fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/without_rbac/app/api/v1/audit_logs/router.py

@@ -0,0 +1,45 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.audit_logs.repository import AuditLogRepository
+from app.api.v1.audit_logs.schema import AuditLogResponse
+from app.core.dependencies import get_async_db, require_superuser
+from app.core.responses import paginated_response, success_response
+from app.helper.pagination_helper import PaginationParams
+
+router = APIRouter(dependencies=[Depends(require_superuser)])
+
+
+@router.get("", summary="List audit log entries")
+async def list_audit_logs(
+    pagination: PaginationParams = Depends(),
+    db: AsyncSession = Depends(get_async_db),
+):
+    entries, total = await AuditLogRepository(db).list(
+        pagination.page,
+        pagination.page_size,
+        pagination.pagination,
+        pagination.search,
+    )
+    items = [
+        AuditLogResponse(
+            id=entry.id,
+            created_at=entry.created_at,
+            user_id=entry.user_id,
+            user_email=entry.user_email,
+            action=entry.action,
+            resource=entry.resource,
+            resource_id=entry.resource_id,
+            old_values=entry.old_values,
+            new_values=entry.new_values,
+            metadata=entry.log_metadata,
+            ip_address=entry.ip_address,
+            user_agent=entry.user_agent,
+            request_id=entry.request_id,
+        ).model_dump()
+        for entry in entries
+    ]
+    if not pagination.pagination:
+        return success_response(data=items)
+    return paginated_response(items, total, pagination.page, pagination.page_size)
+

fastapi_forge/templates/without_rbac/app/api/v1/audit_logs/schema.py

@@ -0,0 +1,21 @@
+from datetime import datetime
+from typing import Any
+from uuid import UUID
+
+from app.utils.casing import CamelModel
+
+
+class AuditLogResponse(CamelModel):
+    id: UUID
+    created_at: datetime
+    user_id: UUID | None = None
+    user_email: str | None = None
+    action: str
+    resource: str
+    resource_id: str | None = None
+    old_values: dict[str, Any] | None = None
+    new_values: dict[str, Any] | None = None
+    metadata: dict[str, Any] | None = None
+    ip_address: str | None = None
+    user_agent: str | None = None
+    request_id: str | None = None

fastapi_forge/templates/without_rbac/app/api/v1/auth/repository.py

@@ -0,0 +1,127 @@
+from datetime import datetime, timezone
+from typing import Optional
+from uuid import UUID
+
+from sqlalchemy import delete, exists, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.models import (
+    EmailVerificationToken,
+    PasswordResetToken,
+    RevokedToken,
+    User,
+    UserSession,
+)
+from app.repositories.base import BaseRepository
+from app.core.security import hash_opaque_token
+
+
+class UserRepository(BaseRepository[User]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(User, session)
+
+    async def get_by_email(self, email: str) -> Optional[User]:
+        result = await self.session.execute(
+            select(User).where(User.email == email.lower(), User.is_deleted == False)
+        )
+        return result.scalar_one_or_none()
+
+    async def get_active(self, user_id: UUID | str) -> Optional[User]:
+        try:
+            user_id = UUID(str(user_id))
+        except ValueError:
+            return None
+        result = await self.session.execute(
+            select(User).where(User.id == user_id, User.is_deleted == False)
+        )
+        return result.scalar_one_or_none()
+
+class RevokedTokenRepository(BaseRepository[RevokedToken]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(RevokedToken, session)
+
+    async def revoke(self, jti: str, token_type: str, expires_at: datetime) -> None:
+        if not await self.is_revoked(jti):
+            self.session.add(
+                RevokedToken(jti=jti, token_type=token_type, expires_at=expires_at)
+            )
+            await self.session.flush()
+
+    async def is_revoked(self, jti: str) -> bool:
+        await self.session.execute(
+            delete(RevokedToken).where(
+                RevokedToken.expires_at <= datetime.now(timezone.utc)
+            )
+        )
+        result = await self.session.execute(
+            select(exists().where(RevokedToken.jti == jti))
+        )
+        return bool(result.scalar())
+
+
+class EmailVerificationTokenRepository(BaseRepository[EmailVerificationToken]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(EmailVerificationToken, session)
+
+    async def get_valid(self, token: str):
+        result = await self.session.execute(
+            select(EmailVerificationToken).where(
+                EmailVerificationToken.token == hash_opaque_token(token),
+                EmailVerificationToken.used_at.is_(None),
+                EmailVerificationToken.expires_at > datetime.now(timezone.utc),
+            )
+        )
+        return result.scalar_one_or_none()
+
+
+class PasswordResetTokenRepository(BaseRepository[PasswordResetToken]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(PasswordResetToken, session)
+
+    async def get_valid(self, token: str):
+        result = await self.session.execute(
+            select(PasswordResetToken).where(
+                PasswordResetToken.token == hash_opaque_token(token),
+                PasswordResetToken.used_at.is_(None),
+                PasswordResetToken.expires_at > datetime.now(timezone.utc),
+            )
+        )
+        return result.scalar_one_or_none()
+
+
+class UserSessionRepository(BaseRepository[UserSession]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(UserSession, session)
+
+    async def get_active_by_refresh_jti(self, jti: str):
+        result = await self.session.execute(
+            select(UserSession).where(
+                UserSession.refresh_jti == jti,
+                UserSession.revoked_at.is_(None),
+                UserSession.expires_at > datetime.now(timezone.utc),
+            )
+        )
+        return result.scalar_one_or_none()
+
+    async def get_by_previous_refresh_jti(self, jti: str):
+        result = await self.session.execute(
+            select(UserSession).where(UserSession.previous_refresh_jti == jti)
+        )
+        return result.scalar_one_or_none()
+
+    async def list_active_for_user(self, user_id: UUID | str):
+        result = await self.session.execute(
+            select(UserSession)
+            .where(
+                UserSession.user_id == UUID(str(user_id)),
+                UserSession.revoked_at.is_(None),
+                UserSession.expires_at > datetime.now(timezone.utc),
+            )
+            .order_by(UserSession.created_at.desc())
+        )
+        return list(result.scalars().all())
+
+    async def revoke_session(self, session: UserSession) -> None:
+        session.revoked_at = datetime.now(timezone.utc)
+        self.session.add(session)
+        await self.session.flush()

