csrd-utils 0.3.96__tar.gz → 0.3.98__tar.gz

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: csrd-utils
-Version: 0.3.96
+Version: 0.3.98
 Summary: CLI utilities for csrd service generation and feature augmentation
 Project-URL: Repository, https://github.com/csrd-api/fastapi-common
 Project-URL: Documentation, https://github.com/csrd-api/fastapi-common/tree/main/packages/utils

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "csrd-utils"
-version = "0.3.96"
+version = "0.3.98"
 description = "CLI utilities for csrd service generation and feature augmentation"
 license = { text = "MIT" }
 requires-python = ">=3.12"

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/compose/presets.py

@@ -33,6 +33,7 @@ PRESET_REGISTRY: dict[str, PresetDefinition] = {
                 features=["database"],
                 augments=[
                     ServiceAugment(name="jwt-auth-consumer"),
+                    ServiceAugment(name="auth-passthrough"),
                     ServiceAugment(name="db-config"),
                 ],
             ),

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/db.py.template

@@ -1,4 +1,4 @@
-"""Database and repository dependencies for the auth service.
+"""Database, repository, and key ring dependencies for the auth service.
 
 This file is scaffolded once and never overwritten.
 """
@@ -7,6 +7,8 @@ from typing import Annotated
 
 from fastapi import Depends
 
+from csrd.auth import KeyRingManager
+
 $db_adapter_import
 
 from ..repositories.user_repository import UserRepository
@@ -43,4 +45,20 @@ def _user_repository_factory(adapter: Adapter) -> UserRepository:
 
 UserRepo = Annotated[UserRepository, Depends(_user_repository_factory)]
 
-__all__ = ("Adapter", "UserRepo")
+
+async def _key_ring_factory(adapter: Adapter, settings: Settings) -> KeyRingManager:
+    """Create and initialize a ``KeyRingManager`` for JWT signing."""
+    key_ring = KeyRingManager(
+        adapter=adapter,
+        key_size=settings.jwt_key_size,
+        rotation_interval=settings.jwt_key_rotation_interval,
+        retention_period=settings.jwt_key_retention_period,
+        token_ttl=settings.jwt_ttl_seconds,
+    )
+    await key_ring.initialize()
+    return key_ring
+
+
+KeyRing = Annotated[KeyRingManager, Depends(_key_ring_factory)]
+
+__all__ = ("Adapter", "KeyRing", "UserRepo")

csrd_utils-0.3.98/src/csrd_utils/v2/templates/augments/jwt-auth-provider/dependencies/token_service.py

@@ -0,0 +1,22 @@
+"""Token service dependency for the auth service.
+
+This file is scaffolded once and never overwritten.
+"""
+
+from typing import Annotated
+
+from fastapi import Depends
+
+from ..services.token_service import TokenService
+from . import Settings
+from .db import KeyRing
+
+
+def _token_service_factory(key_ring: KeyRing, settings: Settings) -> TokenService:
+    """Create a ``TokenService`` with the key ring and settings."""
+    return TokenService(key_ring, settings)
+
+
+TokenSvc = Annotated[TokenService, Depends(_token_service_factory)]
+
+__all__ = ("TokenSvc",)

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/repositories/user_repository.py

@@ -21,7 +21,11 @@ class UserRepository(BaseRepository):
     # ── User CRUD ────────────────────────────────────────────────────
 
     async def create_user(self, username: str, password: str) -> UserResponse:
-        """Create a new user with hashed credentials."""
+        """Create a new user with hashed credentials. Raises 409 if exists."""
+        existing = await self.get_user_by_username(username)
+        if existing is not None:
+            raise HTTPException(status_code=409, detail="Username already taken")
+
         user_id = str(uuid.uuid4())
         await self.execute(
             "INSERT INTO users (id, username) VALUES (:id, :username)",

csrd_utils-0.3.98/src/csrd_utils/v2/templates/augments/jwt-auth-provider/services/token_service.py

