astris-python 0.1.0__py3-none-any.whl

astris/auth/session.py

@@ -0,0 +1,241 @@
+from typing import Annotated, Any, NoReturn, Self
+
+from fastapi import Depends, HTTPException, Request, status
+from fastapi.params import Depends as DependsClass
+from pwdlib import PasswordHash
+
+# Modern Argon2id hasher (pwdlib 0.3.1 / OWASP standard)
+password_hash = PasswordHash.recommended()
+
+
+def hash_password(password: str) -> str:
+    """Hash a password using modern Argon2id with automatic salt generation."""
+    return password_hash.hash(password)
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    """Verify a plain password against an Argon2id hash."""
+    try:
+        return password_hash.verify(plain_password, hashed_password)
+    except (ValueError, TypeError):
+        return False
+
+
+def verify_and_update_password(
+    plain_password: str, hashed_password: str
+) -> tuple[bool, str | None]:
+    """Verify a password and return an updated hash if security parameters need upgrading."""
+    try:
+        return password_hash.verify_and_update(plain_password, hashed_password)
+    except (ValueError, TypeError):
+        return False, None
+
+
+def login_user(
+    request: Request,
+    user_or_id: Any,
+    user_data: dict[str, Any] | None = None,
+) -> None:
+    """Authenticate a user by storing their ID and safe profile data in the signed session."""
+    user_id: int | str | None = None
+    extracted_data: dict[str, Any] = (
+        user_data.copy() if isinstance(user_data, dict) else {}
+    )
+
+    # 1. If an SQLModel or object instance is passed
+    if hasattr(user_or_id, "id"):
+        user_id = user_or_id.id
+        if not user_data:
+            if hasattr(user_or_id, "model_dump"):
+                raw_dict = user_or_id.model_dump()
+            elif hasattr(user_or_id, "__dict__"):
+                raw_dict = dict(user_or_id.__dict__)
+            else:
+                raw_dict = {"id": user_id}
+            # Strip sensitive database fields like passwords/hashes from the session cookie
+            extracted_data = {
+                k: v
+                for k, v in raw_dict.items()
+                if not k.startswith("_")
+                and k
+                not in (
+                    "hashed_password",
+                    "password",
+                    "secret",
+                    "password_hash",
+                )
+            }
+    # 2. If a dictionary is passed
+    elif isinstance(user_or_id, dict):
+        user_id = user_or_id.get("id")
+        if not user_data:
+            extracted_data = {
+                k: v
+                for k, v in user_or_id.items()
+                if k
+                not in (
+                    "hashed_password",
+                    "password",
+                    "secret",
+                    "password_hash",
+                )
+            }
+    # 3. If a raw ID is passed
+    elif isinstance(user_or_id, (int, str)):
+        user_id = user_or_id
+
+    if user_id is None:
+        raise ValueError("Could not determine user_id from the provided user object.")
+
+    if not hasattr(request, "session"):
+        request.state.user_id = user_id
+        if extracted_data:
+            request.state.user = extracted_data
+        return
+
+    request.session["user_id"] = user_id
+    if extracted_data:
+        request.session["user_data"] = extracted_data
+
+
+def logout_user(request: Request) -> None:
+    """Terminate the current authenticated session."""
+    if hasattr(request, "session"):
+        request.session.pop("user_id", None)
+        request.session.pop("user_data", None)
+    if hasattr(request.state, "user_id"):
+        delattr(request.state, "user_id")
+    if hasattr(request.state, "user"):
+        delattr(request.state, "user")
+
+
+def get_user_id(request: Request) -> int | str | None:
+    """Retrieve the current authenticated user ID from the session or request state."""
+    if hasattr(request, "session"):
+        uid = request.session.get("user_id")
+        if uid is not None:
+            return uid
+    return getattr(request.state, "user_id", None)
+
+
+def get_auth_user(request: Request) -> dict[str, Any] | None:
+    """Retrieve the current authenticated user profile dictionary from the session or request state."""
+    user = getattr(request.state, "user", None)
+    if user is not None:
+        if isinstance(user, dict):
+            return user
+        if hasattr(user, "model_dump"):
+            return user.model_dump()
+    if hasattr(request, "session"):
+        user_data = request.session.get("user_data")
+        if isinstance(user_data, dict):
+            return user_data
+        uid = request.session.get("user_id")
+        if uid is not None:
+            return {"id": uid}
+    uid = getattr(request.state, "user_id", None)
+    if uid is not None:
+        return {"id": uid}
+    return None
+
+
+def is_authenticated(request: Request) -> bool:
+    """Check if the current request is from an authenticated user."""
