fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/without_rbac/app/api/v1/auth/service.py

@@ -0,0 +1,373 @@
+from datetime import datetime, timedelta, timezone
+from typing import Dict, Optional
+from uuid import UUID
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.auth.repository import (
+    EmailVerificationTokenRepository,
+    PasswordResetTokenRepository,
+    RevokedTokenRepository,
+    UserRepository,
+    UserSessionRepository,
+)
+from app.api.v1.auth.schema import (
+    ChangePasswordRequest,
+    LoginRequest,
+    PasswordResetConfirmRequest,
+    PasswordResetRequest,
+    RegisterRequest,
+    SessionResponse,
+    TokenResponse,
+    UserResponse,
+)
+from app.core.config import settings
+from app.core.exceptions import (
+    ConflictException,
+    NotFoundException,
+    UnauthorizedException,
+    ValidationException,
+)
+from app.core.logging import get_logger
+from app.core.security import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    generate_secure_token,
+    hash_opaque_token,
+    hash_password,
+    verify_password,
+)
+from app.services.audit import AuditService
+from app.services.email import EmailService
+from app.services.notification import NotificationService
+
+logger = get_logger(__name__)
+
+
+class AuthService:
+    def __init__(self, session: AsyncSession):
+        self.session = session
+        self.repo = UserRepository(session)
+        self.revoked_tokens = RevokedTokenRepository(session)
+        self.email_tokens = EmailVerificationTokenRepository(session)
+        self.password_tokens = PasswordResetTokenRepository(session)
+        self.sessions = UserSessionRepository(session)
+        self.audit = AuditService(session)
+        self.notifications = NotificationService(session)
+        self.email = EmailService()
+
+    async def register(self, data: RegisterRequest, request_meta: Dict) -> UserResponse:
+        if await self.repo.exists("email", data.email.lower()):
+            raise ConflictException("An account with this email already exists")
+        if await self.repo.exists("username", data.username.lower()):
+            raise ConflictException("Username is already taken")
+
+        user = await self.repo.create(
+            {
+                "email": data.email.lower(),
+                "username": data.username.lower(),
+                "full_name": data.full_name,
+                "hashed_password": hash_password(data.password),
+            }
+        )
+        await self.audit.log(
+            action="user.registered",
+            resource="users",
+            resource_id=str(user.id),
+            new_values={"email": user.email, "username": user.username},
+            **request_meta,
+        )
+        await self.notifications.send(
+            user_id=user.id,
+            title="Welcome!",
+            body=f"Hi {user.full_name}, your account was created successfully.",
+            notification_type="system",
+        )
+        # Email verification is currently disabled.
+        # await self.send_verification_email(user.email)
+
+        logger.info("User registered", user_id=str(user.id), email=user.email)
+        return self._user_response(user)
+
+    async def login(self, data: LoginRequest, request_meta: Dict) -> TokenResponse:
+        user = await self.repo.get_by_email(data.email)
+        if not user or not verify_password(data.password, user.hashed_password):
+            raise UnauthorizedException("Invalid email or password")
+        if not user.is_active:
+            raise UnauthorizedException("Account is deactivated")
+
+        login_at = datetime.now(timezone.utc)
+        user.last_login_at = login_at
+        self.session.add(user)
+
+        access_token, _ = create_access_token(
+            str(user.id),
+            {
+                "is_superuser": user.is_superuser,
+            },
+        )
+        refresh_token, refresh_expire = create_refresh_token(str(user.id))
+        refresh_payload = decode_token(refresh_token, expected_type="refresh")
+        await self.sessions.create(
+            {
+                "user_id": user.id,
+                "refresh_jti": refresh_payload["jti"],
+                "user_agent": request_meta.get("user_agent"),
+                "ip_address": request_meta.get("ip_address"),
+                "expires_at": refresh_expire,
+                "last_used_at": login_at,
+            }
+        )
+
+        await self.audit.log(
+            action="user.login",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+        return TokenResponse(
+            access_token=access_token,
+            refresh_token=refresh_token,