@@ -0,0 +1,91 @@
+"""Token service for JWT issuance and verification.
+
+Encapsulates all JWT business logic: signing, verification, and
+claims construction. Views call service methods and return the result.
+
+This file is scaffolded once and never overwritten.
+"""
+
+import time
+from typing import Any
+
+import jwt as pyjwt
+from fastapi import HTTPException
+from jwt.algorithms import RSAAlgorithm
+
+from csrd.auth import KeyRingManager
+
+from ..models.auth import TokenResponse, VerifyClaims, VerifyResponse
+
+
+class TokenService:
+    """JWT token issuance and verification."""
+
+    def __init__(self, key_ring: KeyRingManager, settings: Any) -> None:
+        self._key_ring = key_ring
+        self._settings = settings
+
+    async def issue_token(
+        self,
+        *,
+        user_id: str,
+        username: str,
+        roles: list[str],
+    ) -> TokenResponse:
+        """Create a signed JWT for the given user."""
+        await self._key_ring.rotate_if_needed()
+        kid, private_key = await self._key_ring.active_key()
+
+        now = int(time.time())
+        payload: dict[str, Any] = {
+            "sub": user_id,
+            "user_name": username,
+            "authorities": roles,
+            "iat": now,
+            "exp": now + self._settings.jwt_ttl_seconds,
+            "iss": self._settings.jwt_issuer,
+            "aud": self._settings.jwt_audience,
+        }
+
+        token = pyjwt.encode(
+            payload,
+            private_key,
+            algorithm=self._settings.jwt_algorithm,
+            headers={"kid": kid},
+        )
+
+        return TokenResponse(access_token=token, expires_in=self._settings.jwt_ttl_seconds)
+
+    async def verify_token(self, token: str) -> VerifyResponse:
+        """Verify a JWT and return its claims. Raises on failure."""
+        jwks = await self._key_ring.jwks_dict()
+
+        try:
+            unverified = pyjwt.get_unverified_header(token)
+            kid = unverified.get("kid")
+
+            jwk_data = next(
+                (k for k in jwks["keys"] if k["kid"] == kid),
+                None,
+            )
+            if jwk_data is None:
+                raise HTTPException(status_code=401, detail="Unknown signing key")
+
+            public_key = RSAAlgorithm.from_jwk(jwk_data)
+
+            claims = pyjwt.decode(
+                token,
+                public_key,
+                algorithms=[self._settings.jwt_algorithm],
+                issuer=self._settings.jwt_issuer,
+                audience=self._settings.jwt_audience,
+            )
+            return VerifyResponse(active=True, claims=VerifyClaims(**claims))
+
+        except pyjwt.ExpiredSignatureError:
+            raise HTTPException(status_code=401, detail="Token has expired") from None
+        except pyjwt.InvalidTokenError as exc:
+            raise HTTPException(status_code=401, detail=f"Invalid token: {exc}") from None
+
+
+__all__ = ("TokenService",)

csrd_utils-0.3.98/src/csrd_utils/v2/templates/augments/jwt-auth-provider/views/auth_view.py

@@ -0,0 +1,40 @@
+"""Token issuance and verification endpoints.
+
+This file is scaffolded once and never overwritten.
+"""
+
+from fastapi import APIRouter
+
+from ..dependencies.db import UserRepo
+from ..dependencies.token_service import TokenSvc
+from ..models.auth import (
+    TokenRequest,
+    TokenResponse,
+    VerifyRequest,
+    VerifyResponse,
+)
+
+router = APIRouter(tags=["auth"])
+
+
+
+@router.post("/api/token", response_model=TokenResponse)
+async def issue_token(
+    body: TokenRequest,
+    repo: UserRepo,
+    token_svc: TokenSvc,
+) -> TokenResponse:
+    """Validate credentials and issue a JWT access token."""
+    user = await repo.verify_credentials(body.username, body.password)
+    roles_resp = await repo.get_user_roles(user.id)
+    return await token_svc.issue_token(
+        user_id=user.id,
+        username=user.username,
+        roles=roles_resp.roles,
+    )
+
+
+@router.post("/api/verify", response_model=VerifyResponse)
+async def verify_token(body: VerifyRequest, token_svc: TokenSvc) -> VerifyResponse:
+    """Verify a JWT and return its claims."""
+    return await token_svc.verify_token(body.token)

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/views/jwks_view.py

@@ -6,7 +6,7 @@ This file is scaffolded once and never overwritten.
 
 from fastapi import APIRouter
 
-from ..dependencies.db import Adapter
+from ..dependencies.db import KeyRing
 from ..models.jwks import JWKSResponse
 
 router = APIRouter(tags=["jwks"])
@@ -14,15 +14,11 @@ router = APIRouter(tags=["jwks"])
 
 
 @router.get("/.well-known/jwks.json", response_model=JWKSResponse)
-async def jwks(adapter: Adapter) -> JWKSResponse:
+async def jwks(key_ring: KeyRing) -> JWKSResponse:
     """Return public keys for all active signing keys in JWK format.
 