fastapi_forge/templates/without_rbac/app/api/v1/auth/router.py

@@ -0,0 +1,207 @@
+from typing import Optional
+
+from fastapi import APIRouter, Depends, Request, Response
+from fastapi.security import HTTPAuthorizationCredentials
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.auth.repository import UserRepository
+from app.api.v1.auth.schema import (
+    ChangePasswordRequest,
+    LoginRequest,
+    PasswordResetConfirmRequest,
+    PasswordResetRequest,
+    ResendVerificationRequest,
+    UserResponse,
+)
+from app.api.v1.auth.service import AuthService
+from app.core.config import settings
+from app.core.dependencies import bearer_scheme, get_async_db, get_current_user_id
+from app.core.exceptions import UnauthorizedException
+from app.core.middleware import limiter
+from app.core.responses import success_response
+
+router = APIRouter()
+
+REFRESH_TOKEN_COOKIE_NAME = "refresh_token"
+REFRESH_TOKEN_COOKIE_PATH = "/api/v1/auth"
+
+
+def _set_refresh_token_cookie(response: Response, refresh_token: str) -> None:
+    response.set_cookie(
+        key=REFRESH_TOKEN_COOKIE_NAME,
+        value=refresh_token,
+        max_age=settings.refresh_token_expire_days * 24 * 60 * 60,
+        httponly=True,
+        secure=settings.is_production,
+        samesite="lax",
+        path=REFRESH_TOKEN_COOKIE_PATH,
+    )
+
+
+def _clear_refresh_token_cookie(response: Response) -> None:
+    response.delete_cookie(
+        key=REFRESH_TOKEN_COOKIE_NAME,
+        path=REFRESH_TOKEN_COOKIE_PATH,
+        httponly=True,
+        secure=settings.is_production,
+        samesite="lax",
+    )
+
+
+def _refresh_token_from_cookie(request: Request) -> str:
+    refresh_token = request.cookies.get(REFRESH_TOKEN_COOKIE_NAME)
+    if not refresh_token:
+        raise UnauthorizedException("Refresh token missing")
+    return refresh_token
+
+
+def _request_meta(request: Request) -> dict:
+    return {
+        "ip_address": request.client.host if request.client else None,
+        "user_agent": request.headers.get("user-agent"),
+        "request_id": getattr(request.state, "request_id", None),
+    }
+
+
+@router.post("/login", summary="Obtain access and refresh tokens")
+@limiter.limit("10/minute")
+async def login(
+    request: Request,
+    response: Response,
+    payload: LoginRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    tokens = await AuthService(db).login(payload, _request_meta(request))
+    _set_refresh_token_cookie(response, tokens.refresh_token)
+    return success_response(data=tokens.model_dump(), message="Login successful")
+
+
+@router.post("/refresh", summary="Refresh access token")
+async def refresh_token(
+    request: Request,
+    response: Response,
+    db: AsyncSession = Depends(get_async_db),
+):
+    tokens = await AuthService(db).refresh(
+        _refresh_token_from_cookie(request), _request_meta(request)
+    )
+    _set_refresh_token_cookie(response, tokens["refresh_token"])
+    return success_response(
+        data={key: value for key, value in tokens.items() if key != "refresh_token"},
+        message="Token refreshed",
+    )
+
+
+@router.post("/logout", summary="Logout and revoke tokens")
+async def logout(
+    request: Request,
+    response: Response,
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).logout(
+        access_token=credentials.credentials if credentials else None,
+        refresh_token=_refresh_token_from_cookie(request),
+        request_meta=_request_meta(request),
+    )
+    _clear_refresh_token_cookie(response)
+    return success_response(message="Logout successful")
+
+
+@router.post("/verify-email/resend", summary="Send an email verification link")
+@limiter.limit("3/minute")
+async def resend_verification(
+    request: Request,
+    payload: ResendVerificationRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).send_verification_email(payload.email)
+    return success_response(message="If the account exists, a link was sent")
+
+
+@router.get("/verify-email", summary="Verify an email address")
+async def verify_email(
+    request: Request,
+    token: str,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).verify_email(token, _request_meta(request))
+    return success_response(message="Email verified")
+
+
+@router.post("/password-reset", summary="Request a password reset link")
+@limiter.limit("5/minute")
+async def request_password_reset(
+    request: Request,
+    payload: PasswordResetRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).request_password_reset(payload)
+    return success_response(message="If the account exists, a link was sent")
+
+
+@router.post("/password-reset/confirm", summary="Reset password with a token")
+@limiter.limit("5/minute")
+async def confirm_password_reset(
+    request: Request,
+    payload: PasswordResetConfirmRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).confirm_password_reset(payload, _request_meta(request))
+    return success_response(message="Password reset successful")
+
+
+@router.post("/change-password", summary="Change current user's password")
+async def change_password(
+    request: Request,
+    payload: ChangePasswordRequest,
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).change_password(user_id, payload, _request_meta(request))
+    return success_response(message="Password changed")
+
+
+@router.get("/sessions", summary="List current user's active sessions")
+async def list_sessions(
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    sessions = await AuthService(db).list_sessions(user_id)
+    return success_response(data=[item.model_dump() for item in sessions])
+
+
+@router.delete("/sessions/{session_id}", summary="Revoke one active session")
+async def revoke_session(
+    session_id: str,
+    request: Request,
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).revoke_session(
+        user_id, session_id, _request_meta(request)
+    )
+    return success_response(message="Session revoked")
+
+
+@router.get("/me", summary="Get current authenticated user")
+async def me(
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    repo = UserRepository(db)
+    user = await repo.get_active(user_id)
+    if not user or not user.is_active:
+        raise UnauthorizedException("User not found or deactivated")
+
+    response = UserResponse(
+        id=str(user.id),
+        email=user.email,
+        username=user.username,
+        full_name=user.full_name,
+        is_active=user.is_active,
+        is_superuser=user.is_superuser,
+        is_verified=user.is_verified,
+        last_login_at=user.last_login_at.isoformat() if user.last_login_at else None,
+    )
+    return success_response(data=response.model_dump())

