fastapi-startkit-auth 0.3.0__tar.gz

fastapi_startkit_auth-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FastAPI Startkit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fastapi_startkit_auth-0.3.0/PKG-INFO

@@ -0,0 +1,243 @@
+Metadata-Version: 2.4
+Name: fastapi-startkit-auth
+Version: 0.3.0
+Summary: Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens.
+Keywords: fastapi,oauth2,jwt,auth,passport,sanctum,authentication,authorization,security,tokens,session,cookie,csrf,spa,starter-kit
+Author: Bedram Tamang
+Author-email: Bedram Tamang <tmgbedu@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pyjwt>=2.8
+Requires-Dist: bcrypt>=4.1
+Requires-Dist: pydantic>=2
+Requires-Dist: python-multipart>=0.0.9
+Requires-Dist: masonite-orm>=2.18 ; extra == 'masoniteorm'
+Requires-Dist: fastapi-startkit>=0.51 ; python_full_version >= '3.12' and extra == 'startkit'
+Requires-Dist: pytest>=8 ; extra == 'test'
+Requires-Dist: pytest-asyncio>=0.23 ; extra == 'test'
+Requires-Dist: httpx>=0.27 ; extra == 'test'
+Requires-Python: >=3.9
+Project-URL: Homepage, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Repository, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Issues, https://github.com/fastapi-startkit/fastapi-startkit-auth/issues
+Project-URL: Changelog, https://github.com/fastapi-startkit/fastapi-startkit-auth/releases
+Provides-Extra: masoniteorm
+Provides-Extra: startkit
+Provides-Extra: test
+Description-Content-Type: text/markdown
+
+# fastapi-startkit-auth
+
+Passport-style OAuth2 + JWT authentication for FastAPI.
+
+`fastapi-startkit-auth` brings the ergonomics of [Laravel Passport](https://laravel.com/docs/13.x/passport)
+to FastAPI: a config-driven guard/provider/passwords model layered on top of
+OAuth2 grants and signed JWT access tokens (per the
+[FastAPI security tutorial](https://fastapi.tiangolo.com/tutorial/security/oauth2-jwt/)).
+
+## Features
+
+| Area | What you get |
+| --- | --- |
+| **Config layer** | `AuthConfig` (`default` / `guards` / `providers` / `passwords`) + `AuthProvider` that registers into the app |
+| **Password grant** | OAuth2 password grant → signed JWT access tokens with expiry (`/oauth/token`, `/token`) |
+| **Refresh tokens** | Opaque refresh tokens with **rotation** and configurable TTL |
+| **Personal access tokens** | Named, long-lived tokens with scopes/abilities |
+| **Client credentials** | Machine-to-machine grant |
+| **Authorization code + PKCE** | Browser/SPA flow with S256 & plain PKCE |
+| **Clients** | Register / list / delete confidential & public clients |
+| **Revocation & introspection** | RFC 7009 revoke + RFC 7662 introspect |
+| **Password reset** | `password_reset_tokens` flow with configurable `expire` + `throttle` |
+| **Guards & deps** | `current_user`, `optional_user`, `require_scopes` FastAPI dependencies |
+| **Pluggable providers** | In-memory, generic ORM/masoniteorm model, or any custom `UserProvider` |
+
+## Installation
+
+```bash
+pip install fastapi-startkit-auth
+# optional ORM provider driver
+pip install "fastapi-startkit-auth[masoniteorm]"
+```
+
+> Uses `bcrypt` directly (not `passlib`, which imports the `crypt` stdlib module
+> removed in Python 3.13+), so it runs on modern Python.
