fastapi-forge-cli 0.1.0__py3-none-any.whl

fastapi_forge/templates/with_rbac/app/core/security.py

@@ -0,0 +1,115 @@
+import hashlib
+import hmac
+import secrets
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, Optional, Tuple
+
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+
+from app.core.config import settings
+from app.core.exceptions import UnauthorizedException
+
+# ── Password hashing (bcrypt, cost=12) ──────────────────────────
+pwd_context = CryptContext(
+    schemes=["bcrypt"],
+    deprecated="auto",
+    bcrypt__rounds=12,  # work factor — increase for more security
+)
+
+
+def hash_password(plain: str) -> str:
+    """Hash a plain-text password using bcrypt."""
+    return pwd_context.hash(plain)
+
+
+def verify_password(plain: str, hashed: str) -> bool:
+    """Verify a plain-text password against its bcrypt hash."""
+    return pwd_context.verify(plain, hashed)
+
+
+# ── JWT helpers ──────────────────────────────────────────────────
+def _utcnow() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def create_access_token(
+    subject: Any,
+    extra_claims: Optional[Dict] = None,
+) -> Tuple[str, datetime]:
+    expire = _utcnow() + timedelta(minutes=settings.access_token_expire_minutes)
+    payload = {
+        "sub": str(subject),
+        "exp": expire,
+        "iat": _utcnow(),
+        "jti": str(uuid.uuid4()),
+        "type": "access",
+        **(extra_claims or {}),
+    }
+    token = jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+    return token, expire
+
+
+def create_refresh_token(subject: Any) -> Tuple[str, datetime]:
+    expire = _utcnow() + timedelta(days=settings.refresh_token_expire_days)
+    payload = {
+        "sub": str(subject),
+        "exp": expire,
+        "iat": _utcnow(),
+        "jti": str(uuid.uuid4()),
+        "type": "refresh",
+    }
+    token = jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+    return token, expire
+
+
+def create_password_reset_token(email: str) -> str:
+    expire = _utcnow() + timedelta(minutes=settings.password_reset_token_expire_minutes)
+    payload = {"sub": email, "exp": expire, "type": "password_reset"}
+    return jwt.encode(payload, settings.SECRET_KEY, algorithm=settings.algorithm)
+
+
+def decode_token(token: str, expected_type: str = "access") -> Dict:
+    """
+    Decode and validate a JWT. Raises UnauthorizedException on failure.
+    """
+    try:
+        payload = jwt.decode(
+            token, settings.SECRET_KEY, algorithms=[settings.algorithm]
+        )
+    except JWTError as exc:
+        raise UnauthorizedException(f"Invalid or expired token: {exc}") from exc
+
+    if payload.get("type") != expected_type:
+        raise UnauthorizedException(f"Expected token type '{expected_type}'")
+
+    return payload
+
+
+# ── Webhook signature verification ──────────────────────────────
+def verify_webhook_signature(payload: bytes, signature: str, secret: str) -> bool:
+    """
+    Verify an HMAC-SHA256 webhook signature.
+    Expected header format: 'sha256=<hex_digest>'
+    """
+    expected = (
+        "sha256=" + hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
+    )
+    return hmac.compare_digest(expected, signature)
+
+
+# ── Secure random helpers ────────────────────────────────────────
+def generate_secure_token(nbytes: int = 32) -> str:
+    """Generate a URL-safe random token (for email verification, API keys, etc.)."""
+    return secrets.token_urlsafe(nbytes)
+
+
+def hash_opaque_token(token: str) -> str:
+    """Return a one-way digest suitable for storing an opaque token."""
+    return hashlib.sha256(token.encode("utf-8")).hexdigest()
+
+
+def generate_api_key() -> str:
+    """Generate a prefixed API key."""
+    return f"sk_{secrets.token_urlsafe(40)}"

fastapi_forge/templates/with_rbac/app/db/__init__.py

@@ -0,0 +1 @@
+"""Database package."""