+            expires_in=int(settings.access_token_expire_minutes * 60),
+            user=self._user_response(user),
+        )
+
+    async def refresh(
+        self, refresh_token: str, request_meta: Dict | None = None
+    ) -> Dict:
+        payload = decode_token(refresh_token, expected_type="refresh")
+        refresh_jti = payload.get("jti")
+        if not refresh_jti:
+            raise UnauthorizedException("Invalid token payload")
+        if await self.revoked_tokens.is_revoked(refresh_jti):
+            raise UnauthorizedException("Token has been revoked")
+
+        session = await self.sessions.get_active_by_refresh_jti(refresh_jti)
+        if not session:
+            replayed = await self.sessions.get_by_previous_refresh_jti(refresh_jti)
+            if replayed:
+                await self.sessions.revoke_session(replayed)
+            raise UnauthorizedException("Refresh session is invalid or expired")
+
+        user = await self.repo.get_active(payload.get("sub"))
+        if not user or not user.is_active:
+            raise UnauthorizedException("User not found or deactivated")
+
+        access_token, _ = create_access_token(
+            str(user.id),
+            {
+                "is_superuser": user.is_superuser,
+            },
+        )
+        new_refresh_token, refresh_expire = create_refresh_token(str(user.id))
+        new_refresh_payload = decode_token(new_refresh_token, expected_type="refresh")
+
+        await self._revoke_payload(payload)
+        session.previous_refresh_jti = refresh_jti
+        session.refresh_jti = new_refresh_payload["jti"]
+        session.expires_at = refresh_expire
+        session.last_used_at = datetime.now(timezone.utc)
+        if request_meta:
+            session.ip_address = request_meta.get("ip_address")
+            session.user_agent = request_meta.get("user_agent")
+        self.session.add(session)
+        await self.session.flush()
+
+        return {
+            "access_token": access_token,
+            "refresh_token": new_refresh_token,
+            "token_type": "bearer",
+            "expires_in": int(settings.access_token_expire_minutes * 60),
+        }
+
+    async def logout(
+        self,
+        access_token: Optional[str],
+        refresh_token: str,
+        request_meta: Dict,
+    ) -> None:
+        refresh_payload = decode_token(refresh_token, expected_type="refresh")
+        user_id = refresh_payload.get("sub")
+        if not user_id:
+            raise UnauthorizedException("Invalid token payload")
+
+        access_payload = None
+        if access_token:
+            try:
+                access_payload = decode_token(access_token, expected_type="access")
+            except UnauthorizedException:
+                access_payload = None
+
+        if access_payload:
+            if access_payload.get("sub") != user_id:
+                raise UnauthorizedException("Token subject mismatch")
+            await self._revoke_payload(access_payload)
+
+        await self._revoke_payload(refresh_payload)
+        session = await self.sessions.get_active_by_refresh_jti(refresh_payload["jti"])
+        if session:
+            await self.sessions.revoke_session(session)
+
+        await self.audit.log(
+            action="user.logout",
+            resource="users",
+            resource_id=str(user_id),
+            **request_meta,
+        )
+
+    async def send_verification_email(self, email: str) -> None:
+        user = await self.repo.get_by_email(email)
+        if not user:
+            return
+        token = generate_secure_token()
+        await self.email_tokens.create(
+            {
+                "user_id": user.id,
+                "token": hash_opaque_token(token),
+                "expires_at": datetime.now(timezone.utc) + timedelta(hours=24),
+            }
+        )
+        try:
+            await self.email.send_email_verification(
+                user.email,
+                f"{settings.frontend_url.rstrip('/')}/verify-email?token={token}",
+            )
+        except Exception as exc:
+            logger.warning("Verification email could not be sent", error=str(exc))
+
+    async def verify_email(self, token: str, request_meta: Dict) -> None:
+        token_row = await self.email_tokens.get_valid(token)
+        if not token_row:
+            raise ValidationException("Invalid or expired verification token")
+        user = await self.repo.get_by_id(token_row.user_id)
+        if not user:
+            raise NotFoundException("User not found")
+        user.is_verified = True
+        token_row.used_at = datetime.now(timezone.utc)
+        self.session.add_all([user, token_row])
+        await self.audit.log(