+
+## Quickstart
+
+```python
+from fastapi import Depends
+from fastapi_startkit_auth import Application, AuthProvider, AuthConfig, current_user, require_scopes
+from myapp.models import User  # any active-record-style model
+
+
+class Config(AuthConfig):
+    key = "change-me-to-a-long-random-secret"   # JWT signing key
+
+    default = {"guard": "api", "passwords": "users"}
+    guards = {"api": {"driver": "passport", "provider": "users"}}
+    providers = {"users": {"driver": "masoniteorm", "model": User}}
+    passwords = {
+        "users": {"provider": "users", "table": "password_reset_tokens",
+                  "expire": 60, "throttle": 60},
+    }
+
+
+app = Application([(AuthProvider, Config)])
+api = app.api  # the underlying FastAPI instance
+
+
+@api.get("/me")
+def me(user=Depends(current_user)):
+    return user
+
+
+@api.get("/reports")
+def reports(ctx=Depends(require_scopes("reports:read"))):
+    return {"ok": True}
+```
+
+Serve it:
+
+```bash
+uvicorn myapp:app        # Application is ASGI-callable
+uvicorn myapp:app.api    # or serve the FastAPI instance directly
+```
+
+## Configuration
+
+`AuthConfig` mirrors Laravel's `config/auth.php` and adds JWT/token knobs:
+
+```python
+class AuthConfig:
+    default   = {"guard": "api", "passwords": "users"}
+    guards    = {"api": {"driver": "passport", "provider": "users"}}
+    providers = {"users": {"driver": "masoniteorm", "model": User}}
+    passwords = {"users": {"provider": "users", "table": "password_reset_tokens",
+                            "expire": 60, "throttle": 60}}
+
+    # token settings (all optional, sensible defaults shown)
+    key                        = None          # JWT secret (required in production)
+    algorithm                  = "HS256"
+    access_token_ttl           = 3600          # seconds
+    refresh_token_ttl          = 60 * 60 * 24 * 14
+    personal_access_token_ttl  = 60 * 60 * 24 * 365
+    authorization_code_ttl     = 600
+    bcrypt_rounds              = 12
+```
+
+### Provider drivers
+
+| driver | meaning |
+| --- | --- |
+| `masoniteorm` / `orm` / `model` | wrap a model exposing `find(id)` and `where(field, value).first()` |
+| `memory` | in-memory dict store (`users=[...]`) — great for tests/demos |
+| `instance` | pass a ready `UserProvider` via `{"instance": ...}` |
+| `factory` | pass a zero-arg callable returning a `UserProvider` |
+
+Any object implementing the `UserProvider` protocol
+(`retrieve_by_id`, `retrieve_by_credentials`, `validate_credentials`,
+`get_identifier`, `update_password`) is a valid provider.
+
+## HTTP endpoints
+
+| Method & path | Purpose |
+| --- | --- |
+| `POST /oauth/token` | Unified token endpoint: `password`, `refresh_token`, `client_credentials`, `authorization_code` |
+| `POST /token` | Simple password grant (FastAPI-tutorial style) |
+| `POST /oauth/authorize` | Approve an auth-code request (requires an authenticated user) → returns `code` |
+| `POST /oauth/introspect` | RFC 7662 token introspection (**requires client authentication**) |
+| `POST /oauth/revoke` | RFC 7009 access/refresh token revocation (**requires client authentication**) |
+| `POST/GET /oauth/clients`, `DELETE /oauth/clients/{id}` | Client registration & management |
+| `POST/GET /oauth/personal-access-tokens`, `DELETE .../{jti}` | Personal access tokens |
+| `POST /password/email` | Trigger a password-reset token (delivered out-of-band; see below) |
+| `POST /password/reset` | Reset the password with a token |
+
+### Password resets
+
+`POST /password/email` always returns the same generic response whether or not
+the account exists (no user enumeration) and **never** puts the token in the
+response body. Configure how the token reaches the user with a notifier:
+
+```python
+class AuthConfig(BaseAuthConfig):
+    password_reset_notifier = staticmethod(lambda email, token: send_email(email, token))
+    # debug_expose_reset_token = True   # DEV ONLY: echo the token in the response
+```
+
+The `code_challenge` for public clients is mandatory — a public (secretless)
+client cannot obtain an authorization code without PKCE, and codes are verified
+against the `code_verifier` at exchange.
+
+### Example: password grant
+
+```bash
+curl -X POST localhost:8000/oauth/token \
+  -d grant_type=password -d username=ada@example.com -d password=secret -d scope="read write"
+# → { "access_token": "...", "token_type": "Bearer", "expires_in": 3600,
+#     "refresh_token": "...", "scope": "read write" }
+```
+
+### Example: authorization code + PKCE
+
+1. `POST /oauth/authorize` with a bearer token and `code_challenge` → returns a single-use `code`.
+2. `POST /oauth/token` with `grant_type=authorization_code`, the `code`, and the `code_verifier`.
