fastapi-fullauth 0.17.0__tar.gz → 0.17.2__tar.gz

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.17.2
+
+### Fixed
+
+- **The Redis challenge store raised on a non-positive TTL** where the in-memory one wrote an entry that was simply already expired. With `PASSKEY_CHALLENGE_TTL` set to `0`, beginning a passkey sign-in answered `500` on Redis, on a route that needs no account. Both backends now agree: nothing is stored and the next `pop()` returns `None`.
+- **Numeric settings reject values that cannot work.** Durations, expiries, attempt counts and rate-limit caps are validated at construction, so a mistake fails at startup instead of somewhere unrelated later: `MAX_LOGIN_ATTEMPTS=0` locked every account on its first failed login, and `PASSKEY_CHALLENGE_TTL=0` raised from Redis mid-request. The three settings that document a meaningful zero keep it: `JWT_LEEWAY_SECONDS`, `PASSWORD_MAX_LENGTH` and `REAUTH_MAX_AGE_SECONDS`. **If your configuration holds one of these impossible values, the application now refuses to start and says which setting.**
+- **Auth rate limits shared one bucket per IP on Redis.** Each route gets its own limiter with its own cap, but the key was the client IP alone, and every Redis-backed limiter writes into the same keyspace, so all six auth routes counted into a single sorted set. The smallest cap won for all of them: with `register` at 3, any three auth requests, a token refresh or a failed login included, returned `429` on the next registration attempt for the rest of the window. It also broke the separation `reauth` was given in 0.17.0, where failed password checks were meant not to touch the sign-in budget. The key now carries the route name. Only Redis was affected; the in-memory backend keeps its counts per limiter instance, which is why the test suite never saw it, and why the new regression test runs against both backends. **Note:** the key format changed, so existing counters reset once on deploy.
+
+## 0.17.1
+
+### Changed
+
+- **The SQL adapters no longer call an API that SQLModel deprecates.** `_BaseSQLAlchemyAdapter` is shared by the SQLAlchemy and SQLModel adapters, and its 40 `session.execute()` calls emitted a `DeprecationWarning` for anyone using SQLModel's `AsyncSession`, which is one of the two setups the documentation offers. Applications that treat warnings as errors failed on it. `exec()` cannot replace it, because a plain SQLAlchemy session does not have one and the base serves both; the calls now go through a helper that invokes SQLAlchemy's own `execute()` directly. SQLModel's override does nothing but delegate to it, so behaviour is identical and results are still `Row` objects.
+- **Redis writes use `set(..., ex=)` instead of `setex`,** which redis-py has deprecated since 2.6.12. Affects the token blacklist, the passkey challenge store, and the lockout manager. Stored values and expiries are unchanged.
+- **The SQLModel adapter contract runs against both documented session classes.** Every test built its sessions with SQLAlchemy's `AsyncSession`, so the SQLModel one had no coverage at all, which is why the deprecation above reached an application instead of CI. The conformance suite now runs a second time with `class_=AsyncSession` from SQLModel.
+- **The test suite treats deprecations as errors,** with no ignore entries. A deprecation that cannot be fixed yet gets its own line naming what it waits for, rather than a blanket suppression.
+- **Dependencies refreshed and verified against the newest releases,** including uuid-utils 1.0, SQLModel 0.0.47, SQLAlchemy 2.0.54, PyJWT 2.15, Starlette 1.7 and pymdown-extensions 12. The declared version floors are unchanged: they state the oldest release the library works with, not the newest it was tested against, and nothing here requires a newer one.
+
 ## 0.17.0
 
 ### Added

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-fullauth
-Version: 0.17.0
+Version: 0.17.2
 Summary: Production-grade, async-native authentication and authorization library for FastAPI
 Project-URL: Changelog, https://github.com/mdfarhankc/fastapi-fullauth/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://mdfarhankc.github.io/fastapi-fullauth

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/docs/configuration.md

@@ -124,6 +124,11 @@ If you want to be defensively explicit that no file is ever read, pass `FullAuth
 