fastapi_forge/templates/with_rbac/app/db/base.py

@@ -0,0 +1,5 @@
+from sqlalchemy.orm import DeclarativeBase
+
+
+class Base(DeclarativeBase):
+    pass

fastapi_forge/templates/with_rbac/app/db/models/__init__.py

@@ -0,0 +1,16 @@
+from app.db.models.user import User
+from app.db.models.permission import (
+    Permission,
+    Role,
+    role_permission_table,
+    user_permission_table,
+    user_role_table,
+)
+from app.db.models.audit_log import AuditLog
+from app.db.models.auth_token import (
+    EmailVerificationToken,
+    PasswordResetToken,
+    UserSession,
+)
+from app.db.models.notification import Notification
+from app.db.models.revoked_token import RevokedToken

fastapi_forge/templates/with_rbac/app/db/models/audit_log.py

@@ -0,0 +1,58 @@
+from datetime import datetime
+import uuid
+
+from sqlalchemy import DateTime, ForeignKey, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.names import APP_SCHEMA
+
+
+class AuditLog(Base):
+    __tablename__ = "audit_logs"
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    # ── Who ───────────────────────────────────────────────────
+    user_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
+    user_email: Mapped[str | None] = mapped_column(String(255), nullable=True)
+
+    # ── What ──────────────────────────────────────────────────
+    action: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    resource: Mapped[str] = mapped_column(String(100), nullable=False, index=True)
+    resource_id: Mapped[str | None] = mapped_column(
+        String(255), nullable=True, index=True
+    )
+
+    # ── Payload ───────────────────────────────────────────────
+    old_values: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+    new_values: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+    log_metadata: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+
+    # ── Context ───────────────────────────────────────────────
+    ip_address: Mapped[str | None] = mapped_column(String(45), nullable=True)
+    user_agent: Mapped[str | None] = mapped_column(Text, nullable=True)
+    request_id: Mapped[str | None] = mapped_column(String(100), nullable=True)
+
+    # ── Relationship ──────────────────────────────────────────
+    user: Mapped["User"] = relationship("User", back_populates="audit_logs")
+
+    __table_args__ = (
+        Index("ix_audit_resource_action", "resource", "action"),
+        Index("ix_audit_user_resource", "user_id", "resource"),
+        {"schema": APP_SCHEMA},
+    )
+
+    def __repr__(self) -> str:
+        return f"<AuditLog action={self.action} resource={self.resource} id={self.resource_id}>"

fastapi_forge/templates/with_rbac/app/db/models/auth_token.py

@@ -0,0 +1,72 @@
+from datetime import datetime
+import uuid
+
+from sqlalchemy import DateTime, ForeignKey, Index, String, Text, func
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class EmailVerificationToken(Base):
+    __tablename__ = "email_verification_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    token: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+
+class PasswordResetToken(Base):
+    __tablename__ = "password_reset_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    token: Mapped[str] = mapped_column(String(255), unique=True, nullable=False)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+
+class UserSession(Base):
+    __tablename__ = "user_sessions"
+    __table_args__ = (
+        Index("ix_user_sessions_user_active", "user_id", "revoked_at"),
+        {"schema": AUTH_SCHEMA},
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("auth.users.id", ondelete="CASCADE"), index=True
+    )
+    refresh_jti: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
+    previous_refresh_jti: Mapped[str | None] = mapped_column(String(64), index=True)
+    user_agent: Mapped[str | None] = mapped_column(Text)
+    ip_address: Mapped[str | None] = mapped_column(String(45))
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    last_used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    user = relationship("User", back_populates="sessions")

fastapi_forge/templates/with_rbac/app/db/models/notification.py

@@ -0,0 +1,49 @@
+import uuid
+from datetime import datetime, timezone
+
+from sqlalchemy import Boolean, DateTime, ForeignKey, String, Text
+from sqlalchemy.dialects.postgresql import JSONB, UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import APP_SCHEMA
+
+
+class Notification(BaseModelMixin, Base):
+    __tablename__ = "notifications"
+    __table_args__ = {"schema": APP_SCHEMA}
+
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    title: Mapped[str] = mapped_column(String(255), nullable=False)
+    body: Mapped[str] = mapped_column(Text, nullable=False)
+    notification_type: Mapped[str] = mapped_column(
+        String(100), nullable=False, index=True
+    )  # e.g. "info", "warning", "success", "error", "system"
+
+    # Channel: "in_app" | "email" | "push" | "webhook"
+    channel: Mapped[str] = mapped_column(String(50), default="in_app", nullable=False)
+
+    is_read: Mapped[bool] = mapped_column(
+        Boolean, default=False, nullable=False, index=True
+    )
+    read_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+
+    # Arbitrary extra payload (deep link, action URL, entity ref, etc.)
+    payload: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
+
+    user: Mapped["User"] = relationship("User", back_populates="notifications")
+
+    def mark_read(self) -> None:
+        self.is_read = True
+        self.read_at = datetime.now(timezone.utc)
+
+    def __repr__(self) -> str:
+        return f"<Notification user={self.user_id} type={self.notification_type} read={self.is_read}>"

