fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/without_rbac/app/core/middleware.py

@@ -0,0 +1,188 @@
+import re
+import time
+import uuid
+from typing import Callable
+
+from fastapi import FastAPI, Request, Response
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.middleware.trustedhost import TrustedHostMiddleware
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+from starlette.middleware.base import BaseHTTPMiddleware
+
+from app.core.config import settings
+from app.core.logging import get_logger, set_request_id
+
+logger = get_logger(__name__)
+
+# ── Rate limiter (slowapi + Redis) ───────────────────────────────
+is_redis_store = settings.use_redis and bool(settings.redis_url)
+limiter = Limiter(
+    key_func=get_remote_address,
+    storage_uri=settings.redis_url if is_redis_store else None,
+    default_limits=[f"{settings.rate_limit_per_minute}/minute"],
+)
+
+
+# ── Request-ID / Correlation-ID middleware ───────────────────────
+class RequestIDMiddleware(BaseHTTPMiddleware):
+    """
+    Attaches a unique X-Request-ID to every request.
+    Respects an existing header if the upstream proxy already set one.
+    """
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        supplied_id = request.headers.get("X-Request-ID") or request.headers.get(
+            "X-Correlation-ID"
+        )
+        request_id = (
+            supplied_id
+            if supplied_id and re.fullmatch(r"[A-Za-z0-9._:-]{1,128}", supplied_id)
+            else str(uuid.uuid4())
+        )
+        request.state.request_id = request_id
+        set_request_id(request_id)
+
+        response = await call_next(request)
+        response.headers["X-Request-ID"] = request_id
+        return response
+
+
+# ── Structured request / response logging middleware ─────────────
+class RequestLoggingMiddleware(BaseHTTPMiddleware):
+    """
+    Logs every HTTP request and response with timing, status, and IDs.
+    Skips health-check and metrics endpoints to avoid log noise.
+    """
+
+    SKIP_PATHS = {"/health", "/metrics", "/favicon.ico"}
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        if request.url.path in self.SKIP_PATHS:
+            return await call_next(request)
+
+        start = time.perf_counter()
+        request_id = getattr(request.state, "request_id", "")
+
+        # ── Log incoming request ──────────────────────────────
+        logger.info(
+            "Incoming request",
+            method=request.method,
+            path=request.url.path,
+            client_ip=request.client.host if request.client else "unknown",
+            user_agent=request.headers.get("user-agent", ""),
+            request_id=request_id,
+        )
+
+        response: Response = await call_next(request)
+
+        elapsed_ms = round((time.perf_counter() - start) * 1000, 2)
+
+        # ── Log outgoing response ─────────────────────────────
+        log_fn = logger.error if response.status_code >= 400 else logger.info
+        log_fn(
+            "Request completed",
+            method=request.method,
+            path=request.url.path,
+            status_code=response.status_code,
+            duration_ms=elapsed_ms,
+            request_id=request_id,
+        )
+
+        response.headers["X-Process-Time-Ms"] = str(elapsed_ms)
+        return response
+
+
+# ── Security headers middleware ──────────────────────────────────
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        if settings.is_production:
+            response.headers["Strict-Transport-Security"] = (
+                "max-age=31536000; includeSubDomains"
+            )
+        return response
+
+
+class AuditMiddleware(BaseHTTPMiddleware):
+    """Persist an audit entry for every successful state-changing API request."""
+
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        response = await call_next(request)
+        if (
+            request.method not in {"POST", "PUT", "PATCH", "DELETE"}
+            or not request.url.path.startswith("/api/")
+            or response.status_code >= 400
+        ):
+            return response
+
+        user_id = None
+        authorization = request.headers.get("authorization", "")
+        if authorization.lower().startswith("bearer "):
+            try:
+                from app.core.security import decode_token
+
+                user_id = decode_token(
+                    authorization.split(" ", 1)[1], expected_type="access"
+                ).get("sub")
+            except Exception:
+                user_id = None
+
+        try:
+            from app.db.session import AsyncSessionLocal
+            from app.services.audit import AuditService
+
+            async with AsyncSessionLocal() as session:
+                await AuditService(session).log(
+                    action=request.method.lower(),
+                    resource=request.url.path,
+                    user_id=user_id,
+                    metadata={"status_code": response.status_code},
+                    ip_address=request.client.host if request.client else None,
+                    user_agent=request.headers.get("user-agent"),
+                    request_id=getattr(request.state, "request_id", None),
+                )
+                await session.commit()
+        except Exception as exc:
+            logger.error("Request audit logging failed", error=str(exc))
+
+        return response
+
+
+# ── Registration helper ──────────────────────────────────────────
+def register_middleware(app: FastAPI) -> None:
+    # Order matters: outermost middleware runs first on request, last on response.
+
+    # CORS (must be early so preflight OPTIONS pass)
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=settings.ALLOWED_ORIGINS,
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+        expose_headers=["X-Request-ID", "X-Process-Time-Ms"],
+    )
+
+    # Trusted hosts
+    if settings.is_production:
+        app.add_middleware(
+            TrustedHostMiddleware,
+            allowed_hosts=settings.ALLOWED_HOSTS,
+        )
+
+    # Security headers
+    app.add_middleware(SecurityHeadersMiddleware)
+
+    # Record successful state-changing API requests.
+    app.add_middleware(AuditMiddleware)
+
+    # Starlette runs the last added middleware first on incoming requests.
+    # Logging is added before Request-ID so it runs after the ID is set.
+    app.add_middleware(RequestLoggingMiddleware)
+
+    # Request-ID runs before logging so the logger can read the ID.
+    app.add_middleware(RequestIDMiddleware)

