fastapi-fullstack 0.2.18__tar.gz → 0.2.19__tar.gz

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-fullstack
-Version: 0.2.18
+Version: 0.2.19
 Summary: Full-stack FastAPI + Next.js template generator with PydanticAI/LangChain agents, WebSocket streaming, 20+ enterprise integrations, and Logfire/LangSmith observability. Ship AI apps fast. CLI tool to generate production-ready FastAPI + Next.js projects with AI agents, auth, and observability.
 Project-URL: Homepage, https://github.com/vstorm-co/full-stack-ai-agent-template
 Project-URL: Documentation, https://github.com/vstorm-co/full-stack-ai-agent-template#readme
@@ -19,27 +19,26 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Code Generators
 Requires-Python: >=3.11
-Requires-Dist: arq>=0.28.0
-Requires-Dist: celery>=5.6.3
 Requires-Dist: click>=8.3.3
 Requires-Dist: cookiecutter>=2.7.0
 Requires-Dist: email-validator>=2.3.0
-Requires-Dist: httpx>=0.28.1
 Requires-Dist: packaging>=24.0
-Requires-Dist: pydantic-settings>=2.14.2
 Requires-Dist: pydantic>=2.13.0
-Requires-Dist: pytest-asyncio>=1.3.0
-Requires-Dist: pytest>=9.0.3
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: questionary>=2.1.0
 Requires-Dist: rich>=15.0.0
 Requires-Dist: ruff>=0.14.0
-Requires-Dist: stripe>=15.1.0
-Requires-Dist: taskiq>=0.12.4
 Provides-Extra: dev
+Requires-Dist: arq>=0.28.0; extra == 'dev'
+Requires-Dist: celery>=5.6.3; extra == 'dev'
+Requires-Dist: httpx>=0.28.1; extra == 'dev'
 Requires-Dist: pre-commit>=4.0.0; extra == 'dev'
+Requires-Dist: pydantic-settings>=2.14.2; extra == 'dev'
+Requires-Dist: pytest-asyncio>=1.3.0; extra == 'dev'
 Requires-Dist: pytest-cov>=7.0.0; extra == 'dev'
 Requires-Dist: pytest>=9.0.0; extra == 'dev'
+Requires-Dist: stripe>=15.1.0; extra == 'dev'
+Requires-Dist: taskiq>=0.12.4; extra == 'dev'
 Requires-Dist: ty>=0.0.31; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.7.0; extra == 'docs'
@@ -810,7 +809,7 @@ They also ship a ready-to-use **`.claude/` toolkit** that adapts to the options
 | **Background Tasks** | Celery, Taskiq, ARQ, Prefect |
 | **Billing** | Stripe subscriptions (seat-based), credits + usage metering, invoices, Customer Portal |
 | **Caching & State** | Redis, fastapi-cache2 |
-| **Security** | Rate limiting, CORS, CSRF protection |
+| **Security** | Per-plan sliding-window rate limiting (per user / org / IP), CORS, SSRF-guarded webhook delivery, httpOnly + SameSite session cookies |
 | **Observability** | Logfire, LangSmith, Sentry, Prometheus |
 | **Admin** | SQLAdmin panel with auth |
 | **Collaboration** | Conversation sharing (direct + link), admin conversation browser |
@@ -1315,7 +1314,7 @@ Select what you need:
 ```bash
 fastapi-fullstack new
 # ✓ Redis (caching/sessions)
-# ✓ Rate limiting (slowapi)
+# ✓ Rate limiting (per user/org/IP, Redis or in-memory)
 # ✓ Pagination (fastapi-pagination)
 # ✓ Admin Panel (SQLAdmin)
 # ✓ AI Agent (PydanticAI or LangChain)

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/README.md

@@ -761,7 +761,7 @@ They also ship a ready-to-use **`.claude/` toolkit** that adapts to the options
 | **Background Tasks** | Celery, Taskiq, ARQ, Prefect |
 | **Billing** | Stripe subscriptions (seat-based), credits + usage metering, invoices, Customer Portal |
 | **Caching & State** | Redis, fastapi-cache2 |
-| **Security** | Rate limiting, CORS, CSRF protection |
+| **Security** | Per-plan sliding-window rate limiting (per user / org / IP), CORS, SSRF-guarded webhook delivery, httpOnly + SameSite session cookies |
 | **Observability** | Logfire, LangSmith, Sentry, Prometheus |
 | **Admin** | SQLAdmin panel with auth |
 | **Collaboration** | Conversation sharing (direct + link), admin conversation browser |
@@ -1266,7 +1266,7 @@ Select what you need:
 ```bash
 fastapi-fullstack new
 # ✓ Redis (caching/sessions)
-# ✓ Rate limiting (slowapi)
+# ✓ Rate limiting (per user/org/IP, Redis or in-memory)
 # ✓ Pagination (fastapi-pagination)
 # ✓ Admin Panel (SQLAdmin)
 # ✓ AI Agent (PydanticAI or LangChain)