 ## Reference
 
+Durations, expiries, attempt counts and rate-limit caps must be at least 1, and a
+value that cannot work is rejected when the config is constructed rather than
+failing somewhere unrelated later. `JWT_LEEWAY_SECONDS`, `PASSWORD_MAX_LENGTH`
+and `REAUTH_MAX_AGE_SECONDS` accept `0`, which means something for each of them.
+
 ### Core
 
 | Option | Type | Default | Description |

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/fastapi_fullauth/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.17.0"
+__version__ = "0.17.2"
 
 from fastapi_fullauth.config import AuthRateLimits, FullAuthConfig
 from fastapi_fullauth.fullauth import FullAuth

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/fastapi_fullauth/adapters/_sqlalchemy_base.py

@@ -16,7 +16,7 @@ from datetime import datetime, timezone
 from typing import Any, TypeVar, cast
 from uuid import UUID
 
-from sqlalchemy import CursorResult, delete, select, update
+from sqlalchemy import CursorResult, Result, delete, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker
 from sqlalchemy.orm import selectinload
@@ -258,6 +258,22 @@ class _BaseSQLAlchemyAdapter(
                 await session.rollback()
                 raise
 
+    @staticmethod
+    async def _execute(session: AsyncSession, statement: Any) -> Result[Any]:
+        """Run a statement through SQLAlchemy's own ``execute()``.
+
+        SQLModel's ``AsyncSession`` deprecates ``execute()`` in favour of
+        ``exec()``, but ``exec()`` does not exist on a plain SQLAlchemy session
+        and this base serves both. Its override only delegates to the parent, so
+        calling the parent directly is identical and warns for nobody. Results
+        stay ``Row`` objects, hence the ``.scalars()`` calls throughout.
+
+        SQLAlchemy infers the row type from the statement at the call site; it
+        cannot do that through a helper, so a caller that needs the column type
+        narrows it itself.
+        """
+        return await AsyncSession.execute(session, statement)
+
     def _user_query(self) -> Any:
         # Eager-load roles so _to_schema() can read user.roles outside the session
         # without triggering an async refresh.
@@ -278,7 +294,9 @@ class _BaseSQLAlchemyAdapter(
 
     async def get_user_by_id(self, user_id: UserID) -> UserSchemaType | None:
         async with self._begin() as session:
-            result = await session.execute(self._user_query().where(self._user_model.id == user_id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user_id)
+            )
             user = result.scalars().first()
             return self._to_schema(user) if user else None
 
@@ -294,7 +312,7 @@ class _BaseSQLAlchemyAdapter(
         if field == "email":
             value = normalize_email(value)
         async with self._begin() as session:
-            result = await session.execute(self._user_query().where(column == value))
+            result = await self._execute(session, self._user_query().where(column == value))
             user = result.scalars().first()
             return self._to_schema(user) if user else None
 
@@ -316,7 +334,9 @@ class _BaseSQLAlchemyAdapter(
                     f"User with email {normalized_email} already exists"
                 ) from e
             # Re-fetch with roles eager-loaded so _to_schema works outside the session.
-            result = await session.execute(self._user_query().where(self._user_model.id == user.id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user.id)
+            )
             user = result.scalars().first()
             assert user is not None
             await self._commit(session)
@@ -329,11 +349,14 @@ class _BaseSQLAlchemyAdapter(
             if data:
                 # Skip an empty UPDATE: update(...).values() with no columns is a
                 # compile error in SQLAlchemy. An empty update is a no-op anyway.
-                await session.execute(
-                    update(self._user_model).where(self._user_model.id == user_id).values(**data)
+                await self._execute(
+                    session,
+                    update(self._user_model).where(self._user_model.id == user_id).values(**data),
                 )
                 await self._commit(session)
-            result = await session.execute(self._user_query().where(self._user_model.id == user_id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user_id)
+            )
             user = result.scalars().first()
             if user is None:
                 raise ValueError(f"User {user_id} not found")
@@ -341,8 +364,8 @@ class _BaseSQLAlchemyAdapter(
 
