fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/with_rbac/app/api/v1/auth/router.py

@@ -0,0 +1,209 @@
+from typing import Optional
+
+from fastapi import APIRouter, Depends, Request, Response
+from fastapi.security import HTTPAuthorizationCredentials
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.auth.repository import UserRepository
+from app.api.v1.auth.schema import (
+    ChangePasswordRequest,
+    LoginRequest,
+    PasswordResetConfirmRequest,
+    PasswordResetRequest,
+    ResendVerificationRequest,
+    UserResponse,
+)
+from app.api.v1.auth.service import AuthService
+from app.core.config import settings
+from app.core.dependencies import bearer_scheme, get_async_db, get_current_user_id
+from app.core.exceptions import UnauthorizedException
+from app.core.middleware import limiter
+from app.core.responses import success_response
+
+router = APIRouter()
+
+REFRESH_TOKEN_COOKIE_NAME = "refresh_token"
+REFRESH_TOKEN_COOKIE_PATH = "/api/v1/auth"
+
+
+def _set_refresh_token_cookie(response: Response, refresh_token: str) -> None:
+    response.set_cookie(
+        key=REFRESH_TOKEN_COOKIE_NAME,
+        value=refresh_token,
+        max_age=settings.refresh_token_expire_days * 24 * 60 * 60,
+        httponly=True,
+        secure=settings.is_production,
+        samesite="lax",
+        path=REFRESH_TOKEN_COOKIE_PATH,
+    )
+
+
+def _clear_refresh_token_cookie(response: Response) -> None:
+    response.delete_cookie(
+        key=REFRESH_TOKEN_COOKIE_NAME,
+        path=REFRESH_TOKEN_COOKIE_PATH,
+        httponly=True,
+        secure=settings.is_production,
+        samesite="lax",
+    )
+
+
+def _refresh_token_from_cookie(request: Request) -> str:
+    refresh_token = request.cookies.get(REFRESH_TOKEN_COOKIE_NAME)
+    if not refresh_token:
+        raise UnauthorizedException("Refresh token missing")
+    return refresh_token
+
+
+def _request_meta(request: Request) -> dict:
+    return {
+        "ip_address": request.client.host if request.client else None,
+        "user_agent": request.headers.get("user-agent"),
+        "request_id": getattr(request.state, "request_id", None),
+    }
+
+
+@router.post("/login", summary="Obtain access and refresh tokens")
+@limiter.limit("10/minute")
+async def login(
+    request: Request,
+    response: Response,
+    payload: LoginRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    tokens = await AuthService(db).login(payload, _request_meta(request))
+    _set_refresh_token_cookie(response, tokens.refresh_token)
+    return success_response(data=tokens.model_dump(), message="Login successful")
+
+
+@router.post("/refresh", summary="Refresh access token")
+async def refresh_token(
+    request: Request,
+    response: Response,
+    db: AsyncSession = Depends(get_async_db),
+):
+    tokens = await AuthService(db).refresh(
+        _refresh_token_from_cookie(request), _request_meta(request)
+    )
+    _set_refresh_token_cookie(response, tokens["refresh_token"])
+    return success_response(
+        data={key: value for key, value in tokens.items() if key != "refresh_token"},
+        message="Token refreshed",
+    )
+
+
+@router.post("/logout", summary="Logout and revoke tokens")
+async def logout(
+    request: Request,
+    response: Response,
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).logout(
+        access_token=credentials.credentials if credentials else None,
+        refresh_token=_refresh_token_from_cookie(request),
+        request_meta=_request_meta(request),
+    )
+    _clear_refresh_token_cookie(response)
+    return success_response(message="Logout successful")
+
+
+@router.post("/verify-email/resend", summary="Send an email verification link")
+@limiter.limit("3/minute")
+async def resend_verification(
+    request: Request,
+    payload: ResendVerificationRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).send_verification_email(payload.email)
+    return success_response(message="If the account exists, a link was sent")
+
+
+@router.get("/verify-email", summary="Verify an email address")
+async def verify_email(
+    request: Request,
+    token: str,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).verify_email(token, _request_meta(request))
+    return success_response(message="Email verified")
+
+
+@router.post("/password-reset", summary="Request a password reset link")
+@limiter.limit("5/minute")
+async def request_password_reset(
+    request: Request,
+    payload: PasswordResetRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).request_password_reset(payload)
+    return success_response(message="If the account exists, a link was sent")
+
+
+@router.post("/password-reset/confirm", summary="Reset password with a token")
+@limiter.limit("5/minute")
+async def confirm_password_reset(
+    request: Request,
+    payload: PasswordResetConfirmRequest,
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).confirm_password_reset(payload, _request_meta(request))
