fastapi-startkit-auth 0.3.0__tar.gz → 0.6.1__tar.gz

fastapi_startkit_auth-0.6.1/CHANGELOG.md

@@ -0,0 +1,147 @@
+# Changelog
+
+All notable changes to `fastapi-startkit-auth` are documented in this file.
+
+Release notes are also published on
+[GitHub Releases](https://github.com/fastapi-startkit/fastapi-startkit-auth/releases).
+
+## [Unreleased]
+
+### Changed
+
+- **Breaking:** persistence now goes through the fastapi-startkit ORM with models
+  shipped in `fastapi_startkit_auth.orm`; no raw SQL remains. Use
+  `{"store": "orm"}` (optional ORM `connection` name) for sessions, API tokens and
+  OAuth tokens.
+- **Breaking:** the `startkit` extra now requires `fastapi-startkit[database]>=0.60`.
+- Run the published migrations (`provider:publish -p auth`, then `migrate`) to
+  create the tables; stores no longer create tables themselves.
+
+### Removed
+
+- **Breaking:** the `sql` / `async_sql` stores and the `SqlSessionStore`,
+  `SqlApiTokenRepository`, `AsyncSql*` classes and database adapters.
+
+### Added
+
+- `Client.provider` (and `register(provider=...)`) binds an OAuth client to a
+  user provider. `AuthManager.owner_provider(client_id)` resolves it, falling
+  back to the default guard's provider.
+- `AuthManager.warm_up()` and `AsyncModelUserProvider.warm_up()`, run from the
+  app lifespan by `AuthProvider`, precompute the dummy hash at startup.
+
+### Fixed
+
+- Refresh, authorization-code exchange and introspection re-check the token
+  owner against the provider of the issuing client instead of always using the
+  default guard's provider. The password grant authenticates against the
+  client's provider, and `/oauth/authorize` rejects a client bound to another
+  provider.
+- `AsyncModelUserProvider.is_active` only uses the threadpool for a sync
+  callable hook. Attribute checks and `async def` hooks run inline.
+- The first unknown-user login no longer pays an extra bcrypt hash to create
+  the dummy hash.
+
+## [0.4.0]
+
+### Added
+
+- Async support for async ORMs and drivers, side by side with the sync API:
+  - `AsyncModelUserProvider` (provider driver `"async_model"`) for models whose
+    `find` / `where(...).first()` / `save` are coroutines; bcrypt runs in a
+    worker thread.
+  - `AsyncPassportGuard`, `AsyncSessionGuard`, `AsyncTokenGuard`,
+    `AsyncTokenService`, `AsyncApiTokenManager`, `AsyncPasswordBroker`, the
+    `Async*Grant` variants and the `AsyncAuth` facade.
+  - `AuthManager` picks the async variant automatically when any provider
+    method or store method is async; sync configurations keep getting the sync
+    classes. Sync collaborators used from the async classes run in the
+    threadpool.
+  - `"async_sql"` stores for sessions (`AsyncSqlSessionStore`), personal API
+    tokens (`AsyncSqlApiTokenRepository`) and a new `AuthConfig.tokens` block
+    for OAuth access/refresh tokens and authorization codes
+    (`AsyncSqlTokenRepository`). They accept an asyncpg pool/connection, an
+    aiosqlite connection, or a zero-arg (async) factory. Supported backends are
+    PostgreSQL and SQLite. Refresh tokens and authorization codes are stored as
+    SHA-256 hashes; refresh revocation and code redemption are atomic and use
+    only portable SQL. Expired rows are purged via `expires_at` indexes.
+  - `fastapi-startkit` migrations for the five tables, published to
+    `databases/migrations/` by `AuthServiceProvider`.
+- `password_key` provider option: the credentials key holding the plaintext
+  password, separate from the model column `password_field` (e.g.
+  `password_key="password"`, `password_field="hashed_password"`). Defaults to
+  `password_field`.
+- `is_active` provider option (attribute name or callable; `async def` with
+  the `async_model` driver). Inactive or deleted users are rejected by the
+  password grant, the refresh and authorization-code grants, `Auth.attempt` /
+  `AsyncAuth.attempt` and every guard, and introspect as inactive.
+- `AsyncMisconfiguration`: raised when a sync guard, grant, broker or `Auth`
+  receives an awaitable from a provider or store, so a half-async provider
+  fails closed. Sync providers reject an `async def` `is_active` hook.
+- CI runs the asyncpg store and flow tests against a Postgres service.
+- `Typing :: Typed` classifier (the package already ships `py.typed`).
+
+### Changed
+
+- **Breaking (signature):** `current_context` and `optional_user` are now
+  `async def` dependencies. `Depends(current_user)` and friends keep working
+  unchanged; code calling them directly as plain functions must now await
+  them. Sync guards still run in the threadpool.
+- The built-in OAuth, password-reset and SPA csrf-cookie routes await async
+  collaborators; `SessionMiddleware` accepts an async session store.
+- `Auth` (sync facade) raises `RuntimeError` for async session guards; use
+  `AsyncAuth` there.
+- Minimum supported Python is now 3.10. 0.3.0 advertised `>=3.9` but fails on
+  3.9 because runtime-evaluated annotations use `X | None` syntax.
+- The `startkit` extra is bounded to `fastapi-startkit>=0.51,<1.0`.
+- The package `__init__` imports its public API directly instead of through a
+  lazy export table.
+- The source distribution now ships the test suite and this changelog.
+- `bin/release.sh` uploads to PyPI with `twine upload`, matching
+  fastapi-startkit; the tag-triggered trusted-publishing workflow is removed.
+
+## [0.3.0]
+
+First release published to PyPI. Contains the 0.2.0 feature set, built with
+the `uv_build` backend; no functional changes.
+
+## [0.2.0]
+
+Adds three new authentication modes alongside the existing OAuth2/JWT server,
+so the package now covers the full Laravel-style auth surface.
+
+### Added
+
+- Guard-driver registry in `AuthManager`: guards resolve their driver
+  (`token`, `session`, …) from a pluggable registry, enabling multiple guard
+  types in one application (Phase 0).
+- Cookie/session authentication: `Auth` facade, `SessionGuard`, session
+  middleware, and in-memory + SQL session stores (Phase 1).
+- SPA authentication with CSRF protection: `/__auth__/csrf-cookie` endpoint,
+  double-submit-cookie middleware, and an `AuthServiceProvider` that publishes
+  the `config/cors.py` stub via `provider:publish -p auth` (Phase 2).
+- Sanctum-style API tokens: `TokenGuard`, opaque hashed tokens with abilities,
+  and in-memory + SQL token stores (Phase 3).
+
+### Security / Hardening
+
+- Session guard verifies against a constant-time dummy hash when no user is
+  found, closing a timing side-channel.
+- SQL session and API-token stores prune expired rows; purge cadence is
+  configurable.
+- CSRF cookie endpoint hardened; token repr for `NewApiToken` redacts the
+  plaintext value so it cannot leak into logs.
+- DB-API connection vs. connection-factory detection now probes `execute()`
+  instead of `callable()`, fixing misdetection of raw `sqlite3.Connection`
+  objects in the SQL session and API-token stores.
+
+## [0.1.0]
+
+Initial release.
+
+- Passport-style OAuth2 authorization server for FastAPI: authorization code
+  (with PKCE), password, client credentials, and refresh token grants
+- JWT access tokens with scopes, token guards, and route dependencies
+- Personal access tokens
+- Pluggable user/client providers (in-memory and Masonite ORM)
+- Password reset flow with throttling hardened against account enumeration