+
+## Scopes / abilities
+
+Tokens carry scopes; enforce them with the `require_scopes` dependency:
+
+```python
+require_scopes("posts:write")               # must have this scope
+require_scopes("a", "b")                     # must have all
+require_scopes("a", "b", mode="any")         # must have at least one
+```
+
+`*` is a wildcard scope that satisfies any check. Inside a handler you can also
+inspect the `AuthContext` (`ctx.can(...)`, `ctx.can_any(...)`, `ctx.scopes`).
+
+## Testing
+
+```bash
+pip install -e ".[test]"
+pytest
+```
+
+Or with [uv](https://docs.astral.sh/uv/):
+
+```bash
+uv sync --group dev
+uv run pytest
+```
+
+## Releasing
+
+Releases are cut from `main` with the release script (maintainers only):
+
+```bash
+./bin/release.sh          # patch bump
+./bin/release.sh minor    # or: major
+```
+
+The script bumps the version, builds sdist + wheel, validates them with
+`twine check`, uploads to PyPI, then commits, tags `vX.Y.Z`, and creates a
+GitHub release. It requires `uv`, `gh` (authenticated), and PyPI credentials
+for `twine` (e.g. a `pypi-*` API token via `TWINE_USERNAME=__token__` /
+`TWINE_PASSWORD` or `~/.pypirc`).
+
+## License
+
+MIT

fastapi_startkit_auth-0.3.0/pyproject.toml

@@ -0,0 +1,107 @@
+[project]
+name = "fastapi-startkit-auth"
+version = "0.3.0"
+description = "Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens."
+readme = "readme.md"
+license = "MIT"
+license-files = ["LICENSE"]
+keywords = [
+    "fastapi",
+    "oauth2",
+    "jwt",
+    "auth",
+    "passport",
+    "sanctum",
+    "authentication",
+    "authorization",
+    "security",
+    "tokens",
+    "session",
+    "cookie",
+    "csrf",
+    "spa",
+    "starter-kit",
+]
+authors = [
+    {name = "Bedram Tamang", email = "tmgbedu@gmail.com"}
+]
+requires-python = ">=3.9"
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Framework :: FastAPI",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Internet :: WWW/HTTP :: Session",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "fastapi>=0.110",
+    "pyjwt>=2.8",
+    "bcrypt>=4.1",
+    "pydantic>=2",
+    "python-multipart>=0.0.9",
+]
+
+[project.urls]
+Homepage = "https://github.com/fastapi-startkit/fastapi-startkit-auth"
+Repository = "https://github.com/fastapi-startkit/fastapi-startkit-auth"
+Issues = "https://github.com/fastapi-startkit/fastapi-startkit-auth/issues"
+Changelog = "https://github.com/fastapi-startkit/fastapi-startkit-auth/releases"
+
+[project.optional-dependencies]
+masoniteorm = ["masonite-orm>=2.18"]
+# The framework itself only supports Python >=3.12; on older interpreters the
+# extra resolves to nothing and the package stays standalone.
+startkit = ["fastapi-startkit>=0.51; python_version >= '3.12'"]
+test = [
+    "pytest>=8",
+    "pytest-asyncio>=0.23",
+    "httpx>=0.27",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "pytest-asyncio>=0.23",
+    "httpx>=0.27",
+    "ruff>=0.9.0",
+    "twine>=6.0.0",
+]
+
+[tool.uv]
+# masonite-orm pins cleo<2.0 while fastapi-startkit needs cleo>=2.1: the two
+# extras are mutually exclusive and cannot be locked together.
+conflicts = [
+    [
+        { extra = "masoniteorm" },
+        { extra = "startkit" },
+    ],
+]
+
+[tool.ruff]
+line-length = 120
+
+[tool.ruff.lint]
+select = ["F401"]
+fixable = ["F401"]
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+asyncio_mode = "auto"
+addopts = "-q"
+norecursedirs = [".venv", "dist", "build", "__pycache__"]
+
+[build-system]
+requires = ["uv_build>=0.10.10,<0.11.0"]
+build-backend = "uv_build"

fastapi_startkit_auth-0.3.0/readme.md

@@ -0,0 +1,201 @@
+# fastapi-startkit-auth
+
+Passport-style OAuth2 + JWT authentication for FastAPI.
