fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/with_rbac/app/api/v1/users/service.py

@@ -0,0 +1,291 @@
+from uuid import UUID
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.v1.roles.repository import RoleRepository
+from app.api.v1.users.repository import UserRepository
+from app.api.v1.users.schema import UserCreate, UserResponse, UserUpdate
+from app.core.exceptions import (
+    ConflictException,
+    ForbiddenException,
+    NotFoundException,
+    ValidationException,
+)
+from app.core.security import hash_password
+from app.db.models import User
+
+ROOT_ROLE_NAME = "SUPER ADMIN"
+
+
+class UserService:
+    def __init__(self, session: AsyncSession):
+        self.repo = UserRepository(session)
+        self.roles = RoleRepository(session)
+
+    async def list_users(
+        self,
+        page: int,
+        page_size: int,
+        pagination: bool = True,
+        search: str | None = None,
+        sort_by: str | None = None,
+        sort_order: str | None = None,
+    ) -> tuple[list[UserResponse], int]:
+        users, total = await self.repo.get_all_with_permissions(
+            page,
+            page_size,
+            pagination,
+            search=search,
+            sort_by=sort_by,
+            sort_order=sort_order,
+        )
+        return [self._to_response(user) for user in users], total
+
+    async def list_deleted_users(
+        self,
+        page: int,
+        page_size: int,
+        pagination: bool = True,
+        search: str | None = None,
+        sort_by: str | None = None,
+        sort_order: str | None = None,
+    ) -> tuple[list[UserResponse], int]:
+        users, total = await self.repo.get_deleted(
+            page=page,
+            page_size=page_size,
+            pagination=pagination,
+            search=search,
+            search_columns=[User.email, User.username, User.full_name],
+            sort_by=sort_by,
+            sort_order=sort_order,
+        )
+        return [self._to_response(user) for user in users], total
+
+    async def get_user(
+        self,
+        user_id: UUID,
+    ) -> UserResponse:
+        user = await self.repo.get_with_permissions(user_id)
+        if not user:
+            raise NotFoundException("User", user_id)
+        return self._to_response(user)
+
+    async def create_user(
+        self,
+        data: UserCreate,
+        current_role_name: str | None = None,
+    ) -> UserResponse:
+        current_role = await self._current_role(current_role_name)
+        if data.is_superuser and current_role.name.upper() != ROOT_ROLE_NAME:
+            raise ForbiddenException("You cannot create a superuser")
+        email = data.email.lower()
+        username = data.username.lower()
+
+        if await self.repo.exists("email", email):
+            raise ConflictException("An account with this email already exists")
+        if await self.repo.exists("username", username):
+            raise ConflictException("Username is already taken")
+
+        role = await self._resolve_role(data.role_id)
+        await self._require_manage_role(current_role, role)
+        extra_permissions = await self._resolve_extra_permissions(
+            data.extra_permission_ids,
+            role=role,
+            reject_role_duplicates=False,
+        )
+        user = await self.repo.create(
+            {
+                "email": email,
+                "username": username,
+                "full_name": data.full_name,
+                "hashed_password": hash_password(data.password),
+                "is_active": data.is_active,
+                "is_superuser": data.is_superuser,
+                "is_verified": data.is_verified,
+            }
+        )
+        user.roles = [role]
+        user.extra_permissions = extra_permissions
+        self.repo.session.add(user)
+        await self.repo.session.flush()
+        return self._to_response(user)
+
+    async def update_user(
+        self,
+        user_id: UUID,
+        data: UserUpdate,
+        current_role_name: str | None = None,
+    ) -> UserResponse:
+        current_role = await self._current_role(current_role_name)
+        user = await self.repo.get_with_permissions(user_id)
+        if not user:
+            raise NotFoundException("User", user_id)
+        target_role = self.repo.get_role(user)
+        if user.is_superuser and current_role.name.upper() != ROOT_ROLE_NAME:
+            raise ForbiddenException("You cannot manage a superuser")
+        if target_role:
+            await self._require_manage_role(current_role, target_role)
+
+        values = data.model_dump(exclude_unset=True)
+        if "email" in values:
+            values["email"] = values["email"].lower()
+            if await self.repo.exists_for_other_user("email", values["email"], user_id):
+                raise ConflictException("An account with this email already exists")
+
+        if "username" in values:
+            values["username"] = values["username"].lower()
+            if await self.repo.exists_for_other_user(
+                "username", values["username"], user_id
+            ):
+                raise ConflictException("Username is already taken")
+        if (
+            values.get("is_superuser") is True
+            and current_role.name.upper() != ROOT_ROLE_NAME
+        ):
+            raise ForbiddenException("You cannot create a superuser")
+
+        role_id = values.pop("role_id", None)
+        extra_permission_ids = values.pop("extra_permission_ids", None)
+        if password := values.pop("password", None):
+            values["hashed_password"] = hash_password(password)
+