+    return get_user_id(request) is not None
+
+
+# --- Internal Challenge Handlers ---
+
+
+def _unauthorized_challenge(request: Request, redirect_url: str = "/login") -> NoReturn:
+    """Handle unauthenticated request via 303 redirects (Inertia/HTML) or 401 JSON."""
+    is_inertia = request.headers.get("X-Inertia") == "true"
+    accept = request.headers.get("accept", "")
+    if is_inertia or "text/html" in accept:
+        raise HTTPException(
+            status_code=status.HTTP_303_SEE_OTHER,
+            headers={"Location": redirect_url},
+        )
+    raise HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Authentication required",
+    )
+
+
+def _guest_challenge(request: Request, redirect_url: str = "/dashboard") -> None:
+    """Redirect already authenticated users to the dashboard."""
+    if is_authenticated(request):
+        raise HTTPException(
+            status_code=status.HTTP_303_SEE_OTHER,
+            headers={"Location": redirect_url},
+        )
+
+
+# --- Internal Callables for Dependency Injection ---
+
+
+def _default_auth_id_dependency(request: Request) -> int | str:
+    user_id = get_user_id(request)
+    if user_id is None:
+        _unauthorized_challenge(request, "/login")
+    return user_id
+
+
+def _default_auth_user_dependency(request: Request) -> dict[str, Any]:
+    user = get_auth_user(request)
+    if user is None:
+        _unauthorized_challenge(request, "/login")
+    return user
+
+
+# --- Unified Guards ---
+
+
+class _AuthRequiredGuard(DependsClass):
+    """Authentication guard dependency.
+
+    Usage:
+        dependencies=[auth_required]
+        dependencies=[auth_required(redirect_url="/custom-login")]
+    """
+
+    def __init__(self, redirect_url: str = "/login") -> None:
+        def _dependency(request: Request) -> int | str:
+            user_id = get_user_id(request)
+            if user_id is None:
+                _unauthorized_challenge(request, redirect_url)
+            return user_id
+
+        super().__init__(dependency=_dependency)
+
+    def __call__(self, redirect_url: str = "/login", **kwargs: Any) -> Self:
+        url = kwargs.get("redirect_url", redirect_url)
+        return self.__class__(redirect_url=url)
+
+
+class _GuestRequiredGuard(DependsClass):
+    """Guest-only guard dependency.
+
+    Usage:
+        dependencies=[guest_required]
+        dependencies=[guest_required(redirect_url="/custom-dashboard")]
+    """
+
+    def __init__(self, redirect_url: str = "/dashboard") -> None:
+        def _dependency(request: Request) -> None:
+            _guest_challenge(request, redirect_url)
+
+        super().__init__(dependency=_dependency)
+
+    def __call__(self, redirect_url: str = "/dashboard", **kwargs: Any) -> Self:
+        url = kwargs.get("redirect_url", redirect_url)
+        return self.__class__(redirect_url=url)
+
+
+# Direct Router / Controller Guards:
+auth_required = _AuthRequiredGuard()
+guest_required = _GuestRequiredGuard()
+
+# Direct Parameter Type Aliases:
+AuthUser = Annotated[dict[str, Any], Depends(_default_auth_user_dependency)]
+AuthUserId = Annotated[int | str, Depends(_default_auth_id_dependency)]

astris/cli.py

@@ -0,0 +1,421 @@
+import io
+import subprocess
+import sys
+from pathlib import Path
+
+import typer
+import uvicorn
+
+if sys.platform == "win32":
+    if isinstance(sys.stdout, io.TextIOWrapper):
+        sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+    if isinstance(sys.stderr, io.TextIOWrapper):
+        sys.stderr.reconfigure(encoding="utf-8", errors="replace")
+
+orbit_cli = typer.Typer(
+    name="orbit",
+    help="Astris CLI",
+    no_args_is_help=True,
+    add_completion=False,
+)
+
+
+@orbit_cli.command("list")
+def list_commands(ctx: typer.Context):
+    """List all available Orbit commands."""
