cod]",
+    "**/.pytest_cache",
+    "**/.ruff_cache",
+    "**/node_modules",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/aso"]
+
+# D-022: the app skeleton (`aso new` copies this) ships inside the wheel as
+# `aso/skeleton/`, not as a second top-level package.
+[tool.hatch.build.targets.wheel.force-include]
+"skeleton" = "aso/skeleton"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+asyncio_default_test_loop_scope = "session"
+asyncio_default_fixture_loop_scope = "session"
+addopts = "-p no:aso"
+markers = [
+    "skeleton: exercises `aso new` end-to-end in a subprocess (slow, but still <3 min; part of the default run)",
+]
+
+[tool.ruff]
+line-length = 110
+target-version = "py312"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP"]
+ignore = ["E501", "UP046", "UP047"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["aso"]
+known-local-folder = ["app", "bootstrap", "config", "routes", "database"]
+
+[tool.hatch.build.targets.sdist]
+exclude = ["/spikes", "/storage", "/dist", "**/node_modules", "**/.venv"]

aso-0.2.0/skeleton/.env.example

@@ -0,0 +1,26 @@
+APP_NAME=Aso
+APP_ENV=local
+APP_DEBUG=true
+APP_URL=http://localhost:8000
+APP_KEY=
+APP_TIMEZONE=UTC
+APP_LOCALE=en
+
+DB_CONNECTION=sqlite
+DB_DATABASE=database/database.sqlite
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+
+QUEUE_CONNECTION=sync
+
+CACHE_STORE=file
+
+MAIL_MAILER=log
+MAIL_HOST=127.0.0.1
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_SCHEME=null
+MAIL_FROM_ADDRESS=hello@example.com
+MAIL_FROM_NAME="${APP_NAME}"

aso-0.2.0/skeleton/.env.testing

@@ -0,0 +1,20 @@
+APP_NAME=Aso
+APP_ENV=testing
+APP_DEBUG=true
+APP_URL=http://testserver
+APP_KEY=base64:2fl+Ktvkfl+Fuz4Qp/A75G2RTiWVA/ZoKZvp6fiiM10=
+APP_TIMEZONE=UTC
+APP_LOCALE=en
+
+DB_CONNECTION=sqlite
+DB_DATABASE=:memory:
+
+SESSION_DRIVER=array
+
+QUEUE_CONNECTION=sync
+
+CACHE_STORE=memory
+
+MAIL_MAILER=array
+MAIL_FROM_ADDRESS=hello@example.com
+MAIL_FROM_NAME=Aso

aso-0.2.0/skeleton/.gitignore

@@ -0,0 +1,24 @@
+/.venv
+/node_modules
+/.env
+/database/database.sqlite
+/database/database.sqlite-*
+/public/build
+/public/hot
+/public/storage
+/storage/app/*
+!/storage/app/public
+/storage/app/public/*
+!/storage/app/public/.gitkeep
+/storage/framework/cache/*
+!/storage/framework/cache/.gitkeep
+/storage/logs/*
+!/storage/logs/.gitkeep
+/resources/js/routes
+/resources/js/actions
+/resources/js/wayfinder
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.ruff_cache/
+.coverage

aso-0.2.0/skeleton/AGENTS.md

@@ -0,0 +1,49 @@
+# Instructions for AI Agents
+
+You are developing on an Aso project (FastAPI + Inertia.js v3 + React 19).
+Follow these conventions strictly.
+
+## 1. Generator First
+Always generate code using `aso make:*` commands rather than writing empty files manually:
+- `aso make:model Post -a --fields="title:string body:text"`
+- `aso make:controller PostController --resource --model=Post --requests`
+- `aso make:request StorePostRequest`
+- `aso make:page posts/index`
+- `aso make:test PostTest`
+
+## 2. Architecture Rules (A1-A13)
+The project runs AST-based architecture tests in `tests/architecture/`. Never violate these rules:
+- A1: Controllers must not import `sqlalchemy`. Move queries to model scopes or methods.
+- A2: Models must not import `fastapi`, `starlette`, or `aso.http`. Models must function without HTTP requests.
+- A3: Controller methods must not read raw request input (`request.input()`, `request.json()`). Take a `FormRequest` parameter instead.
+- A4: Pages passed to `inertia("posts/index")` must exist in `resources/js/pages/posts/index.tsx`.
+- A5: Do not import a third-party Inertia adapter (`cross_inertia`, `inertia`, `fastapi_inertia`). Use `aso.inertia`.
+- A6: Never interpolate raw SQL with f-strings, `%`, or `+`. Use parameterized `:name` bindings.
+- A7: Do not use `print()` or `breakpoint()`. Use `from aso.log import log`.
+- A8: Do not subclass `BaseHTTPMiddleware`. Inherit from `aso.http.Middleware`.
+- A9: Do not create manual SQLAlchemy engines or sessions. Use `from aso.database import DB`.
+- A10: Form request classes in `app/http/requests/` must extend `FormRequest` and end with `Request`.
+- A11: Every model in `app/models/` must define `__fillable__` or `__guarded__`.
+- A12: Background jobs in `app/jobs/` must accept scalar IDs in constructors, never model instances.
+- A13: Do not read `os.environ` outside `config/`. Use `from aso.config import config`.
+
+## 3. Inertia v3 Conventions
+- Page names are lowercase paths: `inertia("posts/index")`.
+- No Axios. Use Inertia's `<Form>`, `useForm`, `router`, or `useHttp`.
+- On validation failure, web controllers redirect back; they never return 422 JSON.
+- Never hard-code URLs in TSX. Import route helpers from `@/routes/...` (run `aso routes:generate`).
+- Pages never wrap themselves in `<AppLayout>`; pass breadcrumbs with `Page.layout = { breadcrumbs }`.
+- Flash messages arrive in `usePage().flash`. Never add `flash` to `share()`.
+
+## 4. Backend habits
+- Every write action (store, update, destroy) ends with `redirect(...).with_flash("success", ...)`.
+- Call `await self.authorize(...)` before changing a model the user might not own.
+- Eager load relations with `with_("author")` or `await post.load("author")`. Unloaded relations raise `LazyLoadingViolation`.
+- Everything that touches the database is `async`: `await Post.find(1)`, `await post.save()`.
+- Group multi-step writes in `async with DB.transaction():`.
+- Paginate lists (`.paginate(15)`); never `get()` an unbounded table for a page.
+- Jobs take ids, never models; reload in `handle()`.
+
+## 5. Before you finish
+- `aso test` passes, including `tests/architecture/`.
+- New routes have a feature test: happy path, validation failure, authorization failure.