fastapi_forge/templates/without_rbac/app/core/responses.py

@@ -0,0 +1,108 @@
+from typing import Any, Dict, Generic, List, Optional, TypeVar
+from datetime import datetime, timezone
+
+from app.core.logging import get_request_id
+from app.utils.casing import CamelModel, keys_to_camel
+
+T = TypeVar("T")
+
+
+# ── Pagination metadata ──────────────────────────────────────────
+class PaginationMeta(CamelModel):
+    page: int
+    page_size: int
+    total_items: int
+    total_pages: int
+    has_next: bool
+    has_prev: bool
+
+
+# ── Standard envelope models ─────────────────────────────────────
+class APIResponse(CamelModel, Generic[T]):
+    success: bool
+    message: str
+    data: Optional[T] = None
+    meta: Optional[Dict[str, Any]] = None
+    error_code: Optional[str] = None
+    details: Any = None
+    timestamp: str = ""
+    request_id: Optional[str] = None
+
+
+class PaginatedResponse(CamelModel, Generic[T]):
+    success: bool
+    message: str
+    data: List[T]
+    pagination: PaginationMeta
+    meta: Optional[Dict[str, Any]] = None
+    timestamp: str = ""
+    request_id: Optional[str] = None
+
+
+# ── Builder helpers ──────────────────────────────────────────────
+def _now() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _request_id_or_current(request_id: Optional[str]) -> str:
+    return request_id or get_request_id()
+
+
+def success_response(
+    data: Any = None,
+    message: str = "Success",
+    meta: Optional[Dict[str, Any]] = None,
+    request_id: Optional[str] = None,
+) -> APIResponse:
+    return APIResponse(
+        success=True,
+        message=message,
+        data=keys_to_camel(data),
+        meta=keys_to_camel(meta),
+        timestamp=_now(),
+        request_id=_request_id_or_current(request_id),
+    )
+
+
+def error_response(
+    message: str = "An error occurred",
+    error_code: str = "ERROR",
+    details: Any = None,
+    request_id: Optional[str] = None,
+) -> APIResponse:
+    return APIResponse(
+        success=False,
+        message=message,
+        error_code=error_code,
+        details=keys_to_camel(details),
+        timestamp=_now(),
+        request_id=_request_id_or_current(request_id),
+    )
+
+
+def paginated_response(
+    data: List[Any],
+    total_items: int,
+    page: int,
+    page_size: int,
+    message: str = "Success",
+    meta: Optional[Dict[str, Any]] = None,
+    request_id: Optional[str] = None,
+) -> PaginatedResponse:
+    total_pages = (total_items + page_size - 1) // page_size if page_size > 0 else 0
+    return PaginatedResponse(
+        success=True,
+        message=message,
+        data=keys_to_camel(data),
+        pagination=PaginationMeta(
+            page=page,
+            page_size=page_size,
+            total_items=total_items,
+            total_pages=total_pages,
+            has_next=page < total_pages,
+            has_prev=page > 1,
+        ),
+        meta=keys_to_camel(meta),
+        timestamp=_now(),
+        request_id=_request_id_or_current(request_id),
+    )

