csrd-utils 0.3.93__tar.gz → 0.3.95__tar.gz

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.3.93
+Version: 0.3.95
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.3.93"
+version = "0.3.95"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/augments.py

@@ -131,6 +131,15 @@ AUGMENT_REGISTRY: dict[str, AugmentDescriptor] = {
         template_dir="jwt-auth-consumer",
         # compose_env, compose_depends_on, settings_fields resolved from spec
     ),
+    "auth-passthrough": AugmentDescriptor(
+        name="auth-passthrough",
+        scope="service",
+        description="Unguarded signup/login proxy endpoints to the auth service",
+        requires_workspace_augment="jwt-auth-provider",
+        packages=["csrd-delegate", "csrd-models"],
+        template_dir="auth-passthrough",
+        # compose_env, compose_depends_on, settings_fields resolved from spec
+    ),
     "context-logging": AugmentDescriptor(
         name="context-logging",
         scope="service",

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/renderer.py

@@ -103,6 +103,18 @@ def _wire_augment(
             env["AUTH_JWKS_URL"] = f"http://{auth_svc.name}:{auth_svc.port}/.well-known/jwks.json"
             deps[auth_svc.name] = {"condition": "service_started"}
 
+    # ── Dynamic: auth-passthrough ────────────────────────────────────
+    #
+    # Resolve the auth service URL for signup/login proxy endpoints.
+    if augment.name == "auth-passthrough":
+        auth_svc = next(
+            (s for s in spec.services if s.role == "auth"),
+            None,
+        )
+        if auth_svc is not None and auth_svc.name != svc.name:
+            env["AUTH_SERVICE_URL"] = f"http://{auth_svc.name}:{auth_svc.port}"
+            deps[auth_svc.name] = {"condition": "service_started"}
+
     # ── Dynamic: delegate-config ────────────────────────────────────
     #
     # Resolve target service URLs from the spec and inject per-target

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/scaffolder.py

@@ -189,6 +189,16 @@ def _augment_template_vars(
             variables["auth_service_name"] = auth_svc.name
             variables["auth_service_port"] = str(auth_svc.port)
 
+    # Dynamic: auth-passthrough — resolve auth service URL
+    if augment.name == "auth-passthrough":
+        auth_svc = next(
+            (s for s in spec.services if s.role == "auth"),
+            None,
+        )
+        if auth_svc is not None:
+            variables["auth_service_name"] = auth_svc.name
+            variables["auth_service_port"] = str(auth_svc.port)
+
     # Dynamic: delegate-config — resolve targets
     if augment.name == "delegate-config":
         targets = augment.options.get("targets", [])
@@ -250,6 +260,10 @@ def scaffold_augment(
         relative = template_file.relative_to(template_dir)
         dest = svc_dest / relative
 
+        # Strip .template suffix so e.g. db.py.template → db.py
+        if dest.name.endswith(".template"):
+            dest = dest.with_name(dest.name.removesuffix(".template"))
+
         # Never overwrite existing files
         if dest.exists():
             continue

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/compose/service_renderers.py

@@ -29,6 +29,7 @@ _BASE_PACKAGES: list[str] = [
     "fastapi>=0.115,<1",
     "uvicorn[standard]>=0.30,<1",
     "pydantic-settings>=2.6,<3",
+    "csrd-models>=0.3,<1",
     "csrd-versioning>=0.1.36,<1",
 ]
 
@@ -154,6 +155,15 @@ def _augment_settings_fields(
             augment_fields["jwt_issuer"] = '"csrd-auth"'
             augment_fields["jwt_audience"] = f'"{spec.workspace.name}"'
 
+        # Dynamic: auth-passthrough
+        if augment.name == "auth-passthrough":
+            auth_svc = next(
+                (s for s in spec.services if s.role == "auth"),
+                None,
+            )
+            if auth_svc is not None:
+                augment_fields["auth_service_url"] = f'"http://{auth_svc.name}:{auth_svc.port}"'
+
         # Dynamic: delegate-config
         if augment.name == "delegate-config":
             targets = augment.options.get("targets", [])
@@ -202,13 +212,10 @@ def render_settings(svc: ServiceNode, spec: ComposeSpec) -> str:
     augment_fields = _augment_settings_fields(svc, spec)
 
     lines = [
-        "from pydantic_settings import BaseSettings, SettingsConfigDict",
+        "from csrd.models import BaseSettings",
         "",
         "",
         "class Settings(BaseSettings):",
-        "    model_config = SettingsConfigDict("
-        'env_file=".env", env_file_encoding="utf-8", extra="ignore"'
-        ")",
         "",
         f'    app_name: str = "{svc.name}"',
         f"    port: int = {svc.port}",
@@ -281,6 +288,10 @@ def render_init(svc: ServiceNode, spec: ComposeSpec) -> str:
         imports.append("")
         imports.append("from csrd.context.middleware import RequestContextMiddleware")
 