+    return success_response(message="Password reset successful")
+
+
+@router.post("/change-password", summary="Change current user's password")
+async def change_password(
+    request: Request,
+    payload: ChangePasswordRequest,
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).change_password(user_id, payload, _request_meta(request))
+    return success_response(message="Password changed")
+
+
+@router.get("/sessions", summary="List current user's active sessions")
+async def list_sessions(
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    sessions = await AuthService(db).list_sessions(user_id)
+    return success_response(data=[item.model_dump() for item in sessions])
+
+
+@router.delete("/sessions/{session_id}", summary="Revoke one active session")
+async def revoke_session(
+    session_id: str,
+    request: Request,
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    await AuthService(db).revoke_session(
+        user_id, session_id, _request_meta(request)
+    )
+    return success_response(message="Session revoked")
+
+
+@router.get("/me", summary="Get current authenticated user")
+async def me(
+    user_id: str = Depends(get_current_user_id),
+    db: AsyncSession = Depends(get_async_db),
+):
+    repo = UserRepository(db)
+    user = await repo.get_with_permissions(user_id)
+    if not user or not user.is_active:
+        raise UnauthorizedException("User not found or deactivated")
+
+    response = UserResponse(
+        id=str(user.id),
+        email=user.email,
+        username=user.username,
+        full_name=user.full_name,
+        is_active=user.is_active,
+        is_superuser=user.is_superuser,
+        is_verified=user.is_verified,
+        last_login_at=user.last_login_at.isoformat() if user.last_login_at else None,
+        role=repo.collect_role_name(user),
+        permissions=repo.collect_permissions(user),
+    )
+    return success_response(data=response.model_dump())

fastapi_forge/templates/with_rbac/app/api/v1/auth/schema.py

@@ -0,0 +1,98 @@
+from typing import List, Optional
+from pydantic import EmailStr, Field, field_validator
+
+from app.utils.casing import CamelModel
+import re
+
+
+# ── Request schemas ──────────────────────────────────────────────
+class RegisterRequest(CamelModel):
+    email: EmailStr
+    username: str = Field(..., min_length=3, max_length=50)
+    full_name: str = Field(..., min_length=1, max_length=255)
+    password: str = Field(..., min_length=8, max_length=128)
+
+    @field_validator("password")
+    @classmethod
+    def validate_password_strength(cls, v: str) -> str:
+        errors = []
+        if not re.search(r"[A-Z]", v):
+            errors.append("at least one uppercase letter")
+        if not re.search(r"[a-z]", v):
+            errors.append("at least one lowercase letter")
+        if not re.search(r"\d", v):
+            errors.append("at least one digit")
+        if not re.search(r"[!@#$%^&*()_+\-=\[\]{};':\"\\|,.<>/?]", v):
+            errors.append("at least one special character")
+        if errors:
+            raise ValueError(f"Password must contain {', '.join(errors)}")
+        return v
+
+    @field_validator("username")
+    @classmethod
+    def validate_username(cls, v: str) -> str:
+        if not re.match(r"^[a-zA-Z0-9_]+$", v):
+            raise ValueError(
+                "Username may only contain letters, digits, and underscores"
+            )
+        return v.lower()
+
+
+class LoginRequest(CamelModel):
+    email: EmailStr
+    password: str
+
+
+class PasswordResetRequest(CamelModel):
+    email: EmailStr
+
+
+class PasswordResetConfirmRequest(CamelModel):
+    token: str
+    new_password: str = Field(..., min_length=8, max_length=128)
+
+
+class ChangePasswordRequest(CamelModel):
+    current_password: str
+    new_password: str = Field(..., min_length=8, max_length=128)
+
+
+class ResendVerificationRequest(CamelModel):
+    email: EmailStr
+
+
+# ── Response schemas ─────────────────────────────────────────────
+class UserResponse(CamelModel):
+    id: str
+    email: str
+    username: str
+    full_name: str
+    is_active: bool
+    is_superuser: bool
+    is_verified: bool
+    last_login_at: Optional[str] = None
+    role: Optional[str] = None
+    permissions: List[str] = Field(default_factory=list)
+
+class TokenResponse(CamelModel):
+    access_token: str
+    refresh_token: str = Field(exclude=True)
+    token_type: str = "bearer"
+    expires_in: int  # seconds
+    user: UserResponse
+
+
+class TokenRefreshResponse(CamelModel):
+    access_token: str
+    refresh_token: str = Field(exclude=True)
+    token_type: str = "bearer"
+    expires_in: int
+
+
+class SessionResponse(CamelModel):
+    id: str
+    user_agent: Optional[str] = None
+    ip_address: Optional[str] = None
+    created_at: str
+    last_used_at: Optional[str] = None
+    expires_at: str