{fastapi_startkit_auth-0.3.0 → fastapi_startkit_auth-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-startkit-auth
-Version: 0.3.0
+Version: 0.6.1
 Summary: Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens.
 Keywords: fastapi,oauth2,jwt,auth,passport,sanctum,authentication,authorization,security,tokens,session,cookie,csrf,spa,starter-kit
 Author: Bedram Tamang
@@ -12,7 +12,6 @@ Classifier: Framework :: FastAPI
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -20,21 +19,24 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Internet :: WWW/HTTP :: Session
 Classifier: Topic :: Security
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
 Requires-Dist: fastapi>=0.110
 Requires-Dist: pyjwt>=2.8
 Requires-Dist: bcrypt>=4.1
 Requires-Dist: pydantic>=2
 Requires-Dist: python-multipart>=0.0.9
 Requires-Dist: masonite-orm>=2.18 ; extra == 'masoniteorm'
-Requires-Dist: fastapi-startkit>=0.51 ; python_full_version >= '3.12' and extra == 'startkit'
+Requires-Dist: fastapi-startkit[database]>=0.60,<1.0 ; python_full_version >= '3.12' and extra == 'startkit'
 Requires-Dist: pytest>=8 ; extra == 'test'
 Requires-Dist: pytest-asyncio>=0.23 ; extra == 'test'
 Requires-Dist: httpx>=0.27 ; extra == 'test'
-Requires-Python: >=3.9
+Requires-Dist: aiosqlite>=0.20 ; extra == 'test'
+Requires-Dist: asyncpg>=0.29 ; extra == 'test'
+Requires-Python: >=3.10
 Project-URL: Homepage, https://github.com/fastapi-startkit/fastapi-startkit-auth
 Project-URL: Repository, https://github.com/fastapi-startkit/fastapi-startkit-auth
 Project-URL: Issues, https://github.com/fastapi-startkit/fastapi-startkit-auth/issues
-Project-URL: Changelog, https://github.com/fastapi-startkit/fastapi-startkit-auth/releases
+Project-URL: Changelog, https://github.com/fastapi-startkit/fastapi-startkit-auth/blob/main/CHANGELOG.md
 Provides-Extra: masoniteorm
 Provides-Extra: startkit
 Provides-Extra: test
@@ -67,12 +69,29 @@ OAuth2 grants and signed JWT access tokens (per the
 