     async def delete_user(self, user_id: UserID) -> None:
         async with self._begin() as session:
-            result = await session.execute(
-                select(self._user_model).where(self._user_model.id == user_id)
+            result = await self._execute(
+                session, select(self._user_model).where(self._user_model.id == user_id)
             )
             user = result.scalars().first()
             if user:
@@ -353,7 +376,9 @@ class _BaseSQLAlchemyAdapter(
         if not hasattr(self._user_model, "roles"):
             return []
         async with self._begin() as session:
-            result = await session.execute(self._user_query().where(self._user_model.id == user_id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user_id)
+            )
             user = result.scalars().first()
             if user is None:
                 return []
@@ -361,17 +386,19 @@ class _BaseSQLAlchemyAdapter(
 
     async def get_hashed_password(self, user_id: UserID) -> str | None:
         async with self._begin() as session:
-            result = await session.execute(
-                select(self._user_model.hashed_password).where(self._user_model.id == user_id)
+            result = await self._execute(
+                session,
+                select(self._user_model.hashed_password).where(self._user_model.id == user_id),
             )
-            return result.scalars().first()
+            return cast("str | None", result.scalars().first())
 
     async def set_password(self, user_id: UserID, hashed_password: str) -> None:
         async with self._begin() as session:
-            await session.execute(
+            await self._execute(
+                session,
                 update(self._user_model)
                 .where(self._user_model.id == user_id)
-                .values(hashed_password=hashed_password)
+                .values(hashed_password=hashed_password),
             )
             await self._commit(session)
 
@@ -391,10 +418,11 @@ class _BaseSQLAlchemyAdapter(
 
     async def get_refresh_token(self, token_str: str) -> RefreshToken | None:
         async with self._begin() as session:
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(self._refresh_token_model).where(
                     self._refresh_token_model.token == token_str
-                )
+                ),
             )
             row = result.scalars().first()
             if row is None:
@@ -413,11 +441,12 @@ class _BaseSQLAlchemyAdapter(
         async with self._begin() as session:
             result = cast(
                 "CursorResult[Any]",
-                await session.execute(
+                await self._execute(
+                    session,
                     update(self._refresh_token_model)
                     .where(self._refresh_token_model.token == token_str)
                     .where(self._refresh_token_model.revoked.is_(False))
-                    .values(revoked=True)
+                    .values(revoked=True),
                 ),
             )
             await self._commit(session)
@@ -425,19 +454,21 @@ class _BaseSQLAlchemyAdapter(
 
     async def revoke_refresh_token_family(self, family_id: str) -> None:
         async with self._begin() as session:
-            await session.execute(
+            await self._execute(
+                session,
                 update(self._refresh_token_model)
                 .where(self._refresh_token_model.family_id == family_id)
-                .values(revoked=True)
+                .values(revoked=True),
             )
             await self._commit(session)
 
     async def revoke_all_user_refresh_tokens(self, user_id: UserID) -> None:
         async with self._begin() as session:
-            await session.execute(
+            await self._execute(
+                session,
                 update(self._refresh_token_model)
                 .where(self._refresh_token_model.user_id == user_id)
-                .values(revoked=True)
+                .values(revoked=True),
             )
             await self._commit(session)
 
@@ -446,10 +477,11 @@ class _BaseSQLAlchemyAdapter(
         async with self._begin() as session:
             result = cast(
                 "CursorResult[Any]",
-                await session.execute(
+                await self._execute(
+                    session,
                     delete(self._refresh_token_model).where(
                         self._refresh_token_model.expires_at < cutoff
-                    )
+                    ),
                 ),
             )
             await self._commit(session)
@@ -459,8 +491,8 @@ class _BaseSQLAlchemyAdapter(
         model = self._refresh_token_model
         now = datetime.now(timezone.utc)
         async with self._begin() as session:
-            result = await session.execute(
-                select(model).where(model.user_id == user_id).order_by(model.created_at)
+            result = await self._execute(
+                session, select(model).where(model.user_id == user_id).order_by(model.created_at)
             )
             rows = result.scalars().all()
 