+        user = await self.repo.update(user, values)
+        role = self.repo.get_role(user)
+        if role_id is not None:
+            role = await self._resolve_role(role_id)
+            await self._require_manage_role(current_role, role)
+            user.roles = [role]
+        if role is None:
+            raise ValidationException("User must have exactly one role")
+        if extra_permission_ids is not None:
+            user.extra_permissions = await self._resolve_extra_permissions(
+                extra_permission_ids,
+                role=role,
+                reject_role_duplicates=True,
+            )
+        elif role_id is not None:
+            self._reject_role_permission_duplicates(role, user.extra_permissions)
+
+        self.repo.session.add(user)
+        await self.repo.session.flush()
+        return self._to_response(user)
+
+    async def soft_delete_user(self, user_id: UUID, note: str) -> None:
+        user = await self.repo.get_by_id(user_id)
+        if not user:
+            raise NotFoundException("User", user_id)
+        await self.repo.soft_delete(user, note)
+
+    async def hard_delete_user(self, user_id: UUID, note: str) -> None:
+        user = await self.repo.get_by_id(user_id, include_deleted=True)
+        if not user:
+            raise NotFoundException("User", user_id)
+        await self.repo.hard_delete(user, note)
+
+    def _to_response(self, user) -> UserResponse:
+        role = self.repo.get_role(user)
+        return UserResponse(
+            id=str(user.id),
+            email=user.email,
+            username=user.username,
+            full_name=user.full_name,
+            is_active=user.is_active,
+            is_superuser=user.is_superuser,
+            is_verified=user.is_verified,
+            last_login_at=(
+                user.last_login_at.isoformat() if user.last_login_at else None
+            ),
+            is_deleted=user.is_deleted,
+            deleted_at=user.deleted_at.isoformat() if user.deleted_at else None,
+            deletion_note=user.deletion_note,
+            role_id=str(role.id) if role else None,
+            role=role.name if role else None,
+            role_permissions=self.repo.collect_role_permissions(user),
+            extra_permissions=self.repo.collect_extra_permissions(user),
+            permissions=self.repo.collect_permissions(user),
+        )
+
+    async def _resolve_role(self, role_id: UUID):
+        role = await self.repo.get_active_role(role_id)
+        if not role:
+            raise NotFoundException("Role", role_id)
+        return role
+
+    async def _current_role(self, role_name: str | None):
+        if not role_name:
+            raise ForbiddenException("Current user role is required")
+        role = await self.roles.get_by_name_with_permissions(role_name)
+        if not role:
+            raise ForbiddenException("Current user role is invalid")
+        return role
+
+    async def _require_manage_role(self, current_role, target_role) -> None:
+        if current_role.name.upper() == ROOT_ROLE_NAME:
+            if target_role.id == current_role.id:
+                raise ForbiddenException("You cannot manage your own role")
+            return
+        if not await self.roles.is_descendant(target_role.id, current_role.id):
+            raise ForbiddenException("You cannot manage this user's role")
+
+    async def _resolve_extra_permissions(
+        self,
+        permission_ids: list[UUID],
+        role,
+        reject_role_duplicates: bool,
+    ) -> list:
+        normalized = list(dict.fromkeys(permission_ids))
+        permissions = await self.repo.list_active_permissions_by_ids(normalized)
+        found = {permission.id for permission in permissions}
+        missing = [
+            str(permission_id)
+            for permission_id in normalized
+            if permission_id not in found
+        ]
+        if missing:
+            raise NotFoundException("Permission", ", ".join(missing))
+
+        role_permission_ids = {
+            permission.id
+            for permission in role.permissions
+            if not permission.is_deleted and permission.is_active
+        }
+        duplicates = [
+            permission
+            for permission in permissions
+            if permission.id in role_permission_ids
+        ]
+        if duplicates and reject_role_duplicates:
+            duplicate_codes = ", ".join(
+                sorted(permission.code for permission in duplicates)
+            )
+            raise ValidationException(
+                f"Permission(s) already assigned to role: {duplicate_codes}"
+            )
+        if duplicates:
+            permissions = [
+                permission
+                for permission in permissions
+                if permission.id not in role_permission_ids
+            ]
+        return permissions
+
+    def _reject_role_permission_duplicates(self, role, extra_permissions: list) -> None:
+        role_permission_ids = {
+            permission.id
+            for permission in role.permissions
+            if not permission.is_deleted and permission.is_active
+        }
+        duplicates = [
+            permission
+            for permission in extra_permissions
+            if permission.id in role_permission_ids
+            and not permission.is_deleted
+            and permission.is_active
+        ]
+        if duplicates:
+            duplicate_codes = ", ".join(
+                sorted(permission.code for permission in duplicates)
+            )
+            raise ValidationException(
+                f"Permission(s) already assigned to role: {duplicate_codes}"
+            )