 ## Installation
 
+Requires Python 3.10+.
+
 ```bash
 pip install fastapi-startkit-auth
-# optional ORM provider driver
+# or
+uv add fastapi-startkit-auth
+```
+
+Optional extras:
+
+| Extra | Installs | Use when |
+| --- | --- | --- |
+| `startkit` | `fastapi-startkit[database]>=0.60,<1.0` (Python 3.12+) | Registering `AuthServiceProvider`, publishing its config stub and migrations via `provider:publish -p auth`, and the `"orm"` stores |
+| `masoniteorm` | `masonite-orm` | Using the `masoniteorm` user provider driver |
+
+```bash
+pip install "fastapi-startkit-auth[startkit]"
 pip install "fastapi-startkit-auth[masoniteorm]"
 ```
 
+The `startkit` and `masoniteorm` extras are mutually exclusive: `masonite-orm`
+pins `cleo<2` while `fastapi-startkit` requires `cleo>=2.1`.
+
 > Uses `bcrypt` directly (not `passlib`, which imports the `crypt` stdlib module
 > removed in Python 3.13+), so it runs on modern Python.
 
@@ -144,13 +163,94 @@ class AuthConfig:
 | driver | meaning |
 | --- | --- |
 | `masoniteorm` / `orm` / `model` | wrap a model exposing `find(id)` and `where(field, value).first()` |
+| `async_model` | same, for async ORMs where `find`, `first()` and `save()` are coroutines |
 | `memory` | in-memory dict store (`users=[...]`) — great for tests/demos |
 | `instance` | pass a ready `UserProvider` via `{"instance": ...}` |
 | `factory` | pass a zero-arg callable returning a `UserProvider` |
 