@@ -496,19 +528,21 @@ class _BaseSQLAlchemyAdapter(
             # rows (re-revoking an already-revoked family) reports rowcount 0,
             # which would wrongly 404 a session the user still owns. The contract
             # is idempotent: True if a row existed for (user_id, family_id).
-            existing = await session.execute(
+            existing = await self._execute(
+                session,
                 select(model.id)
                 .where(model.user_id == user_id)
                 .where(model.family_id == family_id)
-                .limit(1)
+                .limit(1),
             )
             if existing.first() is None:
                 return False
-            await session.execute(
+            await self._execute(
+                session,
                 update(model)
                 .where(model.user_id == user_id)
                 .where(model.family_id == family_id)
-                .values(revoked=True)
+                .values(revoked=True),
             )
             await self._commit(session)
             return True
@@ -518,12 +552,13 @@ class _BaseSQLAlchemyAdapter(
         async with self._begin() as session:
             result = cast(
                 "CursorResult[Any]",
-                await session.execute(
+                await self._execute(
+                    session,
                     update(model)
                     .where(model.user_id == user_id)
                     .where(model.family_id != keep_family_id)
                     .where(model.revoked.is_(False))
-                    .values(revoked=True)
+                    .values(revoked=True),
                 ),
             )
             await self._commit(session)
@@ -531,10 +566,11 @@ class _BaseSQLAlchemyAdapter(
 
     async def set_user_verified(self, user_id: UserID) -> None:
         async with self._begin() as session:
-            await session.execute(
+            await self._execute(
+                session,
                 update(self._user_model)
                 .where(self._user_model.id == user_id)
-                .values(is_verified=True)
+                .values(is_verified=True),
             )
             await self._commit(session)
 
@@ -542,14 +578,18 @@ class _BaseSQLAlchemyAdapter(
         role_model = self._require(self._role_model, "Role assignment")
 
         async with self._begin() as session:
-            result = await session.execute(select(role_model).where(role_model.name == role_name))
+            result = await self._execute(
+                session, select(role_model).where(role_model.name == role_name)
+            )
             role = result.scalars().first()
             if role is None:
                 role = role_model(name=role_name)
                 session.add(role)
                 await session.flush()
 
-            result = await session.execute(self._user_query().where(self._user_model.id == user_id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user_id)
+            )
             user = result.scalars().first()
             if user and role not in user.roles:
                 user.roles.append(role)
@@ -558,7 +598,9 @@ class _BaseSQLAlchemyAdapter(
 
     async def remove_role(self, user_id: UserID, role_name: str) -> None:
         async with self._begin() as session:
-            result = await session.execute(self._user_query().where(self._user_model.id == user_id))
+            result = await self._execute(
+                session, self._user_query().where(self._user_model.id == user_id)
+            )
             user = result.scalars().first()
             if user:
                 user.roles = [r for r in user.roles if r.name != role_name]
@@ -573,14 +615,15 @@ class _BaseSQLAlchemyAdapter(
         role_permission_model = self._require(self._role_permission_model, "Permissions")
 
         async with self._begin() as session:
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(permission_model.name)
                 .join(
                     role_permission_model,
                     permission_model.id == role_permission_model.permission_id,
                 )
                 .join(role_model, role_model.id == role_permission_model.role_id)
-                .where(role_model.name.in_(role_names))
+                .where(role_model.name.in_(role_names)),
             )
             return list(set(result.scalars().all()))
 
@@ -590,14 +633,15 @@ class _BaseSQLAlchemyAdapter(
         role_permission_model = self._require(self._role_permission_model, "Permissions")
 
         async with self._begin() as session:
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(permission_model.name)
                 .join(
                     role_permission_model,
                     permission_model.id == role_permission_model.permission_id,
                 )
                 .join(role_model, role_model.id == role_permission_model.role_id)
-                .where(role_model.name == role_name)
+                .where(role_model.name == role_name),
             )
             return list(result.scalars().all())
 
@@ -607,15 +651,17 @@ class _BaseSQLAlchemyAdapter(
         role_permission_model = self._require(self._role_permission_model, "Permissions")
 
         async with self._begin() as session:
-            result = await session.execute(select(role_model).where(role_model.name == role_name))
+            result = await self._execute(
+                session, select(role_model).where(role_model.name == role_name)
+            )
             role = result.scalars().first()
             if role is None:
                 role = role_model(name=role_name)
                 session.add(role)
                 await session.flush()
 