fastapi_fullstack-0.2.19/UPGRADES.yaml

@@ -0,0 +1,41 @@
+# Structural metadata for `fastapi-fullstack upgrade` (renames, removals, manual steps).
+# See docs/guides/version-upgrade.md — "For template maintainers". One block per release.
+#
+# Schema (all keys optional except `version`):
+#
+# - version: "0.2.15"
+#   renames:
+#     - from: "backend/app/core/config.py"
+#       to:   "backend/app/core/settings.py"
+#   variable_renames:
+#     - from: "use_pgvector"
+#       to:   "vector_store"
+#       value_map: { "true": "pgvector" }
+#   removed:
+#     - "backend/app/legacy_auth.py"
+#   breaking:
+#     - "JWT secret env var renamed SECRET_KEY → AUTH_SECRET_KEY."
+#   manual_steps:
+#     - "Run `alembic upgrade head` (new billing tables)."
+
+- version: "0.2.19"
+  removed:
+    - "backend/app/core/rate_limit.py"
+    - "backend/app/core/csrf.py"
+    - "backend/app/api/versioning.py"
+  breaking:
+    - "Delegated auth (--auth-mode delegated) no longer generates the local credential endpoints: /auth/login, /auth/register, /auth/refresh, /auth/logout and the password-reset and magic-link routes. Only /auth/me remains. Any client calling them against a delegated deployment was receiving tokens that get_current_user rejects."
+    - "create_password_reset_token(subject) now requires current_password_hash, and create_magic_link_token(subject) requires magic_link_epoch. Both bind the token to state that changes on redemption, which is what makes the link single-use. Custom callers must pass the new argument."
+    - "The slowapi limiter in core/rate_limit.py is gone. It was never attached to a route and enforced nothing. Rate limits now come from services/rate_limit via make_rate_limit_dep / make_anonymous_rate_limit_dep, and slowapi is no longer a dependency."
+  manual_steps:
+    - "Run `alembic upgrade head` — 0027 adds users.magic_link_epoch, which the single-use magic-link check reads. Without it, sign-in-by-email raises on every attempt."
+    - "Rate limiting is now actually enforced on /auth/login, /auth/register and the password-reset and magic-link request endpoints (default: 5 per 15 minutes per IP). Load tests and smoke scripts that hammer login will start seeing 429s. Override per plan via the plan's features.rate_limits, or adjust DEFAULT_RATE_LIMITS in backend/app/services/rate_limit/rules.py."
+    - "If you generated with --rate-limiting and no Redis, limits are counted per worker process, so the effective limit is multiplied by your worker count. Enable Redis for a shared window."
+    - "Custom routes that need a limit: add `dependencies=[make_rate_limit_dep(RateLimitCategory.X)]` (authenticated) or `make_anonymous_rate_limit_dep` (pre-auth). Nothing is limited by default beyond the auth endpoints."
+    - "If you wired app.state.limiter or @limiter.limit from core/rate_limit.py yourself, those imports are now dead — port them to make_rate_limit_dep."
+
+- version: "0.2.18"
+  manual_steps:
+    - "Rebuild the frontend image: `docker compose -f docker-compose.prod.yml build --no-cache frontend`. NEXT_PUBLIC_* is inlined into the browser bundle at build time and now comes from compose build args, so an image built before this upgrade still has the old ws://localhost URL baked in."
+    - "Serving the frontend over plain http:// with no TLS? Set COOKIE_SECURE=false on the frontend service. The auth cookies are Secure in production and a browser discards a Secure cookie sent over http://, which makes login appear to succeed while every request after it returns 401."
+    - "BACKEND_WS_URL and NEXT_PUBLIC_AUTH_ENABLED were never read by any code and are gone from the env examples. If your deployment sets them, the browser-facing WebSocket origin is NEXT_PUBLIC_WS_URL (build-time)."