 Any object implementing the `UserProvider` protocol
 (`retrieve_by_id`, `retrieve_by_credentials`, `validate_credentials`,
-`get_identifier`, `update_password`) is a valid provider.
+`get_identifier`, `update_password`) is a valid provider. Any of its methods
+may be `async def`; one async method is enough for `AuthManager` to pick the
+async guards, grants and broker. The sync classes refuse an awaitable result
+with `AsyncMisconfiguration` instead of treating it as truthy.
+
+Model-backed providers also accept `password_key` (the credentials key holding
+the plaintext password, default: `password_field`) and `is_active` (a boolean
+attribute name or a `callable(user) -> bool`; inactive users cannot log in,
+authenticate, refresh or exchange a code, and introspect as inactive). The
+`async_model` driver also takes an `async def` hook; the sync drivers reject
+one at construction:
+
+```python
+providers = {
+    "users": {
+        "driver": "async_model",
+        "model": User,
+        "password_field": "hashed_password",
+        "password_key": "password",
+        "is_active": "is_active",
+    }
+}
+```
+
+### Multiple providers
+
+With more than one provider, register each OAuth client with the provider whose
+users it serves (Laravel Passport's `provider` column). The password grant then
+authenticates against that provider, and refresh, code exchange and
+introspection re-check the token owner against it. A client without a
+`provider` uses the default guard's provider, and `/oauth/authorize` rejects a
+client bound to a different provider with `unauthorized_client`:
+
+```python
+client, secret = manager.client_repository.register(name="admin-panel", provider="admins")
+```
+
+### ORM stores and migrations
+
+With an async provider or store, `AuthManager` builds the async guards, grants,
+token service and password broker automatically (use the `AsyncAuth` facade for
+session login/logout). Sessions, API tokens and OAuth tokens persist through the
+fastapi-startkit ORM (`pip install "fastapi-startkit-auth[startkit]"`, which pulls
+in `fastapi-startkit[database]`). The package ships its own models
+(`fastapi_startkit_auth.orm`) and uses no raw SQL:
+
+```python
+session = {"store": "orm"}
+api_tokens = {"store": "orm"}
+tokens = {"store": "orm", "connection": "auth"}  # optional ORM connection name
+```
+
+`connection` names an entry of your database config; omit it to use the default
+connection. Publish and run the migrations once per app (they are reversible
+and create the `sessions`, `personal_api_tokens`, `oauth_access_tokens`,
+`oauth_refresh_tokens` and `oauth_auth_codes` tables with their indexes):
+
+```bash
+python artisan provider:publish -p auth   # copies them to databases/migrations/
+python artisan migrate
+python artisan migrate:rollback           # drops them again
+```
+
+Single-use guarantees rely on conditional `UPDATE`/`DELETE` statements issued
+through the ORM query builder: refresh-token rotation and authorization-code
+redemption each have exactly one winner under concurrency.
+
+The former `sql` and `async_sql` stores were removed; configuring them raises a
+`ValueError` pointing at `"orm"`. Use `"memory"` or an `"instance"` store for
+sync setups.
+
+In mixed setups (async stores with a sync provider or a sync session store),
+the sync calls — lookups, bcrypt, `is_active` hooks, a sync session store in
+`SessionMiddleware` — run in the threadpool, never on the event loop.
+An `is_active` attribute name or `async def` hook runs inline, since neither
+blocks.
+
+`AuthProvider` warms the providers up when the app starts (`await
+manager.warm_up()`), so `AsyncModelUserProvider` computes its dummy hash off the
+event loop before the first request. A login for an unknown user then costs
+one bcrypt verify, the same as a wrong password.
 