+    if ctx.parent:
+        typer.echo(ctx.parent.get_help())
+    else:
+        typer.echo(ctx.get_help())
+
+
+@orbit_cli.command()
+def serve(
+    host: str = typer.Option(
+        "127.0.0.1", "--host", "-h", help="Bind socket to this host"
+    ),
+    port: int = typer.Option(8000, "--port", "-p", help="Bind socket to this port"),
+    reload: bool = typer.Option(
+        True, "--reload/--no-reload", help="Enable/disable auto-reload"
+    ),
+    vite: bool = typer.Option(
+        True,
+        "--vite/--no-vite",
+        help="Start concurrent Vite dev server if package.json exists",
+    ),
+):
+    """Start the development server (with concurrent Vite dev server if package.json exists)."""
+    cwd = Path.cwd()
+    cwd_str = str(cwd)
+    if cwd_str not in sys.path:
+        sys.path.insert(0, cwd_str)
+
+    # If full-stack (package.json present) and vite is enabled, orchestrate Vite concurrently
+    package_json = cwd / "package.json"
+    vite_proc = None
+
+    if package_json.exists() and vite:
+        typer.secho(
+            "⚡ Full-stack project detected. Starting Vite dev server...",
+            fg=typer.colors.MAGENTA,
+        )
+        try:
+            vite_proc = subprocess.Popen(
+                ["npm", "run", "dev"],
+                cwd=cwd_str,
+                stdout=sys.stdout,
+                stderr=sys.stderr,
+                shell=sys.platform == "win32",
+            )
+        except (OSError, subprocess.SubprocessError) as err:
+            typer.secho(
+                f"⚠️ Could not start Vite dev server: {err}",
+                fg=typer.colors.YELLOW,
+            )
+
+    typer.secho(
+        f"🚀 Astris entering orbit on http://{host}:{port}", fg=typer.colors.CYAN
+    )
+
+    try:
+        reload_dirs = []
+        if (cwd / "app").exists():
+            reload_dirs.append(str(cwd / "app"))
+        if (cwd / "database").exists():
+            reload_dirs.append(str(cwd / "database"))
+        if not reload_dirs:
+            reload_dirs = [cwd_str]
+
+        uvicorn.run(
+            "main:app",
+            host=host,
+            port=port,
+            reload=reload,
+            reload_dirs=reload_dirs if reload else None,
+            reload_includes=["*.py", ".env*"] if reload else None,
+            reload_excludes=[
+                "node_modules",
+                "resources",
+                "public",
+                ".vite",
+                ".git",
+                "dist",
+                "build",
+            ]
+            if reload
+            else None,
+            app_dir=cwd_str,
+        )
+    finally:
+        if vite_proc:
+            try:
+                vite_proc.terminate()
+                vite_proc.wait(timeout=2)
+            except subprocess.TimeoutExpired:
+                vite_proc.kill()
+            except OSError:
+                pass
+
+
+@orbit_cli.command("make:module")
+def make_module(name: str):
+    """Scaffold a full domain module (e.g. 'orbit make:module billing')."""
+    clean_name = name.removesuffix("Module").lower()
+    module_dir = Path.cwd() / "app" / "modules" / clean_name
+
+    if module_dir.exists():
+        typer.secho(
+            f"Error: Module '{clean_name}' already exists!", fg=typer.colors.RED
+        )
+        raise typer.Exit(1)
+
+    module_dir.mkdir(parents=True, exist_ok=True)
+    (module_dir / "__init__.py").touch()
+
+    # 1. Controller stub
+    controller_file = module_dir / f"{clean_name}_controller.py"
+    controller_stub = f'''from astris.routing import Controller
+
+controller = Controller(prefix="/{clean_name}s", tags=["{clean_name.capitalize()}"])
+
+
+@controller.get("/")
+async def list_{clean_name}s():
+    return {{"message": "Hello from {clean_name} module!"}}
+'''
+    controller_file.write_text(controller_stub, encoding="utf-8")
+
+    # 2. Service stub (docstring is sufficient, no redundant pass)
+    service_file = module_dir / f"{clean_name}_service.py"
+    service_stub = f'''class {clean_name.capitalize()}Service:
+    """Business logic for {clean_name} domain."""