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/fastapi_gen/prompts.py

@@ -450,7 +450,7 @@ def prompt_integrations(
             checked=True,
         ),
         questionary.Choice(
-            "Rate limiting (slowapi) — optional Redis storage",
+            "Rate limiting (per user/org/IP) — Redis or in-memory storage",
             value="rate_limiting",
             checked=True,
         ),

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-fullstack"
-version = "0.2.18"
+version = "0.2.19"
 description = "Full-stack FastAPI + Next.js template generator with PydanticAI/LangChain agents, WebSocket streaming, 20+ enterprise integrations, and Logfire/LangSmith observability. Ship AI apps fast. CLI tool to generate production-ready FastAPI + Next.js projects with AI agents, auth, and observability."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -43,32 +43,37 @@ classifiers = [
     "Topic :: Software Development :: Code Generators",
 ]
 
+# Runtime deps of the *generator* only. Anything the generated project needs
+# belongs in template/{{cookiecutter.project_slug}}/backend/pyproject.toml —
+# declaring it here makes every `uvx fastapi-fullstack` install it too.
 dependencies = [
     "click>=8.3.3",
     "cookiecutter>=2.7.0",
     "pyyaml>=6.0",
     "packaging>=24.0",
+    # Shelled out to by the post-gen hook to format the rendered project.
     "ruff>=0.14.0",
     "rich>=15.0.0",
     "questionary>=2.1.0",
     "pydantic>=2.13.0",
-    "pydantic-settings>=2.14.2",
+    # Required at runtime by pydantic's EmailStr (ProjectConfig.author_email).
     "email-validator>=2.3.0",
-    "httpx>=0.28.1",
-    "pytest>=9.0.3",
-    "pytest-asyncio>=1.3.0",
-    "celery>=5.6.3",
-    "taskiq>=0.12.4",
-    "arq>=0.28.0",
-    "stripe>=15.1.0",
 ]
 
 [project.optional-dependencies]
 dev = [
     "pytest>=9.0.0",
+    "pytest-asyncio>=1.3.0",
     "pytest-cov>=7.0.0",
     "ty>=0.0.31",
     "pre-commit>=4.0.0",
+    # Imported by tests that exercise generated projects, not by fastapi_gen.
+    "httpx>=0.28.1",
+    "pydantic-settings>=2.14.2",
+    "celery>=5.6.3",
+    "taskiq>=0.12.4",
+    "arq>=0.28.0",
+    "stripe>=15.1.0",
 ]
 docs = [
     "mkdocs>=1.6.1",

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/hooks/post_gen_project.py

@@ -342,7 +342,6 @@ if not enable_caching:
     remove_file(os.path.join(backend_app, "core", "cache.py"))
 
 if not enable_rate_limiting:
-    remove_file(os.path.join(backend_app, "core", "rate_limit.py"))
     remove_dir(os.path.join(backend_app, "services", "rate_limit"))
 
 if not enable_oauth:

fastapi_fullstack-0.2.19/template/{{cookiecutter.project_slug}}/backend/alembic/versions/0027_user_magic_link_epoch.py

@@ -0,0 +1,55 @@
+{%- if cookiecutter.enable_email %}
+"""add users.magic_link_epoch
+
+Revision ID: 0027_user_magic_link_epoch
+Revises: 0026_create_mcp_connections
+Create Date: {{ cookiecutter.generated_at }}
+
+Magic-link sign-in tokens are JWTs, so they cannot be revoked. Each issued
+link carries the epoch in force at issue time; redeeming one bumps the epoch,
+which invalidates that link and every other link outstanding for the user.
+Without this a leaked sign-in link stays usable for its whole TTL, and stays
+usable after the legitimate user has already signed in with it.
+"""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "0027_user_magic_link_epoch"
+down_revision = "0026_create_mcp_connections"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "users",
+        sa.Column("magic_link_epoch", sa.Integer(), nullable=False, server_default="0"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("users", "magic_link_epoch")
+{%- else %}
+"""add users.magic_link_epoch — skipped (enable_email=false)
+
+Revision ID: 0027_user_magic_link_epoch
+
+No-op placeholder so the revision chain stays linear when email (and therefore
+magic-link sign-in) is disabled.
+"""
+
+revision = "0027_user_magic_link_epoch"
+down_revision = "0026_create_mcp_connections"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass
+{%- endif %}