 ## HTTP endpoints
 
@@ -212,15 +312,19 @@ inspect the `AuthContext` (`ctx.can(...)`, `ctx.can_any(...)`, `ctx.scopes`).
 ## Testing
 
 ```bash
-pip install -e ".[test]"
-pytest
+uv sync --group dev
+uv run pytest
+uv run ruff check .
 ```
 
-Or with [uv](https://docs.astral.sh/uv/):
+The async store and flow tests run on aiosqlite; set `TEST_ASYNCPG_DSN` to a
+disposable Postgres database to also run them on asyncpg (CI does).
+
+Or with pip:
 
 ```bash
-uv sync --group dev
-uv run pytest
+pip install -e ".[test]"
+pytest
 ```
 
 ## Releasing
@@ -232,11 +336,15 @@ Releases are cut from `main` with the release script (maintainers only):
 ./bin/release.sh minor    # or: major
 ```
 
-The script bumps the version, builds sdist + wheel, validates them with
-`twine check`, uploads to PyPI, then commits, tags `vX.Y.Z`, and creates a
-GitHub release. It requires `uv`, `gh` (authenticated), and PyPI credentials
-for `twine` (e.g. a `pypi-*` API token via `TWINE_USERNAME=__token__` /
-`TWINE_PASSWORD` or `~/.pypirc`).
+The script bumps the version (`pyproject.toml`, `__version__`, `uv.lock`),
+builds sdist + wheel, validates them with `twine check`, uploads them to PyPI
+with `twine upload`, then commits, tags `vX.Y.Z`, pushes, and creates a GitHub
+release. Move the `Unreleased` notes in `CHANGELOG.md` under the new version
+before running it.
+
+It requires `uv`, an authenticated `gh`, and PyPI credentials for twine: either
+a `[pypi]` entry in `~/.pypirc` (`username = __token__`, `password = pypi-...`)
+or `TWINE_USERNAME=__token__` and `TWINE_PASSWORD=pypi-...` in the environment.
 
 ## License
 

fastapi_startkit_auth-0.3.0/readme.md → fastapi_startkit_auth-0.6.1/README.md

@@ -25,12 +25,29 @@ OAuth2 grants and signed JWT access tokens (per the
 
 ## Installation
 
+Requires Python 3.10+.
+
 ```bash
 pip install fastapi-startkit-auth
-# optional ORM provider driver
+# or
+uv add fastapi-startkit-auth
+```
+
+Optional extras:
+
+| Extra | Installs | Use when |
+| --- | --- | --- |
+| `startkit` | `fastapi-startkit[database]>=0.60,<1.0` (Python 3.12+) | Registering `AuthServiceProvider`, publishing its config stub and migrations via `provider:publish -p auth`, and the `"orm"` stores |
+| `masoniteorm` | `masonite-orm` | Using the `masoniteorm` user provider driver |
+
+```bash
+pip install "fastapi-startkit-auth[startkit]"
 pip install "fastapi-startkit-auth[masoniteorm]"
 ```
 
+The `startkit` and `masoniteorm` extras are mutually exclusive: `masonite-orm`
+pins `cleo<2` while `fastapi-startkit` requires `cleo>=2.1`.
+
 > Uses `bcrypt` directly (not `passlib`, which imports the `crypt` stdlib module
 > removed in Python 3.13+), so it runs on modern Python.
 
@@ -102,13 +119,94 @@ class AuthConfig:
 | driver | meaning |
 | --- | --- |
 | `masoniteorm` / `orm` / `model` | wrap a model exposing `find(id)` and `where(field, value).first()` |
+| `async_model` | same, for async ORMs where `find`, `first()` and `save()` are coroutines |
 | `memory` | in-memory dict store (`users=[...]`) — great for tests/demos |
 | `instance` | pass a ready `UserProvider` via `{"instance": ...}` |
 | `factory` | pass a zero-arg callable returning a `UserProvider` |
 
 Any object implementing the `UserProvider` protocol
 (`retrieve_by_id`, `retrieve_by_credentials`, `validate_credentials`,
-`get_identifier`, `update_password`) is a valid provider.
+`get_identifier`, `update_password`) is a valid provider. Any of its methods
+may be `async def`; one async method is enough for `AuthManager` to pick the
+async guards, grants and broker. The sync classes refuse an awaitable result