fastapi_forge/templates/without_rbac/app/core/security.py

@@ -0,0 +1,115 @@
+import hashlib
+import hmac
+import secrets
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, Optional, Tuple
+
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+
+from app.core.config import settings
+from app.core.exceptions import UnauthorizedException
+
+# ── Password hashing (bcrypt, cost=12) ──────────────────────────
+pwd_context = CryptContext(
+    schemes=["bcrypt"],
+    deprecated="auto",
+    bcrypt__rounds=12,  # work factor — increase for more security
+)
+
+
+def hash_password(plain: str) -> str:
+    """Hash a plain-text password using bcrypt."""
+    return pwd_context.hash(plain)
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    """Verify a plain-text password against its bcrypt hash."""
+    return pwd_context.verify(plain, hashed)
+
+
+# ── JWT helpers ──────────────────────────────────────────────────
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def create_access_token(
+    subject: Any,
+    extra_claims: Optional[Dict] = None,
+) -> Tuple[str, datetime]:
+    expire = _utcnow() + timedelta(minutes=settings.access_token_expire_minutes)
+    payload = {
+        "sub": str(subject),
+        "exp": expire,
+        "iat": _utcnow(),
+        "jti": str(uuid.uuid4()),
+        "type": "access",
+        **(extra_claims or {}),
+    }
+    token = jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+    return token, expire
+
+
+def create_refresh_token(subject: Any) -> Tuple[str, datetime]:
+    expire = _utcnow() + timedelta(days=settings.refresh_token_expire_days)
+    payload = {
+        "sub": str(subject),
+        "exp": expire,
+        "iat": _utcnow(),
+        "jti": str(uuid.uuid4()),
+        "type": "refresh",
+    }
+    token = jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+    return token, expire
+
+
+def create_password_reset_token(email: str) -> str:
+    expire = _utcnow() + timedelta(minutes=settings.password_reset_token_expire_minutes)
+    payload = {"sub": email, "exp": expire, "type": "password_reset"}
+    return jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+
+
+def decode_token(token: str, expected_type: str = "access") -> Dict:
+    """
+    Decode and validate a JWT. Raises UnauthorizedException on failure.
+    """
+    try:
+        payload = jwt.decode(
+            token, settings.SECRET_KEY, algorithms=[settings.algorithm]
+        )
+    except JWTError as exc:
+        raise UnauthorizedException(f"Invalid or expired token: {exc}") from exc
+
+    if payload.get("type") != expected_type:
+        raise UnauthorizedException(f"Expected token type '{expected_type}'")
+
+    return payload
+
+
+# ── Webhook signature verification ──────────────────────────────
+def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
+    """
+    Verify an HMAC-SHA256 webhook signature.
+    Expected header format: 'sha256=<hex_digest>'
+    """
+    expected = (
+        "sha256=" + hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
+    )
+    return hmac.compare_digest(expected, signature)
+
+
+# ── Secure random helpers ────────────────────────────────────────
+def generate_secure_token(nbytes: int = 32) -> str:
+    """Generate a URL-safe random token (for email verification, API keys, etc.)."""
+    return secrets.token_urlsafe(nbytes)
+
+
+def hash_opaque_token(token: str) -> str:
+    """Return a one-way digest suitable for storing an opaque token."""
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def generate_api_key() -> str:
+    """Generate a prefixed API key."""
+    return f"sk_{secrets.token_urlsafe(40)}"

fastapi_forge/templates/without_rbac/app/db/__init__.py

@@ -0,0 +1 @@
+"""Database package."""

fastapi_forge/templates/without_rbac/app/db/base.py

@@ -0,0 +1,5 @@
+from sqlalchemy.orm import DeclarativeBase
+
+
+class Base(DeclarativeBase):
+    pass

fastapi_forge/templates/without_rbac/app/db/models/__init__.py

@@ -0,0 +1,10 @@
+from app.db.models.user import User
+from app.db.models.audit_log import AuditLog
+from app.db.models.auth_token import (
+    EmailVerificationToken,
+    PasswordResetToken,
+    UserSession,
+)
+from app.db.models.notification import Notification
+from app.db.models.revoked_token import RevokedToken
+

fastapi_forge/templates/without_rbac/app/db/models/audit_log.py

@@ -0,0 +1,58 @@
+from datetime import datetime
+import uuid
+
+from sqlalchemy import DateTime, ForeignKey, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.names import APP_SCHEMA
+
+
+class AuditLog(Base):
+    __tablename__ = "audit_logs"
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    # ── Who ───────────────────────────────────────────────────
+    user_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
+    user_email: Mapped[str | None] = mapped_column(String(255), nullable=True)
+
+    # ── What ──────────────────────────────────────────────────
+    action: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    resource: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    resource_id: Mapped[str | None] = mapped_column(
+        String(255), nullable=True, index=True
+    )
+
+    # ── Payload ───────────────────────────────────────────────
+    old_values: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+    new_values: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+    log_metadata: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+
+    # ── Context ───────────────────────────────────────────────
+    ip_address: Mapped[str | None] = mapped_column(String(45), nullable=True)
+    user_agent: Mapped[str | None] = mapped_column(Text, nullable=True)
+    request_id: Mapped[str | None] = mapped_column(String(100), nullable=True)
+
+    # ── Relationship ──────────────────────────────────────────
+    user: Mapped["User"] = relationship("User", back_populates="audit_logs")
+
+    __table_args__ = (
+        Index("ix_audit_resource_action", "resource", "action"),
+        Index("ix_audit_user_resource", "user_id", "resource"),
+        {"schema": APP_SCHEMA},
+    )
+
+    def __repr__(self) -> str:
+        return f"<AuditLog action={self.action} resource={self.resource} id={self.resource_id}>"