fastapi_forge/templates/with_rbac/app/db/models/permission.py

@@ -0,0 +1,174 @@
+"""
+Permission layer:
+  - Permission - a fine-grained code like "users:read", "reports:export"
+  - Role - a named collection of permissions
+  - user_roles - M2M: users can belong to many roles
+  - role_permissions - M2M: roles hold many permissions
+  - user_permissions - M2M: users can have extra individual permissions
+
+At login time the auth service merges role permissions + individual
+permissions into a flat list that is embedded in the JWT.
+"""
+
+import uuid
+
+from sqlalchemy import (
+    Boolean,
+    Column,
+    ForeignKey,
+    String,
+    Table,
+    Text,
+    UniqueConstraint,
+)
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import RBAC_SCHEMA
+
+user_role_table = Table(
+    "user_roles",
+    Base.metadata,
+    Column("id", UUID(as_uuid=True), primary_key=True, default=uuid.uuid4),
+    Column(
+        "user_id",
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    Column(
+        "role_id",
+        UUID(as_uuid=True),
+        ForeignKey("rbac.roles.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    UniqueConstraint("user_id", "role_id", name="uq_user_roles_user_id_role_id"),
+    schema=RBAC_SCHEMA,
+)
+
+role_permission_table = Table(
+    "role_permissions",
+    Base.metadata,
+    Column("id", UUID(as_uuid=True), primary_key=True, default=uuid.uuid4),
+    Column(
+        "role_id",
+        UUID(as_uuid=True),
+        ForeignKey("rbac.roles.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    Column(
+        "permission_id",
+        UUID(as_uuid=True),
+        ForeignKey("rbac.permissions.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    UniqueConstraint(
+        "role_id",
+        "permission_id",
+        name="uq_role_permissions_role_id_permission_id",
+    ),
+    schema=RBAC_SCHEMA,
+)
+
+user_permission_table = Table(
+    "user_permissions",
+    Base.metadata,
+    Column("id", UUID(as_uuid=True), primary_key=True, default=uuid.uuid4),
+    Column(
+        "user_id",
+        UUID(as_uuid=True),
+        ForeignKey("auth.users.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    Column(
+        "permission_id",
+        UUID(as_uuid=True),
+        ForeignKey("rbac.permissions.id", ondelete="CASCADE"),
+        nullable=False,
+    ),
+    UniqueConstraint(
+        "user_id",
+        "permission_id",
+        name="uq_user_permissions_user_id_permission_id",
+    ),
+    schema=RBAC_SCHEMA,
+)
+
+
+class Permission(BaseModelMixin, Base):
+    """
+    A single capability code. Convention: '<resource>:<action>'.
+    Examples: 'users:read', 'invoices:write', 'admin:*'.
+    """
+
+    __tablename__ = "permissions"
+    __table_args__ = {"schema": RBAC_SCHEMA}
+
+    code: Mapped[str] = mapped_column(
+        String(100), unique=True, nullable=False, index=True
+    )
+    name: Mapped[str] = mapped_column(String(255), nullable=False)
+    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+
+    roles: Mapped[list["Role"]] = relationship(
+        "Role",
+        secondary=role_permission_table,
+        back_populates="permissions",
+    )
+    users: Mapped[list["User"]] = relationship(
+        "User",
+        secondary=user_permission_table,
+        back_populates="extra_permissions",
+    )
+
+    def __repr__(self) -> str:
+        return f"<Permission code={self.code}>"
+
+
+class Role(BaseModelMixin, Base):
+    """
+    A named set of permissions. Assign roles to users to grant their bundled
+    permissions. Individual permissions can still be added via user_permissions.
+    """
+
+    __tablename__ = "roles"
+    __table_args__ = {"schema": RBAC_SCHEMA}
+
+    name: Mapped[str] = mapped_column(
+        String(100), unique=True, nullable=False, index=True
+    )
+    description: Mapped[str | None] = mapped_column(Text, nullable=True)
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    parent_role_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True),
+        ForeignKey("rbac.roles.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
+
+    permissions: Mapped[list[Permission]] = relationship(
+        "Permission",
+        secondary=role_permission_table,
+        back_populates="roles",
+        lazy="selectin",
+    )
+    parent: Mapped["Role | None"] = relationship(
+        "Role",
+        remote_side="Role.id",
+        back_populates="children",
+    )
+    children: Mapped[list["Role"]] = relationship(
+        "Role",
+        back_populates="parent",
+    )
+    users: Mapped[list["User"]] = relationship(
+        "User",
+        secondary=user_role_table,
+        back_populates="roles",
+    )
+
+    def __repr__(self) -> str:
+        return f"<Role name={self.name}>"