+    if "auth-passthrough" in augment_names:
+        imports.append("")
+        imports.append("from .views.auth_passthrough_view import router as auth_passthrough_router")
+
     if "service-layer" in augment_names:
         imports.append("")
         imports.append("from csrd.service import service_exception_handler")
@@ -298,12 +309,17 @@ def render_init(svc: ServiceNode, spec: ComposeSpec) -> str:
         body.append("    unversioned_app.include_router(jwks_router)")
         body.append("")
 
+    if "auth-passthrough" in augment_names:
+        body.append("    unversioned_app.include_router(auth_passthrough_router)")
+        body.append("")
+
     body.extend(
         [
             "    app = compose_versioned_apps(",
             "        version_mapping={UNVERSIONED: unversioned_app},",
             "        config=VersionedAppComposeConfig(",
             f'            title="{svc.name}",',
+            '            app_state={"settings": settings},',
             "            api=VersionedApiConfig(",
             '                prefix="/",',
             "                include_actuator_endpoints=settings.include_actuator_endpoints,",

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/delegates/auth_delegate.py

@@ -0,0 +1,35 @@
+"""Auth service delegate for signup and login.
+
+Proxies requests to the auth service's API endpoints.
+This file is scaffolded once and never overwritten.
+"""
+
+from csrd.delegate import BaseDelegate
+
+from ..models.auth_passthrough import TokenResponse, UserResponse
+
+
+class AuthDelegate(BaseDelegate):
+    """Delegate for the cluster auth service."""
+
+    def __init__(self, base_url: str) -> None:
+        super().__init__(base_url)
+
+    async def signup(self, username: str, password: str) -> UserResponse:
+        """Create a new user account via the auth service."""
+        return await self.post(
+            "/api/signup",
+            json={"username": username, "password": password},
+            response_model=UserResponse,
+        )
+
+    async def login(self, username: str, password: str) -> TokenResponse:
+        """Authenticate and obtain a JWT token via the auth service."""
+        return await self.post(
+            "/api/token",
+            json={"username": username, "password": password},
+            response_model=TokenResponse,
+        )
+
+
+__all__ = ("AuthDelegate",)

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/dependencies/auth_passthrough.py

@@ -0,0 +1,21 @@
+"""FastAPI dependency for the auth passthrough delegate.
+
+This file is scaffolded once and never overwritten.
+"""
+
+from typing import Annotated
+
+from fastapi import Depends
+
+from ..delegates.auth_delegate import AuthDelegate
+from . import Settings
+
+
+def auth_delegate_factory(settings: Settings) -> AuthDelegate:
+    """Create an ``AuthDelegate`` bound to the configured auth service URL."""
+    return AuthDelegate(settings.auth_service_url)
+
+
+AuthDelegateDep = Annotated[AuthDelegate, Depends(auth_delegate_factory)]
+
+__all__ = ("AuthDelegateDep", "auth_delegate_factory")

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/models/auth_passthrough.py

@@ -0,0 +1,32 @@
+"""Auth passthrough request/response models."""
+
+from csrd.models import BaseModel
+
+
+class SignupRequest(BaseModel):
+    """Signup request body."""
+
+    username: str
+    password: str
+
+
+class LoginRequest(BaseModel):
+    """Login request body."""
+
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    """Token response from the auth service."""
+
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class UserResponse(BaseModel):
+    """User response from the auth service."""
+
+    id: str
+    username: str

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/auth-passthrough/views/auth_passthrough_view.py