+'''
+    service_file.write_text(service_stub, encoding="utf-8")
+
+    # 3. Model stub (SQLModel Table + DTOs)
+    model_file = module_dir / f"{clean_name}_model.py"
+    class_name = clean_name.capitalize()
+    model_stub = f"""from astris.database import Field, SQLModel
+
+
+class {class_name}Base(SQLModel):
+    name: str = Field(index=True)
+
+
+class {class_name}({class_name}Base, table=True):
+    id: int | None = Field(default=None, primary_key=True)
+
+
+class {class_name}Create({class_name}Base):
+    pass
+
+
+class {class_name}Public({class_name}Base):
+    id: int
+"""
+    model_file.write_text(model_stub, encoding="utf-8")
+
+    typer.secho(
+        f"✓ Created module 'app/modules/{clean_name}' with controller, service, and model",
+        fg=typer.colors.GREEN,
+    )
+
+
+@orbit_cli.command("make:controller")
+def make_controller(
+    name: str,
+    module: str = typer.Option(
+        None, "--module", "-m", help="Target module name (defaults to controller name)"
+    ),
+):
+    """Scaffold a controller inside a domain module."""
+    clean_name = name.removesuffix("Controller").lower()
+    target_module = (module or clean_name).lower()
+    module_dir = Path.cwd() / "app" / "modules" / target_module
+    module_dir.mkdir(parents=True, exist_ok=True)
+    (module_dir / "__init__.py").touch()
+
+    file_name = f"{clean_name}_controller.py"
+    target_file = module_dir / file_name
+
+    if target_file.exists():
+        typer.secho(
+            f"Error: {file_name} already exists in app/modules/{target_module}!",
+            fg=typer.colors.RED,
+        )
+        raise typer.Exit(1)
+
+    stub = f'''from astris.routing import Controller
+
+controller = Controller(prefix="/{clean_name}s", tags=["{clean_name.capitalize()}"])
+
+
+@controller.get("/")
+async def list_{clean_name}s():
+    return {{"message": "Hello from {clean_name}!"}}
+'''
+    target_file.write_text(stub, encoding="utf-8")
+    typer.secho(
+        f"✓ Created app/modules/{target_module}/{file_name}",
+        fg=typer.colors.GREEN,
+    )
+
+
+@orbit_cli.command("make:model")
+def make_model(
+    name: str,
+    module: str = typer.Option(
+        None, "--module", "-m", help="Target module name (defaults to model name)"
+    ),
+):
+    """Scaffold a SQLModel table model inside a domain module."""
+    clean_name = name.removesuffix("Model").lower()
+    class_name = name.removesuffix("Model").capitalize()
+    target_module = (module or clean_name).lower()
+    module_dir = Path.cwd() / "app" / "modules" / target_module
+    module_dir.mkdir(parents=True, exist_ok=True)
+    (module_dir / "__init__.py").touch()
+
+    file_name = f"{clean_name}_model.py"
+    target_file = module_dir / file_name
+
+    if target_file.exists():
+        typer.secho(
+            f"Error: {file_name} already exists in app/modules/{target_module}!",
+            fg=typer.colors.RED,
+        )
+        raise typer.Exit(1)
+
+    stub = f"""from astris.database import Field, SQLModel
+
+
+class {class_name}Base(SQLModel):
+    name: str = Field(index=True)
+
+
+class {class_name}({class_name}Base, table=True):
+    id: int | None = Field(default=None, primary_key=True)
+
+
+class {class_name}Create({class_name}Base):
+    pass
+
+
+class {class_name}Public({class_name}Base):
+    id: int
+"""
+    target_file.write_text(stub, encoding="utf-8")
+    typer.secho(
+        f"✓ Created app/modules/{target_module}/{file_name}",
+        fg=typer.colors.GREEN,
+    )
+
+
+@orbit_cli.command("make:migration")
+def make_migration(
+    name: str,
+    autogenerate: bool = typer.Option(
+        True,
+        "--autogenerate/--empty",
+        help="Autogenerate schema diff from SQLModel models",
+    ),
+):
+    """Generate a new versioned migration script."""
+    from astris.database.migrations import create_migration
+
+    try:
+        create_migration(message=name, autogenerate=autogenerate)
+        typer.secho(
+            f"✓ Migration '{name}' generated successfully!",
+            fg=typer.colors.GREEN,
+        )
+    except Exception as e:
+        typer.secho(f"Error generating migration: {e}", fg=typer.colors.RED)
+        raise typer.Exit(1) from e
+
+
+@orbit_cli.command("migrate")
+def migrate(
+    revision: str = typer.Option(
+        "head", "--revision", "-r", help="Target revision (default: head)"
+    ),
+):
+    """Run pending database migrations."""