fastapi_forge/templates/with_rbac/app/api/v1/auth/service.py

@@ -0,0 +1,383 @@
+from datetime import datetime, timedelta, timezone
+from typing import Dict, Optional
+from uuid import UUID
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.auth.repository import (
+    EmailVerificationTokenRepository,
+    PasswordResetTokenRepository,
+    RevokedTokenRepository,
+    UserRepository,
+    UserSessionRepository,
+)
+from app.api.v1.auth.schema import (
+    ChangePasswordRequest,
+    LoginRequest,
+    PasswordResetConfirmRequest,
+    PasswordResetRequest,
+    RegisterRequest,
+    SessionResponse,
+    TokenResponse,
+    UserResponse,
+)
+from app.core.config import settings
+from app.core.exceptions import (
+    ConflictException,
+    NotFoundException,
+    UnauthorizedException,
+    ValidationException,
+)
+from app.core.logging import get_logger
+from app.core.security import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    generate_secure_token,
+    hash_opaque_token,
+    hash_password,
+    verify_password,
+)
+from app.services.audit import AuditService
+from app.services.email import EmailService
+from app.services.notification import NotificationService
+
+logger = get_logger(__name__)
+
+
+class AuthService:
+    def __init__(self, session: AsyncSession):
+        self.session = session
+        self.repo = UserRepository(session)
+        self.revoked_tokens = RevokedTokenRepository(session)
+        self.email_tokens = EmailVerificationTokenRepository(session)
+        self.password_tokens = PasswordResetTokenRepository(session)
+        self.sessions = UserSessionRepository(session)
+        self.audit = AuditService(session)
+        self.notifications = NotificationService(session)
+        self.email = EmailService()
+
+    async def register(self, data: RegisterRequest, request_meta: Dict) -> UserResponse:
+        if await self.repo.exists("email", data.email.lower()):
+            raise ConflictException("An account with this email already exists")
+        if await self.repo.exists("username", data.username.lower()):
+            raise ConflictException("Username is already taken")
+
+        user = await self.repo.create(
+            {
+                "email": data.email.lower(),
+                "username": data.username.lower(),
+                "full_name": data.full_name,
+                "hashed_password": hash_password(data.password),
+            }
+        )
+        await self.audit.log(
+            action="user.registered",
+            resource="users",
+            resource_id=str(user.id),
+            new_values={"email": user.email, "username": user.username},
+            **request_meta,
+        )
+        await self.notifications.send(
+            user_id=user.id,
+            title="Welcome!",
+            body=f"Hi {user.full_name}, your account was created successfully.",
+            notification_type="system",
+        )
+        # Email verification is currently disabled.
+        # await self.send_verification_email(user.email)
+
+        logger.info("User registered", user_id=str(user.id), email=user.email)
+        return self._user_response(user, [])
+
+    async def login(self, data: LoginRequest, request_meta: Dict) -> TokenResponse:
+        user = await self.repo.get_by_email(data.email)
+        if not user or not verify_password(data.password, user.hashed_password):
+            raise UnauthorizedException("Invalid email or password")
+        if not user.is_active:
+            raise UnauthorizedException("Account is deactivated")
+
+        login_at = datetime.now(timezone.utc)
+        user.last_login_at = login_at
+        self.session.add(user)
+
+        permissions = self.repo.collect_permissions(user)
+        role = self.repo.collect_role_name(user)
+        access_token, _ = create_access_token(
+            str(user.id),
+            {
+                "permissions": permissions,
+                "role": role,
+                "is_superuser": user.is_superuser,
+            },
+        )
+        refresh_token, refresh_expire = create_refresh_token(str(user.id))
+        refresh_payload = decode_token(refresh_token, expected_type="refresh")
+        await self.sessions.create(
+            {
+                "user_id": user.id,
+                "refresh_jti": refresh_payload["jti"],
+                "user_agent": request_meta.get("user_agent"),
+                "ip_address": request_meta.get("ip_address"),
+                "expires_at": refresh_expire,
+                "last_used_at": login_at,
+            }
+        )
+
+        await self.audit.log(
+            action="user.login",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+        return TokenResponse(
+            access_token=access_token,
+            refresh_token=refresh_token,
+            expires_in=int(settings.access_token_expire_minutes * 60),
+            user=self._user_response(user, permissions),