fastapi_forge/templates/without_rbac/app/db/models/auth_token.py

@@ -0,0 +1,72 @@
+from datetime import datetime
+import uuid
+
+from sqlalchemy import DateTime, ForeignKey, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class EmailVerificationToken(Base):
+    __tablename__ = "email_verification_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    token: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+
+class PasswordResetToken(Base):
+    __tablename__ = "password_reset_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    token: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+
+class UserSession(Base):
+    __tablename__ = "user_sessions"
+    __table_args__ = (
+        Index("ix_user_sessions_user_active", "user_id", "revoked_at"),
+        {"schema": AUTH_SCHEMA},
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    refresh_jti: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
+    previous_refresh_jti: Mapped[str | None] = mapped_column(String(64), index=True)
+    user_agent: Mapped[str | None] = mapped_column(Text)
+    ip_address: Mapped[str | None] = mapped_column(String(45))
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    last_used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    user = relationship("User", back_populates="sessions")

fastapi_forge/templates/without_rbac/app/db/models/notification.py

@@ -0,0 +1,49 @@
+import uuid
+from datetime import datetime, timezone
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, String, Text
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import APP_SCHEMA
+
+
+class Notification(BaseModelMixin, Base):
+    __tablename__ = "notifications"
+    __table_args__ = {"schema": APP_SCHEMA}
+
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    title: Mapped[str] = mapped_column(String(255), nullable=False)
+    body: Mapped[str] = mapped_column(Text, nullable=False)
+    notification_type: Mapped[str] = mapped_column(
+        String(100), nullable=False, index=True
+    )  # e.g. "info", "warning", "success", "error", "system"
+
+    # Channel: "in_app" | "email" | "push" | "webhook"
+    channel: Mapped[str] = mapped_column(String(50), default="in_app", nullable=False)
+
+    is_read: Mapped[bool] = mapped_column(
+        Boolean, default=False, nullable=False, index=True
+    )
+    read_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+
+    # Arbitrary extra payload (deep link, action URL, entity ref, etc.)
+    payload: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+
+    user: Mapped["User"] = relationship("User", back_populates="notifications")
+
+    def mark_read(self) -> None:
+        self.is_read = True
+        self.read_at = datetime.now(timezone.utc)
+
+    def __repr__(self) -> str:
+        return f"<Notification user={self.user_id} type={self.notification_type} read={self.is_read}>"

fastapi_forge/templates/without_rbac/app/db/models/revoked_token.py

@@ -0,0 +1,21 @@
+from datetime import datetime
+
+from sqlalchemy import DateTime, String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class RevokedToken(BaseModelMixin, Base):
+    __tablename__ = "revoked_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    jti: Mapped[str] = mapped_column(
+        String(64), unique=True, nullable=False, index=True
+    )
+    token_type: Mapped[str] = mapped_column(String(20), nullable=False, index=True)
+    expires_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )

fastapi_forge/templates/without_rbac/app/db/models/user.py

@@ -0,0 +1,33 @@
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, String
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class User(BaseModelMixin, Base):
+    __tablename__ = "users"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False, index=True)
+    username: Mapped[str] = mapped_column(String(100), unique=True, nullable=False, index=True)
+    full_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    hashed_password: Mapped[str] = mapped_column(String(255), nullable=False)
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    is_superuser: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    is_verified: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    last_login_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+
+    notifications: Mapped[list["Notification"]] = relationship(
+        "Notification", back_populates="user", lazy="dynamic"
+    )
+    audit_logs: Mapped[list["AuditLog"]] = relationship(
+        "AuditLog", back_populates="user", lazy="dynamic"
+    )
+    sessions: Mapped[list["UserSession"]] = relationship(
+        "UserSession", back_populates="user", lazy="dynamic"
+    )
+

fastapi_forge/templates/without_rbac/app/db/schemas/__init__.py

@@ -0,0 +1,8 @@
+from app.db.schemas.common import BaseModelMixin, SoftDeleteMixin, TimestampMixin, UUIDMixin
+
+__all__ = [
+    "BaseModelMixin",
+    "SoftDeleteMixin",
+    "TimestampMixin",
+    "UUIDMixin",
+]