fastapi_forge/templates/without_rbac/app/api/v1/auth/schema.py

@@ -0,0 +1,96 @@
+from typing import List, Optional
+from pydantic import EmailStr, Field, field_validator
+
+from app.utils.casing import CamelModel
+import re
+
+
+# ── Request schemas ──────────────────────────────────────────────
+class RegisterRequest(CamelModel):
+    email: EmailStr
+    username: str = Field(..., min_length=3, max_length=50)
+    full_name: str = Field(..., min_length=1, max_length=255)
+    password: str = Field(..., min_length=8, max_length=128)
+
+    @field_validator("password")
+    @classmethod
+    def validate_password_strength(cls, v: str) -> str:
+        errors = []
+        if not re.search(r"[A-Z]", v):
+            errors.append("at least one uppercase letter")
+        if not re.search(r"[a-z]", v):
+            errors.append("at least one lowercase letter")
+        if not re.search(r"\d", v):
+            errors.append("at least one digit")
+        if not re.search(r"[!@#$%^&*()_+\-=\[\]{};':\"\\|,.<>/?]", v):
+            errors.append("at least one special character")
+        if errors:
+            raise ValueError(f"Password must contain {', '.join(errors)}")
+        return v
+
+    @field_validator("username")
+    @classmethod
+    def validate_username(cls, v: str) -> str:
+        if not re.match(r"^[a-zA-Z0-9_]+$", v):
+            raise ValueError(
+                "Username may only contain letters, digits, and underscores"
+            )
+        return v.lower()
+
+
+class LoginRequest(CamelModel):
+    email: EmailStr
+    password: str
+
+
+class PasswordResetRequest(CamelModel):
+    email: EmailStr
+
+
+class PasswordResetConfirmRequest(CamelModel):
+    token: str
+    new_password: str = Field(..., min_length=8, max_length=128)
+
+
+class ChangePasswordRequest(CamelModel):
+    current_password: str
+    new_password: str = Field(..., min_length=8, max_length=128)
+
+
+class ResendVerificationRequest(CamelModel):
+    email: EmailStr
+
+
+# ── Response schemas ─────────────────────────────────────────────
+class UserResponse(CamelModel):
+    id: str
+    email: str
+    username: str
+    full_name: str
+    is_active: bool
+    is_superuser: bool
+    is_verified: bool
+    last_login_at: Optional[str] = None
+
+class TokenResponse(CamelModel):
+    access_token: str
+    refresh_token: str = Field(exclude=True)
+    token_type: str = "bearer"
+    expires_in: int  # seconds
+    user: UserResponse
+
+
+class TokenRefreshResponse(CamelModel):
+    access_token: str
+    refresh_token: str = Field(exclude=True)
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class SessionResponse(CamelModel):
+    id: str
+    user_agent: Optional[str] = None
+    ip_address: Optional[str] = None
+    created_at: str
+    last_used_at: Optional[str] = None
+    expires_at: str