aso-0.2.0/skeleton/LICENSES/laravel-react-starter-kit.md

@@ -0,0 +1,35 @@
+# Laravel React Starter Kit
+
+The React side of this kit (layouts, components, pages, hooks under `resources/js/`) is ported
+from the [Laravel React starter kit](https://github.com/laravel/react-starter-kit), which is
+MIT-licensed (its `README.md` and `composer.json` say so; the repository has no separate
+`LICENSE` file, checked 2026-10-09). See T-05 ("Licence") in the FastoGram docs.
+
+```
+MIT License
+
+Copyright (c) Taylor Otwell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+Every ported file keeps a one-line header comment naming its origin (T-05): layouts, components,
+hooks and pages ported from the kit say so directly; shadcn/ui primitives under
+`resources/js/components/ui/` (vendored inside the kit's repo, not authored by Laravel, but MIT
+either way) say "Ported from the Laravel React starter kit's shadcn/ui primitives".

aso-0.2.0/skeleton/app/actions/auth/create_new_user.py

@@ -0,0 +1,16 @@
+"""Creates a new user from validated registration data (T-38, Fortify's `CreateNewUser`).
+
+Edit this to assign default roles, create workspace records, or set other defaults when a user
+signs up. It survives framework/library upgrades because it lives in your own app code.
+"""
+
+from app.models.user import User
+
+
+class CreateNewUser:
+    async def create(self, data: dict) -> User:
+        return await User.create(
+            name=data["name"],
+            email=data["email"].lower(),
+            password=data["password"],
+        )

aso-0.2.0/skeleton/app/actions/auth/password_validation_rules.py

@@ -0,0 +1,28 @@
+"""The password rules shared by registration and password reset (T-38, Fortify's
+`PasswordValidationRules` trait).
+
+`rule()` is passed to `Password.defaults()` via `config/auth.py`; `description()` builds the
+`passwordRules` help text the Laravel React kit's `register`/`reset-password`/`settings/security`
+pages display under the password field.
+"""
+
+from aso.config import config
+from aso.validation import Password
+
+
+class PasswordValidationRules:
+    def rule(self) -> Password:
+        return Password.defaults()
+
+    def description(self) -> str:
+        rules = config("auth.password_rules", {})
+        parts = [f"at least {rules.get('min', 8)} characters"]
+        if rules.get("letters"):
+            parts.append("letters")
+        if rules.get("mixed_case"):
+            parts.append("upper and lowercase letters")
+        if rules.get("numbers"):
+            parts.append("at least one number")
+        if rules.get("symbols"):
+            parts.append("at least one symbol")
+        return "Must be " + ", ".join(parts) + "."

aso-0.2.0/skeleton/app/actions/auth/reset_user_password.py

@@ -0,0 +1,15 @@
+"""Sets a user's new password (T-38, Fortify's `ResetUserPassword`).
+
+`aso.auth.password_broker().reset()` already saves the new password and rotates
+`remember_token` itself (T-38 "How it works"); this action exists so your own reset flow -- or a
+custom `NewPasswordController` -- can reuse the same "how do we set a password" logic instead of
+duplicating it, and so you have one obvious place to extend it (e.g. logging, notifying admins).
+"""
+
+from app.models.user import User
+
+
+class ResetUserPassword:
+    async def reset(self, user: User, password: str) -> None:
+        user.password = password  # the `Hashed` column hashes it on assignment (T-31, T-40)
+        await user.save()

aso-0.2.0/skeleton/app/http/controllers/auth/authenticated_session_controller.py

@@ -0,0 +1,32 @@
+"""Login and logout (T-38)."""
+
+from aso.auth import auth, features
+from aso.http import Controller, Request, redirect
+from aso.inertia import clear_history, inertia
+from aso.routing import route
+from aso.session import session
+
+from app.http.requests.auth.login_request import LoginRequest
+
+
+class AuthenticatedSessionController(Controller):
+    async def create(self, request: Request):
+        return inertia(
+            "auth/login",
+            {
+                "status": session().get("status"),
+                "canResetPassword": features.enabled("reset_passwords"),
+            },
+        )
+
+    async def store(self, form: LoginRequest):
+        await form.authenticate()
+        session().regenerate()
+        return redirect().intended(route("dashboard"))
+
+    async def destroy(self):
+        await auth().logout()
+        session().invalidate()
+        session().regenerate_token()
+        clear_history()
+        return redirect("/")