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/admin.py

@@ -301,7 +301,19 @@ def get_sync_engine() -> Engine:
 class AdminAuth(AuthenticationBackend):
     """Admin panel authentication backend.
 
-    Requires superuser credentials to access the admin panel.
+    Requires app-admin credentials to access the admin panel. Note this is a
+    *local* password check — it does not consult any external IdP, so it must
+    never be the only thing standing between a self-registered account and the
+    database. Both conditions below matter:
+
+    - ``is_app_admin`` — the explicit admin flag, not just the ``role`` column,
+      so a row that acquired ``role=admin`` some other way is not enough.
+{%- if cookiecutter.use_delegated_auth %}
+    - ``external_user_id`` — the row must correspond to a real IdP identity.
+      Under delegated auth the local ``/auth/register`` endpoint is not
+      generated, so no unlinked row should exist; this check makes that
+      guarantee local instead of relying on a route elsewhere staying absent.
+{%- endif %}
     """
 
     async def login(self, request: Request) -> bool:
@@ -321,9 +333,14 @@ class AdminAuth(AuthenticationBackend):
 
             if (
                 user
+                and user.is_active
                 and user.hashed_password
                 and verify_password(password, user.hashed_password)
                 and user.has_role(UserRole.ADMIN)
+                and getattr(user, "is_app_admin", False)
+{%- if cookiecutter.use_delegated_auth %}
+                and user.external_user_id is not None
+{%- endif %}
             ):
                 request.session["admin_user_id"] = str(user.id)
                 request.session["admin_email"] = user.email
@@ -344,7 +361,12 @@ class AdminAuth(AuthenticationBackend):
 
         with DBSession(get_sync_engine()) as session:
             user = session.query(User).filter(User.id == admin_user_id).first()
-            if user and user.has_role(UserRole.ADMIN) and user.is_active:
+            if (
+                user
+                and user.is_active
+                and user.has_role(UserRole.ADMIN)
+                and getattr(user, "is_app_admin", False)
+            ):
                 return True
 
         request.session.clear()

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/api/deps.py

@@ -512,6 +512,11 @@ async def get_current_user_ws(
     Tokens in query strings are NOT accepted — they leak into logs and
     Referer headers.
 
+    The token is validated by the same authority as ``get_current_user``: the
+    IdP's keys under delegated auth, this backend's ``SECRET_KEY`` otherwise.
+    The two must not diverge — a WebSocket that trusts a different issuer than
+    the REST API is an authentication bypass on whichever side is weaker.
+
     Raises:
         WebSocketException: If token is invalid or user not found. Raising the
             WebSocket-native exception lets Starlette close the handshake cleanly
@@ -527,6 +532,35 @@ async def get_current_user_ws(
     if not auth_token:
         raise WebSocketException(code=4001, reason="Missing authentication token")
 
+{%- if cookiecutter.use_delegated_auth %}
+    payload = verify_idp_token(auth_token)
+    if payload is None:
+        raise WebSocketException(code=4001, reason="Invalid or expired token")
+
+    # No `type` check here: an external IdP does not mint our access/refresh
+    # distinction. The audience and issuer checks in verify_idp_token are what
+    # constrain which tokens this API accepts.
+    external_id = payload.get(settings.IDP_USER_ID_CLAIM)
+    if not external_id:
+        raise WebSocketException(code=4001, reason="Invalid token payload")
+
+    async with get_db_context() as db:
+        user_service = UserService(db)
+        user = await user_service.get_or_create_from_idp(
+            external_user_id=str(external_id),
+            email=payload.get(settings.IDP_EMAIL_CLAIM) or f"{external_id}@idp.local",
+            full_name=payload.get(settings.IDP_NAME_CLAIM),
+        )
+
+        if not user.is_active:
+            raise WebSocketException(code=4001, reason="User account is disabled")
+
+        # Eagerly load all columns, then detach from session to avoid
+        # "instance not bound to a Session" errors after the context manager exits
+        await db.refresh(user)
+        db.expunge(user)
+        return user
+{%- else %}
     payload = verify_token(auth_token)
     if payload is None:
         raise WebSocketException(code=4001, reason="Invalid or expired token")
@@ -553,6 +587,7 @@ async def get_current_user_ws(
         await db.refresh(user)
         db.expunge(user)
         return user
+{%- endif %}
 