fastapi_forge/templates/with_rbac/app/db/models/revoked_token.py

@@ -0,0 +1,21 @@
+from datetime import datetime
+
+from sqlalchemy import DateTime, String
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class RevokedToken(BaseModelMixin, Base):
+    __tablename__ = "revoked_tokens"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    jti: Mapped[str] = mapped_column(
+        String(64), unique=True, nullable=False, index=True
+    )
+    token_type: Mapped[str] = mapped_column(String(20), nullable=False, index=True)
+    expires_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False
+    )

fastapi_forge/templates/with_rbac/app/db/models/user.py

@@ -0,0 +1,53 @@
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, String
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base
+from app.db.schemas.common import BaseModelMixin
+from app.db.schemas.names import AUTH_SCHEMA
+
+
+class User(BaseModelMixin, Base):
+    __tablename__ = "users"
+    __table_args__ = {"schema": AUTH_SCHEMA}
+
+    email: Mapped[str] = mapped_column(
+        String(255), unique=True, nullable=False, index=True
+    )
+    username: Mapped[str] = mapped_column(
+        String(100), unique=True, nullable=False, index=True
+    )
+    full_name: Mapped[str] = mapped_column(String(255), nullable=False)
+    hashed_password: Mapped[str] = mapped_column(String(255), nullable=False)
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
+    is_superuser: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    is_verified: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    last_login_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+
+    roles: Mapped[list["Role"]] = relationship(
+        "Role",
+        secondary="rbac.user_roles",
+        back_populates="users",
+        lazy="selectin",
+    )
+    extra_permissions: Mapped[list["Permission"]] = relationship(
+        "Permission",
+        secondary="rbac.user_permissions",
+        back_populates="users",
+        lazy="selectin",
+    )
+    notifications: Mapped[list["Notification"]] = relationship(
+        "Notification", back_populates="user", lazy="dynamic"
+    )
+    audit_logs: Mapped[list["AuditLog"]] = relationship(
+        "AuditLog", back_populates="user", lazy="dynamic"
+    )
+    sessions: Mapped[list["UserSession"]] = relationship(
+        "UserSession", back_populates="user", lazy="dynamic"
+    )
+
+    def __repr__(self) -> str:
+        return f"<User id={self.id} email={self.email}>"

fastapi_forge/templates/with_rbac/app/db/schemas/__init__.py

@@ -0,0 +1,8 @@
+from app.db.schemas.common import BaseModelMixin, SoftDeleteMixin, TimestampMixin, UUIDMixin
+
+__all__ = [
+    "BaseModelMixin",
+    "SoftDeleteMixin",
+    "TimestampMixin",
+    "UUIDMixin",
+]

fastapi_forge/templates/with_rbac/app/db/schemas/common.py

@@ -0,0 +1,70 @@
+import uuid
+from datetime import datetime, timezone
+
+from sqlalchemy import Boolean, DateTime, Text, func
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column
+
+
+def utcnow():
+    return datetime.now(timezone.utc)
+
+
+class UUIDMixin:
+    """Provides a UUID primary key."""
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True),
+        primary_key=True,
+        default=uuid.uuid4,
+        index=True,
+    )
+
+
+class TimestampMixin:
+    """Adds created_at / updated_at columns with automatic server defaults."""
+
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        nullable=False,
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        onupdate=func.now(),
+        nullable=False,
+    )
+
+
+class SoftDeleteMixin:
+    """
+    Provides soft-delete support.
+    - is_deleted=True  → soft-deleted (row hidden from normal queries)
+    - deleted_at       → timestamp of soft-deletion
+    Call .hard_delete() on the session to permanently remove the row.
+    """
+
+    is_deleted: Mapped[bool] = mapped_column(
+        Boolean, default=False, nullable=False, index=True
+    )
+    deleted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    deletion_note: Mapped[str | None] = mapped_column(Text, nullable=True)
+
+    def soft_delete(self, note: str | None = None) -> None:
+        self.is_deleted = True
+        self.deleted_at = utcnow()
+        self.deletion_note = note
+
+    def restore(self) -> None:
+        self.is_deleted = False
+        self.deleted_at = None
+        self.deletion_note = None
+
+
+class BaseModelMixin(UUIDMixin, TimestampMixin, SoftDeleteMixin):
+    """Convenience mixin that combines UUID PK, timestamps, and soft-delete."""
+
+    pass

fastapi_forge/templates/with_rbac/app/db/schemas/names.py

@@ -0,0 +1,9 @@
+APP_SCHEMA = "app"
+AUTH_SCHEMA = "auth"
+RBAC_SCHEMA = "rbac"
+
+ALL_SCHEMAS = (
+    AUTH_SCHEMA,
+    RBAC_SCHEMA,
+    APP_SCHEMA,
+)