-            result = await session.execute(
-                select(permission_model).where(permission_model.name == permission)
+            result = await self._execute(
+                session, select(permission_model).where(permission_model.name == permission)
             )
             perm = result.scalars().first()
             if perm is None:
@@ -623,11 +669,12 @@ class _BaseSQLAlchemyAdapter(
                 session.add(perm)
                 await session.flush()
 
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(role_permission_model).where(
                     role_permission_model.role_id == role.id,
                     role_permission_model.permission_id == perm.id,
-                )
+                ),
             )
             if result.scalars().first() is None:
                 session.add(role_permission_model(role_id=role.id, permission_id=perm.id))
@@ -639,23 +686,26 @@ class _BaseSQLAlchemyAdapter(
         role_permission_model = self._require(self._role_permission_model, "Permissions")
 
         async with self._begin() as session:
-            result = await session.execute(select(role_model).where(role_model.name == role_name))
+            result = await self._execute(
+                session, select(role_model).where(role_model.name == role_name)
+            )
             role = result.scalars().first()
             if role is None:
                 return
 
-            result = await session.execute(
-                select(permission_model).where(permission_model.name == permission)
+            result = await self._execute(
+                session, select(permission_model).where(permission_model.name == permission)
             )
             perm = result.scalars().first()
             if perm is None:
                 return
 
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(role_permission_model).where(
                     role_permission_model.role_id == role.id,
                     role_permission_model.permission_id == perm.id,
-                )
+                ),
             )
             link = result.scalars().first()
             if link:
@@ -678,11 +728,12 @@ class _BaseSQLAlchemyAdapter(
     async def get_oauth_account(self, provider: str, provider_user_id: str) -> OAuthAccount | None:
         oauth_model = self._require(self._oauth_account_model, "OAuth")
         async with self._begin() as session:
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(oauth_model).where(
                     oauth_model.provider == provider,
                     oauth_model.provider_user_id == provider_user_id,
-                )
+                ),
             )
             row = result.scalars().first()
             return self._to_oauth_account(row) if row else None
@@ -690,8 +741,8 @@ class _BaseSQLAlchemyAdapter(
     async def get_user_oauth_accounts(self, user_id: UserID) -> list[OAuthAccount]:
         oauth_model = self._require(self._oauth_account_model, "OAuth")
         async with self._begin() as session:
-            result = await session.execute(
-                select(oauth_model).where(oauth_model.user_id == user_id)
+            result = await self._execute(
+                session, select(oauth_model).where(oauth_model.user_id == user_id)
             )
             return [self._to_oauth_account(row) for row in result.scalars().all()]
 