 
 CurrentUserWS = Annotated[User, Depends(get_current_user_ws)]
@@ -639,18 +674,34 @@ def get_vectorstore(request: Request, embedder: EmbeddingSvc) -> BaseVectorStore
 
 VectorStoreSvc = Annotated[BaseVectorStore, Depends(get_vectorstore)]
 
-def get_retrieval_service(vector_store: VectorStoreSvc) -> RetrievalService:
+{%- if cookiecutter.enable_reranker %}
+def get_rerank_service(request: Request) -> RerankService:
+    """Get the reranker warmed at startup, or build one if warmup failed.
+
+    Reusing the lifespan instance is not an optimisation — a cross-encoder
+    reranker holds its model on the instance and loads it lazily, so a
+    per-request service reloads the model inside the request.
+    """
+    if hasattr(request.state, "rerank_service"):
+        return request.state.rerank_service  # type: ignore[no-any-return]
+    return RerankService(settings=settings.rag)
+
+RerankSvc = Annotated[RerankService, Depends(get_rerank_service)]
+
+def get_retrieval_service(
+    vector_store: VectorStoreSvc, rerank_service: RerankSvc
+) -> RetrievalService:
     """Create RetrievalService instance."""
-    {%- if cookiecutter.enable_reranker %}
-    rerank_service = RerankService(settings=settings.rag)
     return RetrievalService(
         vector_store=vector_store,
         settings=settings.rag,
         rerank_service=rerank_service,
     )
-    {%- else %}
+{%- else %}
+def get_retrieval_service(vector_store: VectorStoreSvc) -> RetrievalService:
+    """Create RetrievalService instance."""
     return RetrievalService(vector_store=vector_store, settings=settings.rag)
-    {%- endif %}
+{%- endif %}
 
 RetrievalSvc = Annotated[RetrievalService, Depends(get_retrieval_service)]
 

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/auth.py

@@ -1,19 +1,44 @@
+{%- if cookiecutter.use_delegated_auth %}
+"""Authentication routes.
+
+Delegated auth mode: identity is owned by the external IdP, so this module
+exposes **only** ``/me``. Local email/password endpoints (login, register,
+refresh, logout, password reset, magic link) are deliberately absent — see
+``get_current_user`` in ``app/api/deps.py``, which validates IdP signatures and
+would reject any token this backend minted. Leaving them mounted would also
+mean an unauthenticated caller could create a local account, and the first such
+account is auto-promoted to app-admin.
+"""
+{%- else %}
 """Authentication routes."""
+{%- endif %}
 
 import logging
+{%- if cookiecutter.use_delegated_auth %}
+from typing import Any
+{%- else %}
 from typing import Annotated, Any
+{%- if not cookiecutter.enable_session_management %}
+from uuid import UUID
+{%- endif %}
+{%- endif %}
 
-from fastapi import APIRouter, Depends, Request, status
+from fastapi import APIRouter{% if not cookiecutter.use_delegated_auth %}, Depends, Request{% endif %}{% if not cookiecutter.use_delegated_auth %}, status{% endif %}
+{%- if not cookiecutter.use_delegated_auth %}
 from fastapi.security import OAuth2PasswordRequestForm
+{%- endif %}
 