@@ -0,0 +1,25 @@
+"""Auth passthrough endpoints — unguarded signup and login.
+
+Proxies signup and login requests to the cluster auth service.
+No authentication required on these endpoints.
+This file is scaffolded once and never overwritten.
+"""
+
+from fastapi import APIRouter
+
+from ..dependencies.auth_passthrough import AuthDelegateDep
+from ..models.auth_passthrough import LoginRequest, SignupRequest, TokenResponse, UserResponse
+
+router = APIRouter(prefix="/api/auth", tags=["Auth"])
+
+
+@router.post("/signup", status_code=201, response_model=UserResponse)
+async def signup(body: SignupRequest, delegate: AuthDelegateDep) -> UserResponse:
+    """Create a new user account via the auth service."""
+    return await delegate.signup(body.username, body.password)
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(body: LoginRequest, delegate: AuthDelegateDep) -> TokenResponse:
+    """Authenticate and obtain a JWT token via the auth service."""
+    return await delegate.login(body.username, body.password)

csrd_utils-0.3.93/src/csrd_utils/v2/templates/augments/db-config/dependencies/db.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/db-config/dependencies/db.py.template

@@ -1,15 +1,19 @@
-"""Database adapter factory for $service_name.
+"""Database adapter dependency for $service_name.
 
 This file is scaffolded once and never overwritten. Customize the
 adapter type, DSN construction, or add connection pooling here.
 """
 
+from typing import Annotated
+
+from fastapi import Depends
+
 $db_adapter_import
 
-from ..settings import settings
+from . import Settings
 
 
-def create_adapter() -> $db_adapter_class:
+def _create_adapter(settings: Settings) -> $db_adapter_class:
     """Create the database adapter for this service.
 
     Override this to switch adapter types (PGAdapter, MariaAdapter)
@@ -18,4 +22,6 @@ def create_adapter() -> $db_adapter_class:
     return $db_adapter_constructor
 
 
-__all__ = ("create_adapter",)
+Adapter = Annotated[$db_adapter_class, Depends(_create_adapter)]
+
+__all__ = ("Adapter",)

csrd_utils-0.3.93/src/csrd_utils/v2/templates/augments/jwt-auth-consumer/dependencies/auth.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-consumer/dependencies/auth.py.template

@@ -13,6 +13,11 @@ from ..settings import settings
 
 # Build the auth dependency — tokens are verified locally using
 # the public keys from the auth service's JWKS endpoint.
+#
+# Note: this is constructed at module level because FastAPI security
+# dependencies (Security / Depends) must be stable objects. The
+# settings singleton is appropriate here — auth config is fixed
+# for the lifetime of the process.
 auth_dep = create_jwt_bearer(
     key=JWKSKeyProvider(url=settings.auth_jwks_url),
     algorithms=[settings.jwt_algorithm],

csrd_utils-0.3.93/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/db.py → csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/db.py.template

@@ -5,12 +5,12 @@ This file is scaffolded once and never overwritten.
 
 $db_adapter_import
 
-from ..settings import settings
+from . import Settings
 
 _adapter: $db_adapter_class | None = None
 
 
-async def get_adapter() -> $db_adapter_class:
+async def get_adapter(settings: Settings) -> $db_adapter_class:
     """Get or create the database adapter (singleton per process)."""
     global _adapter
     if _adapter is None:

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/auth.py

@@ -0,0 +1,39 @@
+"""Token issuance and verification models."""
+
+from csrd.models import BaseModel
+
+
+class TokenRequest(BaseModel):
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    """JWT token issuance response."""
+
+    access_token: str
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class VerifyRequest(BaseModel):
+    token: str
+
+
+class VerifyClaims(BaseModel):
+    """JWT claim fields returned by the verify endpoint."""
+
+    sub: str
+    user_name: str
+    authorities: list[str]
+    iat: int
+    exp: int
+    iss: str
+    aud: str
+
+
+class VerifyResponse(BaseModel):
+    """Token verification response."""
+
+    active: bool
+    claims: VerifyClaims

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/jwks.py

@@ -0,0 +1,11 @@
+"""JWKS response models."""
+
+from typing import Any
+
+from csrd.models import BaseModel
+
+
+class JWKSResponse(BaseModel):
+    """JSON Web Key Set response (RFC 7517)."""
+
+    keys: list[dict[str, Any]]

csrd_utils-0.3.95/src/csrd_utils/v2/templates/augments/jwt-auth-provider/models/users.py