+        )
+
+    async def refresh(
+        self, refresh_token: str, request_meta: Dict | None = None
+    ) -> Dict:
+        payload = decode_token(refresh_token, expected_type="refresh")
+        refresh_jti = payload.get("jti")
+        if not refresh_jti:
+            raise UnauthorizedException("Invalid token payload")
+        if await self.revoked_tokens.is_revoked(refresh_jti):
+            raise UnauthorizedException("Token has been revoked")
+
+        session = await self.sessions.get_active_by_refresh_jti(refresh_jti)
+        if not session:
+            replayed = await self.sessions.get_by_previous_refresh_jti(refresh_jti)
+            if replayed:
+                await self.sessions.revoke_session(replayed)
+            raise UnauthorizedException("Refresh session is invalid or expired")
+
+        user = await self.repo.get_with_permissions(payload.get("sub"))
+        if not user or not user.is_active:
+            raise UnauthorizedException("User not found or deactivated")
+
+        permissions = self.repo.collect_permissions(user)
+        role = self.repo.collect_role_name(user)
+        access_token, _ = create_access_token(
+            str(user.id),
+            {
+                "permissions": permissions,
+                "role": role,
+                "is_superuser": user.is_superuser,
+            },
+        )
+        new_refresh_token, refresh_expire = create_refresh_token(str(user.id))
+        new_refresh_payload = decode_token(new_refresh_token, expected_type="refresh")
+
+        await self._revoke_payload(payload)
+        session.previous_refresh_jti = refresh_jti
+        session.refresh_jti = new_refresh_payload["jti"]
+        session.expires_at = refresh_expire
+        session.last_used_at = datetime.now(timezone.utc)
+        if request_meta:
+            session.ip_address = request_meta.get("ip_address")
+            session.user_agent = request_meta.get("user_agent")
+        self.session.add(session)
+        await self.session.flush()
+
+        return {
+            "access_token": access_token,
+            "refresh_token": new_refresh_token,
+            "token_type": "bearer",
+            "expires_in": int(settings.access_token_expire_minutes * 60),
+        }
+
+    async def logout(
+        self,
+        access_token: Optional[str],
+        refresh_token: str,
+        request_meta: Dict,
+    ) -> None:
+        refresh_payload = decode_token(refresh_token, expected_type="refresh")
+        user_id = refresh_payload.get("sub")
+        if not user_id:
+            raise UnauthorizedException("Invalid token payload")
+
+        access_payload = None
+        if access_token:
+            try:
+                access_payload = decode_token(access_token, expected_type="access")
+            except UnauthorizedException:
+                access_payload = None
+
+        if access_payload:
+            if access_payload.get("sub") != user_id:
+                raise UnauthorizedException("Token subject mismatch")
+            await self._revoke_payload(access_payload)
+
+        await self._revoke_payload(refresh_payload)
+        session = await self.sessions.get_active_by_refresh_jti(refresh_payload["jti"])
+        if session:
+            await self.sessions.revoke_session(session)
+
+        await self.audit.log(
+            action="user.logout",
+            resource="users",
+            resource_id=str(user_id),
+            **request_meta,
+        )
+
+    async def send_verification_email(self, email: str) -> None:
+        user = await self.repo.get_by_email(email)
+        if not user:
+            return
+        token = generate_secure_token()
+        await self.email_tokens.create(
+            {
+                "user_id": user.id,
+                "token": hash_opaque_token(token),
+                "expires_at": datetime.now(timezone.utc) + timedelta(hours=24),
+            }
+        )
+        try:
+            await self.email.send_email_verification(
+                user.email,
+                f"{settings.frontend_url.rstrip('/')}/verify-email?token={token}",
+            )
+        except Exception as exc:
+            logger.warning("Verification email could not be sent", error=str(exc))
+
+    async def verify_email(self, token: str, request_meta: Dict) -> None:
+        token_row = await self.email_tokens.get_valid(token)
+        if not token_row:
+            raise ValidationException("Invalid or expired verification token")
+        user = await self.repo.get_by_id(token_row.user_id)
+        if not user:
+            raise NotFoundException("User not found")
+        user.is_verified = True
+        token_row.used_at = datetime.now(timezone.utc)
+        self.session.add_all([user, token_row])
+        await self.audit.log(
+            action="user.email_verified",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def request_password_reset(self, data: PasswordResetRequest) -> None:
+        user = await self.repo.get_by_email(data.email)
+        if not user:
+            return
+        token = generate_secure_token()
+        await self.password_tokens.create(
+            {
+                "user_id": user.id,
+                "token": hash_opaque_token(token),
+                "expires_at": datetime.now(timezone.utc)
+                + timedelta(minutes=settings.password_reset_token_expire_minutes),
+            }
+        )
+        try:
+            await self.email.send_password_reset_email(
+                user.email,
+                f"{settings.frontend_url.rstrip('/')}/reset-password?token={token}",
+            )
+        except Exception as exc:
+            logger.warning("Password reset email could not be sent", error=str(exc))
+
+    async def confirm_password_reset(
+        self, data: PasswordResetConfirmRequest, request_meta: Dict
+    ) -> None:
+        token_row = await self.password_tokens.get_valid(data.token)
+        if not token_row:
+            raise ValidationException("Invalid or expired reset token")
+        user = await self.repo.get_by_id(token_row.user_id)
+        if not user:
+            raise NotFoundException("User not found")
+        user.hashed_password = hash_password(data.new_password)
+        token_row.used_at = datetime.now(timezone.utc)
+        self.session.add_all([user, token_row])
+        await self.audit.log(
+            action="user.password_reset",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def change_password(
+        self, user_id: str, data: ChangePasswordRequest, request_meta: Dict
+    ) -> None:
+        user = await self.repo.get_by_id(UUID(str(user_id)))
+        if not user or not verify_password(data.current_password, user.hashed_password):
+            raise UnauthorizedException("Current password is incorrect")
+        user.hashed_password = hash_password(data.new_password)
+        self.session.add(user)
+        await self.audit.log(
+            action="user.password_changed",
+            resource="users",
+            resource_id=str(user.id),
+            **request_meta,
+        )
+
+    async def list_sessions(self, user_id: str) -> list[SessionResponse]:
+        sessions = await self.sessions.list_active_for_user(user_id)
+        return [
+            SessionResponse(
+                id=str(item.id),
+                user_agent=item.user_agent,
+                ip_address=item.ip_address,
+                created_at=item.created_at.isoformat(),
+                last_used_at=(
+                    item.last_used_at.isoformat() if item.last_used_at else None
+                ),
+                expires_at=item.expires_at.isoformat(),
+            )
+            for item in sessions
+        ]
+
+    async def revoke_session(
+        self, user_id: str, session_id: str, request_meta: Dict
+    ) -> None:
+        session = await self.sessions.get_by_id(UUID(str(session_id)))
+        if not session or str(session.user_id) != str(user_id):
+            raise NotFoundException("Session not found")
+        await self.sessions.revoke_session(session)
+        await self.revoked_tokens.revoke(
+            session.refresh_jti, "refresh", session.expires_at
+        )
+        await self.audit.log(
+            action="user.session_revoked",
+            resource="user_sessions",
+            resource_id=str(session.id),
+            user_id=user_id,
+            **request_meta,
+        )
+
+    async def _revoke_payload(self, payload: Dict) -> None:
+        jti = payload.get("jti")
+        expires_at = self._payload_expires_at(payload)
+        token_type = payload.get("type")
+        if not jti or not expires_at or not token_type:
+            raise UnauthorizedException("Invalid token payload")
+        await self.revoked_tokens.revoke(jti, token_type, expires_at)
+
+    def _payload_expires_at(self, payload: Dict) -> datetime | None:
+        exp = payload.get("exp")
+        if isinstance(exp, (int, float)):
+            return datetime.fromtimestamp(exp, tz=timezone.utc)
+        if isinstance(exp, datetime):
+            return exp
+        return None
+
+    def _user_response(self, user, permissions: list[str]) -> UserResponse:
+        return UserResponse(
+            id=str(user.id),
+            email=user.email,
+            username=user.username,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            is_superuser=user.is_superuser,
+            is_verified=user.is_verified,
+            last_login_at=(
+                user.last_login_at.isoformat() if user.last_login_at else None
+            ),
+            role=self.repo.collect_role_name(user),
+            permissions=permissions,
+        )

fastapi_forge/templates/with_rbac/app/api/v1/health/__init__.py

@@ -0,0 +1,3 @@
+from app.api.v1.health.router import router
+
+__all__ = ["router"]