 {%- if cookiecutter.enable_session_management %}
 from app.api.deps import CurrentUser, SessionSvc, UserSvc
-{%- else %}
+{%- elif not cookiecutter.use_delegated_auth %}
 from app.api.deps import CurrentUser, UserSvc
+{%- else %}
+from app.api.deps import CurrentUser
 {%- endif %}
-{%- if cookiecutter.enable_email %}
+{%- if cookiecutter.enable_email and not cookiecutter.use_delegated_auth %}
 from app.core.config import settings
 {%- endif %}
+{%- if not cookiecutter.use_delegated_auth %}
 from app.core.exceptions import AuthenticationError
 from app.core.security import (
     create_access_token,
@@ -22,7 +47,8 @@ from app.core.security import (
     verify_token,
 {%- endif %}
 )
-{%- if cookiecutter.enable_email %}
+{%- endif %}
+{%- if cookiecutter.enable_email and not cookiecutter.use_delegated_auth %}
 from app.services.email.service import get_email_service
 from app.schemas.password_reset import (
     MagicLinkRequest,
@@ -33,15 +59,35 @@ from app.schemas.password_reset import (
     PasswordResetResponse,
 )
 {%- endif %}
+{%- if not cookiecutter.use_delegated_auth %}
 from app.schemas.token import RefreshTokenRequest, Token
 from app.schemas.user import UserCreate, UserRead
+{%- else %}
+from app.schemas.user import UserRead
+{%- endif %}
+{%- if cookiecutter.enable_rate_limiting and not cookiecutter.use_delegated_auth %}
+from app.services.rate_limit import RateLimitCategory, make_anonymous_rate_limit_dep
+
+# Unauthenticated endpoints: the only scope available is the caller's IP, and
+# these are exactly the routes that need one (credential stuffing, reset-email
+# flooding). Default rule: 5 requests per 15 minutes per IP.
+AuthRateLimit = make_anonymous_rate_limit_dep(RateLimitCategory.AUTH)
+{%- endif %}
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter()
 
+{%- if not cookiecutter.use_delegated_auth %}
+
 
-@router.post("/login", response_model=Token)
+@router.post(
+    "/login",
+    response_model=Token,
+{%- if cookiecutter.enable_rate_limiting %}
+    dependencies=[AuthRateLimit],
+{%- endif %}
+)
 async def login(
     request: Request,
     form_data: Annotated[OAuth2PasswordRequestForm, Depends()],
@@ -67,7 +113,14 @@ async def login(
     return Token(access_token=access_token, refresh_token=refresh_token)
 
 
-@router.post("/register", response_model=UserRead, status_code=status.HTTP_201_CREATED)
+@router.post(
+    "/register",
+    response_model=UserRead,
+    status_code=status.HTTP_201_CREATED,
+{%- if cookiecutter.enable_rate_limiting %}
+    dependencies=[AuthRateLimit],
+{%- endif %}
+)
 async def register(
     user_in: UserCreate,
     user_service: UserSvc,
@@ -100,9 +153,13 @@ async def refresh_token(
     payload = verify_token(body.refresh_token)
     if not payload or payload.get("type") != "refresh":
         raise AuthenticationError(message="Invalid or expired refresh token")
-    user_id = payload.get("sub")
-    if not user_id:
+    subject = payload.get("sub")
+    if not subject:
         raise AuthenticationError(message="Invalid refresh token")
+    try:
+        user_id = UUID(str(subject))
+    except ValueError as exc:
+        raise AuthenticationError(message="Invalid refresh token") from exc
     user = await user_service.get_by_id(user_id)
 {%- endif %}
     if not user.is_active:
@@ -140,6 +197,7 @@ async def logout(
     """No-op without session tracking. Clients drop their JWTs locally."""
     return None
 {%- endif %}
+{%- endif %}
 
 
 @router.get("/me", response_model=UserRead)
@@ -147,11 +205,17 @@ async def get_current_user_info(current_user: CurrentUser) -> Any:
     """Get current authenticated user information."""
     return current_user
 
-{%- if cookiecutter.enable_email %}
+{%- if cookiecutter.enable_email and not cookiecutter.use_delegated_auth %}
 
 
 
-@router.post("/password-reset/request", response_model=PasswordResetResponse)
+@router.post(
+    "/password-reset/request",
+    response_model=PasswordResetResponse,
+{%- if cookiecutter.enable_rate_limiting %}
+    dependencies=[AuthRateLimit],
+{%- endif %}
+)
 async def request_password_reset(
     body: PasswordResetRequest,
     user_service: UserSvc,
@@ -187,7 +251,13 @@ async def confirm_password_reset(
 
 
 
