csrd-utils 0.3.56__tar.gz → 0.3.57__tar.gz

{csrd_utils-0.3.56 → csrd_utils-0.3.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.3.56
+Version: 0.3.57
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils

{csrd_utils-0.3.56 → csrd_utils-0.3.57}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.3.56"
+version = "0.3.57"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

csrd_utils-0.3.57/src/csrd_utils/__init__.py

@@ -0,0 +1,14 @@
+"""csrd-utils: template and feature tooling for csrd services."""
+
+from .audit import run_audit
+from .augmentor import ServiceAugmentor
+from .doctor import run_doctor
+from .generator import generate_platform_service, generate_service
+
+__all__ = [
+    "ServiceAugmentor",
+    "generate_platform_service",
+    "generate_service",
+    "run_audit",
+    "run_doctor",
+]

{csrd_utils-0.3.56 → csrd_utils-0.3.57}/src/csrd_utils/__main__.py

@@ -22,7 +22,7 @@ from .cluster import (
     normalize_cluster_spec,
 )
 from .doctor import run_doctor
-from .generator import generate_service
+from .generator import generate_platform_service, generate_service
 from .resources import features_path
 
 
@@ -476,24 +476,48 @@ def _generate_services_from_cluster_spec(
             continue
 
         try:
-            result = generate_service(
-                name=name,
-                output_dir=workspace_root,
-                description=f"{name} service",
-                port=port,
-                model_name="Item",
-                model_name_plural="items",
-                has_database=has_database,
-                database=database,
-                has_delegates=has_delegates,
-                upstreams=upstreams,
-                has_workers=has_workers,
-                broker=broker,
-                has_caching=has_caching,
-                cache_backend="redis",
-                has_structured_logging=has_structured_logging,
-                overwrite_if_exists=force,
-            )
+            if service_type == "platform":
+                role = str(service.get("role", "custom")).strip()
+                # Build extra_context for platform templates that have additional variables
+                extra: dict[str, str] = {}
+                if role == "auth":
+                    # Resolve the identity-service URL from the port map if present
+                    identity_port = next(
+                        (port_map[n] for n in port_map if "identity" in n),
+                        8082,
+                    )
+                    identity_name = next(
+                        (n for n in port_map if "identity" in n),
+                        "identity-service",
+                    )
+                    extra["identity_service_url"] = f"http://{identity_name}:{identity_port}"
+                result = generate_platform_service(
+                    name=name,
+                    output_dir=workspace_root,
+                    port=port,
+                    role=role,
+                    extra_context=extra if extra else None,
+                    overwrite_if_exists=force,
+                )
+            else:
+                result = generate_service(
+                    name=name,
+                    output_dir=workspace_root,
+                    description=f"{name} service",
+                    port=port,
+                    model_name="Item",
+                    model_name_plural="items",
+                    has_database=has_database,
+                    database=database,
+                    has_delegates=has_delegates,
+                    upstreams=upstreams,
+                    has_workers=has_workers,
+                    broker=broker,
+                    has_caching=has_caching,
+                    cache_backend="redis",
+                    has_structured_logging=has_structured_logging,
+                    overwrite_if_exists=force,
+                )
             generated.append(result)
             print(f"Generated service: {name}")
         except Exception as exc:

{csrd_utils-0.3.56 → csrd_utils-0.3.57}/src/csrd_utils/cluster.py

@@ -39,33 +39,33 @@ PRESETS: dict[str, list[ServiceSpec]] = {
             "requires": ["auth-service"],
         },
     ],
-    "minimal-cluster": [
-        {"name": "auth-service", "type": "platform", "role": "auth", "port": 8081, "requires": []},
-        {
-            "name": "core-db",
-            "type": "db",
-            "database": "sqlite",
-            "port": 8091,
-            "requires": ["auth-service"],
-        },
-    ],
-    "event-driven-cluster": [
-        {"name": "auth-service", "type": "platform", "role": "auth", "port": 8081, "requires": []},
-        {
-            "name": "events",
-            "type": "db",
-            "database": "postgres",
-            "port": 8091,
-            "requires": ["auth-service"],
-        },
-        {
-            "name": "worker-consume",
-            "type": "worker",
-            "broker": "redis",
-            "port": 8093,
-            "requires": ["events", "redis"],
-        },
-    ],
+    # "minimal-cluster": [
+    #     {"name": "auth-service", "type": "platform", "role": "auth", "port": 8081, "requires": []},
+    #     {
+    #         "name": "core-db",
+    #         "type": "db",
+    #         "database": "sqlite",
+    #         "port": 8091,
+    #         "requires": ["auth-service"],
+    #     },
+    # ],
+    # "event-driven-cluster": [
+    #     {"name": "auth-service", "type": "platform", "role": "auth", "port": 8081, "requires": []},
+    #     {
+    #         "name": "events",
+    #         "type": "db",
+    #         "database": "postgres",
+    #         "port": 8091,
+    #         "requires": ["auth-service"],
+    #     },
+    #     {
+    #         "name": "worker-consume",
+    #         "type": "worker",
+    #         "broker": "redis",
+    #         "port": 8093,
+    #         "requires": ["events", "redis"],
+    #     },
+    # ],
 }
 