+
+`fastapi-startkit-auth` brings the ergonomics of [Laravel Passport](https://laravel.com/docs/13.x/passport)
+to FastAPI: a config-driven guard/provider/passwords model layered on top of
+OAuth2 grants and signed JWT access tokens (per the
+[FastAPI security tutorial](https://fastapi.tiangolo.com/tutorial/security/oauth2-jwt/)).
+
+## Features
+
+| Area | What you get |
+| --- | --- |
+| **Config layer** | `AuthConfig` (`default` / `guards` / `providers` / `passwords`) + `AuthProvider` that registers into the app |
+| **Password grant** | OAuth2 password grant → signed JWT access tokens with expiry (`/oauth/token`, `/token`) |
+| **Refresh tokens** | Opaque refresh tokens with **rotation** and configurable TTL |
+| **Personal access tokens** | Named, long-lived tokens with scopes/abilities |
+| **Client credentials** | Machine-to-machine grant |
+| **Authorization code + PKCE** | Browser/SPA flow with S256 & plain PKCE |
+| **Clients** | Register / list / delete confidential & public clients |
+| **Revocation & introspection** | RFC 7009 revoke + RFC 7662 introspect |
+| **Password reset** | `password_reset_tokens` flow with configurable `expire` + `throttle` |
+| **Guards & deps** | `current_user`, `optional_user`, `require_scopes` FastAPI dependencies |
+| **Pluggable providers** | In-memory, generic ORM/masoniteorm model, or any custom `UserProvider` |
+
+## Installation
+
+```bash
+pip install fastapi-startkit-auth
+# optional ORM provider driver
+pip install "fastapi-startkit-auth[masoniteorm]"
+```
+
+> Uses `bcrypt` directly (not `passlib`, which imports the `crypt` stdlib module
+> removed in Python 3.13+), so it runs on modern Python.
+
+## Quickstart
+
+```python
+from fastapi import Depends
+from fastapi_startkit_auth import Application, AuthProvider, AuthConfig, current_user, require_scopes
+from myapp.models import User  # any active-record-style model
+
+
+class Config(AuthConfig):
+    key = "change-me-to-a-long-random-secret"   # JWT signing key
+
+    default = {"guard": "api", "passwords": "users"}
+    guards = {"api": {"driver": "passport", "provider": "users"}}
+    providers = {"users": {"driver": "masoniteorm", "model": User}}
+    passwords = {
+        "users": {"provider": "users", "table": "password_reset_tokens",
+                  "expire": 60, "throttle": 60},
+    }
+
+
+app = Application([(AuthProvider, Config)])
+api = app.api  # the underlying FastAPI instance
+
+
+@api.get("/me")
+def me(user=Depends(current_user)):
+    return user
+
+
+@api.get("/reports")
+def reports(ctx=Depends(require_scopes("reports:read"))):
+    return {"ok": True}
+```
+
+Serve it:
+
+```bash
+uvicorn myapp:app        # Application is ASGI-callable
+uvicorn myapp:app.api    # or serve the FastAPI instance directly
+```
+
+## Configuration
+
+`AuthConfig` mirrors Laravel's `config/auth.php` and adds JWT/token knobs:
+
+```python
+class AuthConfig:
+    default   = {"guard": "api", "passwords": "users"}
+    guards    = {"api": {"driver": "passport", "provider": "users"}}
+    providers = {"users": {"driver": "masoniteorm", "model": User}}
+    passwords = {"users": {"provider": "users", "table": "password_reset_tokens",
+                            "expire": 60, "throttle": 60}}
+
+    # token settings (all optional, sensible defaults shown)
+    key                        = None          # JWT secret (required in production)
+    algorithm                  = "HS256"
+    access_token_ttl           = 3600          # seconds
+    refresh_token_ttl          = 60 * 60 * 24 * 14
+    personal_access_token_ttl  = 60 * 60 * 24 * 365
+    authorization_code_ttl     = 600
+    bcrypt_rounds              = 12
+```
+
+### Provider drivers
+
+| driver | meaning |
+| --- | --- |
+| `masoniteorm` / `orm` / `model` | wrap a model exposing `find(id)` and `where(field, value).first()` |
+| `memory` | in-memory dict store (`users=[...]`) — great for tests/demos |
+| `instance` | pass a ready `UserProvider` via `{"instance": ...}` |
+| `factory` | pass a zero-arg callable returning a `UserProvider` |
+
+Any object implementing the `UserProvider` protocol
+(`retrieve_by_id`, `retrieve_by_credentials`, `validate_credentials`,
+`get_identifier`, `update_password`) is a valid provider.