@@ -713,11 +764,12 @@ class _BaseSQLAlchemyAdapter(
                 # Concurrent OAuth callback for the same (provider, provider_user_id)
                 # won the insert. Return the existing row; both callers linked the
                 # same identity, which is the intended outcome.
-                result = await session.execute(
+                result = await self._execute(
+                    session,
                     select(oauth_model).where(
                         oauth_model.provider == data.provider,
                         oauth_model.provider_user_id == data.provider_user_id,
-                    )
+                    ),
                 )
                 existing = result.scalars().first()
                 if existing is not None:
@@ -732,13 +784,14 @@ class _BaseSQLAlchemyAdapter(
         oauth_model = self._require(self._oauth_account_model, "OAuth")
         async with self._begin() as session:
             if data:
-                await session.execute(
+                await self._execute(
+                    session,
                     update(oauth_model)
                     .where(
                         oauth_model.provider == provider,
                         oauth_model.provider_user_id == provider_user_id,
                     )
-                    .values(**data)
+                    .values(**data),
                 )
                 await self._commit(session)
             return await self.get_oauth_account(provider, provider_user_id)
@@ -746,11 +799,12 @@ class _BaseSQLAlchemyAdapter(
     async def delete_oauth_account(self, provider: str, provider_user_id: str) -> None:
         oauth_model = self._require(self._oauth_account_model, "OAuth")
         async with self._begin() as session:
-            result = await session.execute(
+            result = await self._execute(
+                session,
                 select(oauth_model).where(
                     oauth_model.provider == provider,
                     oauth_model.provider_user_id == provider_user_id,
-                )
+                ),
             )
             row = result.scalars().first()
             if row:
@@ -776,8 +830,8 @@ class _BaseSQLAlchemyAdapter(
     async def get_passkey_by_credential_id(self, credential_id: str) -> PasskeyCredential | None:
         passkey_model = self._require(self._passkey_model, "Passkeys")
         async with self._begin() as session:
-            result = await session.execute(
-                select(passkey_model).where(passkey_model.credential_id == credential_id)
+            result = await self._execute(
+                session, select(passkey_model).where(passkey_model.credential_id == credential_id)
             )
             row = result.scalars().first()
             return self._to_passkey(row) if row else None
@@ -785,8 +839,8 @@ class _BaseSQLAlchemyAdapter(
     async def get_user_passkeys(self, user_id: UserID) -> list[PasskeyCredential]:
         passkey_model = self._require(self._passkey_model, "Passkeys")
         async with self._begin() as session:
-            result = await session.execute(
-                select(passkey_model).where(passkey_model.user_id == user_id)
+            result = await self._execute(
+                session, select(passkey_model).where(passkey_model.user_id == user_id)
             )
             return [self._to_passkey(row) for row in result.scalars().all()]
 
@@ -813,11 +867,12 @@ class _BaseSQLAlchemyAdapter(
         async with self._begin() as session:
             result = cast(
                 "CursorResult[Any]",
-                await session.execute(
+                await self._execute(
+                    session,
                     update(passkey_model)
                     .where(passkey_model.credential_id == credential_id)
                     .where(passkey_model.sign_count < sign_count)
-                    .values(sign_count=sign_count, last_used_at=now)
+                    .values(sign_count=sign_count, last_used_at=now),
                 ),
             )
             if result.rowcount == 0:
@@ -825,10 +880,11 @@ class _BaseSQLAlchemyAdapter(
                 # counter (both stored and new are 0) or a concurrent writer already wrote
                 # a value >= ours. Touch last_used_at for the no-counter case; caller
                 # decides whether to reject based on the new_sign_count value.
-                await session.execute(
+                await self._execute(
+                    session,
                     update(passkey_model)
                     .where(passkey_model.credential_id == credential_id)
-                    .values(last_used_at=now)
+                    .values(last_used_at=now),
                 )
                 await self._commit(session)
                 return False
@@ -838,8 +894,8 @@ class _BaseSQLAlchemyAdapter(
     async def delete_passkey(self, passkey_id: UUID) -> None:
         passkey_model = self._require(self._passkey_model, "Passkeys")
         async with self._begin() as session:
-            result = await session.execute(
-                select(passkey_model).where(passkey_model.id == passkey_id)
+            result = await self._execute(
+                session, select(passkey_model).where(passkey_model.id == passkey_id)
             )
             row = result.scalars().first()
             if row:

{fastapi_fullauth-0.17.0 → fastapi_fullauth-0.17.2}/fastapi_fullauth/config.py

@@ -40,6 +40,14 @@ class AuthRateLimits:
     # bucket, so failed attempts cannot exhaust an IP's sign-in budget.
     reauth: int = 5
 
+    def __post_init__(self) -> None:
+        for name, value in vars(self).items():
+            if value < 1:
+                raise ValueError(
+                    f"AUTH_RATE_LIMITS.{name} must be at least 1; "
+                    f"{value} would reject every request to that route."
+                )
+
 
 class FullAuthConfig(BaseSettings):
     model_config = SettingsConfigDict(
@@ -61,19 +69,20 @@ class FullAuthConfig(BaseSettings):
     SECRET_KEY: str | None = None
     ALGORITHM: Literal["HS256", "HS384", "HS512"] = "HS256"
 