@@ -0,0 +1,26 @@
+"""User management models."""
+
+from csrd.models import BaseModel
+
+
+class SignupRequest(BaseModel):
+    username: str
+    password: str
+
+
+class UserResponse(BaseModel):
+    """Basic user info returned after signup or lookup."""
+
+    id: str
+    username: str
+
+
+class UserRolesResponse(BaseModel):
+    """User with their assigned roles/authorities."""
+
+    user_id: str
+    roles: list[str]
+
+
+class RoleRequest(BaseModel):
+    role: str

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/repositories/user_repository.py

@@ -7,85 +7,93 @@ This file is scaffolded once and never overwritten.
 import hashlib
 import secrets
 import uuid
-from typing import Any
 
+from fastapi import HTTPException
 
-class UserRepository:
-    """User, credential, and role storage backed by a database adapter."""
+from csrd.repository import BaseRepository
+
+from ..models.users import UserResponse, UserRolesResponse
 
-    def __init__(self, adapter: Any) -> None:
-        self._adapter = adapter
+
+class UserRepository(BaseRepository):
+    """User, credential, and role storage backed by a database adapter."""
 
     # ── User CRUD ────────────────────────────────────────────────────
 
-    async def create_user(self, username: str, password: str) -> dict:
+    async def create_user(self, username: str, password: str) -> UserResponse:
         """Create a new user with hashed credentials."""
         user_id = str(uuid.uuid4())
-        await self._adapter.execute(
+        await self.execute(
             "INSERT INTO users (id, username) VALUES (:id, :username)",
             {"id": user_id, "username": username},
         )
 
         password_hash = self._hash_password(password)
-        await self._adapter.execute(
+        await self.execute(
             "INSERT INTO user_credentials (user_id, password_hash) "
             "VALUES (:user_id, :password_hash)",
             {"user_id": user_id, "password_hash": password_hash},
         )
 
-        return {"id": user_id, "username": username}
+        return UserResponse(id=user_id, username=username)
 
-    async def get_user(self, user_id: str) -> dict | None:
-        """Get a user by ID."""
-        return await self._adapter.fetch_one(
-            "SELECT id, username, created_at FROM users WHERE id = :id",
+    async def get_user(self, user_id: str) -> UserResponse:
+        """Get a user by ID. Raises 404 if not found."""
+        return await self.require_one(
+            "SELECT id, username FROM users WHERE id = :id",
             {"id": user_id},
+            model=UserResponse,
+            detail="User not found",
         )
 
-    async def get_user_by_username(self, username: str) -> dict | None:
-        """Get a user by username."""
-        return await self._adapter.fetch_one(
-            "SELECT id, username, created_at FROM users WHERE username = :username",
+    async def get_user_by_username(self, username: str) -> UserResponse | None:
+        """Get a user by username, or ``None`` if not found."""
+        row = await self.fetch_one(
+            "SELECT id, username FROM users WHERE username = :username",
             {"username": username},
         )
+        if row is None:
+            return None
+        return self.apply_model(row, model=UserResponse)
 
     # ── Credential verification ──────────────────────────────────────
 
-    async def verify_credentials(self, username: str, password: str) -> dict | None:
-        """Verify username + password. Returns user dict or None."""
+    async def verify_credentials(self, username: str, password: str) -> UserResponse:
+        """Verify username + password. Raises 401 on failure."""
         user = await self.get_user_by_username(username)
         if user is None:
-            return None
+            raise HTTPException(status_code=401, detail="Invalid credentials")
 
-        cred = await self._adapter.fetch_one(
+        cred = await self.fetch_one(
             "SELECT password_hash FROM user_credentials WHERE user_id = :user_id",
-            {"user_id": user["id"]},
+            {"user_id": user.id},
         )
-        if cred is None:
-            return None
-
-        if not self._verify_password(password, cred["password_hash"]):
-            return None
+        if cred is None or not self._verify_password(password, cred["password_hash"]):
+            raise HTTPException(status_code=401, detail="Invalid credentials")
 
         return user
 
     # ── Role management ──────────────────────────────────────────────
 
-    async def get_roles(self, user_id: str) -> list[str]:
-        """Get all roles for a user."""
-        rows = await self._adapter.fetch_all(
+    async def get_user_roles(self, user_id: str) -> UserRolesResponse:
+        """Get all roles for a user. Raises 404 if user not found."""
+        await self.get_user(user_id)  # ensures user exists (raises 404)
+        rows = await self.fetch_all(
             "SELECT role FROM user_roles WHERE user_id = :user_id",
             {"user_id": user_id},
         )
-        return [row["role"] for row in rows]
+        roles = [row["role"] for row in rows]
+        return UserRolesResponse(user_id=user_id, roles=roles)
 