+
+## HTTP endpoints
+
+| Method & path | Purpose |
+| --- | --- |
+| `POST /oauth/token` | Unified token endpoint: `password`, `refresh_token`, `client_credentials`, `authorization_code` |
+| `POST /token` | Simple password grant (FastAPI-tutorial style) |
+| `POST /oauth/authorize` | Approve an auth-code request (requires an authenticated user) → returns `code` |
+| `POST /oauth/introspect` | RFC 7662 token introspection (**requires client authentication**) |
+| `POST /oauth/revoke` | RFC 7009 access/refresh token revocation (**requires client authentication**) |
+| `POST/GET /oauth/clients`, `DELETE /oauth/clients/{id}` | Client registration & management |
+| `POST/GET /oauth/personal-access-tokens`, `DELETE .../{jti}` | Personal access tokens |
+| `POST /password/email` | Trigger a password-reset token (delivered out-of-band; see below) |
+| `POST /password/reset` | Reset the password with a token |
+
+### Password resets
+
+`POST /password/email` always returns the same generic response whether or not
+the account exists (no user enumeration) and **never** puts the token in the
+response body. Configure how the token reaches the user with a notifier:
+
+```python
+class AuthConfig(BaseAuthConfig):
+    password_reset_notifier = staticmethod(lambda email, token: send_email(email, token))
+    # debug_expose_reset_token = True   # DEV ONLY: echo the token in the response
+```
+
+The `code_challenge` for public clients is mandatory — a public (secretless)
+client cannot obtain an authorization code without PKCE, and codes are verified
+against the `code_verifier` at exchange.
+
+### Example: password grant
+
+```bash
+curl -X POST localhost:8000/oauth/token \
+  -d grant_type=password -d username=ada@example.com -d password=secret -d scope="read write"
+# → { "access_token": "...", "token_type": "Bearer", "expires_in": 3600,
+#     "refresh_token": "...", "scope": "read write" }
+```
+
+### Example: authorization code + PKCE
+
+1. `POST /oauth/authorize` with a bearer token and `code_challenge` → returns a single-use `code`.
+2. `POST /oauth/token` with `grant_type=authorization_code`, the `code`, and the `code_verifier`.
+
+## Scopes / abilities
+
+Tokens carry scopes; enforce them with the `require_scopes` dependency:
+
+```python
+require_scopes("posts:write")               # must have this scope
+require_scopes("a", "b")                     # must have all
+require_scopes("a", "b", mode="any")         # must have at least one
+```
+
+`*` is a wildcard scope that satisfies any check. Inside a handler you can also
+inspect the `AuthContext` (`ctx.can(...)`, `ctx.can_any(...)`, `ctx.scopes`).
+
+## Testing
+
+```bash
+pip install -e ".[test]"
+pytest
+```
+
+Or with [uv](https://docs.astral.sh/uv/):
+
+```bash
+uv sync --group dev
+uv run pytest
+```
+
+## Releasing
+
+Releases are cut from `main` with the release script (maintainers only):
+
+```bash
+./bin/release.sh          # patch bump
+./bin/release.sh minor    # or: major
+```
+
+The script bumps the version, builds sdist + wheel, validates them with
+`twine check`, uploads to PyPI, then commits, tags `vX.Y.Z`, and creates a
+GitHub release. It requires `uv`, `gh` (authenticated), and PyPI credentials
+for `twine` (e.g. a `pypi-*` API token via `TWINE_USERNAME=__token__` /
+`TWINE_PASSWORD` or `~/.pypirc`).
+
+## License
+
+MIT

fastapi_startkit_auth-0.3.0/src/fastapi_startkit_auth/__init__.py

@@ -0,0 +1,67 @@
+"""Passport-style OAuth2 + JWT authentication for FastAPI.
+
+Public API mirrors the config-driven guard/provider/passwords model of Laravel
+Passport while staying idiomatic FastAPI:
+
+    from fastapi_startkit_auth import Application, AuthProvider, AuthConfig
+
+Attributes are resolved lazily so importing a single submodule never forces the
+whole package to load.