-    ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
-    REFRESH_TOKEN_EXPIRE_DAYS: int = 30
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = Field(default=30, ge=1)
+    REFRESH_TOKEN_EXPIRE_DAYS: int = Field(default=30, ge=1)
     REFRESH_TOKEN_ROTATION: bool = True
-    JWT_LEEWAY_SECONDS: int = 30
+    JWT_LEEWAY_SECONDS: int = Field(default=30, ge=0)
 
-    PASSWORD_RESET_EXPIRE_MINUTES: int = 15
-    EMAIL_VERIFY_EXPIRE_MINUTES: int = 1440
+    PASSWORD_RESET_EXPIRE_MINUTES: int = Field(default=15, ge=1)
+    EMAIL_VERIFY_EXPIRE_MINUTES: int = Field(default=1440, ge=1)
 
     PASSWORD_HASH_ALGORITHM: Literal["argon2id", "bcrypt"] = "argon2id"
-    PASSWORD_MIN_LENGTH: int = 8
+    PASSWORD_MIN_LENGTH: int = Field(default=8, ge=1)
     # Upper bound so an attacker can't spend the server's CPU hashing a huge
     # body. bcrypt caps at 72 bytes anyway; argon2 will hash whatever it is given.
-    PASSWORD_MAX_LENGTH: int = 4096
+    # 0 disables the cap, hence ge=0 rather than ge=1.
+    PASSWORD_MAX_LENGTH: int = Field(default=4096, ge=0)
 
     LOGIN_FIELD: str = "email"
     # When True, login runs a dummy password verify on unknown-user / no-password
@@ -86,12 +95,12 @@ class FullAuthConfig(BaseSettings):
     # destructive action (deleting the account, setting a first password).
     # Supplying the current password proves it too. 0 accepts only the password,
     # which locks passwordless accounts out of those actions.
-    REAUTH_MAX_AGE_SECONDS: int = 300
+    REAUTH_MAX_AGE_SECONDS: int = Field(default=300, ge=0)
 
     LOCKOUT_ENABLED: bool = True
     LOCKOUT_BACKEND: Literal["memory", "redis"] = "memory"
-    MAX_LOGIN_ATTEMPTS: int = 5
-    LOCKOUT_DURATION_MINUTES: int = 15
+    MAX_LOGIN_ATTEMPTS: int = Field(default=5, ge=1)
+    LOCKOUT_DURATION_MINUTES: int = Field(default=15, ge=1)
 
     RATE_LIMIT_BACKEND: Literal["memory", "redis"] = "memory"
     TRUSTED_PROXY_HEADERS: Annotated[list[str], NoDecode] = []
@@ -104,14 +113,14 @@ class FullAuthConfig(BaseSettings):
 
     AUTH_RATE_LIMIT_ENABLED: bool = True
     AUTH_RATE_LIMITS: AuthRateLimits = Field(default_factory=AuthRateLimits)
-    AUTH_RATE_LIMIT_WINDOW_SECONDS: int = 60
+    AUTH_RATE_LIMIT_WINDOW_SECONDS: int = Field(default=60, ge=1)
 
     REDIS_URL: str | None = None
 
     BLACKLIST_ENABLED: bool = True
     BLACKLIST_BACKEND: Literal["memory", "redis"] = "memory"
 
-    OAUTH_STATE_EXPIRE_SECONDS: int = 300
+    OAUTH_STATE_EXPIRE_SECONDS: int = Field(default=300, ge=1)
     OAUTH_AUTO_LINK_BY_EMAIL: bool = True
     OAUTH_PKCE_ENABLED: bool = True
 
@@ -124,7 +133,7 @@ class FullAuthConfig(BaseSettings):
     PASSKEY_RP_NAME: str | None = None
     PASSKEY_ORIGINS: Annotated[list[str], NoDecode] = []
     PASSKEY_CHALLENGE_BACKEND: Literal["memory", "redis"] = "memory"
-    PASSKEY_CHALLENGE_TTL: int = 60
+    PASSKEY_CHALLENGE_TTL: int = Field(default=60, ge=1)
     PASSKEY_REQUIRE_USER_VERIFICATION: bool = True
 
     API_PREFIX: str = "/api/v1"