+with `AsyncMisconfiguration` instead of treating it as truthy.
+
+Model-backed providers also accept `password_key` (the credentials key holding
+the plaintext password, default: `password_field`) and `is_active` (a boolean
+attribute name or a `callable(user) -> bool`; inactive users cannot log in,
+authenticate, refresh or exchange a code, and introspect as inactive). The
+`async_model` driver also takes an `async def` hook; the sync drivers reject
+one at construction:
+
+```python
+providers = {
+    "users": {
+        "driver": "async_model",
+        "model": User,
+        "password_field": "hashed_password",
+        "password_key": "password",
+        "is_active": "is_active",
+    }
+}
+```
+
+### Multiple providers
+
+With more than one provider, register each OAuth client with the provider whose
+users it serves (Laravel Passport's `provider` column). The password grant then
+authenticates against that provider, and refresh, code exchange and
+introspection re-check the token owner against it. A client without a
+`provider` uses the default guard's provider, and `/oauth/authorize` rejects a
+client bound to a different provider with `unauthorized_client`:
+
+```python
+client, secret = manager.client_repository.register(name="admin-panel", provider="admins")
+```
+
+### ORM stores and migrations
+
+With an async provider or store, `AuthManager` builds the async guards, grants,
+token service and password broker automatically (use the `AsyncAuth` facade for
+session login/logout). Sessions, API tokens and OAuth tokens persist through the
+fastapi-startkit ORM (`pip install "fastapi-startkit-auth[startkit]"`, which pulls
+in `fastapi-startkit[database]`). The package ships its own models
+(`fastapi_startkit_auth.orm`) and uses no raw SQL:
+
+```python
+session = {"store": "orm"}
+api_tokens = {"store": "orm"}
+tokens = {"store": "orm", "connection": "auth"}  # optional ORM connection name
+```
+
+`connection` names an entry of your database config; omit it to use the default
+connection. Publish and run the migrations once per app (they are reversible
+and create the `sessions`, `personal_api_tokens`, `oauth_access_tokens`,
+`oauth_refresh_tokens` and `oauth_auth_codes` tables with their indexes):
+
+```bash
+python artisan provider:publish -p auth   # copies them to databases/migrations/
+python artisan migrate
+python artisan migrate:rollback           # drops them again
+```
+
+Single-use guarantees rely on conditional `UPDATE`/`DELETE` statements issued
+through the ORM query builder: refresh-token rotation and authorization-code
+redemption each have exactly one winner under concurrency.
+
+The former `sql` and `async_sql` stores were removed; configuring them raises a
+`ValueError` pointing at `"orm"`. Use `"memory"` or an `"instance"` store for
+sync setups.
+
+In mixed setups (async stores with a sync provider or a sync session store),
+the sync calls — lookups, bcrypt, `is_active` hooks, a sync session store in
+`SessionMiddleware` — run in the threadpool, never on the event loop.
+An `is_active` attribute name or `async def` hook runs inline, since neither
+blocks.
+
+`AuthProvider` warms the providers up when the app starts (`await
+manager.warm_up()`), so `AsyncModelUserProvider` computes its dummy hash off the
+event loop before the first request. A login for an unknown user then costs
+one bcrypt verify, the same as a wrong password.
 
 ## HTTP endpoints
 
@@ -170,15 +268,19 @@ inspect the `AuthContext` (`ctx.can(...)`, `ctx.can_any(...)`, `ctx.scopes`).
 ## Testing
 