fastapi_forge/templates/with_rbac/app/core/__init__.py

@@ -0,0 +1 @@
+

fastapi_forge/templates/with_rbac/app/core/config.py

@@ -0,0 +1,131 @@
+import json
+from functools import lru_cache
+from typing import List
+
+from pydantic import field_validator, model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+from sqlalchemy.engine import URL
+
+
+class Settings(BaseSettings):
+    APP_NAME: str = "__PROJECT_NAME__"
+    APP_VERSION: str = "1.0.0"
+    APP_ENV: str = "development"
+    APP_DEBUG: bool = False
+    SECRET_KEY: str = "change-me-in-production"
+    ALLOWED_HOSTS: List[str] = ["*"]
+    ALLOWED_ORIGINS: List[str] = ["*"]
+    log_dir: str = "logs"
+    log_to_files: bool = False
+
+    pg_host: str = "localhost"
+    pg_port: int = 5432
+    pg_database: str = "project_name"
+    pg_user: str = "postgres"
+    pg_password: str = "postgres"
+    pg_sslmode: str = "prefer"
+    database_pool_size: int = 10
+    database_max_overflow: int = 20
+    database_pool_timeout: int = 30
+    database_debug: bool = False
+
+    access_token_expire_minutes: int = 30
+    refresh_token_expire_days: int = 7
+    algorithm: str = "HS256"
+    password_reset_token_expire_minutes: int = 15
+
+    use_redis: bool = False
+    redis_url: str = ""
+    rate_limit_per_minute: int = 60
+
+    mail_username: str = ""
+    mail_password: str = ""
+    mail_from: str = "noreply@example.com"
+    mail_port: int = 587
+    mail_server: str = "smtp.example.com"
+    mail_starttls: bool = True
+    mail_ssl_tls: bool = False
+    mail_from_name: str = "__PROJECT_NAME__"
+    frontend_url: str = "http://localhost:3000"
+
+    default_page_size: int = 20
+    max_page_size: int = 100
+
+    model_config = SettingsConfigDict(
+        env_file=".env",
+        env_file_encoding="utf-8",
+        case_sensitive=False,
+        extra="ignore",
+    )
+
+    @field_validator("ALLOWED_HOSTS", "ALLOWED_ORIGINS", mode="before")
+    @classmethod
+    def parse_json_or_csv_list(cls, value):
+        if isinstance(value, str):
+            value = value.strip()
+            if not value:
+                return []
+            if value.startswith("["):
+                return json.loads(value)
+            return [item.strip() for item in value.split(",") if item.strip()]
+        return value
+
+    @model_validator(mode="after")
+    def validate_production_settings(self):
+        if not self.is_production:
+            return self
+        default_secrets = {
+            "change-me-in-production",
+            "replace-with-a-long-random-secret",
+        }
+        if self.SECRET_KEY in default_secrets or len(self.SECRET_KEY) < 32:
+            raise ValueError(
+                "Production SECRET_KEY must be a unique value of at least 32 characters"
+            )
+        if not self.ALLOWED_HOSTS or "*" in self.ALLOWED_HOSTS:
+            raise ValueError("Production ALLOWED_HOSTS must contain explicit hostnames")
+        if not self.ALLOWED_ORIGINS or "*" in self.ALLOWED_ORIGINS:
+            raise ValueError("Production ALLOWED_ORIGINS must contain explicit origins")
+        if self.pg_sslmode in {"disable", "allow", "prefer"}:
+            raise ValueError("Production PG_SSLMODE must verify or require TLS")
+        return self
+
+    @property
+    def postgres_url(self) -> str:
+        return URL.create(
+            "postgresql+psycopg",
+            username=self.pg_user,
+            password=self.pg_password,
+            host=self.pg_host,
+            port=self.pg_port,
+            database=self.pg_database,
+            query={"sslmode": self.pg_sslmode},
+        ).render_as_string(hide_password=False)
+
+    @property
+    def postgres_async_url(self) -> str:
+        return URL.create(
+            "postgresql+asyncpg",
+            username=self.pg_user,
+            password=self.pg_password,
+            host=self.pg_host,
+            port=self.pg_port,
+            database=self.pg_database,
+            query={"ssl": self.pg_sslmode},
+        ).render_as_string(hide_password=False)
+
+    @property
+    def is_production(self) -> bool:
+        return self.APP_ENV.lower() in {"production", "prod"}
+
+    @property
+    def is_development(self) -> bool:
+        return self.APP_ENV.lower() in {"development", "dev"}
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()
+
+
+settings = get_settings()