+            action="user.email_verified",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def request_password_reset(self, data: PasswordResetRequest) -> None:
+        user = await self.repo.get_by_email(data.email)
+        if not user:
+            return
+        token = generate_secure_token()
+        await self.password_tokens.create(
+            {
+                "user_id": user.id,
+                "token": hash_opaque_token(token),
+                "expires_at": datetime.now(timezone.utc)
+                + timedelta(minutes=settings.password_reset_token_expire_minutes),
+            }
+        )
+        try:
+            await self.email.send_password_reset_email(
+                user.email,
+                f"{settings.frontend_url.rstrip('/')}/reset-password?token={token}",
+            )
+        except Exception as exc:
+            logger.warning("Password reset email could not be sent", error=str(exc))
+
+    async def confirm_password_reset(
+        self, data: PasswordResetConfirmRequest, request_meta: Dict
+    ) -> None:
+        token_row = await self.password_tokens.get_valid(data.token)
+        if not token_row:
+            raise ValidationException("Invalid or expired reset token")
+        user = await self.repo.get_by_id(token_row.user_id)
+        if not user:
+            raise NotFoundException("User not found")
+        user.hashed_password = hash_password(data.new_password)
+        token_row.used_at = datetime.now(timezone.utc)
+        self.session.add_all([user, token_row])
+        await self.audit.log(
+            action="user.password_reset",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def change_password(
+        self, user_id: str, data: ChangePasswordRequest, request_meta: Dict
+    ) -> None:
+        user = await self.repo.get_by_id(UUID(str(user_id)))
+        if not user or not verify_password(data.current_password, user.hashed_password):
+            raise UnauthorizedException("Current password is incorrect")
+        user.hashed_password = hash_password(data.new_password)
+        self.session.add(user)
+        await self.audit.log(
+            action="user.password_changed",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def list_sessions(self, user_id: str) -> list[SessionResponse]:
+        sessions = await self.sessions.list_active_for_user(user_id)
+        return [
+            SessionResponse(
+                id=str(item.id),
+                user_agent=item.user_agent,
+                ip_address=item.ip_address,
+                created_at=item.created_at.isoformat(),
+                last_used_at=(
+                    item.last_used_at.isoformat() if item.last_used_at else None
+                ),
+                expires_at=item.expires_at.isoformat(),
+            )
+            for item in sessions
+        ]
+
+    async def revoke_session(
+        self, user_id: str, session_id: str, request_meta: Dict
+    ) -> None:
+        session = await self.sessions.get_by_id(UUID(str(session_id)))
+        if not session or str(session.user_id) != str(user_id):
+            raise NotFoundException("Session not found")
+        await self.sessions.revoke_session(session)
+        await self.revoked_tokens.revoke(
+            session.refresh_jti, "refresh", session.expires_at
+        )
+        await self.audit.log(
+            action="user.session_revoked",
+            resource="user_sessions",
+            resource_id=str(session.id),
+            user_id=user_id,
+            **request_meta,
+        )
+
+    async def _revoke_payload(self, payload: Dict) -> None:
+        jti = payload.get("jti")
+        expires_at = self._payload_expires_at(payload)
+        token_type = payload.get("type")
+        if not jti or not expires_at or not token_type:
+            raise UnauthorizedException("Invalid token payload")
+        await self.revoked_tokens.revoke(jti, token_type, expires_at)
+
+    def _payload_expires_at(self, payload: Dict) -> datetime | None:
+        exp = payload.get("exp")
+        if isinstance(exp, (int, float)):
+            return datetime.fromtimestamp(exp, tz=timezone.utc)
+        if isinstance(exp, datetime):
+            return exp
+        return None
+
+    def _user_response(self, user) -> UserResponse:
+        return UserResponse(
+            id=str(user.id),
+            email=user.email,
+            username=user.username,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            is_superuser=user.is_superuser,
+            is_verified=user.is_verified,
+            last_login_at=(
+                user.last_login_at.isoformat() if user.last_login_at else None
+            ),
+        )