 ```bash
-pip install -e ".[test]"
-pytest
+uv sync --group dev
+uv run pytest
+uv run ruff check .
 ```
 
-Or with [uv](https://docs.astral.sh/uv/):
+The async store and flow tests run on aiosqlite; set `TEST_ASYNCPG_DSN` to a
+disposable Postgres database to also run them on asyncpg (CI does).
+
+Or with pip:
 
 ```bash
-uv sync --group dev
-uv run pytest
+pip install -e ".[test]"
+pytest
 ```
 
 ## Releasing
@@ -190,11 +292,15 @@ Releases are cut from `main` with the release script (maintainers only):
 ./bin/release.sh minor    # or: major
 ```
 
-The script bumps the version, builds sdist + wheel, validates them with
-`twine check`, uploads to PyPI, then commits, tags `vX.Y.Z`, and creates a
-GitHub release. It requires `uv`, `gh` (authenticated), and PyPI credentials
-for `twine` (e.g. a `pypi-*` API token via `TWINE_USERNAME=__token__` /
-`TWINE_PASSWORD` or `~/.pypirc`).
+The script bumps the version (`pyproject.toml`, `__version__`, `uv.lock`),
+builds sdist + wheel, validates them with `twine check`, uploads them to PyPI
+with `twine upload`, then commits, tags `vX.Y.Z`, pushes, and creates a GitHub
+release. Move the `Unreleased` notes in `CHANGELOG.md` under the new version
+before running it.
+
+It requires `uv`, an authenticated `gh`, and PyPI credentials for twine: either
+a `[pypi]` entry in `~/.pypirc` (`username = __token__`, `password = pypi-...`)
+or `TWINE_USERNAME=__token__` and `TWINE_PASSWORD=pypi-...` in the environment.
 
 ## License
 

{fastapi_startkit_auth-0.3.0 → fastapi_startkit_auth-0.6.1}/pyproject.toml

@@ -1,8 +1,8 @@
 [project]
 name = "fastapi-startkit-auth"
-version = "0.3.0"
+version = "0.6.1"
 description = "Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens."
-readme = "readme.md"
+readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
 keywords = [
@@ -25,14 +25,13 @@ keywords = [
 authors = [
     {name = "Bedram Tamang", email = "tmgbedu@gmail.com"}
 ]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 classifiers = [
     "Development Status :: 4 - Beta",
     "Framework :: FastAPI",
     "Intended Audience :: Developers",
     "Operating System :: OS Independent",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -40,6 +39,7 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP :: Session",
     "Topic :: Security",
     "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
 ]
 dependencies = [
     "fastapi>=0.110",
@@ -53,17 +53,19 @@ dependencies = [
 Homepage = "https://github.com/fastapi-startkit/fastapi-startkit-auth"
 Repository = "https://github.com/fastapi-startkit/fastapi-startkit-auth"
 Issues = "https://github.com/fastapi-startkit/fastapi-startkit-auth/issues"
-Changelog = "https://github.com/fastapi-startkit/fastapi-startkit-auth/releases"
+Changelog = "https://github.com/fastapi-startkit/fastapi-startkit-auth/blob/main/CHANGELOG.md"
 
 [project.optional-dependencies]
 masoniteorm = ["masonite-orm>=2.18"]
 # The framework itself only supports Python >=3.12; on older interpreters the
 # extra resolves to nothing and the package stays standalone.
-startkit = ["fastapi-startkit>=0.51; python_version >= '3.12'"]
+startkit = ["fastapi-startkit[database]>=0.60,<1.0; python_version >= '3.12'"]
 test = [
     "pytest>=8",
     "pytest-asyncio>=0.23",
     "httpx>=0.27",
+    "aiosqlite>=0.20",
+    "asyncpg>=0.29",
 ]
 
 [dependency-groups]
@@ -71,8 +73,10 @@ dev = [
     "pytest>=8",
     "pytest-asyncio>=0.23",
     "httpx>=0.27",
+    "aiosqlite>=0.20",
+    "asyncpg>=0.29",
     "ruff>=0.9.0",
-    "twine>=6.0.0",
+    "twine>=6.1.0",
 ]
 
 [tool.uv]
@@ -105,3 +109,6 @@ norecursedirs = [".venv", "dist", "build", "__pycache__"]
 [build-system]
 requires = ["uv_build>=0.10.10,<0.11.0"]
 build-backend = "uv_build"
+
+[tool.uv.build-backend]
+source-include = ["CHANGELOG.md", "tests/**"]