 

{csrd_utils-0.3.56 → csrd_utils-0.3.57}/src/csrd_utils/generator.py

@@ -244,6 +244,106 @@ def generate_service(
     return generated_path
 
 
+# ---------------------------------------------------------------------------
+# Platform-specific service generation
+# ---------------------------------------------------------------------------
+
+#: Maps role names to the cookiecutter template directory names bundled under templates/.
+_PLATFORM_ROLE_TEMPLATES: dict[str, str] = {
+    "auth": "platform-auth-service",
+    "identity": "platform-identity-service",
+}
+
+
+def generate_platform_service(
+    *,
+    name: str,
+    output_dir: Path,
+    port: int,
+    role: str,
+    extra_context: dict[str, Any] | None = None,
+    overwrite_if_exists: bool = False,
+) -> Path:
+    """Generate a platform service (auth/identity) from a dedicated cookiecutter template.
+
+    Unlike :func:`generate_service` this function uses a role-specific template that
+    ships purpose-built source code rather than the generic item-CRUD stub.
+
+    Parameters
+    ----------
+    name:
+        Kebab-case service name (e.g. ``"auth-service"``).
+    output_dir:
+        Workspace root.  The service source lands at ``output_dir/src/<name_snake>/``.
+    port:
+        Port the service will listen on.
+    role:
+        Platform role — currently ``"auth"`` or ``"identity"``.
+    extra_context:
+        Additional cookiecutter variables merged on top of the defaults.
+    overwrite_if_exists:
+        When *True*, an existing service directory is overwritten.
+
+    Returns
+    -------
+    Path
+        Absolute path to the generated service package (``output_dir/src/<name_snake>``).
+    """
+    if role not in _PLATFORM_ROLE_TEMPLATES:
+        raise ValueError(
+            f"Unknown platform role '{role}'. Supported roles: {sorted(_PLATFORM_ROLE_TEMPLATES)}"
+        )
+
+    template_name = _PLATFORM_ROLE_TEMPLATES[role]
+    output_root = output_dir.resolve()
+    src_dir = output_root / "src"
+    src_dir.mkdir(parents=True, exist_ok=True)
+
+    service_name_snake = name.replace("-", "_")
+    target = src_dir / service_name_snake
+
+    if target.exists() and any(target.iterdir()) and not overwrite_if_exists:
+        raise FileExistsError(
+            f"Target directory already exists and is not empty: {target}. Use --force to overwrite."
+        )
+
+    context: dict[str, Any] = {
+        "service_name": name,
+        "port": str(port),
+        "__service_name_snake": service_name_snake,
+    }
+    if extra_context:
+        context.update(extra_context)
+
+    old_dontwritebytecode = os.environ.get("PYTHONDONTWRITEBYTECODE")
+    try:
+        os.environ["PYTHONDONTWRITEBYTECODE"] = "1"
+        with templates_path() as template_root:
+            template = template_root / template_name
+            generated = cookiecutter(
+                str(template),
+                no_input=True,
+                extra_context=context,
+                output_dir=str(src_dir),
+                overwrite_if_exists=overwrite_if_exists,
+            )
+    finally:
+        if old_dontwritebytecode is None:
+            os.environ.pop("PYTHONDONTWRITEBYTECODE", None)
+        else:
+            os.environ["PYTHONDONTWRITEBYTECODE"] = old_dontwritebytecode
+
+    generated_path = Path(generated).resolve()
+    for pycache_dir in generated_path.rglob("__pycache__"):
+        shutil.rmtree(pycache_dir, ignore_errors=True)
+
+    _move_docker_files_to_workspace_root(generated_path, output_root, name)
+    _write_workspace_pyproject(output_root)
+    _write_workspace_readme(output_root)
+
+    return generated_path
+
+
 def _move_docker_files_to_workspace_root(
     service_path: Path, workspace_root: Path, service_name: str
 ) -> None:

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/cookiecutter.json

@@ -0,0 +1,6 @@
+{
+  "service_name": "auth-service",
+  "port": "8081",
+  "identity_service_url": "http://identity-service:8082",
+  "__service_name_snake": "{{ cookiecutter.service_name | replace('-', '_') }}"
+}

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/.dockerignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+.env
+.git

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY . /app
+RUN pip install --no-cache-dir -r /app/requirements.txt
+
+ENV PORT={{ cookiecutter.port }}
+
+CMD uvicorn {{cookiecutter.__service_name_snake}}:build_app --factory --host 0.0.0.0 --port ${PORT}

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/README.md

@@ -0,0 +1,28 @@
+# {{ cookiecutter.service_name }}
+
+Platform auth service — issues and verifies JWT tokens.
+
+## Endpoints
+
+- `POST /api/token` — issue a JWT (validates credentials via identity-service)
+- `POST /api/verify` — verify a JWT and return claims
+- `GET /health` — liveness probe
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `JWT_SECRET` | `dev-secret-change-me-please-32-bytes` | Signing key |
+| `JWT_ALGORITHM` | `HS256` | JWT algorithm |
+| `JWT_ISSUER` | `{{ cookiecutter.service_name }}` | Token issuer |
+| `JWT_AUDIENCE` | `cluster` | Token audience |
+| `JWT_TTL_SECONDS` | `3600` | Token TTL |
+| `DB_PATH` | `./{{ cookiecutter.__service_name_snake }}.db` | SQLite database path |
+| `IDENTITY_SERVICE_URL` | `{{ cookiecutter.identity_service_url }}` | Identity service URL |
+
+## Run
+
+```bash
+pip install -r requirements.txt
+uvicorn {{ cookiecutter.__service_name_snake }}:build_app --factory --port {{ cookiecutter.port }}
+```

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/__init__.py

@@ -0,0 +1,23 @@
+from fastapi import FastAPI
+
+from csrd.versioning import (
+    UNVERSIONED,
+    VersionedApiConfig,
+    VersionedAppComposeConfig,
+    compose_versioned_apps,
+)
+
+from .views import unversioned_app
+
+
+def build_app() -> FastAPI:
+    return compose_versioned_apps(
+        version_mapping={UNVERSIONED: unversioned_app},
+        config=VersionedAppComposeConfig(
+            title="{{ cookiecutter.service_name }}",
+            api=VersionedApiConfig(prefix="/", include_actuator_endpoints=False),
+        ),
+    )
+
+
+__all__ = ("build_app",)

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/dependencies/__init__.py

@@ -0,0 +1,25 @@
+from collections.abc import AsyncIterator
+from typing import Annotated
+
+from fastapi import Depends
+
+from csrd.repository import SQLiteAdapter
+
+from ..repositories.token_repository import TokenRepository
+from ..settings import settings
+
+
+async def token_repository_factory() -> AsyncIterator[TokenRepository]:
+    adapter = SQLiteAdapter(settings.db_path)
+    await adapter.connect()
+    repo = TokenRepository(adapter)
+    await repo._init_schema()
+    try:
+        yield repo
+    finally:
+        await adapter.close()
+
+
+TokenRepositoryDep = Annotated[TokenRepository, Depends(token_repository_factory)]
+
+__all__ = ("TokenRepositoryDep", "token_repository_factory")

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/repositories/__init__.py

@@ -0,0 +1,3 @@
+from .token_repository import TokenRepository
+
+__all__ = ("TokenRepository",)