-    async def add_role(self, user_id: str, role: str) -> None:
-        """Add a role to a user. Idempotent."""
-        await self._adapter.execute(
+    async def add_role(self, user_id: str, role: str) -> UserRolesResponse:
+        """Add a role to a user. Idempotent. Returns updated roles."""
+        await self.get_user(user_id)  # ensures user exists (raises 404)
+        await self.execute(
             "INSERT OR IGNORE INTO user_roles (user_id, role) "
             "VALUES (:user_id, :role)",
             {"user_id": user_id, "role": role},
         )
+        return await self.get_user_roles(user_id)
 
     # ── Password hashing ─────────────────────────────────────────────
     #

{csrd_utils-0.3.93 → csrd_utils-0.3.95}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/views/auth_view.py

@@ -8,72 +8,31 @@ from typing import Any
 
 import jwt as pyjwt
 from fastapi import APIRouter, HTTPException
-from pydantic import BaseModel
 
-from ..dependencies.db import get_adapter
-from ..repositories.user_repository import UserRepository
-from ..settings import settings
+from ..dependencies import Settings
+from ..dependencies.db import Adapter, UserRepo
+from ..models.auth import (
+    TokenRequest,
+    TokenResponse,
+    VerifyClaims,
+    VerifyRequest,
+    VerifyResponse,
+)
 
 router = APIRouter(tags=["auth"])
 
 
-# ---------------------------------------------------------------------------
-# Request / response models
-# ---------------------------------------------------------------------------
-
-
-class TokenRequest(BaseModel):
-    username: str
-    password: str
-
-
-class TokenResponse(BaseModel):
-    """JWT token issuance response."""
-
-    access_token: str
-    token_type: str = "bearer"
-    expires_in: int
-
-
-class VerifyRequest(BaseModel):
-    token: str
-
-
-class VerifyClaims(BaseModel):
-    """JWT claim fields returned by the verify endpoint."""
-
-    sub: str
-    user_name: str
-    authorities: list[str]
-    iat: int
-    exp: int
-    iss: str
-    aud: str
-
-
-class VerifyResponse(BaseModel):
-    """Token verification response."""
-
-    active: bool
-    claims: VerifyClaims
-
-
-# ---------------------------------------------------------------------------
-# Endpoints
-# ---------------------------------------------------------------------------
-
 
 @router.post("/api/token", response_model=TokenResponse)
-async def issue_token(body: TokenRequest) -> TokenResponse:
+async def issue_token(
+    body: TokenRequest,
+    settings: Settings,
+    adapter: Adapter,
+    repo: UserRepo,
+) -> TokenResponse:
     """Validate credentials and issue a JWT access token."""
-    adapter = await get_adapter()
-    repo = UserRepository(adapter)
-
     user = await repo.verify_credentials(body.username, body.password)
-    if user is None:
-        raise HTTPException(status_code=401, detail="Invalid credentials")
-
-    roles = await repo.get_roles(user["id"])
+    roles_resp = await repo.get_user_roles(user.id)
 
     # Get the active signing key
     from csrd.auth import KeyRingManager
@@ -91,9 +50,9 @@ async def issue_token(body: TokenRequest) -> TokenResponse:
 
     now = int(time.time())
     payload: dict[str, Any] = {
-        "sub": user["id"],
-        "user_name": user["username"],
-        "authorities": roles,
+        "sub": user.id,
+        "user_name": user.username,
+        "authorities": roles_resp.roles,
         "iat": now,
         "exp": now + settings.jwt_ttl_seconds,
         "iss": settings.jwt_issuer,
@@ -111,9 +70,12 @@ async def issue_token(body: TokenRequest) -> TokenResponse:
 
 
 @router.post("/api/verify", response_model=VerifyResponse)
-async def verify_token(body: VerifyRequest) -> VerifyResponse:
+async def verify_token(
+    body: VerifyRequest,
+    settings: Settings,
+    adapter: Adapter,
+) -> VerifyResponse:
     """Verify a JWT and return its claims."""
-    adapter = await get_adapter()
 
     from csrd.auth import KeyRingManager