fastapi_forge/templates/without_rbac/app/api/v1/health/__init__.py

@@ -0,0 +1,3 @@
+from app.api.v1.health.router import router
+
+__all__ = ["router"]

fastapi_forge/templates/without_rbac/app/api/v1/health/router.py

@@ -0,0 +1,23 @@
+from fastapi import APIRouter, Response, status
+
+from app.api.v1.health.service import HealthService
+
+router = APIRouter()
+
+
+@router.get("/health")
+async def health_check():
+    return await HealthService().status()
+
+
+@router.get("/health/live")
+async def liveness_check():
+    return HealthService().liveness()
+
+
+@router.get("/health/ready")
+async def readiness_check(response: Response):
+    result = await HealthService().readiness()
+    if result["status"] != "healthy":
+        response.status_code = status.HTTP_503_SERVICE_UNAVAILABLE
+    return result

fastapi_forge/templates/without_rbac/app/api/v1/health/schema.py

@@ -0,0 +1,5 @@
+from app.utils.casing import CamelModel
+
+
+class HealthResponse(CamelModel):
+    status: str

fastapi_forge/templates/without_rbac/app/api/v1/health/service.py

@@ -0,0 +1,25 @@
+from app.core.config import settings
+from app.db.session import check_db_health
+
+
+class HealthService:
+    @staticmethod
+    def liveness() -> dict:
+        return {"status": "healthy"}
+
+    async def readiness(self) -> dict:
+        database = await check_db_health()
+        return {
+            "status": "healthy" if database["status"] == "healthy" else "unhealthy",
+            "database": database,
+        }
+
+    async def status(self) -> dict:
+        database = await check_db_health()
+        return {
+            "status": "healthy" if database["status"] == "healthy" else "degraded",
+            "app": settings.APP_NAME,
+            "version": settings.APP_VERSION,
+            "environment": settings.APP_ENV,
+            "database": database,
+        }

fastapi_forge/templates/without_rbac/app/api/v1/schema.py

@@ -0,0 +1,7 @@
+from pydantic import Field
+
+from app.utils.casing import CamelModel
+
+
+class DeleteNoteRequest(CamelModel):
+    note: str = Field(..., min_length=3, max_length=1000)

fastapi_forge/templates/without_rbac/app/api/v1/users/__init__.py

@@ -0,0 +1 @@
+

fastapi_forge/templates/without_rbac/app/api/v1/users/repository.py

@@ -0,0 +1,69 @@
+from uuid import UUID
+
+from sqlalchemy import and_, func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.db.models import User
+from app.helper.pagination_helper import apply_pagination
+from app.helper.search import text_search_filter
+from app.helper.sorting import sort_expressions
+from app.repositories.base import BaseRepository
+
+
+class UserRepository(BaseRepository[User]):
+    def __init__(self, session: AsyncSession):
+        super().__init__(User, session)
+
+    async def get_active(self, user_id: UUID):
+        result = await self.session.execute(
+            select(User).where(
+                User.id == user_id,
+                User.is_deleted == False,
+                User.is_active == True,
+            )
+        )
+        return result.scalar_one_or_none()
+
+    async def get_all(
+        self,
+        page: int,
+        page_size: int,
+        pagination: bool = True,
+        search: str | None = None,
+        sort_by: str | None = None,
+        sort_order: str | None = None,
+    ):
+        query = select(User).where(
+            User.is_deleted == False, User.is_active == True
+        )
+        search_filter = text_search_filter(
+            User, search, [User.email, User.username, User.full_name]
+        )
+        if search_filter is not None:
+            query = query.where(search_filter)
+        total = (
+            await self.session.execute(
+                select(func.count()).select_from(query.subquery())
+            )
+        ).scalar_one()
+        query = query.order_by(
+            *sort_expressions(User, sort_by, sort_order, (User.created_at.desc(),))
+        )
+        result = await self.session.execute(
+            apply_pagination(query, page, page_size, pagination)
+        )
+        return list(result.scalars().all()), total
+
+    async def exists_for_other_user(
+        self, field: str, value: str, user_id: UUID
+    ) -> bool:
+        result = await self.session.execute(
+            select(User).where(
+                and_(
+                    getattr(User, field) == value,
+                    User.id != user_id,
+                    User.is_deleted == False,
+                )
+            )
+        )
+        return result.scalar_one_or_none() is not None