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/repositories/token_repository.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from csrd.repository import BaseRepository, DBProtocol
+
+
+class TokenRepository(BaseRepository):
+    """Repository backed by a pluggable DBProtocol adapter."""
+
+    def __init__(self, adapter: DBProtocol) -> None:
+        super().__init__(adapter)
+
+    async def _init_schema(self) -> None:
+        await self.execute(
+            """
+            CREATE TABLE IF NOT EXISTS issued_tokens (
+                token TEXT PRIMARY KEY,
+                subject TEXT NOT NULL,
+                issued_at TEXT NOT NULL
+            )
+            """
+        )
+
+    async def record_issued_token(self, token: str, subject: str) -> None:
+        issued_at = datetime.now(UTC).isoformat()
+        await self._init_schema()
+        await self.execute(
+            "INSERT OR REPLACE INTO issued_tokens (token, subject, issued_at) "
+            "VALUES (:token, :subject, :issued_at)",
+            {"token": token, "subject": subject, "issued_at": issued_at},
+        )

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/requirements.txt

@@ -0,0 +1,9 @@
+fastapi>=0.115,<1
+uvicorn[standard]>=0.30,<1
+pyjwt>=2.8,<3
+pydantic-settings>=2.6,<3
+httpx>=0.27,<1
+aiosqlite>=0.21,<1
+csrd-versioning>=0.1.0,<1
+csrd-repository>=0.1.0,<1
+csrd-auth>=0.1.0,<1

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/settings.py

@@ -0,0 +1,20 @@
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    app_name: str = "{{ cookiecutter.service_name }}"
+    port: int = {{ cookiecutter.port }}
+
+    jwt_secret: str = "dev-secret-change-me-please-32-bytes"
+    jwt_algorithm: str = "HS256"
+    jwt_issuer: str = "{{ cookiecutter.service_name }}"
+    jwt_audience: str = "cluster"
+    jwt_ttl_seconds: int = 3600
+
+    db_path: str = "./{{ cookiecutter.__service_name_snake }}.db"
+    identity_service_url: str = "{{ cookiecutter.identity_service_url }}"
+
+
+settings = Settings()

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/views/__init__.py

@@ -0,0 +1,3 @@
+from .unversioned import unversioned_app
+
+__all__ = ("unversioned_app",)

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/views/unversioned/__init__.py

@@ -0,0 +1,10 @@
+from fastapi import FastAPI
+
+from . import auth_view, health_view
+
+unversioned_app = FastAPI(title="{{ cookiecutter.service_name }}")
+
+unversioned_app.include_router(health_view.router)
+unversioned_app.include_router(auth_view.router)
+
+__all__ = ("unversioned_app",)

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/views/unversioned/auth_view.py

@@ -0,0 +1,93 @@
+from datetime import UTC, datetime, timedelta
+
+import httpx
+import jwt
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+
+from csrd.auth import JWTAuthenticator, StaticKeyProvider
+
+from ...dependencies import TokenRepositoryDep
+from ...settings import settings
+
+router = APIRouter(prefix="/api", tags=["Auth Endpoints"])
+
+
+class TokenRequest(BaseModel):
+    username: str
+    password: str
+
+
+class VerifyRequest(BaseModel):
+    token: str
+
+
+def _make_verifier() -> JWTAuthenticator:
+    return JWTAuthenticator(
+        key=StaticKeyProvider(settings.jwt_secret),
+        algorithms=[settings.jwt_algorithm],
+        audience=settings.jwt_audience,
+        issuer=settings.jwt_issuer,
+    )
+
+
+async def _validate_credentials(username: str, password: str) -> list[str]:
+    """Validate username/password against identity-service; raises 401 on failure.
+    Returns the list of roles assigned to the user."""
+    if not settings.identity_service_url:
+        return []  # identity not configured — allow any username (fallback)
+
+    async with httpx.AsyncClient(timeout=5.0) as client:
+        try:
+            response = await client.post(
+                f"{settings.identity_service_url}/api/verify-credentials",
+                json={"username": username, "password": password},
+            )
+        except httpx.ConnectError as exc:
+            raise HTTPException(status_code=503, detail="identity service unavailable") from exc
+
+    if response.status_code == 401:
+        raise HTTPException(status_code=401, detail="invalid credentials")
+
+    if response.status_code != 200:
+        raise HTTPException(status_code=502, detail="identity service error")
+
+    data = response.json()
+    user = data.get("user", {})
+    return list(user.get("roles", []))
+
+
+@router.post("/token")
+async def issue_token(
+    payload: TokenRequest, token_repo: TokenRepositoryDep
+) -> dict[str, str | int | list[str]]:
+    roles = await _validate_credentials(payload.username, payload.password)
+
+    now = datetime.now(UTC)
+    claims = {
+        "sub": payload.username,
+        "iss": settings.jwt_issuer,
+        "aud": settings.jwt_audience,
+        "iat": int(now.timestamp()),
+        "exp": int((now + timedelta(seconds=settings.jwt_ttl_seconds)).timestamp()),
+        "authorities": roles,
+        "roles": roles,
+    }
+    token = jwt.encode(claims, settings.jwt_secret, algorithm=settings.jwt_algorithm)
+    await token_repo.record_issued_token(token=token, subject=payload.username)
+    return {"access_token": token, "token_type": "bearer", "expires_in": settings.jwt_ttl_seconds}
+
+
+@router.post("/verify")
+async def verify_token(request: Request, payload: VerifyRequest) -> dict[str, object]:
+    verifier = _make_verifier()
+    claims = await verifier(request, payload.token)
+    return {
+        "valid": True,
+        "claims": {
+            "sub": claims.sub,
+            "user_name": claims.user_name,
+            "authorities": claims.authorities,
+            "roles": claims.authorities,
+        },
+    }