fastapi_forge/templates/with_rbac/app/core/dependencies.py

@@ -0,0 +1,131 @@
+from collections.abc import AsyncGenerator, Generator
+from typing import Optional
+
+from fastapi import Depends, Query, Request
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import Session
+
+from app.api.v1.auth.repository import RevokedTokenRepository
+from app.core.exceptions import ForbiddenException, UnauthorizedException
+from app.core.security import decode_token
+from app.db.session import AsyncSessionLocal, SyncSessionLocal
+
+bearer_scheme = HTTPBearer(auto_error=False)
+
+
+async def get_async_db() -> AsyncGenerator[AsyncSession, None]:
+    async with AsyncSessionLocal() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+
+
+def get_sync_db() -> Generator[Session, None, None]:
+    db = SyncSessionLocal()
+    try:
+        yield db
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+    finally:
+        db.close()
+
+
+def get_db() -> Generator[Session, None, None]:
+    yield from get_sync_db()
+
+
+async def get_current_user_payload(
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
+    db: AsyncSession = Depends(get_async_db),
+) -> dict:
+    if not credentials:
+        raise UnauthorizedException("Bearer token missing")
+
+    payload = decode_token(credentials.credentials, expected_type="access")
+    jti = payload.get("jti")
+    if not jti:
+        raise UnauthorizedException("Invalid token payload")
+    if await RevokedTokenRepository(db).is_revoked(jti):
+        raise UnauthorizedException("Token has been revoked")
+    return payload
+
+
+async def get_current_user_id(
+    payload: dict = Depends(get_current_user_payload),
+) -> str:
+    user_id = payload.get("sub")
+    if not user_id:
+        raise UnauthorizedException("Invalid token payload")
+    return user_id
+
+
+def _has_permission_override(payload: dict) -> bool:
+    return bool(payload.get("is_superuser") or "*" in payload.get("permissions", []))
+
+
+def require_permissions(*required_permissions: str):
+    async def _checker(payload: dict = Depends(get_current_user_payload)) -> dict:
+        if _has_permission_override(payload):
+            return payload
+        missing = [
+            permission
+            for permission in required_permissions
+            if permission not in set(payload.get("permissions", []))
+        ]
+        if missing:
+            raise ForbiddenException(
+                f"Missing required permission(s): {', '.join(missing)}"
+            )
+        return payload
+
+    return _checker
+
+
+def require_any_permission(*allowed_permissions: str):
+    async def _checker(payload: dict = Depends(get_current_user_payload)) -> dict:
+        if _has_permission_override(payload):
+            return payload
+        user_permissions = set(payload.get("permissions", []))
+        if any(item in user_permissions for item in allowed_permissions):
+            return payload
+        raise ForbiddenException(
+            f"Missing one of required permission(s): {', '.join(allowed_permissions)}"
+        )
+
+    return _checker
+
+
+async def get_request_id(request: Request) -> str:
+    return getattr(request.state, "request_id", "")
+
+
+async def get_optional_user(
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(bearer_scheme),
+    db: AsyncSession = Depends(get_async_db),
+) -> Optional[dict]:
+    if not credentials:
+        return None
+    try:
+        payload = decode_token(credentials.credentials, expected_type="access")
+        jti = payload.get("jti")
+        if not jti or await RevokedTokenRepository(db).is_revoked(jti):
+            return None
+        return payload
+    except Exception:
+        return None
+
+
+class SortingParams:
+    def __init__(
+        self,
+        sort_by: str | None = Query(default=None, alias="sortBy"),
+        sort_order: str | None = Query(default="asc", alias="sortOrder"),
+    ):
+        self.sort_by = sort_by
+        self.sort_order = sort_order