-@router.post("/magic-link/request", response_model=PasswordResetResponse)
+@router.post(
+    "/magic-link/request",
+    response_model=PasswordResetResponse,
+{%- if cookiecutter.enable_rate_limiting %}
+    dependencies=[AuthRateLimit],
+{%- endif %}
+)
 async def request_magic_link(
     body: MagicLinkRequest,
     user_service: UserSvc,

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/knowledge_bases.py

@@ -13,10 +13,9 @@ from uuid import UUID
 from fastapi import APIRouter, File, Query, UploadFile, status
 from fastapi.responses import FileResponse
 
-from app.api.deps import ActiveOrg, CurrentUser, DBSession, KnowledgeBaseSvc
+from app.api.deps import ActiveOrg, CurrentUser, KnowledgeBaseSvc
 from app.api.deps import RAGDocumentSvc, SyncSourceSvc, VectorStoreSvc
 from app.core.exceptions import NotFoundError
-from app.repositories import sync_log as sync_log_repo
 from app.schemas.knowledge_base import (
     KnowledgeBaseCreate,
     KnowledgeBaseList,
@@ -362,14 +361,14 @@ async def list_kb_sync_source_logs(
     kb_id: UUID,
     source_id: UUID,
     service: KnowledgeBaseSvc,
-    db: DBSession,
+    sync_source_svc: SyncSourceSvc,
     current_user: CurrentUser,
     active_org: ActiveOrg,
     limit: int = Query(20, ge=1, le=100),
 ) -> Any:
     """List sync run history for a specific KB sync source."""
     kb = await service.get(kb_id, user_id=current_user.id, organization_id=active_org.id)
-    logs = await sync_log_repo.get_all(db, sync_source_id=source_id, limit=limit)
+    logs = await sync_source_svc.list_logs(source_id, limit=limit)
     # Verify source belongs to this KB's collection (security: don't leak other KBs' logs).
     items = [
         RAGSyncLogItem(

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/api/routes/v1/org_integrations.py

@@ -17,7 +17,6 @@ from app.api.deps import (
     RequireAdminPlus,
     SyncSourceSvc,
 )
-from app.repositories import sync_log as sync_log_repo
 from app.schemas.rag import RAGSyncLogList, RAGSyncLogItem, RAGSyncResponse
 from app.schemas.sync_source import (
     ConnectorList,
@@ -98,12 +97,12 @@ async def trigger_org_integration(
 @router.get("/{source_id}/logs", response_model=RAGSyncLogList)
 async def list_org_integration_logs(
     source_id: UUID,
-    db: DBSession,
+    sync_source_svc: SyncSourceSvc,
     _: RequireAdminPlus,
     limit: int = Query(20, ge=1, le=100),
 ) -> Any:
     """List sync run history for a specific org integration."""
-    logs = await sync_log_repo.get_all(db, sync_source_id=source_id, limit=limit)
+    logs = await sync_source_svc.list_logs(source_id, limit=limit)
     items = [
         RAGSyncLogItem(
             id=str(log.id),

{fastapi_fullstack-0.2.18 → fastapi_fullstack-0.2.19}/template/{{cookiecutter.project_slug}}/backend/app/core/crypto.py

@@ -1,10 +1,19 @@
 """Field-level Fernet encryption for sensitive connector credentials.
 
+Every caller keys this with ``settings.SECRET_KEY`` — keep it that way. The key
+is only a *derivation input*, so any two callers using different keys produce
+ciphertext the other cannot read: mixing keys silently strands rows rather than
+raising at write time.
+
+Consequence worth knowing before you rotate anything: rotating ``SECRET_KEY``
+(the JWT signing key) makes every value encrypted with the old one
+undecryptable. See ``app/services/mcp_connection.py`` for how that is handled.
+
 Usage:
     from app.core.crypto import encrypt_value, decrypt_value, is_encrypted
 
-    stored = encrypt_value(plaintext, settings.CHANNEL_ENCRYPTION_KEY)
-    original = decrypt_value(stored, settings.CHANNEL_ENCRYPTION_KEY)
+    stored = encrypt_value(plaintext, settings.SECRET_KEY)
+    original = decrypt_value(stored, settings.SECRET_KEY)
 """
 
 import base64