+"""
+from __future__ import annotations
+
+import importlib
+from typing import Any
+
+__version__ = "0.2.0"
+
+_EXPORTS = {
+    "AuthConfig": ("fastapi_startkit_auth.config", "AuthConfig"),
+    "AuthProvider": ("fastapi_startkit_auth.provider", "AuthProvider"),
+    "Application": ("fastapi_startkit_auth.application", "Application"),
+    "AuthManager": ("fastapi_startkit_auth.manager", "AuthManager"),
+    "current_user": ("fastapi_startkit_auth.dependencies", "current_user"),
+    "optional_user": ("fastapi_startkit_auth.dependencies", "optional_user"),
+    "require_scopes": ("fastapi_startkit_auth.dependencies", "require_scopes"),
+    "require_abilities": ("fastapi_startkit_auth.dependencies", "require_abilities"),
+    "AuthError": ("fastapi_startkit_auth.exceptions", "AuthError"),
+    "InvalidGrant": ("fastapi_startkit_auth.exceptions", "InvalidGrant"),
+    "InvalidClient": ("fastapi_startkit_auth.exceptions", "InvalidClient"),
+    "InvalidToken": ("fastapi_startkit_auth.exceptions", "InvalidToken"),
+    "InsufficientScope": ("fastapi_startkit_auth.exceptions", "InsufficientScope"),
+    "InvalidSession": ("fastapi_startkit_auth.exceptions", "InvalidSession"),
+    "CsrfTokenMismatch": ("fastapi_startkit_auth.exceptions", "CsrfTokenMismatch"),
+    "Auth": ("fastapi_startkit_auth.facade", "Auth"),
+    "SessionGuard": ("fastapi_startkit_auth.guards.session", "SessionGuard"),
+    "SessionMiddleware": ("fastapi_startkit_auth.middleware.session", "SessionMiddleware"),
+    "CsrfMiddleware": ("fastapi_startkit_auth.middleware.csrf", "CsrfMiddleware"),
+    "AuthServiceProvider": ("fastapi_startkit_auth.startkit", "AuthServiceProvider"),
+    "SessionRecord": ("fastapi_startkit_auth.sessions.models", "SessionRecord"),
+    "SessionStore": ("fastapi_startkit_auth.sessions.store", "SessionStore"),
+    "InMemorySessionStore": ("fastapi_startkit_auth.sessions.store", "InMemorySessionStore"),
+    "SqlSessionStore": ("fastapi_startkit_auth.sessions.sql", "SqlSessionStore"),
+    "TokenGuard": ("fastapi_startkit_auth.guards.token", "TokenGuard"),
+    "ApiTokenManager": ("fastapi_startkit_auth.apitokens.manager", "ApiTokenManager"),
+    "NewApiToken": ("fastapi_startkit_auth.apitokens.manager", "NewApiToken"),
+    "ApiTokenRecord": ("fastapi_startkit_auth.apitokens.models", "ApiTokenRecord"),
+    "ApiTokenRepository": ("fastapi_startkit_auth.apitokens.repository", "ApiTokenRepository"),
+    "InMemoryApiTokenRepository": (
+        "fastapi_startkit_auth.apitokens.repository",
+        "InMemoryApiTokenRepository",
+    ),
+    "SqlApiTokenRepository": ("fastapi_startkit_auth.apitokens.sql", "SqlApiTokenRepository"),
+}
+
+__all__ = list(_EXPORTS)
+
+
+def __getattr__(name: str) -> Any:
+    try:
+        module_name, attr = _EXPORTS[name]
+    except KeyError:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}") from None
+    return getattr(importlib.import_module(module_name), attr)
+
+
+def __dir__() -> list[str]:
+    return sorted(__all__)

fastapi_startkit_auth-0.3.0/src/fastapi_startkit_auth/apitokens/__init__.py

@@ -0,0 +1,13 @@
+from .manager import ApiTokenManager, NewApiToken
+from .models import ApiTokenRecord
+from .repository import ApiTokenRepository, InMemoryApiTokenRepository
+from .sql import SqlApiTokenRepository
+
+__all__ = [
+    "ApiTokenManager",
+    "ApiTokenRecord",
+    "ApiTokenRepository",
+    "InMemoryApiTokenRepository",
+    "NewApiToken",
+    "SqlApiTokenRepository",
+]