csrd_utils-0.3.57/src/csrd_utils/templates/platform-auth-service/{{cookiecutter.__service_name_snake}}/views/unversioned/health_view.py

@@ -0,0 +1,8 @@
+from fastapi import APIRouter
+
+router = APIRouter(tags=["Health Endpoints"])
+
+
+@router.get("/health")
+def health() -> dict[str, str]:
+    return {"status": "ok", "service": "{{ cookiecutter.service_name }}"}

csrd_utils-0.3.57/src/csrd_utils/templates/platform-identity-service/cookiecutter.json

@@ -0,0 +1,5 @@
+{
+  "service_name": "identity-service",
+  "port": "8082",
+  "__service_name_snake": "{{ cookiecutter.service_name | replace('-', '_') }}"
+}

csrd_utils-0.3.57/src/csrd_utils/templates/platform-identity-service/{{cookiecutter.__service_name_snake}}/.dockerignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+.env
+.git

csrd_utils-0.3.57/src/csrd_utils/templates/platform-identity-service/{{cookiecutter.__service_name_snake}}/Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY . /app
+RUN pip install --no-cache-dir -r /app/requirements.txt
+
+ENV PORT={{ cookiecutter.port }}
+
+CMD uvicorn {{cookiecutter.__service_name_snake}}:build_app --factory --host 0.0.0.0 --port ${PORT}

csrd_utils-0.3.57/src/csrd_utils/templates/platform-identity-service/{{cookiecutter.__service_name_snake}}/README.md

@@ -0,0 +1,25 @@
+# {{ cookiecutter.service_name }}
+
+Platform identity service — manages users and credentials.
+
+## Endpoints
+
+- `POST /api/signup` — create a new user
+- `GET /api/users/{user_id}` — get user by ID
+- `GET /api/users/{user_id}/roles` — get user roles
+- `POST /api/users/{user_id}/roles` — assign a role to user
+- `POST /api/verify-credentials` — verify username/password (used by auth-service)
+- `GET /health` — liveness probe
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `DB_PATH` | `./{{ cookiecutter.__service_name_snake }}.db` | SQLite database path |
+
+## Run
+
+```bash
+pip install -r requirements.txt
+uvicorn {{ cookiecutter.__service_name_snake }}:build_app --factory --port {{ cookiecutter.port }}
+```

csrd_utils-0.3.57/src/csrd_utils/templates/platform-identity-service/{{cookiecutter.__service_name_snake}}/__init__.py

@@ -0,0 +1,23 @@
+from fastapi import FastAPI
+
+from csrd.versioning import (
+    UNVERSIONED,
+    VersionedApiConfig,
+    VersionedAppComposeConfig,
+    compose_versioned_apps,
+)
+
+from .views import unversioned_app
+
+
+def build_app() -> FastAPI:
+    return compose_versioned_apps(
+        version_mapping={UNVERSIONED: unversioned_app},
+        config=VersionedAppComposeConfig(
+            title="{{ cookiecutter.service_name }}",
+            api=VersionedApiConfig(prefix="/", include_actuator_endpoints=False),
+        ),
+    )
+
+
+__all__ = ("build_app",)