+    from astris.database.migrations import run_migrations
+
+    try:
+        run_migrations(revision=revision)
+        typer.secho(
+            f"✓ Database migrated successfully to '{revision}'!",
+            fg=typer.colors.GREEN,
+        )
+    except Exception as e:
+        typer.secho(f"Error executing migrations: {e}", fg=typer.colors.RED)
+        raise typer.Exit(1) from e
+
+
+@orbit_cli.command("migrate:rollback")
+def migrate_rollback(
+    steps: int = typer.Option(
+        1, "--steps", "-s", help="Number of migrations to roll back"
+    ),
+):
+    """Roll back database migrations by N steps."""
+    from astris.database.migrations import rollback_migrations
+
+    try:
+        target_revision = f"-{steps}"
+        rollback_migrations(revision=target_revision)
+        typer.secho(
+            f"✓ Rolled back {steps} migration(s) successfully!",
+            fg=typer.colors.GREEN,
+        )
+    except Exception as e:
+        typer.secho(f"Error rolling back migrations: {e}", fg=typer.colors.RED)
+        raise typer.Exit(1) from e
+
+
+@orbit_cli.command("migrate:status")
+def migrate_status():
+    """Display current database migration revision and head status."""
+    from astris.database.migrations import get_migration_status
+
+    try:
+        status = get_migration_status()
+        current = status["current_revisions"] or ["None"]
+        heads = status["heads"] or ["None"]
+        up_to_date = status["is_up_to_date"]
+
+        typer.secho(f"Current revision: {', '.join(current)}", fg=typer.colors.CYAN)
+        typer.secho(f"Latest head:      {', '.join(heads)}", fg=typer.colors.CYAN)
+        if up_to_date:
+            typer.secho("✓ Database is up to date!", fg=typer.colors.GREEN)
+        else:
+            typer.secho(
+                "⚠ Pending migrations exist! Run 'orbit migrate' to apply.",
+                fg=typer.colors.YELLOW,
+            )
+    except Exception as e:
+        typer.secho(f"Error checking migration status: {e}", fg=typer.colors.RED)
+        raise typer.Exit(1) from e
+
+
+@orbit_cli.command("key:generate")
+def key_generate(
+    show: bool = typer.Option(
+        False, "--show", help="Display the generated key instead of writing to .env"
+    ),
+):
+    """Generate and set the application encryption key (APP_KEY)."""
+    import secrets
+
+    key = secrets.token_urlsafe(32)
+    if show:
+        typer.secho(f"APP_KEY={key}", fg=typer.colors.CYAN)
+        return
+
+    env_path = Path.cwd() / ".env"
+    if not env_path.exists():
+        env_path.write_text(f"APP_KEY={key}\n", encoding="utf-8")
+        typer.secho("✓ Created .env and set APP_KEY", fg=typer.colors.GREEN)
+        return
+
+    content = env_path.read_text(encoding="utf-8")
+    if "APP_KEY=" in content:
+        lines = []
+        replaced = False
+        for line in content.splitlines():
+            if line.startswith("APP_KEY="):
+                lines.append(f"APP_KEY={key}")
+                replaced = True
+            else:
+                lines.append(line)
+        if not replaced:
+            lines.append(f"APP_KEY={key}")
+        env_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    else:
+        env_path.write_text(content.rstrip() + f"\nAPP_KEY={key}\n", encoding="utf-8")
+
+    typer.secho("✓ Application key [APP_KEY] set successfully.", fg=typer.colors.GREEN)
+
+
+@orbit_cli.command("make:auth")
+def make_auth():
+    """Scaffold complete authentication (routes, controller, service, model, and Inertia Vue pages)."""
+    from astris.auth.installer import install_auth_starter
+
+    try:
+        install_auth_starter()
+        typer.secho(
+            "✓ Authentication scaffolding generated successfully!\n"
+            "  - Backend:  app/modules/auth (controller, service, model)\n"
+            "  - Frontend: resources/js/Pages/Auth (Login.vue, Register.vue)\n"
+            "  - Frontend: resources/js/Pages/Dashboard.vue\n\n"
+            "Next steps:\n"
+            '  1. Run: uv run orbit make:migration "create_users_table"\n'
+            "  2. Run: uv run orbit migrate",
+            fg=typer.colors.GREEN,
+        )
+    except Exception as e:
+        typer.secho(f"Error generating auth scaffolding: {e}", fg=typer.colors.RED)
+        raise typer.Exit(1) from e