fastapi_forge/templates/without_rbac/app/api/v1/users/router.py

@@ -0,0 +1,94 @@
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.schema import DeleteNoteRequest
+from app.api.v1.users.schema import UserCreate, UserUpdate
+from app.api.v1.users.service import UserService
+from app.core.dependencies import get_async_db, require_superuser
+from app.core.responses import paginated_response, success_response
+from app.helper.pagination_helper import PaginationParams
+
+router = APIRouter(dependencies=[Depends(require_superuser)])
+
+
+@router.get("")
+async def list_users(
+    pagination: PaginationParams = Depends(),
+    db: AsyncSession = Depends(get_async_db),
+):
+    data, total = await UserService(db).list_users(
+        pagination.page,
+        pagination.page_size,
+        pagination.pagination,
+        search=pagination.search,
+        sort_by=pagination.sort_by,
+        sort_order=pagination.sort_order,
+    )
+    items = [item.model_dump() for item in data]
+    if not pagination.pagination:
+        return success_response(data=items)
+    return paginated_response(items, total, pagination.page, pagination.page_size)
+
+
+@router.get("/deleted")
+async def list_deleted_users(
+    pagination: PaginationParams = Depends(),
+    db: AsyncSession = Depends(get_async_db),
+):
+    data, total = await UserService(db).list_deleted_users(
+        pagination.page,
+        pagination.page_size,
+        pagination.pagination,
+        search=pagination.search,
+        sort_by=pagination.sort_by,
+        sort_order=pagination.sort_order,
+    )
+    items = [item.model_dump() for item in data]
+    if not pagination.pagination:
+        return success_response(data=items)
+    return paginated_response(items, total, pagination.page, pagination.page_size)
+
+
+@router.post("", status_code=status.HTTP_201_CREATED)
+async def create_user(
+    body: UserCreate, db: AsyncSession = Depends(get_async_db)
+):
+    user = await UserService(db).create_user(body)
+    return success_response(data=user.model_dump(), message="User created")
+
+
+@router.get("/{user_id}")
+async def get_user(user_id: UUID, db: AsyncSession = Depends(get_async_db)):
+    user = await UserService(db).get_user(user_id)
+    return success_response(data=user.model_dump())
+
+
+@router.patch("/{user_id}")
+async def update_user(
+    user_id: UUID, body: UserUpdate, db: AsyncSession = Depends(get_async_db)
+):
+    user = await UserService(db).update_user(user_id, body)
+    return success_response(data=user.model_dump(), message="User updated")
+
+
+@router.delete("/{user_id}")
+async def soft_delete_user(
+    user_id: UUID,
+    body: DeleteNoteRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await UserService(db).soft_delete_user(user_id, body.note)
+    return success_response(message="User soft deleted")
+
+
+@router.delete("/{user_id}/hard")
+async def hard_delete_user(
+    user_id: UUID,
+    body: DeleteNoteRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await UserService(db).hard_delete_user(user_id, body.note)
+    return success_response(message="User hard deleted")
+

fastapi_forge/templates/without_rbac/app/api/v1/users/schema.py

@@ -0,0 +1,50 @@
+import re
+from typing import Optional
+
+from pydantic import EmailStr, Field, field_validator
+
+from app.utils.casing import CamelModel
+
+
+class UserBase(CamelModel):
+    email: EmailStr
+    username: str = Field(..., min_length=3, max_length=50)
+    full_name: str = Field(..., min_length=1, max_length=255)
+    is_active: bool = True
+    is_superuser: bool = False
+    is_verified: bool = False
+
+    @field_validator("username")
+    @classmethod
+    def validate_username(cls, value: str) -> str:
+        if not re.match(r"^[a-zA-Z0-9_]+$", value):
+            raise ValueError("Username may only contain letters, digits, and underscores")
+        return value.lower()
+
+
+class UserCreate(UserBase):
+    password: str = Field(..., min_length=8, max_length=128)
+
+
+class UserUpdate(CamelModel):
+    email: Optional[EmailStr] = None
+    username: Optional[str] = Field(default=None, min_length=3, max_length=50)
+    full_name: Optional[str] = Field(default=None, min_length=1, max_length=255)
+    is_active: Optional[bool] = None
+    is_superuser: Optional[bool] = None
+    is_verified: Optional[bool] = None
+
+
+class UserResponse(CamelModel):
+    id: str
+    email: str
+    username: str
+    full_name: str
+    is_active: bool
+    is_superuser: bool
+    is_verified: bool
+    last_login_at: Optional[str] = None
+    is_deleted: bool = False
+    deleted_at: Optional[str] = None
+    deletion_note: Optional[str] = None
+