     Consumers cache this response and refresh automatically when
     they encounter an unknown ``kid`` in a token header.
     """
-    from csrd.auth import KeyRingManager
-
-    key_ring = KeyRingManager(adapter=adapter)
-    await key_ring.initialize()
     jwks_data = await key_ring.jwks_dict()
     return JWKSResponse(keys=jwks_data["keys"])

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/templates/augments/jwt-auth-provider/views/users_view.py

@@ -3,7 +3,7 @@
 This file is scaffolded once and never overwritten.
 """
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter
 
 from ..dependencies.db import UserRepo
 from ..models.users import (
@@ -20,9 +20,6 @@ router = APIRouter(tags=["users"])
 @router.post("/api/signup", status_code=201, response_model=UserResponse)
 async def signup(body: SignupRequest, repo: UserRepo) -> UserResponse:
     """Create a new user account."""
-    existing = await repo.get_user_by_username(body.username)
-    if existing is not None:
-        raise HTTPException(status_code=409, detail="Username already taken")
     return await repo.create_user(body.username, body.password)
 
 

{csrd_utils-0.3.96 → csrd_utils-0.3.98}/src/csrd_utils/v2/templates/service/{{cookiecutter.__service_name_snake}}/__init__.py

@@ -16,6 +16,7 @@ def build_app() -> FastAPI:
         version_mapping={UNVERSIONED: unversioned_app},
         config=VersionedAppComposeConfig(
             title="{{ cookiecutter.service_name }}",
+            app_state={"settings": settings},
             api=VersionedApiConfig(
                 prefix="/",
                 include_actuator_endpoints=settings.include_actuator_endpoints,

csrd_utils-0.3.96/src/csrd_utils/v2/templates/augments/jwt-auth-provider/views/auth_view.py

@@ -1,115 +0,0 @@
-"""Token issuance and verification endpoints.
-
-This file is scaffolded once and never overwritten.
-"""
-
-import time
-from typing import Any
-
-import jwt as pyjwt
-from fastapi import APIRouter, HTTPException
-
-from ..dependencies import Settings
-from ..dependencies.db import Adapter, UserRepo
-from ..models.auth import (
-    TokenRequest,
-    TokenResponse,
-    VerifyClaims,
-    VerifyRequest,
-    VerifyResponse,
-)
-
-router = APIRouter(tags=["auth"])
-
-
-
-@router.post("/api/token", response_model=TokenResponse)
-async def issue_token(
-    body: TokenRequest,
-    settings: Settings,
-    adapter: Adapter,
-    repo: UserRepo,
-) -> TokenResponse:
-    """Validate credentials and issue a JWT access token."""
-    user = await repo.verify_credentials(body.username, body.password)
-    roles_resp = await repo.get_user_roles(user.id)
-
-    # Get the active signing key
-    from csrd.auth import KeyRingManager
-
-    key_ring = KeyRingManager(
-        adapter=adapter,
-        key_size=settings.jwt_key_size,
-        rotation_interval=settings.jwt_key_rotation_interval,
-        retention_period=settings.jwt_key_retention_period,
-        token_ttl=settings.jwt_ttl_seconds,
-    )
-    await key_ring.initialize()
-    await key_ring.rotate_if_needed()
-    kid, private_key = await key_ring.active_key()
-
-    now = int(time.time())
-    payload: dict[str, Any] = {
-        "sub": user.id,
-        "user_name": user.username,
-        "authorities": roles_resp.roles,
-        "iat": now,
-        "exp": now + settings.jwt_ttl_seconds,
-        "iss": settings.jwt_issuer,
-        "aud": settings.jwt_audience,
-    }
-
-    token = pyjwt.encode(
-        payload,
-        private_key,
-        algorithm=settings.jwt_algorithm,
-        headers={"kid": kid},
-    )
-
-    return TokenResponse(access_token=token, expires_in=settings.jwt_ttl_seconds)
-
-
-@router.post("/api/verify", response_model=VerifyResponse)
-async def verify_token(
-    body: VerifyRequest,
-    settings: Settings,
-    adapter: Adapter,
-) -> VerifyResponse:
-    """Verify a JWT and return its claims."""
-
-    from csrd.auth import KeyRingManager
-
-    key_ring = KeyRingManager(adapter=adapter)
-    await key_ring.initialize()
-    jwks = await key_ring.jwks_dict()
-
-    try:
-        # Get the kid from the token header
-        unverified = pyjwt.get_unverified_header(body.token)
-        kid = unverified.get("kid")
-
-        # Find the matching public key
-        from jwt.algorithms import RSAAlgorithm
-
-        jwk_data = next(
-            (k for k in jwks["keys"] if k["kid"] == kid),
-            None,
-        )
-        if jwk_data is None:
-            raise HTTPException(status_code=401, detail="Unknown signing key")
-
-        public_key = RSAAlgorithm.from_jwk(jwk_data)
-
-        claims = pyjwt.decode(
-            body.token,
-            public_key,
-            algorithms=[settings.jwt_algorithm],
-            issuer=settings.jwt_issuer,
-            audience=settings.jwt_audience,
-        )
-        return VerifyResponse(active=True, claims=VerifyClaims(**claims))
-
-    except pyjwt.ExpiredSignatureError:
-        raise HTTPException(status_code=401, detail="Token has expired") from None
-    except pyjwt.InvalidTokenError as exc:
-        raise HTTPException(status_code=401, detail=f"Invalid token: {exc}") from None